Interview Questions for Hiring Top Performers - <AUTHOR> http://firstround.com/review/hire-a-top-performer-every-time-with-these-interview-questions/ <comment><USER3> _What to ask:_

 _We look for a time the candidate wanted something so badly, they were unstoppable in pursuing it. Or a time they overcame an obstacle," Hamilton says. As you listen to the answers to those questions, pay close attention to both the tasks and the duration described. "Try to get a sense of how long that person can stick it out. How long are they going to beat their head against a stats problem?"_

Good qualities for an academic (or inventor type), but doesn't seem to have much correlation with the kind of "grit" needed for most commercial development work.

In which, the vast majority of the time, we benefit the most from "triaging": that is, discerning when _not_ to go down rabbit holes, and when _not_ to "bang our heads" against problems when it may be better to simply... route around them, or leave them be until some sunny day arrives when there's a legitimate business need to properly resolve them, and we have appropriate resources available to do so.

</comment><comment><USER4> If a candidate actually had any of those attributes, never mind all seven, they wouldn't be interviewing at your company. Companies need to realize 99% of candidates are B players, and 99% of their own employees are too.

<comment><USER5> Very well said.

Interviews are not standardized tests. They are closer to a date/sale, than they are to a test. Same answer in an interview is likely to be interpreted differently by different people, very much like you're on a date.

The more you think of interviews like a test, the more you'll agonize about it, and the more you'll feel writing and believing such gospel-ic articles like this. True, there are a few basic common things, but beyond that, it's subjective by definition.

Whoever YOU think fits your values and ideas, is an A player. Everyone else is "B", because they are not exactly "compatible" to your thinking.

At [http://InterviewKickstart.com](http://InterviewKickstart.com), that's what we find. Every company has a different viewpoint of what a great engineer is. After a generic training for interviews, it's about compatibility with the companies.

<comment><USER6> My current gig asked me a bunch of questions about tools and techniques... that I am unable to use to do my job.

Suffice it to say that there were some hurt feelings when the contract actually started and I saw how they were actually doing their work. If I knew then what I know now I would have continued looking.

</comment></comment></comment><comment><USER7> I have a sneaking suspicion that hiring is like stockpicking: after an initial filter, monkeys with darts would do just as well.

The problem is: if the interviewers are "constantly learning," (and they are, just ask them), then they are consistently making mistakes that the future, more learn-ed version of themselves wouldn't make. To take an example from the article: interviewers are to ask candidates about some time that they used data to make a decision. What if a candidate responds with a story in which they realized the data were pointing the way to a local optimum that the candidate cleverly avoided? To you, smart HN reader, you are perhaps impressed, and tempted to slap the candidate on the back and rejoice in your shared membership in the club of those who've discovered ambiguity ("Complexity, such a bitch, right?"); but if the interviewer but dimly remembers calculus but is proud of themselves for using a sentence with the word "data" in it, then the candidate's response will come off not as an indication of the ability to "ask the right questions," but a sign of non- cooperativeness, "irrational refusal to let decisions be driven by the data," and perhaps intellectual arrogance.

For interviewers, I have no idea what to tell them. For candidates, I can only say: Lie, and then follow through. If they are looking for "grit" but you had a privileged upbringing, make something up and commit to yourself to be grit- ful[0], rather than saying what's in your head, which is "I haven't had much hardship but I get the importance of resilience." If they ask for your greatest weakness[1], say _anything but your greatest weakness_ ; instead talk about the difficulty of coping with _other_ peoples' weaknesses ("I don't deal with my father's alcoholism as well as I ought," or "I get impatient with lazy people.").

[0]This is basically what the sales people in your org do, which is why you get those requests.

[1] This is a dishonest question, because there are wrong answers. The only acceptable answers are weaknesses that the interviewer shares; but by making that the only right answer the interviewer is implying that they have the "best" weakness and therefore have _no_ "real" weaknesses. If they don't introspect honestly, why the hell should you? Or, more charitably, which is a better approximation of reality, that you are both about equal on your paths to enlightenment, or that you are an imbecile? Is truth best served by communicating the former through omission, or the latter through facts?

<comment><USER8> \-->I have a sneaking suspicion that hiring is like stockpicking: after an initial filter, monkeys with darts would do just as well.

I couldn't agree more. I have probably had more interviews / initial conversations in the last ninety days with tech recruiters. I would say about 95%, knew absolutely nothing about what they where doing, they ask me the generic questions... What are you strengths, weakness? What was a time you where in a bad situation... A lot of times I could figure out that they hadn't read to the bottom of my resume.

Then there is the Tech guy questions: What is OOP? What does it mean when you get this error? What is the difference between PHP 5.6 and PHP 5.5, tell me right now!

I did run across some recruiters that actual read to the bottom of my resume. Usually, they where the ones that figured out I was over qualified for most positions.

The best job I ever had was in the Marine Corps and they never asked me any questions, they where happy to have me sign the contract!

In the meantime, I'm looking for work... [http://www.strategic- options.com/resume/?=HN](http://www.strategic-options.com/resume/?=HN)

<comment><USER9> > In the meantime, I'm looking for work... [http://www.strategic- > options.com/resume/?=HN](http://www.strategic-options.com/resume/?=HN)

Clearly I'm not the target audience (I'm not in a position to hire, in fact, I'm also looking for work), but I'd be more inclined to read to the end if a) It rendered anything before allowing js, and b) if there was a link (or preferably content) at the top, just listing the bullet points.

Looking at the html-source, I see there's a link to a doc-document buried at the end of the rabbit hole -- I humbly suggest whatever hides in there should also be exported as html, and linked prominently from the landing page.

That said, I'm assuming your reference to people not reading your whole resume is from applications where you've submitted a cover letter + traditional CV?

I should also add, that your resume-site has some impressive points, and good visuals -- I just don't think busy, technical people would want to waste time on that, if they could just see a short list of some of the good things you've done. If those details means nothing to them without pictures, then they're probably not technical enough to be able to make good decisions regarding hiring for technical positions. Personally, I don't think being overlooked by companies that have bad management/HR is a bad thing. I guess it depends who you see as your audience?

<comment><USER8> Thanks, I agree with most of what you said.

I made the visual resume, mostly for tech recruiters and non technical people / business owners. (Definitely not CTO's), I also use it to see if the tech recruiters actual view my resume, which a lot of time they don't look it at.

Your right, being overlooked by bad management is a blessing in disguise.

</comment></comment></comment></comment><comment><USER10> This (like most interview processes) seems very unscientific and error prone.

She doesn't mention correlation of their process to successful outcomes and until you do that you're guessing.

Also doesn't mention reviewing quality of past work which I'm guessing has a better correlation if the contributions are properly vetted.

Unless you're doing A/B testing you'll never know, and are certainly screening out candidates who could have ended up being star players.

<comment><USER11> Here's a meta-analysis of the empirical literature: [http://mavweb.mnsu.edu/howard/Schmidt%20and%20Hunter%201998%...](http://mavweb.mnsu.edu/howard/Schmidt%20and%20Hunter%201998%20Validity%20and%20Utility%20Psychological%20Bulletin.pdf).

TL/DR: Give the candidate an IQ test and a work-sample test. The next best is an "integrity test", which actually measures mostly conscientiousness. You can totally ignore years of experience and education.

<comment><USER9> What is an "integrity test"?

<comment><USER9> Reflecting a bit on this, and on my comment above re: CVs -- I'm inclined to just start applying to jobs with something along the lines of: I'm above average IQ[1], you can send me a work test at <email>. If the test goes ok, lets talk.

Actually, in this light, codeval.com makes (even) more sense.

[1] Sadly, not impressively high. I forget what score I got last time, IIRC around 130 or so. Then again, I also have pretty high "Social IQ" (self- assessed ;-), and the tests don't cover that.

</comment></comment></comment></comment><comment><USER12> Why don't we ever hear about management tips to get more performance out of the people you have?

<comment><USER13> That information is out there, but it's much easier to focus on changing or improving things that don't involve management practices and organizational behavior, especially focusing on people who aren't part of the business yet.

There is a common flawed view that if you can focus on hiring the best people then you won't have problems with performance. It can also result in high turnover, and hinder performance when the rest of the equation isn't weighted heavily.

Focusing on things other than hiring also comes with politics, because it involves admitting that something isn't perfect with the organization.

<comment><USER14> > There is a common flawed view that if you can focus on hiring the best > people then you won't have problems with performance.

I think, more specifically, there is a common flawed view that hiring the best _engineers_ means you can ignore _management_ and have them "self-organize". Related to this is the false idea that a room full of really smart people don't need dirty things like "process".

Nearly every time I get someone to give me a concrete example of why a false positive is dangerous I find a management flaw that is the root cause of the damage.

</comment></comment></comment><comment><USER15> This just in: "How to do X by doing Y". The only way to get good candidates is to optimize your hiring pipeline to the point that you can hire someone in less than two days and fire them within 2-4 months if it becomes clear things are not working out. Doing anything else is just a waste of time, money, and effort. There is no proxy out there that will give you only the candidates you're looking for.

</comment><comment><USER16> This is a puff piece thinly veiled as a guest post.

<comment><USER17> The "First Round Review" is an embarrassment, they push out content-free fluffy valley conventional wisdom every day or so, an unfortunate number of which make it to the HN front page for some reason.

<comment><USER16> I'm confused as to why this made the front page (and is _still_ there).

The content isn't new or noteworthy.

I suspect some strategic upvoting but maybe I'm just paranoid.

<comment><USER18> See what you did there?

You called attention to the strategic upvoting.

Which means you get downvoted.

Welcome to real HN where groupthink is the only think.

<comment><USER16> Couldn't care less about karma tbh.

</comment></comment></comment></comment></comment><comment><USER18> Meh.

Here's what all these HR sourced "top performer" filters are missing: top performers are a nurture not nature thing i.e they are a function of the environment.

What's the incentive for a top performer to work for you? We hear a ton about how the best people "take ownership", but a lot less of why they should build your company for you (rather than starting their own).

The most important thing a manager/CEO can do is to align the company's success with the individual. That's how you make top performers out of people you already have.

<comment><USER19> I agree, if you want good people you need to create an environment in which they can thrive. They need challenging problems, stake in the company, and most importantly get out their way and let them build stuff. Great companies are built by engineers and not the HR dept. or CEO's with an accounting background.

</comment></comment><comment><USER20> Still waiting for an HR blog where they checked the people they didn't hire against those they did.

<comment><USER21> Yep. Nearly every 'article' about how to hire suffers from selection bias.

Here's what I'd like to see: Find some super-talented folks who are critical to the success of whatever they're currently working on. Have them name names of companies that turned them down in the past. Then interview HR from those companies to find out what they did that filtered those people out of their organization. This kind of study would probably be impossible for a number of reasons, legal and otherwise, but I bet it would be a fun and informative read.

<comment><USER14> The big problem with this idea is that many will assume, rightly or wrongly, that in spite of someone's success at $COMPANY_X that they still would have been bad for $COMPANY_Y. I am personally of the opinion that a good engineer is a good engineer, and a bad engineer is a bad engineer. Organization and culture can amplify or attenuate the "goodness" or "badness", but cannot make a good engineer bad or vice versa. I also think _way_ too much emphasis is put on culture fit, however it gets defined.

</comment></comment></comment><comment><USER22> TL;DR: "How would you convince me you are willing to exchange professional services for currency?"

</comment><comment><USER23> Specifically, I'm not sure these characteristics are the perfect set for all interviews. I only spent 5 minutes reading the article, after all :)

But, I like that these are all personality traits with no easy answer. I get the feeling that an interviewer trying to craft questions to test "grit" or "impact" will discover good stories about the candidate. They'll probably push the candidate to talk about real challenges, or explain below-the-waterline projects they thought were important. Assuming there's a technical screen that validates that they're woefully uneducated (I'm thinking FizzBuzz, not 3 hours of red-black trees), it feels like an interview designed to capture these attributes would be pretty probing, and if the topics were divided among different interviewers, they'd all get different angles on the candidate.

That seems good. Interviewing for the nominal job description is easy to game. This checklist, if thoughtfully prepared for, seems harder to game.

</comment><comment><USER24> All Hiring/Interviewing blogs should have a disclaimer like this.

Hiring/interviewing is like judging a medicine by its packaging. It is error prone and there is little you can do to avoid making bad decisions.

Many people get good at it after making so many mistakes. It is much easier to ask an expert in the field help you choose a candidate for the role.

</comment><comment><USER25> As a person that has interviewed for and gotten jobs at multiple Fortune 500s (whose tech departments varied from abysmal to impressive effective) and as a person that has been a part of the interviewing/hiring process several times, I appreciate the attempted formalization of interview metrics and see more than a little value in the metrics described in the article.

To me, though, there is one "metric" that trumps all the rest, and that is personality fit with existing employees. If you have two brilliant software engineers that just absolutely cannot stand each other, nothing will get done. The best interview experience I've had, personally, has been to be placed into a technical interview - "start programming application X that does Y" \- with two existing employees looking over my shoulders asking me why I'm doing what I'm doing and why not something else.

The technical justification for my chosen solution to the technical interview question didn't matter much once it was clear I covered a base level of technical ability, but it was incredibly valuable that I and the employees looking over my shoulder didn't want to get into a fistfight after an hour - it meant that we could amicably disagree, support our reasonings for our arguments, and then not have sticks up our asses when the other person's proposed solution ended up being the right one, and then gracefully defer and say "thank you for the conversation and debate." That meld is immensely important.

That said, I do recognize that it becomes increasingly difficult to gauge this sort of interaction with increasingly large teams. My experience interviewing and being interviewed is limited to cases where it's been a team of 3 - <USER2> people. For larger teams, perhaps such a formalized approach makes sense. I do not have any experience that informs me as to whether it is or isn't.

But then I have to ask whether there should be a team of more than about 8 people without a dedicated manager. I don't have anything more than a gut answer to that question, but my gut says no.

</comment><comment><USER26> There seem to be a lot of questions of the form

 _Have your candidate tell you about a time ________

I hope they're giving their candidates time to prepare answers to these. I feel like I wouldn't be able to think of anything during the interview.

</comment><comment><USER27> I will just say again like I always do, there is no solution to the problem. You hire, you try, and if no good, you fire.

I have some thoughts regarding possibly giving the interviewer some more leeway (like for engineers, don't start off with solve this first) but haven't thought enough about that.

</comment><comment><USER28> Interestingly, this rubric outlined in article applies the advice Daniel Kahneman gives in his section on interviews in Thinking Fast and Slow. As he acknowledges, it isn't perfect but in studies it generally shows an improvement over the sort of gut-level hiring most people end up doing.

</comment><comment><USER29> So yeah - if you think the technical interview process is broken, take a look at this and realize that at least in our business there is _hope_. Hiring someone for _non-technical_ jobs? This is the best you can do.

</comment><comment><USER30> "Top Performers" [https://youtu.be/yoy4_h7Pb3M](https://youtu.be/yoy4_h7Pb3M)

</comment><comment><USER31> Given a person who knows nothing about medicine, then might sell them on leech bleeding.

Given a person who knows nothing about technical work, might sell them on the OP.

Bet if take five interviewers and have each of them read the OP and apply it to interviewing 100 people and compare the results, will find (1) validity, the interview results will on average be a poor predictor of anything important and (2) reliability, the interview results will scatter with huge standard deviation. That is, it's throwing darts where the scatter is huge and the center of the scatter is far off the center of the target.

Uh, didn't see where there was some good double blind tests of the OP for such _reliability_ and _validity_. Uh, the OP was big on _analysis_ \-- good, now have them tell us about their 7 devices and reliability and validity, that is social science 101.

Let me just guess, from reality and common sense, what is going on with the OP: The whole OP is essentially just _plausibility psycho-babble_ that HR interviewers would like to entertain. It's aimed at HR.

The OP is yet more evidence that under no circumstances should anyone in HR have a substantive interview with an important candidate for anything important.

Instead, HR should smile, be nice, offer water, coffee, tea, soda, smile, be nice, give directions to the rest rooms, help with the interview schedule and the organization chart, hand over the benefits packet, smile, be nice, help with the travel and lodging arrangements, help with expense reimbursements, smile, be nice, etc.

E.g., the OP wants to ignore school work but wants to emphasize ability with, what was it, _analysis_?

Okay, I can understand why an HR humanities major would get confused here, but a good solution is to look for majors in math, physics, electronic engineering.

The OP wants to give as a test of ability with _analysis_ something with Excel. Upchuck: I avoid Excel because it is nearly always way beneath me -- I use much more powerful tools. Excel will do Lagrangian relaxation, the fast Fourier transform, Wiener filtering, least squares, multi-variate spline interpolation, L. Breiman's random forests or even CART, stochastic optimal control, solve some differential equations? I don't think so. I don't waste time with Excel. That's like testing a cardiac surgeon on cleaning bedpans.

"Top Performers"? Right, maybe for toilet cleaning. Even then they'd be at risk of mixing the Muriatic stuff with the Drano stuff -- don't do that!

HR tries again, fumbles with the ball, drops the ball, trips over the ball, falls on the ball, loses the ball, is face down in the mud.

HR: Smile and be nice.

</comment><comment><USER32> A lot of questions here seem superfluous. They can be easily bluffed on. Also, the questions assume that perfection exists.

</comment><comment><USER33> Well, at least it's a change of pace from the same handful of technical questions people post over and over again.

</comment><comment><USER34> "For more technical roles, you can even build a timed Excel test with some practice problems or logic tests.", what? is the Excel page for the interviewer or the candidate?

In any case, you can use whatever questions you like, they are very trainable and people good at BS and making up anything quick will do well at those.

</comment><comment><USER35> As a candidate, this is the best interview guide I've read.

<comment><USER36> Trust me, if they're interviewing like this, you don't want to work there.

<comment><USER35> I'm an MBA type with a lot of compsci background, and I get this bullshit all the time. These advice were poignant and to the point of actually suggesting to me how to think and how to answer those incredibly silly questions. That's what it's like over at the Corporate Overlords in Scandinavia at least.

</comment></comment></comment><comment><USER37> Where is the actual data that back up this recommendations?

</comment><comment><USER38> Aren't these all pretty obvious?

<comment><USER10> They may seem intuitive, but that doesn't prove the questions or approach valid.

</comment></comment><comment><USER39> This would be very politically incorrect, but I'd wager the best way to find top performers is to ask "What do your parents do for work, and how much money do they make?" There is a very high correlation between the success of parents and their children.

<comment><USER33> I don't think it'd be hard, if you gave it a moment, to think of counterexamples whom we'd almost all recognize.

<comment><USER40> Avoiding false positives is much more important than eliminating all the false negatives. Ugly, but true.

<comment><USER14> Much parroted, rarely if ever supported by hard data.

<comment><USER40> One does not need data to support it.

Attention is your scarcest resource at any company. You hire people to add to this resource. Bad hires do not add, but subtract from this pool, by forcing you to pay attention to them rather than on running your business.

No amount of "hard data" can make that untrue.

<comment><USER14> > One does not need data to support it.

I'm an engineer; one _always_ needs data to support something.

> Attention is your scarcest resource at any company. You hire people to add > to this resource.

Not sure what you mean by "attention", but I think it is the same thing I would call "throughput": the rate at which the company can turn customer requirements into engineering products (and thus money). If so, I would agree, as pretty much all resources of the company combine to affect this.

> Bad hires do not add, but subtract from this pool, by forcing you to pay > attention to them rather than on running your business.

Still on board with you. I would agree that someone whose net throughput contribution is negative is a bad hire.

The problem is, this has nothing to do with the statement I was originally reacting to: "Avoiding false positives is much more important than eliminating all the false negatives." _That_ statement needs hard data about:

\- The expected number of false positives

\- The expected magnitude of the throughput loss from each false positive

\- The expected number of false negatives

\- The expected magnitude of the lost potential throughput due to the false negatives

<comment><USER40> >The problem is, this has nothing to do with the statement I was originally reacting to: "Avoiding false positives is much more important than eliminating all the false negatives."

You don't quantify the impact of false positives the same way you do the false negatives. A false negative simply means you take more time to look for a candidate. A false positive's impact is so huge that you can't come up with numbers large enough for false negatives to outweigh it.

To make a broader point, not everything can be tracked and measured. Things that can be tracked and measured often can't be compared to each other usefully.

<comment><USER14> > You don't quantify the impact of false positives the same way you do the > false negatives. A false negative simply means you take more time to look > for a candidate. A false positive's impact is so huge that you can't come up > with numbers large enough for false negatives to outweigh it.

I vehemently disagree with this.

A false negative means either work isn't getting done or current people are overworked. This is costing your business. If it isn't, why are you hiring in the first place?

As for the cost of false positives being "huge", how? All you have stated is that a bad hire brings down the net productivity of a team. _How much_ is very relevant and something you can get a rough feel for. If I hire someone who has a slight net negative impact on team productivity, and they show no signs of improving, I fire them and move on. Is it a worse outcome than not hiring them or anyone else for that period of time? Yes. Is it a _huge_ impact? Not at all.

You can come up with a hypothetical worst-case, company-destroying false positive, but that would be comparing apples to oranges based on your position concerning false negatives. The worst-case false negative situation is also company-destroying.</comment></comment></comment></comment></comment></comment></comment></comment>


The Verge's Deputy Editor Chris Ziegler Was Working for Apple for Two Months - <AUTHOR> http://gizmodo.com/verge-deputy-editor-chris-ziegler-was-working-for-apple-1787018849 <comment><USER2> duplicate: [https://news.ycombinator.com/item?id=12567848](https://news.ycombinator.com/item?id=12567848)</comment>


JavaScript (and Node.js) Continues to Eat the World - <AUTHOR> https://medium.com/presence-product-group/javascript-and-node-js-continue-to-eat-the-world-d41918a0615b <comment><USER2> WRT one of the later comments on "callback hell" .. Although it isn't free, async functions (await) combined with Promises leads to some relatively level code, and pretty easy to reason about and understand... even if getting Babel into your team's build chain is like pulling teeth.

I've been a pretty big fan of JS for a very long time, and I'm glad to see it see the growth and maturity that it has in the past 7 years. The tooling although still somewhat fragmented is better than ever. I do think it'll be a few more years before things start to come together around fewer more successful options, not to mention working better with other web platforms.

Today, it's difficult to compose a web project without Node/npm for at least the tooling. And I really wouldn't want to. What came before was a barely functioning mess.... What we have now is a well functioning mess, with a lot of options. It'll come together, and I'm looking forward to it.

I'm still hoping to find a reason/opportunity to use go or rust for something though.</comment>


Understanding Connected Living Room Audiences - <AUTHOR> https://www.nielsen.com/us/en/insights/news/2018/the-ott-experience-understanding-connected-living-room-audience.html <comment><USER2> _Connected devices allow brands and publishers the opportunity to connect with harder-to-reach demographics, especially Millennials and Gen Zers._

Or maybe these demographics actually aren't interested in your brand's bullshit.

<comment><USER3> I rarely wish this (this is HN, not Reddit) but occasionally I wish that vote counts we're public so I could see how many supportive votes you get.</comment></comment>


On Botnets and Streaming Music Services - <AUTHOR> http://motherboard.vice.com/read/i-built-a-botnet-that-could-destroy-spotify-with-fake-listens <comment><USER4> The takeaway I'm getting from this is, as with other websites, the attempt to fund streaming music indirectly via targeted advertising is hopelessly unable to keep up with ever-more-clever click fraud. At best, we end up with an arms race of more and more powerful "criminal" botnets and more and more heavyweight advertising tech crowding out the original content. I'm becoming very sympathetic to the viewpoint of backing out towards either completely untargeted advertising (which, paradoxically, can be far more effective) or -- and, admittedly, I'm going crazy out on a limb here -- paying for content.

<comment><USER5> Paying for content worked great until the middle class collapsed.

<comment><USER6> s/middle class collapsed/broadband became prevalent/

<comment><AUTHOR> "What do you mean people can use their computers to listen to music and copy things infinitely? There's no money in that! We should try and kill this Napster thing to protect selling CDs for $20 a pop and never support online distribution no matter the customer demand!" \- The Music Industry (paraphrased for sarcastic effect)

<comment><USER7> And... were they wrong?

<comment><AUTHOR> That depends! Are you on the side of Cliff Burton era Metallica as a band that encouraged tape trading as an avenue for exposure, or are you on the side of Lars Ulrich era Metallica that feels people sharing music without paying money are enemies of the band?

If you believe in the latter, then that's a perfectly reasonable position for record labels and publishers who invest in "startup" acts hoping they get enough ROI to cover the failures, and then give the successful bands only what they're contractually owed after recouping. Sure, that's a business model. The only number that matters is the number of people paying for the recording.

If you're in the camp of the former, you might think that organic growth and demand for your supply means getting to hit as many ears as possible is a chance to broaden the base of people willing to pay for more. Just because somebody can get a recording for free doesn't mean they aren't interested in giving you money for a live show or a t-shirt or a sticker. The bigger the fan base, the better the income potential.

I'm going to assume you didn't live through the same era that I did, when Napster was more prevalent in dorm rooms than illegal booze. After that window got slammed shut, the industry narrative (backed by an ignorant Judge's opinion that "the computer is not an audio device") was that anybody who didn't buy retail was a criminal. Ever buy a used CD? That was another target.

There was a huge opportunity to embrace technological evolution. Not until Steve Jobs and iTunes worked out the mechanics of DRM and "buying a license" did the industry decide to get on board. It seemed like the industry had their cake and could eat it too...until Eminem looked at his contract and saw that digital downloads were being paid out at the "sale" rate of (est) $0.25 per track, but the words on the page said any "license" should be paid out at $0.50 per track. He took them to court, for himself, and also for clarity in the rules of business. He won. A lot of money. Other artists started to notice this...

There's an alternate reality where more forward people would've been thinking about consumers as audiences instead of wallets, but that didn't happen, and here we are, arguing over the table scraps that Sony/Warner/Universal leave for the independents.

<comment><USER7> > I'm going to assume you didn't live through the same era that I did

You're incorrect.

And... Jobs DID come along, iTunes DOES exit, it ate album sales without providing similar revenue, now Spotify et al are eating iTunes' market share while providing even less revenue, and it's a race to the bottom.

Everyone loves to talk about what would've happened if all the various content industries had been more forward looking, and it's all ridiculous. One of my favorite, quantifiable examples is the newspaper industry and the classifieds. Yes, I guess the newspaper companies could've been Craigslist instead of Craigslist being Craigslist. To what end, though? Look at Craigslist's revenues. Look at what the newspaper classifieds' revenue was before Craigslist came along. We're talking orders of magnitude difference. And that's Craigslist's business model, right? Low overhead, passes the savings onto the customer, skims a little cream off the top and it's more to pay their bills because they're not using their cut to subsidize journalism, they're just doing the whole Bezosian "your margin is my opportunity" thing and making money where they can. If you split all of Craigslist's revenue up among every newspaper in the country that lost classified revenue when Craigslist hit the market and they could afford to pay everyone a few dollars more in their severance packages as they keep laying off journalists.

The world changed. We think we've figured out where the world is landing, but we're pretty much just all sitting here in the post-apocalyptic wasteland scavenging -- all the big names we think of when it comes to new media -- iTunes, Spotify, Netflix, Hulu -- are just selling us media produced under the old business model at marginal cost. When Spotify and iTunes and all them finally do get around to killing the music industry we're going to be in a very, very different world. Maybe it's better! Maybe it's worse! I only really trust people who say they don't know.

<comment><AUTHOR> >it ate album sales without providing similar revenue

Similar revenue for WHO? If you've studied the music industry then you know that artist compensation - whether a physical sale or digital sale - <USER2> equivalent from a practical standpoint. Of a $.99 sale on iTunes, Apple takes the first $.30 for their role, and the rest is at the mercy of label and artist agreements. Whether it was a CD or a digital sale, an artist was only entitled to a certain defined compensation.

It's kind of funny you mention Craigslist, because you're citing it as a reason that the predominant distributors - PRINT DISTRIBUTORS - should not have to compete with a technological innovation with less overhead. It's a middle man of the highest order. And you assert they should be propped up because why?

Craigslist exploited a loophole of eliminating the friction between seller and buyer without skimming a bunch of revenue in the process. Why are you trying to argue that systems which benefit sellers and buyers should compensate legacy entities which refused to adapt and change? In a digital realm where rights management matters, the only people who argue for additional payout layers are people I don't trust. I don't like the old business model, so that's why I refuse to buy in and push for a new one.

<comment><USER7> > Why are you trying to argue that systems which benefit sellers and buyers > should compensate legacy entities which refused to adapt and change?

wat

<comment><AUTHOR> >Look at Craigslist's revenues. Look at what the newspaper classifieds' revenue was before Craigslist came along. We're talking orders of magnitude difference... they're not using their cut to subsidize journalism...

If you want to support a middleman business model, that's your prerogative. If I want to support a direct-to-customer-as-much-as-possible one, then that's mine. I don't want to support a label, I want to support myself.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> This seems to be another argument in favor of the model proposed here: [https://news.ycombinator.com/item?id=9226497](https://news.ycombinator.com/item?id=9226497)

Split revenue per individual amongst artists, instead of splitting total revenue amongst artists.

</comment><comment><USER9> I wondered about this, I figured someone had figured out they could use pretty standard click fraud techniques to milk money out of the pay-per-play ecosystem.

No doubt someone in operations over at Spotify spends their nights trying to detect these kinds of patterns. It would be interesting to hear their take on it.

<comment><AUTHOR> Agreed!

Considering how much discussion there has been regarding transparency in the music business - the leak of confidential information via the Sony hack being one of the few instances where numbers are exposed - I think this could be a viable avenue for Spotify to make their case better to artists.

Also, I'd hope it's one of the few areas where Spotify and other services can legitimately have "free reign" to discuss their operations without being handcuffed by non-disclosure clauses in contracts.

</comment></comment><comment><USER10> Isn't there potential here for a much more nefarious plan than merely earning revenue from fake listens?

If you could do the same thing across a few services, spreading the number listens out on a viral pattern, based on a bit of investment in highly marketable songs, it sounds like you could create a bedroom-singer rags-to- riches superstar story and potentially make millions upon millions.

<comment><USER11> A similar thing has happened in the past:

>> "Gracia was selected to represented [sic] Germany in the Eurovision Song Contest with the song "Run & Hide", produced and composed by David Brandes. After the German national pre-selection for the Eurovision Song Contest it was revealed that Brandes had bought thousands of his own CDs to ensure chart placement, a requirement of the ESC"

[https://en.wikipedia.org/wiki/Gracia_Baur](https://en.wikipedia.org/wiki/Gracia_Baur)

<comment><USER12> Instead of that pedantic "sic" you could have, you know, fixed the article.

<comment><USER13> Can you really call it a direct wrote at that point? [sic] is an accepted way to avoid integrity issues when quoting.

</comment></comment></comment></comment><comment><USER14> (I misread. It's 8/100th of a cent. Much more realistic.)

Artists on Spotify earn 8 cents each time their song is played? That figure seems really, really high to me.

I'm not especially surprised this is possible, but it comes as a huge shock that it would be financially profitable for someone.

A quick glance at some other articles ([http://www.theguardian.com/technology/2015/apr/03/how- much-m...](http://www.theguardian.com/technology/2015/apr/03/how-much- musicians-make-spotify-itunes-youtube)) shows drastically different figures:

"For example, Spotify says that its average payout for a stream to labels and publishers is between $0.006 and $0.0084 but Information Is Beautiful suggests that the average payment to an artist from the label portion of that is $0.001128 – this being what a signed artist receives after the label's share."

This would make it much more expensive to run a botnet through AWS than any potential profits it could generate.

Some other thoughts after reading more closely:

\- It's surprising that the minimum listen time required for payout is 30 seconds when average song length is 3 minutes (or even higher? A reported 3m 45s: [http://www.statcrunch.com/5.0/viewreport.php?reportid=28647&...](http://www.statcrunch.com/5.0/viewreport.php?reportid=28647&groupid=948)). Is listening to 3/18th of a song really enough to warrant payout? Maybe.

\- The opening sentence isn't all that truthful. It's implying that an average user is just going to open Spotify, mute it, and go to sleep. That means they won't be there to skip every 30 seconds. So, we fall back to the 3 minute average. Assuming you sleep for 8 hours that means you're only going to get 160 plays or ~12 cents not 72.

<comment><USER15> Spotify is shit for artists. Anyone that says otherwise is a liar.

<comment><AUTHOR> I'm not a liar when I say Spotify has expanded my global listener base beyond any other service I've used in the past. Through DistroKid, I can actually examine where, when, and how my music gets to listeners. That includes country of origin.

Yes, the prospect of worthwhile income is shit, but it always has been whether on the radio or signing over a license just "for exposure." Or, yeah, Spotify is shit for people who signed a shit contract with a shit label who doesn't do shit for their artists other than point the finger elsewhere. I'll give you that.

So I guess this is a matter of perspective, because I'm not a liar and I don't think it's shit for artists.

<comment><USER15> It's not a matter of perspective. The numbers you would need to be pulling on Spotify are huge to sustain yourself on a decent level. By that point, you're already big enough where you wouldn't need Spotify's income because you're big enough to have other sources.

<comment><AUTHOR> Okay, I'll give you one more response after you "moved the goalposts" so quickly: The only perspective that Spotify or iTunes is an avenue to make a living is straight up delusional. Getting a hit song on the radio, on iTunes, or Spotify is about opening up opportunities where there is a demand for the commodity - the music - and gives the artist a better bargaining position. Making a living in music is about having other sources _as a fundamental rule of the industry_. One good contract for a license to a commercial on broadcast television likely would dwarf the income one would receive from an entire year of streaming income. Selling t-shirts will make more than streaming income.

I've made more money busking with an acoustic guitar on a busy corner in 2 hours than I've made from streaming. This is how I use Spotify - it's a street corner that pays in pennies. However, I can't afford to travel the world to get in front of people. Thus, while it's very close to the "exposure" concept of compensation, at least there's an exchange of monies as a matter of principle.

<comment><USER16> As a music purchaser who doesn't torrent music, I like that Spotify lets me try new music in a convenient & legal way. It's a step in the purchasing process, not the final destination.

There's a German metal/rock band called Unheilig that I heard about in 2013. After seeing a YouTube clip [1], Spotify / Rdio let me try more of their songs & add them to my playlists. That hooked me enough to add the album to my Spotify offline downloads so I can listen on the train.

At that point, I'm a committed fan who doesn't want to lose the album... so that's when I buy the CD. Two years later, I've bought all their albums, 2 limited Super Deluxe editions, t-shirts & hats & merch, and been to two of their concerts. Unheilig probably got nearly nothing from me via Spotify, but it was an important step in getting me hooked & ultimately spending hundreds of dollars.

[1] [https://www.youtube.com/watch?v=Cl- mvbxAf-k](https://www.youtube.com/watch?v=Cl-mvbxAf-k)

<comment><AUTHOR> Just wanted to say thank you for sharing this personal story, as I really think there are a lot of "music consumers" who think - and act - like you. The funny thing about music is that it, well, has no "inherent value" as soon as it's created. It's a matter of finding an audience that values the music enough to want more. I feel culinary art is sort of similar - there's no "perfect recipe" for a successful restaurant. If there's an audience, there's demand, and just because, in theory, somebody could make the same dish at home (i.e. download a pirate / clone recipe) doesn't mean the original loses all its merit.

I'll admit that Napster, to me, was an avenue to find things that I couldn't get my hands on otherwise. My favorite search term was "remix" and I got unreleased / international tracks that I still love to this day. I'm a consistent Beatport Pro customer, about $20 a month, and I buy physical CDs for artists to both help their traditional sales metrics and simply for nostalgia. I can't tell you how happy I was to buy the last Columbia release by Weird Al and be a part of giving him his first #1 album release of his career. Yeah, it's kind of hokey, but that's what's so fun about music - <USER3> cradle to grave, there's no shame in loving what we love.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> The difference between a "bot" and a real person is that the real person have money to spend. Now, how do you figure out if someone is a real person or not?

<comment><USER18> What if the bot had an allowance and periodically bought music (on iTunes, if they were using Apple Music) OR if the bot had a 'premium' Spotify account.

What is the difference then?

Also, what is worse? A bot with a premium account or a human with a free account?

<comment><AUTHOR> Damn, that's a stone cold divergence based on priorities. I think asking a "label" versus an "artist" might yield different results, depending on priorities. Nice food for thought on that logic tree.

</comment></comment></comment><comment><USER19> I think calling this a botnet, albeit technically correct is both really silly and clickbaity.

<comment><AUTHOR> So, what would you call it then? If it's technically correct then being needlessly contradictory is silly and superfluous.

<comment><USER19> "Botnet" almost always refers to compromised computers, that's not what this article talks about. The article describes a ridiculously ineffective approach of buying a bunch of EC2 instances to run 50(!) copies of spotify each, when you should be able to easily support thousands of instances of spotify running on a single server.

There's no need to do this using a botnet, there's no point in doing this using a botnet... It's utter nonsense. The only reason they talk about one is to make the whole thing sound far more nefarious than it is.

And to reiterate my point once more, nobody ever refers to remotely managing their own computers as a "botnet".

<comment><USER20> OK then, it's proof of concept for a botnet. That would make the headline awfully long.

<comment><USER19> It'd be ridiculously stupid to have a botnet do this instead of running it on your own hardware. Again, you can easily run thousands of spotify clients on a single computer.

<comment><AUTHOR> Fair enough. I think his assertion that using an exploit to compromise Spotify Premium account users (via targeted malware) is kind of the extreme example to justify the term botnet. Unless I'm mistaken, running thousands of clients on the same computer would take a lot of effort to 'distribute' over enough IPs as to cloak the operation? I get that you have some beef with the phrasing used, but I think for the sake of practicality calling "a network of robots posing as humans" a botnet is fine and not click bait at its core. Not to belabor the point but I'm pretty sure I could scold you about some improper music terminology usage when you'd be trying to make a point.

</comment></comment></comment></comment></comment></comment><comment><USER21> As long as Spotify doesn't make a loss on the payout per streamed listen event and the pay-in from advertising, I don't see any problem.

Spotify has a pretty much working monetization model, they could just tell advertising to fuck off. Their free model is like classic radio, where advertisers pay without knowing if there is one listener tuned in or millions (literally).

</comment><comment><USER22> In the end I feel we need better captcha options.. images for most people with options for the impared. In the end stuff that's relatively easy for a person (click the picture of a cat), but harder for a computer to do...

Another option might be regular challenge-response that makes interaction harder and more costly for a fake listener.. having to run a pbfdk, scrypt or other result on a given input at regular intervals... (the service could have a pre-computed pool to randomly serve out, so they wouldn't have the same costs).

They could also flag accounts that get my than N hours of play in a day, or number of days that's much higher than a typical listener... or who plays more artists/songs outside the top 10k songs the previous month. Asking them to login to their account, or validate their email address at that point... Anything that makes the process much more complicatied to automate but would affect a very low number of real people.

Yes, it's an arms race, but there are a lot of things that could be done that could keep the barbarians out of the gates... Not to mention other suggestions that split per-user royalties to artists, instead of the pool as a whole... That combined with other models could go a long way here.

</comment><comment><USER23> You can filter this out. Using Spam filtering bot detection security methods.

</comment><comment><USER24> There is really no need to call this a botnet

<comment><USER25> But the point is a botnet could, instead of mining bitcoins for example, stream content of which the rights are owned by the botnet operator.

<comment><USER19> Except this would be infinitely more traceable and would still require quite a bit of development work, whereas bitcoin mining is really easy.

And using a botnet to do this offers no benefits from just running it on your own hardware. Unlike bitcoin mining, running spotify clients isn't resource intensive.

</comment></comment></comment><comment><USER26> I feel like the writer of this article has a fundamental misunderstanding of Spotify's business model. The number of plays influences how much money Spotify brings in from advertisements. As far as they are concerned fake and real plays are not much different beyond maintaining credibility with their advertisers.

<comment><USER27> "beyond maintaining credibility with their advertisers"

This may come as a surprise to you, but advertisers are deeply concerned with click-fraud and impression reliability/value. So it's not important to Spotify... except for this one reason that actually makes it super important.

<comment><USER26> Right, that is exactly what I said. I feel like you misunderstood my comment.

<comment><USER28> I feel like you're misunderstanding the situation to be honest...

>As far as they are concerned fake and real plays are not much different

This is flagrantly false given that they do care whether plays are legitimate because they do want to be able to verify with advertisers that plays are served to credible clients...

Are you implying that Spotify would expect that advertisers are stupid/inept enough to not notice when a large number of ads are served to fake/bot consumers?

Spotify as a company has the prerogative of acting with integrity in these situations if only for future maintainability/acquisition of relationships with advertisers.

Even if an advertiser was inept enough to not notice their ads were served largely to bots the value of those ads would still ultimately be lowered by them being served to bots. e.g. if 1000 ads are served and 500 are sent to bots, the overall value of each clicked ad is eventually lowered by 50%. This is assuming an advertiser is so inept they aren't measuring clicks per served ad, which doesn't even occur.

I think you're fundamentally misunderstanding why spotify _does_ have to maintain the credibility of those ad clicks/listens/etc...

<comment><USER29> Advertisers may or may not care. Many are indeed both stupid and inept. Their clients should care, but may not be technically savvy or aware enough to care. Fragmentation in advertising also makes accountability a lot harder.

Spotify definitely has to care in the long run, but it may be better for their chances of making it through that IPO window to see no evil, hear no evil, and speak no evil until someone forces it upon them. If it worked for Facebook and Twitter, why wouldn't it work for Spotify?

Honestly, this is one of the reasons why 'free' services provide such low value to advertisers unless there's world class fraud fighting capability at the company. If the service is paid, it's significantly more expensive to generate fake traffic. But that'd be bad for the loosey goosey user numbers (AKA 1990s era 'eyeballs') that so excite momentum investors.

<comment><USER28> Sure, maybe they could get to an IPO without addressing the issue, that doesn't in any way invalidate the legitimacy of the posted article.

There is a vulnerability. It is exploitable. In the long run spotify _will_ be negatively affected if it isn't addressed.

Honestly surprised that there is any arguement whatsoever to the contrary.

If it was, 'well they can make it to IPO before addressing it' as you've stated, sure, that's valid. The parent was saying, 'it's not an issue, it's a matter of perception'.... Which is extremely naive and shortsighted. Perception is the very thing that drives advertisement cost.

<comment><USER29> Nope, doesn't invalidate what he did. Everyone would be better off if this was either cleared up or if other streaming services with models less prone to fraud could pop up.

<comment><USER28> Is it my tone then?

Rereading my posts I do seem like a braggadocios douche, but I'm not incorrect at all I don't think; the comment I'm replying to is incorrect though.

That I genuinely feel is true.

<comment><USER29> Yes the parent comment you were replying to was off base and you were right to correct him. You didn't seem rude to me. I was being a little bit sarcastic about Spotify riding a fraud-wave to a public offering based on inflated numbers.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN: Why don't people register personal domains? (eg YourName.com) - <AUTHOR>

I own jarema.com (my last name), mikejarema.com (my full name), and a few other variations and TLDs. I take pride in my slick email address (m*@jarema.com) and my blog ranking highly in Google for name queries. Based on HN submissions coming from personal domains, I expect that there are others here like me in this respect.
When I encourage others to grab a personal domain, especially when their last name .com or even first name .com is unregistered, I find myself all but pleading the case, most times unsuccessfully.
I mean for ~$10 annually, and a bit of upfront effort, you can:
- move your email from gmail, ymail, hotmail, whatevermail over to your own domain
- redirect visitors to your favorite social media profile (FB, twitter, github, dribbble) or in minutes have an about.me page going aggregating it all
- alternatively spend some effort building out a blog or portfolio site
- avoid worrying about being "cyber-squatted" or pranked by a buddy with some initiative
- just sit on the domain (defensive registration)
The truth of the matter is that a good number of personal domains are available in the .com namespace, and many last name .coms are also up for the taking.
However, if & when your name is taken, you're basically SOL.
So... I'm curious, why DON'T people register their personal domains? <comment><USER2> Mike, I totally agree with you and it drives me crazy and has become a bit of a personal mission. My field is career development and so I work a lot with people during their job search, and one of the first things I ask is "what happens when someone googles you?" Then I'll explain the value of having your own domain. I understood when older workers would say they didn't understand how to set it up, or were confused, etc so I often walk them through it.

Then I went back and spoke at my college (I'm 42). I figured, well, these 21 year old internet whiz kids will certainly have this figured out. Nope. The number of people I met that owned their domain was about the same... consistently about 1-2 out of every 10 people I ask.

So in tech geek/lean startup mode, I got frustrated with explaining it to people over and over, so I purchased a domain, bought a theme for $8, used my friend Jayme as a guinea pig, and in 1 weekend recorded a how-to video and built a site so I didn't have to explain it over and over. It's called GetYourNameToday.com.

Look, I realize there's no way for me to not make this comment look spammy, and yes, in full disclosure there is a GoDaddy affiliate link on there (which I note in both the video and on each page), but I figured if it doesn't cost the person anything more, I am genuinely helping them out, and I can get a little something for my effort, why not.

I'm very transparent with who I am on the site, link to my career development/new media blog to show that it is in sync with what I do for a living, and even tackle questions such as WHY to register your name and what to do if you have a basic name that isn't available. I'm with you... seems like there are very few reasons why someone wouldn't see the benefits of securing their name for the "investment" of $10.

Would love to hear your feedback on the site and if you would have positioned it any differently or what I could do to improve it. Thanks! Jim

<comment><AUTHOR> Jim, thanks for the link and insights. I used to interview boatloads of interns for a couple companies here in Toronto, and the personal domain always left me with an improved first impression of an applicant.

But yes, the ratio was quite low, especially considering I was interviewing CS students.

I'll take a look at the link and send you some notes later.

<comment><USER2> Thanks Mike. Wow, just went to your site and found Namevine -- what an awesome site. That's the logical next step for a lot of job-seekers... once they have their URL, they want a Twitter account and maybe a YouTube video. And obviously we're both in sync with the helping people/affiliate link dynamic. I'll be recommending this to people I work with. Thanks again.

<comment><AUTHOR> Thanks Jim, Namevine is a fun side project of mine, and like you I'm hoping to monetize via affiliate links.

Really the big win (for individuals) would be a one click unified domain registration, social media signup, @yourname.com email hosting and About.me setup.

The video you've made shows the current path of least resistance to setup your online identity (at YourName.com), but I can't help but feel it requires more effort than it needs to. Eg. navigating GoDaddy's aggressive upselling, DNS management, etc.

Have you seen IWantMyName.com? They're trying to simplify some of this.

On the other hand, Flavors.me is like About.me but also offer domain registration as a part of the signup.

Finally, when it comes to _using_ a personal domain, my instinct (and most others I'm sure) is to find free solutions for every aspect of the domain where possible.

On my personal domains I use:

\- Google Apps for email and private wikis (free, I'm well within the free usage limitations)

\- Tumblr for my blog (free, including pointing my domain to their service, I love that about Tumblr)

\- Montastic for monitoring (free, my needs are quite simple and they'll happily monitor a couple URLs at somewhat infrequent intervals)

I think the point I'm trying to make here is that I'm onboard with you in terms of personal domain advocacy. However in terms of a business its probably tough to simultaneously offer a very low effort solution that provides a good overview/perspective on the individual using the service (eg. a nice default personal profile page) and make money given people's propensity to use free solutions for their own domain.

Check out the recently launched BrandYourself.com, they're doing something cool that is really in line with your thinking, I wonder what their traction is like (I use the free tier - surprise, surprise).

</comment></comment></comment></comment><comment><USER3> \- People may feel there is no content they wish to broadcast about themselves to the world. I don't have a desire to promote myself constantly, I'll just continue being quiet. Not everyone feels the need to tell the world their thoughts constantly.

\- A single gmail/similar address can work fine.

\- Not everyone has enough friends to warrant using "social media".

<comment><AUTHOR> Good points, I suppose one assumption I'm making is that people do have something they'd like to share with the world at large.

What are your thoughts about the notion of registering YourName.com now basically as an insurance policy to ensure it's available in the future if you'd like to use it?

Personally I think the annual reg fee is worth it, actually my domain went unused for a couple years.

</comment></comment><comment><USER4> My surname is Benedetto and unfortunately "benedetto.com" is owned by a funeral services company. However I managed to register "benedet.to", which makes a great personal domain!

My only fear in owning an extremely personalized domain is that if for any reason I fail to renew the domain, some squatter could get it and do whatever he wants (it happened with my previous blog: someone picked up the domain and used it for a porn website. It took months to take down every link that still referred it as my personal blog).

<comment><AUTHOR> I like the domain hack, good grab. Do you host your email on this domain? Are you launching the blog anytime soon?

I view a personal domain as an asset for life. On one hand some of my web projects may die and I'll subsequently let the domain drop, I view my personal domain in the opposite light.

I'm ready and willing to keep renewing year after year, the yearly cost is worth it, much like I need to renew my drivers license or pay property taxes, its just an annual expense that's a part of being me.

<comment><USER4> Thanks :) I use the free version of Google Apps with this domain for my email.

The best thing is that I'm de facto using the gmail web app, but if in the future I would like to change provider it will be a smooth transition, since my email address will remain the same.

</comment></comment></comment><comment><USER5> i think it's because i internalised the "domain names should be cute/clever/creative/individual" mindset; registering yourname.tld comes way too low on the imaginativeness scale. i wouldn't name a star/planet/city/village/company/building/house after myself either. the internet at large does seem to be shifting more towards seeing domains as equivalent to email addresses, though, so i'll probably go ahead and register myname.net at some point.

<comment><AUTHOR> I hadn't thought of the creativity perspective here & I agree that YourName.tld is an uninspiring, obvious choice.

I've made the analogy to a few people that a firstname.lastname@example.com email address that you may have setup in high school isn't necessarily what you want to be posting on your resume / linkedin account.

Thanks for the comment!

<comment><USER5> i wasn't thinking about the domain equivalent of cooldude69, i was thinking more of sites like "daringfireball.net", "intertwingly.net", "defmacro.org" - something that is creative without being gauche. (personally, i really wanted hitchhiker.net but i was too late to get it)

<comment><AUTHOR> Sorry, didn't mean to imply that tackiness was along the lines of what you were thinking, the analogy was off the mark.

I like hitchhiker.net, but looks that company has grabbed all the TLD variations unfortunately.

I'm curious, what would you do with hitchhiker.net if you had it today? I ask because a friend of mine was excited to grab InsomniaLabs.com on the drop, but has yet to make much of it as his personal site.

<comment><USER5> i'd probably move over my rudimentary website [<http://zem.novylen.net/> \- some 10 years ago a friend who was more proactive about these things set up novylen.net and then offered a bunch of friends free domains on it, so i figured why not] and consolidate a few scattered ideas for blogs i started on wordpress.org. "zem" and "hitchhiker" are names i frequently go by online and in fandom, so it would definitely be something i thought of as a personal site to coalesce my online identity around.

</comment></comment></comment></comment></comment><comment><USER6> My name is too common. I think it was already registered before I started coding back in '85.

Though I agree that for programmers who want to create a brand around themselves, having their name as their domain is a fair move.

</comment><comment><USER7> Because I can't find any domain variation of my name that isn't taken.

<comment><AUTHOR> I can't argue with that.

Are the current registrants doing much with the domains? Do you check back every so often to see if the names are expiring?

</comment></comment><comment><USER8> my name is already taken :(

<comment><AUTHOR> Mine was too - an unflattering picture of some other guy with the same name. As soon as it dropped, I claimed it and will be holding on to it.

If you're interested, there's a bunch of backordering / drop-catching services out there that you only pay upon successful delivery of the domain. I'd register and backorder your name if you're interested. Look for snapnames, pool, namejet.

</comment></comment><comment><USER9> In my case, [lastname].com is owned by some domain squatter looking to make a quick buck (or 12k of them last I checked). I own [firstname][lastname].com and that seems to be good, but it'd be cool to have my email me [first]@[last].com and my blog at [first].[last].com.

First world problems!</comment>


Ask HN: What are the next Google product(s) might get axed? - <AUTHOR> <comment><USER2> How do you expect anyone to be able to answer that question? I doubt even people employeed by Google would be able to answer it unless they are very high up in the food chain.</comment>


Setting Up Your Development Environment with Docker Compose - <AUTHOR> http://blog.dubizzle.com/boilerroom/2016/08/18/setting-development-environment-docker-compose/ <comment><USER2> I'm really not a fan of absolute paths in the compose file:

      services:
        volumes:
          - /path/to/my/code/on/my/dev/machine:/path/to/the/code/in/the/container

If you're sharing your docker-compose.yml file with other developers, this will get annoying really quickly. Normally, I'd place the docker-compose.yml file in the root of my project, and then replace "/path/to/my/code/on/my/dev/machine" with ".". That way, it doesn't matter where other devs keep code on their machines.

In the case where you have a compose file that builds multiple projects (See: double time!), keep the compose file in one git repo, and then include the code for the other two projects (webappone and webapptwo) as submodules.

</comment><comment><USER3> "Mount your code, but don't forget to restart your services in between changes"

This is the part I find unacceptable for a development environment. Is there a way to have live-reloading of docker instance somehow?

<comment><USER4> This is why I just run all of an app's dependencies in a Docker container and connect the app to the Docker containers. Then I don't have to brew install all this crap.

<comment><USER5> That's exactly what I do, mainly because on Mac OS the host volume mounts are 2 magnitudes slower than volumes.

</comment></comment></comment><comment><USER6> Semi-related, but I had issues with Docker Compose and database volumes for web-development work (where the database volume-only container to allow for persistence across containers would be recreated, thus losing the data that was there). This prompted a tiny wrapper around some patterns we were using, exposed via a CLI tool and JSON file:

[https://github.com/girvo/dup](https://github.com/girvo/dup)

Even more unrelated: it's written in Nim, and a big refactor is coming along that works with the Docker socket directly (either the AF_UNIX or TCP socket, depending on what's available)

</comment><comment><USER7> We use a similar setup for some of our services at edX. It is worth noting that you may need to adjust your development behaviors/environment somewhat to accommodate Docker.

For example, PyCharm supports using Docker Machine but not the new Docker for Mac. This means you won't necessarily have access to PyCharm's code inspection and remote debugging if you solely use Docker. This has resulted in my having a virtualenv on my host machine as well as the Docker setup, which is not ideal.

Once the tooling is better, things will be great; however, we aren't quite there yet.

<comment><AUTHOR> yeah, the tools have some way to go, I did have issues with virtualenvs like you mentioned but given how fast the docker ecosystem has developed, I expect them to make it there soon enough.

</comment></comment><comment><USER8> This is how we do development as well, it's been working out great!

One thing to note is that volumes can act weird at times if using docker- toolbox (I know the Blog Post was about using a Linux host).

[https://www.virtualbox.org/ticket/14920](https://www.virtualbox.org/ticket/14920)

As a workaround we set up an alias for opening the file in VIM and saving it (without making any changes) that would run from within the container. Like the following:

        vim <filename> -c 'wq!'

<comment><USER9> I don't think you'll see these problems with the new Docker 1.12 for Mac (no docker toolbox), which brings the experience on the Mac much closer to what you see on Linux boxes.

</comment></comment><comment><USER10> > webapp declares an env_file from which to pick up env vars. This is > important because we configure a lot of our applications with environment > variables so that the same docker image can run in different environments, > taking inspiration from 12-factor apps.

Keep in mind that your environment variables can be learned by inspecting the image. So if you make that image public, those envs are visible. As far as i understand, this is analogous to committing your passwords to source control and should be a consideration.

<comment><USER11> Huh? I mean, sure, you can probably figure out the _names_ of the environment variables expected by the code of the image, but the image itself doesn't have the values for those variables.

Environment files are—unless I'm missing something—a run-time consideration. You provide the an env-file you have locally to connect to your development images, etc., and could deploy (possibly) the same image elsewhere, with a different env-file. But the env-file values are not baked into the image.

<comment><USER6> They _can_ be baked into the image via build-args or the "ENV" Dockerfile syntax, but as your Dockerfile is committed to git normally this has the same dramas, of course! You're completely correct, but I wanted to mention that it was possible :)

<comment><USER2> Build-args and ENVs are not the same thing. Build-args use the ARG syntax and are baked in during docker build. ENVs are not baked in; the values are passed in during docker run or docker exec.

<comment><USER6> You are correct, they are not the same thing; however they can be combined to bake in an ENV to an image as a default value for a given ENV key, controlled at "docker build".

</comment></comment></comment></comment></comment><comment><USER12> Nice timing.

My dev env is deteriorating after 2 years use and I'll set up a new one this weekend.

Probably going to use NixOS, but also looking into Docker.

<comment><USER13> I wanted to learn some things a while back (can't remember what, I think it was laravel and angular) and set about creating a dev environment for it. Whatever I started out to learn fell by the wayside and building a shit-hot, easy to use, modular, containerised dev environment became my soul focus. I'm getting ready to open it up to the world any day now[1].

I'll post about it once I've ironed out a few more quirks. It makes life so much less unpleasant in so many ways.

[1] yeah we'll see how that goes

</comment></comment><comment><USER14> I was just starting to play with this last night. Frustrating couple of hours because it turns out that IntelliJ's Docker plugin isn't yet compatible with Docker For Mac, and in a way that isn't JetBrains' fault. You have to do some kind of weird workaround with socat.</comment>


Ask HN: Where can we see Data Structures in nature - <AUTHOR> <comment><USER2> Nowhere, data structures are conceptual inventions and not discoveries.</comment>


The many ways of handling TCP RST packets - <AUTHOR> https://www.snellman.net/blog/archive/2016-02-01-tcp-rst/ <comment><USER2> "What could be a simpler networking concept than TCP's RST packet?"

There are _twelve_ RFCs that cover the TCP protocol. They had to write a guide to traversing them all (RFC7414), and that guide references _128 other RFCs_. I doubt we can expect any aspect of a particular implementation to be simple.

As more products emerge, their functionality diverges and inconsistencies appear. Unless you test your product against someone else's, assume there will probably be unexpected behavior, no matter what spec you're following. (It just gets worse with the intermediary devices, as they're not even a plain-old TCP stack anymore; now they can include a NAT implementation, routing, a firewall, an application proxy... the complexity becomes dizzying)

<comment><USER3> These intermediary devices vastly outnumber our routers and are a huge part of the "internet sucks" problem.

</comment></comment><comment><USER4> "What could be a simpler networking concept than TCP's RST packet?"

I just checked my collection of Steven's TCP/IP Illustrated and there are a couple of pages on RST. So it's not that simple.

Kudo's to digging into RST as deeply as you did, I found the article to be a good read. I do think it's very cool that the people that did the RFC's really thought about the corner cases and how the protocol could take care of them.

</comment><comment><USER5> I just had a short romance with RST/ACK. It happened during a keepalive http session to AWS ELB, where the nginx backend had keepalive disabled completely due to a misconfiguration. The ELB's idle_time was set to 10seconds (instead of default 60). Just because the idle_time was set to a low value the effect of seeing the RST/ACK could be seen. It needed Wireshark to track this down. On the http level it appeared that a request had been sent, but the received response was empty and didn't even reach nginx at all (because ELB closed the stream).

</comment><comment><USER6> I don't have a huge knowledge of TCP, but IMHO the sequence number should just be ignored for RST --- that half of the connection is unusable for sending data after a RST, so the sequence number is irrelevant. I think the connection should close, unconditionally. The argument about RST spoofing seems somewhat contrived - if you have the means to inject arbitrary packets, chances are you also have the means to read them, so what sequence numbers are being used is known. Any flaw in this reasoning? Despite the diagram showing very different behaviour for all the OSs, the fact that they should be able to successfully communicate with each other, and the Internet is the biggest example of that, says to me that it might not really matter all that much...

 _What would really suck is if an operating system were to totally ignore the rule to reply with an RST when receiving a packet on a closed socket._

Isn't this behaviour explicitly encouraged to prevent port scanning and related attacks?

<comment><USER7> "if you have the means to inject arbitrary packets, chances are you also have the means to read them" \- this is not true in some (most?) settings. Current mode of operation of the Internet as we know it will allow incoming traffic allow to claim to stem from any public IP address. It's up to the interconnecting parties to ensure that no forged source IP adresses are used on packets leaving their network towards others, but that's all there is at the moment. See [http://www.internetsociety.org/doc/addressing-challenge- ip-s...](http://www.internetsociety.org/doc/addressing-challenge-ip-spoofing)</comment></comment>


How to Start a Startup lecture 2 - <AUTHOR>

Lecture 2- How to Start a Startup: http://youtu.be/CBYhVcO4WgI <comment><USER2> This is a dup of: [https://news.ycombinator.com/item?id=8370199](https://news.ycombinator.com/item?id=8370199)</comment>


Quantum information teleported between distant atoms  - <AUTHOR> http://www.sciencenews.org/view/generic/id/40133/title/Quantum_information_teleported_between_distant_atoms

<comment><USER2> how fast does the information get transmitted? Is it instant or at the speed of light?

<comment><USER3> No information is transmitted. It's like this with every article about entanglement.

If I have a red chip and a black chip and I mail one to you and one to your friend in New York then as soon you open your envelope and see a red chip the information "the envelope in New York contains a black chip" will be "teleported" from New York to your brain. Or not.

<comment><USER3> Here's a great interview I linked to last time there was an entanglement article on HN: <http://www.signandsight.com/features/614.html>

And Eliezer Yudkowsky linked to his own explanation: <http://www.overcomingbias.com/2008/05/spooky-action-a.html>

The HN item was: <http://news.ycombinator.com/item?id=276058>

<comment><USER4> Uhh doesn't Eliezer Yudkowsky's account explicitly discount the envelope explanation?

<comment><USER3> That was a metaphor not an explanation. What's actually happening is pretty much incomprehensible, but is just as unrelated to the transmission of information as my metaphor.

<comment><USER5> What gets "teleported" is indexical information, information about _which Everett branch_ "you" happen to be in.

One might say that _you_ are in the envelope - different versions of you in different envelopes.

It may sound odd, but it makes a whole lot of completely unphysical behavior in the "collapse" "theory" evaporate in a puff of smoke.</comment></comment></comment></comment></comment></comment>


Show HN: Just launched a modern spin on Show HN - <AUTHOR> http://tipcast.com

<comment><AUTHOR> It's work in progress, but in the app you can subscribe to get updates on new features as we release them. We used to share news this way with our own users of our iPhone games, and thought it would be a viable platform for others to Show & Tell what they are working on.</comment>


AmEx: "We discourage the use of special characters because..." - <AUTHOR> http://trn.n0t.net/post/374883143/i-wish-that-i-could-use-a-stronger-password-for <comment><USER2> Interesting - almost every single paragraph of this response is incorrect:

<\-- I would like to inform you that our website has a 128 bit encryption. With this base, passwords that comprise only of letters and alphabets create an algorithm that is difficult to crack. We discourage the use of special characters because hacking softwares can recognize them very easily. \-->

I don't even need to dissect the "hacking software can recognize them very easily" in this forum. They sound like they are suggesting reducing the possible keyspace is a _good_ thing. It isn't. It really, really isn't.

<\-- The length of the password is limited to 8 characters to reduce keyboard contact. Some softwares can decipher a password based on the information of "most common keys pressed". \-->

This one is just so wrong as to make it hard to understand what they are saying. Ironically, _fewer_ keys, make it easier to guess based on the "common keys pressed (4 character passwords on Intercoms are easily guess based on "Wear")

<\-- Therefore, lesser keys punched in a given frame of time lessen the possibility of the password being cracked. \-->

Still making no sense.

<\-- Moreover, American Express is committed to protecting the privacy and security of all of our Cardmembers, both on-line and off-line. We believe that our current security measures, which include our sophisticated monitoring systems to detect unusual or fraudulent card activity, provide strong, ongoing protections for our Cardmembers. \-->

Nothing to do with passwords, and, based on the previous sentences, doesn't really inspire faith on their Sophisticated Security. I'm not saying amex doesn't have their act together, it's just not coming through in this email.

<\-- Rest assured, I have forwarded your comments to our webmaster for review. During this review, we may contact you if additional information is required. \-->

Well, at least there is hope that the "webmaster" may come to their senses.

<comment><USER3> "They sound like they are suggesting reducing the possible keyspace is a _good_ thing."

I disagree. If a password is lost on the user side, it's probably going to be due to a keylogger, phishing, or a trojan.

Requiring short passwords doesn't make the user any more vulnerable to phishing, and it may make it harder for keyloggers or trojans to identify the password. And since the bank locks your account after three wrong guesses, there is no vulnerability from brute force attacks, especially with an RSA token.

The number of people who lose their bank password from shoulder surfing or people noticing keyboard wear is probably virtually zero, so optimizing your system to prevent against these scenarios makes no sense.

<comment><USER2> Alex - while on the surface what you are saying makes sense, as one who has looked at a lot of keylogger data, I can tell you that identifying passwords is fairly trivial, even when the passwords are simple english words like "house" or "dog" (let alone "scrambled words" like "zydkgel" that basically _scream _password. Two things make it straightforward.

       * The word is out of context.
       * There is usually a time delay on each side of the word.

Also, you usually have them typing in their username/account number near the password, another dead giveaway

So, even requiring that the user make it a straight forward english word provides little (no) defense against keyloggers. On the flip side, when the vendor's hash files (we are presuming at the _very_ least the passwords aren't stored in plaintext, or, the marginally better, "encrypted file") are compromised, having a broad keyspace makes cracking the passwords by brute force more difficult.

If you read the Amex email, they actually require _only letters_ - And, it's not even clear they require capitalization.

I'd love to see how quickly that hash file would fall apart. :-)

<comment><USER4> Ironically if they made their password the same as their username it might actually make it harder to spot in a keylogger context. (But trivially easy to guess.)

Making your password:

       http://google.com

would be pretty sneaky.

<comment><USER2> And, ironically, not allowed by Amex. :-) (BTW - you are correct, even _knowing_ that the password folllows the user account - a password that is a URL would be an incredibly effective way of defeating keyloggers. At least the ones who are trying to pull data in from thousands of people. Once you are focussed on the keylog data from a _single_ stream, it's basically game over.

<comment><USER5> Can alternating mouse input help? E.g. click over to your google-search box, type in p455w0rd, then click back over to your password box and type in your password, facebook.

</comment></comment></comment></comment></comment></comment><comment><USER6> The reason for the character limitation is a lot more straightforward - on the backend its stored on a very legacy system (in plaintext.. but I didn't tell you that), and to increase the length of the database field would cost 7 figures.

<comment><USER7> It's COBOL, isn't it? (Not being sarcastic; that's the only system I can think of that would cost 7 figures to change a field length in the database.)

<comment><USER8> At a past job, the mainframe "copybooks" required an extra digit for certain price fields (cars never used to cost > 100K). It was a months-long project which required tons of coordination with other clients systems. One could argue that the 27 other ways the company didn't have its house in order made the project costly, but the 30+ hour flatfile data conversion was an inherent part of the plan.

Edit: Legacy COBOL, of course.

</comment></comment></comment><comment><USER9> Holy living fuck. And this is a company that basically has encryption and security tied into its basic business. I think I might have to cancel my AmEx, cause they are obviously idiots over there.

<comment><USER10> Why does it matter, really? If someone hacks your account and somehow charges a bunch of stuff to your AmEx, then you're not going to be held responsible anyway. And since it's a credit card, you don't even have to pay out of pocket or take interest on the disputed amount.

In fact, I've never dealt with a company that makes it easier to dispute incorrect charges on a card; It's usually a matter of calling them, to which they respond "ok, we'll take it off."

If AmEx thought the amount they'd have to spend on security upgrades would be less than the money they're losing to fraud, they'd spend it. It's almost certainly more difficult than it seems on the surface. A random confused customer service rep's mail is worth a chuckle, but it's not a smoking gun that proves widespread incompetence.

<comment><USER11> If they steal your identity, it might not be a lot of fun.

<comment><USER12> Identity theft's such a fun phrase. <http://www.youtube.com/watch?v=CS9ptA3Ya9E>

</comment></comment></comment></comment><comment><USER13> There are about half a dozen different kinds of institutional stupidity that could lead to a response like this. I'm not sure which kind of stupid worries me most. Do they let their customer service team just make shit up? Do they train them this way? Do they really think we're that stupid? Are _they_ really that stupid? Gah.

<comment><USER14> Who's keeping them honest? 90% of people applying for jobs as security advisors or programmers or web developers or directors-of-logging-people-on are not going to understand about security. (I'm sure that most people would say that number is being very gracious about the quality of people applying for IT jobs, but I'm going with Sturgeon's Law to be safe.) Half of the remainder are the sort of people who won't do a good job without being cajoled into it, so unless their manager understands about security, we're out of luck.

So then, if they hire one of the majority, what happens to them? Not very much. At worst, some people on Hacker News complain about it for a day or two when it becomes clear that they aren't doing their job, and they get a little bad press. At next-to-worst, someone breaks their system and commits a lot of fraud, but they can write a press release with a lot of handwaving and pretend that it's fine until it happens again. It's not as if the mainstream press is in a better position to judge the actual facts of the matter.

</comment></comment><comment><USER15> That response seems to be par for the course.

I phoned up my bank (HSBC in the UK) a few days ago to explain that their bank-issued Visa debit card is not secure: Verified by Visa is akin to protecting my money with a sheet of paper. Their explanation was, and I am not joking, that the system was American and so poor them can't do anything about it.

Honestly, the banks don't care. They've shifted the burden of dealing with fraud onto us consumers, but gave rubbish security tools. They have no incentive to change, until a big theft happens. Even then, I doubt they'll change their ways.

<comment><USER16> The security in Visa, for the most part, doesn't come from protecting you from illegitimate charges happening in the first place, but rather in the fact that there's a chain of _authentication_ so that charges can be reversed at any time, and an expert system trained on your buying habits so that you'll be alerted when you probably do need to make a reversal.

</comment></comment><comment><USER17> This seems reasonable to me. Key loggers on users' computers are probably their most common breach vector (by far), so whatever password policy minimizes that risk is probably best. You also see this in their other security policies - for example, asking a secondary password (security question) which sets a long-expiration cookie. With 128-bit SSL on the login page and a 5-guess lockout policy, there isn't much reason for strong passwords.

<comment><USER18> Damn text. So hard to get sarcasm sometimes. It was, right?

<comment><USER19> Considering that andreyf posted original link -- yes, it was a sarcasm :-)

</comment></comment></comment><comment><USER20> No special characters in passwords is one of my biggest pet peeves. It really screws up my general system for generating passwords for different sites.

<comment><USER16> You can just "describe" your password for the special-character-impaired:

#(%$^ -> hashleftparenpercentdollarcaret

Probably a might bit harder to crack, too.

<comment><USER21> Not when they limit you to 8 characters. :)

</comment></comment></comment><comment><USER22> I suppose what they mean is that keyloggers / keylogger log analyzers can spot passwords by detecting unusual sequences of special characters or improbably long non-dictionary words. I'm far from being an expert at security but sounds like a reasonable concern to me.

It would be very interesting to hear the thoughts of some of the security expert HN-readers on this matter.

<comment><USER23> Well on the face of it it is a reasonable concern. But if the system has a keylogger there is very little you can do to protect your user. It is a very poor attempt at security through obscurity.

If the users system is compromised there is nothing you can do. Sacrificing general security for that case is silly.

The best defence to a keylogger attack is to have a secondary number vaidation alongside the password that requires you to enter a random subset of that number each time (eg 1st, 2nd, 8th).

<comment><USER24> It's quite laughable really, if I'm logging into my bank I type HSBC.co.uk first, anything following that is my International Banking number, following that is my password (which is the best defence you state) and date of birth. If I was required to enter all 8 numbers my password would be the easiest thing to catch.

The only better defence I can think is to have a user enter 3 genuine numbers from their password and 3 randomly generated numbers given to you, but it the 6 numbers are requested randomly. Requesting only random genuine numbers gives you encryption by hiding the sequence of the numbers, if you are also hiding the genuine numbers it's two levels of deceit.

<comment><USER23> I wish hsbc gave you the numbers it wanted you to enter as images too. Makes it a little more difficult to parse.

<comment><USER25> Some banks in South Africa used to bring up a little image keyboard and you click the letters (ie no keyboard) in my mind this is still one of the best ways to protect against keylogging.

<comment><USER26> Storing the password in a truecrypted file and copy pasting also works. Though, for someone going to those lengths, a keylogger is a very unlikely to be a problem for someone paying that much attention.

<comment><USER27> A software key-logger can also typically snoop the contents of the clipboard.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> I'm not Bruce Schneier, but to me this sounds like an incredibly lame security policy. If someone asked me to write a piece of software implementing this policy, I think I would just laugh.

The hypothesis that this is really because they're running very old legacy systems behind the scenes seems very plausible to me. Over a decade ago I occasionally worked with computer systems in banks and large retailers. In some cases the banks were still using computer systems for processing transactions which were more than 25 years old, and usually only one or two highly prized gurus on astronomical consultation fees knew how to run and maintain those systems.

</comment><comment><USER29> I don't know what's scarier, their security practices, or the fact that they call the person responsible for the system a "webmaster".

<comment><USER17> It seems like whoever answered this e-mail isn't a native English speaker, and so probably doesn't use the word "webmaster" the same way as you would.

</comment></comment><comment><USER30> I think I hurt my palm when it hit my face.

<comment><USER31> I don't think The Onion could have come up with that email... Definitely facepalm material.

</comment></comment><comment><USER32> There is a problem with the special characters for international users.

For example there are tree keyboards for Spanish: "Spanish", "Spanish Variation" and "Latin American". [http://en.wikipedia.org/wiki/Keyboard_layout#Spanish_.28Spai...](http://en.wikipedia.org/wiki/Keyboard_layout#Spanish_.28Spain.29.2C_aka_Spanish_.28International_sort.29)

And usually, the computers are not correctly configurated, so to type the special characters you have to guess or try to remember where they are. And the problem is worse when you type a password because can not see the characters.

(At work I have an "US" keyboard, but they are difficult to find here, and more expensive. At home I have a "Spanish" keyboad, but the key for typing "<" and ">" is missing, so I have to use an special keyboard driver from <http://keyboards.jargon-file.org/> )

</comment><comment><USER33> Zipcar does the same thing: only numbers and letters. Also, try putting '<' or '>' in your password -- they'll complain about how you're putting HTML tags in your password.

Now why would they worry about that?

<comment><USER34> Ooh, that's _scary_. Being so worried about XSSing themselves when they _look at your password_ and so uncertain of their HTML sanitisation that they reduce the keyspace... that's a special kind of special.

</comment></comment><comment><USER35> There are a number of prominent financial sites with similar policies, check out this cringe-inducing rundown: <http://weakpasswords.org/list/>

</comment><comment><USER36> Wow, that's pretty bad, but it's got nothing on one 'security' measure I ran into on an online college application site.

To enumerate, the password had to:

\- have exactly 8 characters

\- contain characters from 3 of the following 4 groups

\-- lowercase letters

\-- uppercase letters

\-- numbers

\-- ? . , _ - + = $ ! –

There were also some things that the password _could not_ do:

\- be a dictionary word

\- contain any series of characters in your username

All of this was enforced.

<comment><USER37> Apart from requiring exactly 8 characters, the other constraints will genuinely increase security.

Except, of course, that half the students will end up carrying their password on a piece of paper in their wallet.

<comment><USER38> There is nothing wrong with carrying your password around on a piece of paper in your wallet. This is the Bruce-Schneier-approved method.

[http://www.schneier.com/blog/archives/2005/06/write_down_you...](http://www.schneier.com/blog/archives/2005/06/write_down_your.html)

<comment><USER37> Or, just have a half-decent password management tool which keeps an encrypted file of your passwords on your phone, and remember just one password.

Schneier may say it's ok, but to me it seems stupidly insecure, especially when you consider that we're talking about a student's university network password, and that there'll be identification in that student's wallet that allows the thief to make use of the password immediately.

</comment></comment></comment></comment><comment><USER39> _screams_

...so yeah, I've always been bothered by their password hogwash. I suppose I'm glad to see that they're actually as terrible as I thought they were.

</comment><comment><USER40> Not really too surprising - tech support staff on the front line rarely are trained to actually have a clue what they're talking about. Just ask for a supervisor next time.

</comment><comment><USER41> Come on! It's a website, and I'm sure it's not using Cobol Server Pages (CSP), so why now just put some simple logic between the web controllers and the COBOL logic?

</comment><comment><USER42> Almost as bad as the IRS: <http://zaid.posterous.com/irs-is-not-dot-com- friendly>

</comment><comment><USER43> A common issue of banking websites is that they force weak passwords, but I rarely hear about banking websites being "hacked". Why?

<comment><USER44> They force weak passwords for the users, not for the admin, so you could hack an account but not the website itself.

Accounts also have plenty of protection besides the password: IP is logged, if it's not the usual IP my bank asks a secret question, and after 3 failed tries it locks out the account until you phone them, succeed at getting a human on the line and explain your situation. You can't brute-force much in 3 attempts.

</comment></comment><comment><USER45> the fact that it is minimum 6 chars and max 8 limits the size of the search field as well for brute forcing

</comment><comment><USER46> Fake, right?

<comment><USER47> You'd hope so.

There was a guy by that name working for American Express though:

<http://in.linkedin.com/in/gauravsharma14>

But the timestamp on the screenshot is recent.

<comment><USER48> The same message is here in early December

[http://lists.eclug.net/pipermail/eclug/2009-December/008208....](http://lists.eclug.net/pipermail/eclug/2009-December/008208.html)

This suggests it was copy-and-pasted either inside or outside AMEX.</comment></comment></comment>