How Dropbox handles downgrades - <AUTHOR> https://userflowpro.com/blog/dropbox-downgrades/ <comment><USER2> Personally, I'm done with these kind of mind hacks.

While not quite in Facebook 'Your friends will miss you' territory, it still feels quite scummy.

They belong to an era of the Internet where growth and retention stats trump all. Just let me cancel.

Oh, and if you cancel and are over the limit and login, Dropbox will give you a nag screen and hold your files hostage till you cough up.

How this is in any way an example of good practice is beyond me.

<comment><USER3> What if you rent a 2000 sqft apartment and don't renew your lease because of price. You decide to move to a smaller apartment with cheaper rent or move back in with your parents where rents free. Can you keep your stuff in the original apartment?

I don't disagree with you but your analogy is flawed. At least Dropbox keeps your stuff to reclaim whereas a landlord would kindly shuffle it to the garbage while cleaning your old apartment.

That nag screen is a nice way of sayig we're still paying for your hard drive space.

<comment><USER4> "That nag screen is a nice way of sayig we're still paying for your hard drive space."

i don't remember what the nag screen says, but saying that they're still paying for hard drive space for me would feel a bit more straightforward and genuine.

<comment><USER2> It is also a sunk cost. Dropbox has already paid for your hard disk space - they run their own data centers. Okay, there is an opportunity cost, but unless Dropbox is running really close to capacity in its data centers, it is quite a small one.

</comment></comment></comment></comment><comment><USER5> I think the core problem is that you lose that available space even if you paid out through the month/year. I have a suspicion this is an intentional dark pattern to keep people from downgrading and not some weird engineering constraint. So it's a bad and maybe unethical user experience.

Why couldn't it be: "Thank you for using Dropbox, you have access to your 1t (or whatever) until X date, after that your files will stop syncing unless you do Y. Come back any time!"

<comment><USER6> So if I pay for a year, then cancel 6 months in, I lose my 1tb immediately?

Do they give you a pro-rated refund for canceling? Otherwise (unless I'm misunderstanding your comment) that seems like they aren't giving you what you paid for.

<comment><USER5> Yes, or at least that was my experience a few months ago. I'd have to check if anything changed.

<comment><USER7> "In most cases, canceling your Plus or Professional subscription before it expires means you'll finish your current subscription without receiving money back. Once the subscription expires, your Dropbox will revert to a Basic account, and you will no longer have the additional storage quota or features granted by the Plus upgrade."

[https://www.dropbox.com/help/billing/plus- refund](https://www.dropbox.com/help/billing/plus-refund)

</comment></comment></comment></comment><comment><USER8> Audible has something similar: they require that you use up all your credits before cancellation is even possible, so that is obstacle #1. Then they ask for reason and sub-reason, and give you either a $20 coupon if you say the reason is because it's too expensive, or a 3 months praise on your account if you say you can't catch up to one book a month.

Pretty clever. But having to choose 6 books immediately at the point of cancellation sucks

<comment><USER9> Yeah, they tried to do this to me so I complained to support and they refunded all my credits. At least their support staff treat you right, if not their software.

</comment></comment><comment><USER10> I cancelled my New York Times digital subscription this year. It required a phone call and talking to two individuals. Of course I couldn't do it the very first time I tried because I wasn't in a position to make a phone call at the time.

I find Dropbox's approach middle of the road. I think the thing that annoys me the most is that the button that does what you are specifically trying to do is de-emphasized. It shows a lack of respect.

<comment><USER11> FYI, Apple and Google both now resell subscriptions to various newspapers. And unlike this case, you can unsubscribe from them without having to call anyone.

</comment></comment><comment><USER12> It is also interesting how the handle forced downgrades. I just lost some GBs from previous promotions (like Dropbox Campus Cup) and are now stuck with the following situation:

\- all files are still there, downloads are possible

\- they disabled syncing between devices and sharing

\- in case of upgrading to a paid plan I can continue as before

<comment><USER13> I can't really imagine a better solution though. Is there any grace period? I assume you can delete files and directories to get below your quota.

</comment></comment><comment><USER14> Thank you for posting this. I have been putting off downgrading my Dropbox account because I thought it would be painful. Now I'll just go do it.

</comment><comment><USER15> I'm not sure whether it's better than usual that they actually do let you cancel online, or worse that they make you drill through apparently 20 screens or so of trying to get you not to cancel, answering questions, and finding de- emphasized buttons to click on. Thinking about it, I think that's the biggest obstacle to signing up to more services - not that I'll miss the money, but that it's going to be a royal PITA to cancel when I decide to.

I should give props to Google Play's subscription system for making the cancel interface work well. I subscribed to HBO Go for a few months to watch some shows, and wanted to cancel when I was done and didn't see anything else I wanted to watch. I just clicked one button in the play store, and it cancelled the renewal right away AND also kept my access active until the end of the period I already paid for. That's much better than I expected, and I will have much less worries about subscribing to things on the Play store in the future.

But yes, please go away "retention mind hacks".

</comment><comment><USER16> None of this is "good". User wants to downgrade, let them downgrade without asking a bunch of questions and clicking next 5 times.

</comment><comment><USER17> I still love how netflix handles cancelling subscriptions. settings -> cancel subscription -> are you sure? -> done and done. Feel free to re-subscribe anytime. They'll have kept your watching progress and personal recommendations safe in the meantime.

No weird psychological tricks to get you to not cancel, just a button and a confirmation.

</comment><comment><USER18> My interpretation: "no big deal, not scummy, better than average by a distance". And: please buy userflowpro.

</comment><comment><USER19> I feel the downgrade flow could still be shorter (fewer steps) without affecting the amount of information provided on the downgrade or the level of influencing that happens in these screens to get the user to stay.

</comment><comment><USER20> Off topic, but I wonder how much money they are not getting by offering a lower priced tier of like 5$ per month?

<comment><USER21> This is a deliberate pricing decision. They would lose money on people switching to the cheaper plan, who were otherwise willing to pay a higher price but not use the full plan's potential.

</comment></comment><comment><USER22> Wow, dropbox made it long and annoying to give them less money. Verdict : I love it!

</comment><comment><USER23> How Dropbox makes customers jump through sales hoops before doing what they actually want. _

<comment><USER24> True, but clicking the button is still easy

What is not clear is what happens if you're using more than 2GB of space and downgrade

<comment><USER25> It's shown in that screenshot in the "Overcoming your objection" section of the article, next to the fish tank graphic:

"If you've already reached your quota, this means that: * Your Dropbox will stop syncing * You won't be able to add any new files to your Dropbox * You can't restore any files removed from your Dropbox"</comment></comment></comment>


Steve Jobs WWDC Keynote (in 60 Seconds) - <AUTHOR> http://www.mahalodaily.com/2008/06/10/md139-steve-jobs-wwdc-keynote-in-60-seconds/ <comment><USER2> this is a search startup? really? it sounds like they don't know whether they want to provide a search capability or be a news outlet.

mahalo the alleged search utility does not know what, for instance, a support vector machine is. when i search for "matrix algebra", they give me 4 pages, only 2 of which are mathematics-related (neither of them actually being about matrix algebra specifically) and then they don't even punt to google which is their saving grace when you search for anything besides celebrities and high- profile politicians.

they don't even _try_ to guess whether wikipedia has something highly relevant (it does for both SVMs and matrix algebra). why?

i would say something nastier, but instead i'll say, where's the value?

now watch the "long tail" people scramble to tell me about how all users search for is britney spears and barack obama.

</comment><comment><USER3> For me the Youtube embed wouldn't load on the site but <http://youtube.com/watch?v=dGY28Qbj76A> works great.

<comment><USER4> It doesn't work for me either. (just in case: Windows XP SP2; Opera 9.24)

</comment></comment><comment><USER5> I've never been a big Mahalo Daily fan but I couldn't help but get a chuckle out of Jason Calacanis being listed as "Craft Services" in the credits.

</comment><comment><USER6> Thats actually a really good overview, just about covered everything announced.</comment>


How to Run a 5 Whys (with Humans, not Robots) - <AUTHOR> http://www.slideshare.net/danmil30/how-to-run-a-5-whys-with-humans-not-robots

<comment><USER2> The summarised version: 1. Mistakes happen and will always happen. Saying "it wont happen again" doesn't fix the problem. 2. Make a joke to stop people getting defensive.

<comment><USER3> 3\. Plan for a future in which we remain as stupid as we are today. 4\. Pick broad fixes over root cause fixes.

<comment><USER4> It makes me wonder what the 5 whys are. :)

</comment></comment></comment><comment><USER5> As much as I agree with the general message (nobody died, so it's not _that_ bad), and have employed that same technique over the years, the part about root cause is off point IMHO.

'Root cause' can absolutely refer to a collection of events. In the example given, clearly both things were causal, clearly you fix both - you don't pick one and label it 'THE root cause' and forget about the other (yes I know he talks about prioritisation, but again that's perfectly valid when addressing a root cause that happens to be a collection).

<comment><USER6> Heya, author of the slides here.

Re: 'root causes' -- I find the words somewhat important. Like, if you say you're looking for a root cause, then people tend to be in the sort of moral mindset, and have a harder time seeing it as a collection of contingent events.

Also, in the (truly amazing) "How Complex Systems Fail", he's pretty down on "root cause":

[http://www.ctlab.org/documents/How%20Complex%20Systems%20Fai...](http://www.ctlab.org/documents/How%20Complex%20Systems%20Fail.pdf)

"7) Post-accident attribution accident to a 'root cause' is fundamentally wrong"

<comment><USER7> I'm with you on this one. Especially in an iterative context, there is zero value in looking for the true root cause.

The point of the exercise is to identify economical interventions that will get the system to produce better results. If you go much beyond that, people can get off into moral, analytical, or philosophical weeds and get lost.

As long as you do retrospectives and five-whys frequently, you can count on useful analytical depth to come over time. If an issue is really both important and subtle, it will crop up again. The next time you'll have another perspective, so it will be easier to find. And by waiting, you'll have avoided examining all the equally subtle but unimportant things.

</comment></comment></comment><comment><USER8> Brilliant, I've definitely struggled before with how to get people to 1)not worry about being blamed and 2)claim they won't repeat a mistake. This is totally actionable, thanks!

</comment><comment><USER9> If you are interested in the root of this methodology, consider reading Toyota Production System by Taiichi Ohno. Page 17 starts the discussion on how asking Why Five times is a method of determining root cause. This book isn't popular, but is worth your time.

[http://www.amazon.com/Toyota-Production-System-Beyond- Large-...](http://www.amazon.com/Toyota-Production-System-Beyond-Large- Scale/dp/0915299143)

</comment><comment><USER10> This is more a meta-comment about slideshare than about this presentation in particular. I really like being able to access the slides of talks I've seen, but for talks I haven't seen, there often is just enough that's missing from the slides that I don't get the full picture.

Does anybody have a solution to this?

Now, having said that, this particular slide deck suffers very little from this problem.

<comment><USER6> (author of slides here): I actually took the slides I presented, went back and interleaved simple bullet point slides covering what I talked about.

Because I have that same problem -- if someone has nice visual slides, the Slideshare is often kind of useless.

<comment><USER11> This is also good relationship advice. The slides, I mean, not putting bullets in things.

</comment></comment></comment><comment><USER7> This was my very favorite talk from the Lean Startup conference. I hope they put up the video as well, which was excellent.

</comment><comment><USER4> What if one's humor goes off wrong, which is often the case in these situations?

</comment><comment><USER12> Great talk from LS conference. Thanks for sharing.</comment>


Ask Successful People of HN: What influenced your personal growth the most? - <AUTHOR>

I want this directed at those that have a net worth of at least $3 million. While that's by no means a definition of success, my question is geared towards achieving financial freedom.
Assuming many of you were once at a stage where you knew little about starting a business, striking deals, and leading a team, what, in your opinion, are the most influential books, quotes, stories, etc, that contributed greatly to your development into a person fit for success?
Swombat wrote a comment here a few weeks ago in which he said "successful companies come out of successful people", and from that point on I've been thinking about how one would become a successful person, or in other words, how one would prepare oneself to increase the chances of being in a position to lead a successful business. I thought it'd be of great value to me and others here if we heard from financially successful people of this community on what they credit as being the main reasons that helped them grow into being "successful people".
Books, anecdotes, a mentor's advice on everything from personal improvement to business mechanics are welcome. <comment><USER3> Watching, learning and forever re-thinking.

I was at AOL from 1989 to 2001. When I started, there were 150 employees, and a month later, we had one of those "Look around you - everyone you don't see isn't here anymore" layoffs. When I left, there were 10,000 employees, not counting the 90K cable techs at Time Warner. In between, I learned more than any MBA course could teach, because I saw everything we did right - <USER2> everything we did wrong.

As time went on, I got to revisit our old mistakes in a new light. Business books are best read years after the fact, when you can see which predictions hit their mark and which were passing fads. A decade later, I'm still gaining new understandings into why we were bound to fail, business-wise, and what technical leaps we made that would still be useful today. (Hey, turns out multiplexed connections ARE more efficient! Hi, SPDY.)

There are three ways to understand what makes a city tick: Study its history, ask a realtor, or live there. When you live there, you have less formal, analytical knowledge, but you also have an intuitive sense of how things work. That intuition is gold.

So really, I'd just recommend getting a job someplace that grows into a multi- billion dollar global megacorporation - and keep notes. Hindsight is 20/20, and history repeats itself. That's a winning freaking formula right there.

Also, mail everyone CDs, and be sure to get Apple to pay you to develop a service and then pay you to discontinue it. Twice.

</comment><comment><USER4> Create wealth: <http://www.paulgraham.com/wealth.html></comment>


The Rise of Anti-Social A.k.a Private Networks - <AUTHOR> http://backroommag.netcurate.com/stories/the-rise-of-anti-social-a-k-a-private-networks

<comment><AUTHOR> Which is your preferred Private Social Network? Any particular reason for you to use it?</comment>


Ask HN: Did you know you can live with your head detached? - <AUTHOR>

I've just discovered that we can die (removing blood) and then come back to life (after pumping the blood back). I've lived until now not knowing this, it's like today I've discovered the world is spherical!
See video at 5:42 => http://www.youtube.com/watch?feature=player_embedded&v=Jq06D0xRWmc
See more about: http://techzwn.com/2011/08/the-soviet-zombie-experiments/ <comment><USER2> Sam Parnia – the man who could bring you back from the dead [http://www.guardian.co.uk/society/2013/apr/06/sam-parnia- res...](http://www.guardian.co.uk/society/2013/apr/06/sam-parnia-resurrection- lazarus-effect)

Related to death.

<comment><AUTHOR> interesting... thanks ^;)</comment></comment>


Silk Road Investigation: Criminal Charges Against Agents Reveal Corruption - <AUTHOR> http://www.forbes.com/sites/sarahjeong/2015/03/31/force-and-bridges/

<comment><USER2> tumble??</comment>


Getting Started with Webpack 2 - <AUTHOR> https://blog.madewithenvy.com/getting-started-with-webpack-2-ed2b86c68783#.diw20huhm <comment><USER2> Interestingly, things seem to be settling down in the JS community. In the past, every time a library lacked a particular feature, the community suddenly abandoned it. At the same time, every new version release had all sorts of horrible breaking changes, that made upgrading a very scary task.

Now, the JS community seems to be thinking more about stability and backwards compatibility. That's very welcome, at least from the perspective of this grumpy server-side developer.

<comment><USER3> I'm still skeptical. Webpack is one of the saner ones. Many JS libraries are still doing break-everything major version releases- Babel and Angular come to mind.

<comment><USER4> That's what a major version is supposed to signify though, isn't it? Most JS/NPM-based projects use semantic versioning, so a major version update means breaking/backwards-incompatible.

<comment><USER3> Even if it's communicated correctly, it's still a hassle.

<comment><USER4> Are you complaining that things get updated? You don't have to use the absolute latest versions of everything, you can still use older versions if you want.

<comment><USER5> Caring about upgrade paths is super important to the longevity of a project. See: Python 3 vs Ruby 2 adoption.

Taking the mentality that "I can break everything and just bump the major number" will lead to a project that either 1) is no longer is used by many people or 2) is a maintenance hell because people are staying on old versions and asking for bug fixes and improvements.

</comment></comment></comment></comment></comment></comment><comment><USER6> I currently use gulp and, over the yars, have found many ways to do my own parsing and smart caching and stuff over, like checking and bumping version numbers, conditional compiling, caching assets etc.

I'd hate to loose all that, but I do see the advantages of Webpack. How much control do I have with Webpack though? Can I still write my own hooks?

<comment><USER7> That's my concern as well, I use browserify and a simple bash script to do some clever stuff I couldn't reliably do with Grunt, I'd hate to lose the flexibility.

<comment><USER8> You won't lose any flexibility. See link above regarding plugins.

</comment></comment></comment><comment><USER9> What is the difference from Webpack 1? This tutorial seems identical to every other Webpack getting started I've read.

<comment><USER10> There's a list from the start of the year here:

[https://gist.github.com/sokra/27b24881210b56bbaff7](https://gist.github.com/sokra/27b24881210b56bbaff7)

<comment><USER11> Id recommend our newer upgrade guide. [https://webpack.js.org/how-to/upgrade- from-webpack-1/](https://webpack.js.org/how-to/upgrade-from-webpack-1/)

</comment></comment></comment><comment><USER12> We have experienced issues getting sourcemaps support to work in Webpack 2 and had to use Webpack 1 instead. Lack of sourcemaps is a deal killer for us and for any major application IMHO. Has anyone experienced the same and has this been resolved?

<comment><USER13> Which version of the beta? We're using beta 25 currently with babel and source map support.

</comment></comment><comment><USER14> Now that Webpack has tree shaking, are there still reasons to use Rollup?

<comment><USER15> Rollup's gains come mainly from the way it combines modules into a single scope, rather than wrapping them in functions and shipping a module loader with the bundle. It's not uncommon to see parse/evaluate time plummet when switching to Rollup because of this, which is often more important than the number of bytes.

However Rollup currently lacks a lot of features that make Webpack a good choice for large and complex apps.

You can get a feel for the code Rollup generates at [http://rollupjs.org](http://rollupjs.org).

<comment><USER16> Could you please expand on:

> it combines modules into a single scope, rather than wrapping them in > functions and shipping a module loader with the bundle

I'm really interested, I got into JS development this year and have no idea of the internals of bundlers/packagers.

</comment></comment></comment><comment><USER17> Semi-related: I also found it useful to name the config file webpack.config.babel.js instead of webpack.config.js so I can use ES6 in my Webpack config.

<comment><USER18> Also see interpret [1] which is used by Webpack internally (afaik). For instance, when you name you configuration webpack.config.ts it will be transpiled by TypeScript before being loaded.

[1] [https://www.npmjs.com/package/interpret](https://www.npmjs.com/package/interpret)

</comment></comment><comment><USER19> Webpack 2 is so awesome that I'm really confused why haven't they released it as a non-beta yet. It's way past MVP and has more than enough quality for a non-beta. It looks like the maintainers want it to get perfect and release it "when it's done", and that is so wrong.

<comment><USER11> I can understand your concerns but we made a promise early on that we wouldnt release v2 from beta until our MVP docs milestone is complete.

We are just around 90% completion ([http://github.com/webpack/webpack.js.org/milestone/1](http://github.com/webpack/webpack.js.org/milestone/1))

After that we will release v2. Help always wanted! <3

<comment><USER20> Can you please add some documentation for sourcemap and debugging to the doc?

WP 1's sourcemap doc is confusing as hell and WP 2's doc just copied that over. I imagine debugging un-transpiled code with sourcemap is one of the most common use-cases.

And I'm not alone if you look at the disqus of WP's doc[0] and a blog by @bebraw[1], one of the guys running webpack.js.org.

I even opened an issue[2], I hope it can make into your MVP.

[0]: [http://survivejs.com/webpack/developing-with- webpack/enablin...](http://survivejs.com/webpack/developing-with- webpack/enabling-sourcemaps/)

[1]: [https://webpack.github.io/docs/configuration.html](https://webpack.github.io/docs/configuration.html)

[2]: [https://github.com/webpack/webpack.js.org/issues/273](https://github.com/webpack/webpack.js.org/issues/273)

<comment><USER11> By all means we take PR's as well. Our MVP list is pretty set in stone and we don't want to extend our timeline. However simply by adding the issue to the new docs repo, I'll make sure the information will get prioritized for adding.

</comment></comment></comment></comment><comment><USER21> 1 point of minor interest is that they start by using Yarn, not NPM. Little things like that (esp from a major project like Webpack) can develop into definite trends.

<comment><USER14> I found the inclusion of Yarn in this tutorial to be misplaced. Adding another step to what is already considered a complex library feels unnecessary.

Maybe the author is trying to make Yarn a trend?

<comment><USER22> > Maybe the author is trying to make Yarn a trend?

The JavaScript community makes me a cranky old man, because yarn is even a very good idea and solves actual problems. Still that was the point in the article where I thought "fucking JS hipsters". No time to play with tooling, when there is actual work to do.

Especially with other people in your team, whose time costs actual money, I think standardization of dev environments and tools trumps almost every new feature (as long as you were using tools in the first place).

I have seen the talk (I believe it was from Instagram), which showed how Webpack could work with shared code and so on, but still: Browserify and Gulp were already working (and I believe can now do the same thing) and even Gulp has only very marginal benefits over Grunt in my opinion. I would love to go a few steps further back, but "installable via npm" is just a crushing argument against Makefiles.

<comment><USER23> Gulp and Grunt were essentially wrong. Using a task runner as an asset pipeline makes no sense. A lot of things, like doing incremental compilation of Sass takes 100+ lines of Gulp crap to do, while it's the default in webpack.

Browserify was nice for simple cases, but getting it to do what's needed in a large, real world application was really difficult. Lately it has a lot of those features, but when Webpack became popular, it just didn't.

I started using Webpack after doing a length cost/benefit analysis and settling on.....gulp + browserify, because WebPack looked too complicated and people in the team had experience with browserify. After a week of trying to get it to do what we needed, I tried WebPack again and did it in an afternoon. That's when we switched.

<comment> vladimir-y > Gulp and Grunt were essentially wrong.

They were not wrong, but they do a general automation (and sometimes it's needed), just a task runners and a wrong thing was to use them for web building automation collection scattered over the internet stuff together into the complex framework. So every team or project had own framework, which means no standard, and that's a bad thing. Webpack allows to defined a needed behavior in a kind of declarative way since it has a structure.

</comment></comment></comment></comment></comment><comment><USER24> Has anyone played with Bazel/Closure?

You get dependency management (resolution, pruning) for free from Closure and declarative build targets from Bazel. (Including dependencies on other targets, e.g. non-module-bundle.js)

To be fair, I don't think the (publicly) available rule set grants parity with webpack, but the syntax is a lot less gross and the concepts have been there from the start.

(Re gross: Instantiation in a config file?)

</comment><comment><USER25> I haven't even got started with Webpack 1 yet!</comment>


A first look at docker.io  - <AUTHOR> http://www.alexhudson.com/2013/05/28/a-first-look-at-docker-io/

<comment><USER2> > docker is just slightly further along the spectrum than Xen: instead of > using a special guest kernel, you use the host kernel. Instead of > paravirtualisation ops, you use a combination of cgroups and lxc containers. > Without the direct virtualisation of hardware devices, you don't need the > various special drivers to get performance, but there are also fewer > security guarantees.

No. People seem to be really confused about this. Docker is a _container standard_ , not a virtualization system. The thing you can download on the Docker website, besides being a toolchain for creating containers, is a _reference target_ for containers to deploy to, which just _happens_ to (currently!) use cgroups and lxc and aufs overlays.

The point of Docker is to create one thing (basically a container file format + some metadata stored in a "container registry") that you _can_ deploy to all sorts of different places, without changing what's inside it. In fact, one of the goals of Docker is precisely that the reference target (cgroups+lxc+aufs) could be entirely swapped out for something else in the next version of the Docker toolchain, and none of your containers would have to change.

Docker containers _will_ be deployable as Vagrant boxes, Xen VMs, AWS instances, whatever. Targets that have an overlay filesystem will use overlays; targets that don't will build a flattened filesystem image from the container stack. Targets that have paravirtualization will rely on their host kernel; targets that don't will rely on the kernel in the container's base image. And so forth. It isn't possible _yet_ , but that's the entire goal here.

<comment><USER3> (Disclaimer; I wrote the blog post a little while ago, and my thoughts on this have changed a little bit - surprised to see it pop up here...)

I think the confusion here is two-fold; sure, I think many don't really grasp what the point of the project is in its entirety, but I also think the aim of the project is a bit confused.

The comment I made that you're referring to was specifically about the runtime: that's the bit of the paragraph at the start you chopped out. Yes, the runtime could change in the future, but the comment was about the existing runtime.

The 'container standard' thing I think is potentially interesting, but actually, I don't think it buys much. As a set of tools, it is substantially weaker than the existing system development/spinning tools. And sure, getting rid of overlays might be possible - but then, what's the point? If you're going to flatten out trees, you may as well build the image properly in the first place.

<comment><USER2> The point of the layered containers has nothing to do with how they're run; it has to do with how they're developed. By splitting the OS from the runtime from the application, each one can be updated when the layer above it needs it to be, and is otherwise fixed to a binary-identical image. Then, new releases of higher-level things (apps) can target the _old_ versions of lower-level things (runtimes, OSes), knowing they will be _literally_ , bit-for-bit, the same thing their other releases are using.

This is the guarantee Heroku makes, for example: updates to their servers will never break your app, because although the packages making up their _infrastructure_ might update, the packages making up _your container 's base image_ are frozen in time unless _you_ switch out your container's "stack" (base image) for a new one.

Having a frozen base OS image, and then a frozen runtime on top of that, allows for perfect _repeatability_ in your deploy process. Once you've got a tested-and-working runtime image, that references a tested-and-working OS image, you just stop touching them altogether; you keep the container-ID of that runtime image fixed in production, and deploy your new app releases on top of it.

One neat side-effect of this: if containers have parent-images in common, those parent-images can be _cached_ at the target. If all the containers running on some server use the same common base-image, that base image only needs to be downloaded to the server once. The second-through-Nth time, the container only grabs what's different--the tiny "app" part of the image--and then composes it with everything into a running container.

<comment><USER3> I disagree entirely, tbh, the only advantage of layering I see is precisely in the runtime: it makes the layers that change most very slim and easily deployable.

Repeatability is great, but who doesn't have that already? Are people really building new OS images for every deploy? I don't believe that for a second, and I can't think of many tools off the top of my head that don't have that baked in right from the start. That's the whole point of package management.

<comment><USER2> Package management is entirely _non_ -repeatable in almost every incarnation. DEB, RPM, even Slackware tarballs, all run scripts on install. There are shunts of existing files and directories, interactive prompts, EULAs to agree to (try installing mscorefonts on Ubuntu), packages that immediately start services that generate files on first run that the service expects to be there from then on, packages that expect other packages to _not_ have been installed (samba3 doesn't like samba4 much)--and so forth. Installing a package _can fail_ , or produce widely-varying results from machine to machine.

"Configuration management", ala Chef/Puppet, is no better--it tries to manipulate a system from an _unknown_ state into a _known_ state, without having an awareness of the full set of interactions that the _unknown_ state can have on the _known_ state. (For example, deploy Apache with default setup via Chef, on a server that already had Nginx installed manually. What do you get? Who knows!)

You'd think that, say, running the OS install media from scratch on each "container-up", and then running a script to install a preset list of packages with hardcoded versions, might be enough--but nope, OS install media is absolutely non-deterministic, just like everything else. The installer could decide from the container's IP address that it should talk to a different package server (oh hey I'm in Canada let's use ca.archive.ubuntu.com!) and then find itself unable to get past the deploy-infrastructure's firewall- whitelist.

In short--anything that relies upon, or can make a decision based upon, information that could be different from container to container (like the container's IP address, for example) _isn 't guaranteed_ to produce binary- identical results at the target. You _only_ get that by running through whatever imperative process spits out all these files _once_ \--and then freezing the results into a _declarative_ container.

So, what does work? Xen snapshots. Amazon AMIs. Vagrant images. All of these are declarative. And all of these _are target formats_ for Docker. Docker is a vendor-neutral thing which you will _turn into these_ , along with turning it into its current LXC+aufs form.

And note, by design, the running images of the "final product" will be leaf- nodes; you won't touch them or modify them or SSH into them, you won't base new containers on them; you'll just spin them up and then down again, like on- demand EC2 instances. Docker is not _for_ doing fancy things with the running final products in their target format. Docker, by itself, is _not for production at all!_ Once you've deployed a Docker container as a Xen snapshot or an AMI or whatever, it's done; some other infrastructure takes care of the _running the target-format containers_ part.

So what's all that junk in the Docker toolchain? Docker, as a standard, is an _intermediary format_ that makes it easy for _developers_ to build these vendor-neutral images. The reason you can start containers, stop them, freeze them, and then fork new containers from them, is entirely to do with _developing new container images_ , and not at all to do with deploying containers in production. It's about re-using common parent images, by reference, as easily as we currently stick a Github repo in our Gemfiles.

<comment><USER4> > Docker is not for doing fancy things with the running final products in > their target format. Docker, by itself, is not for production at all! Once > you've deployed a Docker container as a Xen snapshot or an AMI or whatever, > it's done; some other infrastructure takes care of the running the target- > format containers part.

This is something very interesting and under-communicated. I've always assumed docker is run on the production server and is used to pull updated images and spawn containers. But you're suggesting one uses custom toolchain for making an image out of the container filesystem and the LXC template, and then deploy this container?

<comment><USER5> Both are possible. And since docker itself is not yet production-ready, exporting docker containers to "inert" server images (for example AMIs) is a good stopgap which allows you to use docker for dev and test.

But that is not the ideal workflow. The ideal workflow is to run docker on all your machines, from development to production, and move containers across them. If you don't do that, you will miss out on a big part of the value of docker. To name a few: identical images in dev and prod; lightweight deployment; and a toolchain that is less dependent on a particular infrastructure.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Ever since I first read about docker I wondered: How are you dealing with application data and updates of containers? Let's say you package everything you need for your web application together as one container: Web Server, Database-Server and Application Server: Where would the data go that the users of that web applications generate?

In the container? That would means that the data goes away as the container gets updated (if you just replace the old container with a new one). Or do you just never replace the whole container but just update what's inside? Or would you mount a device of the host? Does the container get access to device nodes of the parent? I would assume not. Or can you provide a container with something it can mount? Or are you stuck with some network based storage solution? That would rule out running databases in containers once the load raises.

Yes. I could just read up on all of this, but I have a feeling that other people have the same question, so by asking here, I might help them too.

<comment><USER7> I think this issue somewhat compromises Dockerfiles as a means of distributing applications. With a VM, you can supply something in a minimally configured, plug-and-play state, and then leave it to the user to set it up. With Docker, it's a little bit too painful to configure things after running an image. I'm not sure what the answer to this is.

<comment><USER8> Which is it: Minimally configured, or plug-and-play?

Either you'll be setting up your containers to prepare you to use something like Chef or Puppet against the, or you'll be setting up your containers to be fully configured apart from connection details to other components.

That last bit is down to service orchestration, which is outside the scope of Docker as far as I understand it. You can "roll your own" easily enough: Write a "/usr/local/bin/add-relation" script that takes a function and a list of arguments to configure that function.

Write a script that reads a config file that defines the relationships between container types (e.g. your MySQL container and your Web container), and triggers execution of those add-relation scripts. E.g. your Web container gets called with "add-relation Mysql --ip [foo] --username [bar] --password [baz]" and the version of the script in that container knows how to add users to MySQL.

That is _very roughly_ the approach that Juju (Ubuntu's orchestration system) takes.

The point is to split all configuration details into thress classes: Those that can be set statically on build. Those that can be decided on first boot (e.g. re-generate a ssh-host-key, get IP address etc.). And finally those that needs to be set dynamically based on what other containers are spun up.

The latter has no place in the Dockerfiles or images, but scripts or tools to set these config details based on input from some external source, does.

It may sound painful, but only if you do it to a handful of vm's that rarely change. The moment you need to manage dozens, or need to spin vm's up and down regularly, taking the effort to set up proper orchestration, whichever method you prefers, wins hands down to having a user set it up (I can guarantee with near 100% certainty that said user will not set them up different VMs consistently).

</comment></comment></comment><comment><USER9> I'm quite excited seeing the open source community putting so much work into Linux containers. For the most part they're a lot better than true virtualization. We've seen it in the past, what you guys can do with Puppet as a configuration system.

I just wish lxc was as secure as Solaris zones. Since containers are not secure at all, they definitely won't be used for shared hosting. The team seems to be working on it, but it will probably take a few years to get it secure enough:

[https://wiki.ubuntu.com/LxcSecurity](https://wiki.ubuntu.com/LxcSecurity)

<comment><USER10> > Since containers are not secure at all

I feel like you're just spreading FUD here. This was definitely true a few years ago, but "Citation Needed" applies. The worst thing I found in the article you linked is that guests use the same kernel as the host, so if the host kernel is vulnerable, it will still be vulnerable from the guest...

Then it goes on to say "we have seccomp2 to lower the dimensions of attack surface." It does not sound to me like your citation agrees with what you said at all.

I just hope you've read the top-rated comment, where it's explained that containers are not virtualization, and they solve different problems.

<comment><USER9> IF you have root on the container, you have root on the host. This is a HUGE difference and probably one of the main reasons LXC isn't in huge use for VPS.

This is, btw, different than Solaris Zones, which give you a complete new user management for each container. They're very isolated. Zones have had some exploits to get out of the Zone, but they're pretty secure. LXC has started moving towards a more secure design but it will take years (IMO) to get LXC actually in production for _shared_ hosting.

See:

[https://www.suse.com/documentation/sles11/singlehtml/lxc_qui...](https://www.suse.com/documentation/sles11/singlehtml/lxc_quickstart/lxc_quickstart.html)

 _Security depends on the host system. LXC is not secure. If you need a secure system, use KVM._

[http://www.funtoo.org/Linux_Containers](http://www.funtoo.org/Linux_Containers)

 _As of Linux kernel 3.1.5, LXC is usable for isolating your own private workloads from one another. It is not yet ready to isolate potentially malicious users from one another or the host system. For a more mature containers solution that is appropriate for hosting environments, see OpenVZ._

[http://lwn.net/Articles/515034/](http://lwn.net/Articles/515034/)

 _" Containers are not for security", he said, because root inside the container can always escape, so the container gets wrapped in SELinux to restrict it_ ... _A number of steps have been taken to try to prevent root from breaking out of the container, but there is more to be done. Both mount and mknod will fail inside the container for example. These containers are not as secure as full virtualization, Walsh said, but they are much easier to manage than handling the multiple full operating systems that virtualization requires. For many use cases, secure containers may be the right fit._

<comment><USER11> Sorry, but this is FUD:

> IF you have root on the container, you have root on the host.

This is only true on badly configured systems. If you run some kind of public shared hosting (like Heroku, dotCloud, etc.) you probably slap some extra security on top of it. For instance, dotCloud uses GRSEC, limits root access, and uses kernel capabilities.

It won't take years to get LXC in production for shared hosting: it has been in production for shared hosting for years -- but by people who (more or less) knew what they were doing.

Agreed, "out-of-the-box LXC" is probably not that secure; which is probably why many people won't deploy it. And I can't blame them. Any technology generally starts being usable (or usable safely) only for expert users, then progressively gets more industrialized and ready to use for a broader audience. It doesn't mean that the technology is not mature.

Also, the user separation that you mention has been implemented in the Linux kernel for a while[1]; it's called "user namespace", and even if the default LXC userland tools do not make use of it at this point, it's here.

[1] [https://wiki.ubuntu.com/UserNamespace](https://wiki.ubuntu.com/UserNamespace)

<comment><USER9> I do know those things. It doesn't change the fact that you can _easily_ break out of a Container and compromise neighboring Containers. No matter how much to harden the system you implement.

Who is using LXC in a _shared_ hosting environment?

</comment></comment></comment></comment></comment><comment><USER12> What makes me excited about Docker's diff-based filesystem stack is that it potentially allows a build of code to go through a CI chain untouched, all the way into production really quickly. I'm not a virtual machine expert, but I believe this is slower in traditional virtualization like Vagrant for example. Am I far off? At work we're using layered AMI build tools to roll new services and app builds into production, and the process is not quick.

<comment><USER5> You hit the nail on the head. That is a major promise of Docker, and the reason we are emphasizing Dockerfiles so much. It makes the act of building your code 100% automated and discoverable, and the resulting build should be usable, unchanged, all the way from development to production.

</comment></comment><comment><USER13> > given the claims on the website I assumed there was something slightly more > clever going on, but the only "special sauce" is the use of aufs to layer > one file system upon another.

There's also the network stuff? From docker's website, a simple "docker run ubuntu /bin/echo hello world" does the following:

        It downloaded the base image from the docker index
        it created a new LXC container
        It allocated a filesystem for it
        Mounted a read-write layer
        Allocated a network interface
        Setup an IP for it, with network address translation
        And then executed a process in there
        Captured its output and printed it to you

</comment><comment><USER14> What is the recommended workflow for using docker?

Say I have:

* a base Ubuntu container with a few utilities installed like htop and my user account * a base Python web container with Nginx and libxml, libjpeg, etc * a specific Python web app

If I update my app should I save the container state and push it to all my web servers or use something like fabric to update the app on all my app servers?

If Nginx has a security release and I update my base Python web container, do I now need to rebuild all my Python web containers or is there some way to merge?

When the next LTS release of Ubuntu comes out and I upgrade, do I have to manually apply that to every container or just the base?

</comment><comment><USER15> Serious question. I've been looking at docker today and I can't seem to grasp why would I use docker for dev and deployment over something like ansible also both for dev (on VM) and deployment. I must be missing something. I now understand vagrant somewhat that it alleviates manual hurdle of VM starting and running, but not enough for me to use it.. yet I don't see where and how docker fits in. Would I be wrong if I thought of it more as a virtualenv(wrapper) but not only for python?

<comment><USER16> Read this comment: [https://news.ycombinator.com/item?id=6178526](https://news.ycombinator.com/item?id=6178526)

</comment></comment><comment><USER17> Thanks for the article. While I disagree with your conclusion, getting a clear view of the the misconceptions that exist allow for more pointed documentation and focus.

</comment><comment><USER18> [http://www.readability.com/read?url=http%3A//www.alexhudson....](http://www.readability.com/read?url=http%3A//www.alexhudson.com/2013/05/28/a-first- look-at-docker-io/)

Just a better way to read the article.

<comment><USER3> I'll update my theme, thanks :-P

<comment><USER18> Anyways is there any option to grant external ftp access to docker instances? I was wondering if I can move my multiplayer games instances to docker and allow my users to still connect to ftp.</comment></comment></comment>


LinkedIn: The Creepiest Social Network - <AUTHOR> http://www.interactually.com/linkedin-creepiest-social-network/ <comment><USER2> There's a more benign answer to the creepy connection suggestions. LOTS of people import their email address books into linkedin. It's not a stretch to think that his girlfriend's mother (or some other relative) imported her address book that contained the names of both the OP and the girlfriend's stepfather.

As far as the creepier name mismatches go, my oldest email address list has tons of maiden names and unused/defunct email addresses. It's likely that some high school friend of the OP uploaded an old address book and LinkedIn's algorithm made a best effort match on some of the rarer names even if the email addresses don't match. I mean, how many Lucy Hatsbaughs do you think there are on linked in? Two? LinkedIn may as well gamble on odds like that.

<comment><USER3> I didn't import anything to LinkedIn. One person showed up on mine who could _only_ have come from either my Twitter account or G+ account, both of which have been deleted.

Yes, it was a hot chick I was creepily cyber stalking. Like you haven't ever.

<comment><USER4> So you and the person it suggested to you don't know anyone in common that might have uploaded _their_ address book?

<comment><USER3> I guess that's possible, but unlikely. I'm looking at it now, she's still there and so is a girl I had a crush on in junior high. This is fascinating but extremely disturbing, I'm deleting this thing asap. I figure I must have googled her and found her LinkedIn page while signed in, it could have been years ago. In fact that's got to be the explanation for both of them unless they did something extremely unethical with the email address I gave them.

</comment></comment></comment></comment><comment><USER5> I finally joined linkedin about a week ago, and it just feels...scammy.

It's interesting to me (or frightening) that some of the smartest people I know have the fewest endorsements. People I know doing [1] _actual real work_ on things like "microcontrollers" have...3-4 endorsements with them, but people who I _know_ have only maybe _installed_ Linux, have 20 or so endorsements for "linux".

There are people I know who are post-graduate level experts on certain fields, and those fields are either not listed at all, or they have maybe 1 or 2 endorsements for it.

Stupid.

I'll keep just linking people to my github, and showing them projects I've built.

[1]: Actual real work as in: writing libraries that other people use. Contributing to the community in ways that effect _the entire_ community.

<comment><USER6> The endorsements on LinkedIn are useless. LinkedIn suggests things like "Endorse [So and So] for [some thing]," and people just click the "endorse" button.

People that know nothing about technology have endorsed me for skills I don't have.

<comment><USER7> Agreed. Endorsements are largely a popularity contest. Sure, it is great that your connect [name] endorsed you for [skill]... That is helpful to know in some ways, but it is no way definitive on your ability.

We're working on a system we think is slight better, based on getting credit for what you read, and hopefully one day what you know.

<comment><USER8> > Endorsements are largely a popularity contest.

That's the way I've been looking at the entire web these days - and not just social media. The Google page ranking algorithm really boils down to a (potentially high stakes) popularity contest.

<comment><USER9> Not just the web though - our entire political system is one great big popularity contest.

<comment><USER8> Ha ha, I get your point.

There are SEO tea leaf readers who think Google+ plays an increasing role in search rankings. It's probably just speculation coupled with coincidence, but as I was reading some articles on this last week, I was reminded of the Googler that wrote about why he was not going to his high school reunion. It wasn't just sad - it made me angry that adults condoned the activity. I was struck by the irony that this Googler had escaped the high school social pressure cooker, only to go on to work for a company that has engineered the world's biggest popularity contest.

</comment></comment></comment></comment></comment></comment><comment><USER10> Facebook does the same thing and it's just as creepy.

I closed my "real" account around 2011. A few months back I created a new blank account because I needed access to a couple organization's pages. The only information on that account is my name (a fairly common one) and an email address which is different from the one on my original account. It's possible they have some geographic info linking the two accounts as I closed and opened them from the same city.

90% of the "people you may know" are correct and from dramatically different social groups. Some how it's picked out a girl I did a family stay with in Germany in '04, a fourth cousin I'm only vaguely aware of, current friends from several groups, and high school friends I haven't talked to in 10 years.

<comment><USER11> I set up a test Facebook account while doing a Facebook app that uses an e-mail address that has _never_ been used for anything else.

Yet it keeps suggesting people I actually know.

The second account also does not have my full name (if it had my full name it'd be less weird, as my name to my knowledge is globally unique - there's only a few hundred people with my last name worldwide)

The account has not been used for anything related to me. I've never searched for anyone from it. Never given my e-mail address there...

The only thing connecting the two is that the "fake" e-mail address is a "firstname.lastname@example.com" address, and that I've logged in to them from the same machine.

It took less than a day before that account started getting friend requests from people I know (clearly the "TEST" instead of my surname did nothing to dissuade them)

<comment><USER12> > The only thing connecting the two is that the "fake" e-mail address is a > "firstname.lastname@example.com" address, and that I've logged in to > them from the same machine.

So, to summarize, a simple regular expression matching emails against /\\+[^@]+/ and replacing with '' is some 1984-level creepiness?

Come on.

<comment><USER13> The technology to do any of those is little more than a few database joins and some fuzzier matching logic like you are suggesting. What's creepy is just the extent to which they match. In the email contacts theory, for example, it's not hard to remember an email address that was in a user's contacts list and then suggest they connect when that email address is used. It's only creepy because you personally had no control over giving them the information that allows them to make that leap.

</comment></comment></comment></comment><comment><USER14> Here are some things I find more creepy about LinkedIn:

-It tells people when I view their profile. So now I _never_ view people's profiles because I don't want to look like a stalker. Imagine if Facebook worked this way.

-An andecdote, but maybe you've experienced it: a guy I worked with about 3 years ago (and only for 2 weeks) has "endorsed" me several times recently. I don't know if this is some kind of quid pro quo, but it makes me somewhat uncomfortable.

<comment><USER4> You can turn off your visibility when browsing other people's profiles. By default, it should be anonymized anyway, unless you switched it when trying to view profile stats __:

[https://www.linkedin.com/settings/wvmp- visibility?goback=%2E...](https://www.linkedin.com/settings/wvmp- visibility?goback=%2Enas_*1_*1_*1)

Personally I keep mine fully on since it is a good way of passive contact (I once browsed ~1000 VCs with a headline that was somewhat provocative as an experiment and about half looked at my profile back and 6 of them emailed me asking what I was working on).

 __Note: I actually designed this feature at LinkedIn after doing a ton of interviews with people and going to multiple privacy organizations and the EU to make sure it wasn't violating anyone's privacy by making it a tit-for-tat system that was by default anonymized (if you click on profile stats, it prompts you to switch your setting if you want to see who has viewed your profile (or did when I was there)).

<comment><USER15> Premium accounts still see it, though.

<comment><USER16> LI employee here. That's actually not correct. Premium accounts do not still see anonymous viewers.

<comment><USER15> I'm not sure exactly which accounts premium accounts _can_ see have viewed their profile, but pretty sure all free accounts are included. Will get someone who has setting on anonymous to view my profile later and check, but for now there's only a couple of hidden names on there, looks like people who are more than 3 degrees away.

</comment></comment></comment></comment></comment><comment><USER17> It's not the creepiness that's relevant here. That's rather subjective, and as others have pointed out, all social networks do the same.

What's most relevant here is that it's downright illegal in most Western countries LinkedIn e.a. operate in. Both collecting this information and sharing it without explicit (as in: not just default checked boxes) informed (as in: information about why, what and shared with whom) consent is not just unethical, it's a violation of most known privacy laws.

The widespread practice of blatantly unethical business practices in our industry by both high profile companies and small start-ups alike is something we as professionals should take more seriously.

If we don't, it doesn't only harm the image of our industry, but we'll be faced with ever more regulatory hurdles. The infamous EU cookie law is just the beginning if we don't act to clean up our own industry.

Every second web company seems to have a business model that directly or indirectly generates revenue through stalking people on a massive scale. This cannot possible be sustainable without a huge backlash.

</comment><comment><USER18> I just did a test and opened LinkedIn and took a look at the suggested people.

They included: Several people with the same name as I (expected, not really creepy). But also: People that I trained martial arts with, and I NEVER exchanged electronic messages with them, and I do not talk with them for 4 years now. Also I doubt they remember me to search me, I am not much remarkable. People that I met at school and church 6, 7 years ago, and that again, I never exchanged electronic messages with them.

Yes, LinkedIn is very, very, very creepy.

<comment><USER19> I am curious why this is supposedly _creepy_. I think the main premise of a social network is that you reach out or get reached out to people who might know you or you might know. Now, you have the option of not reaching out to those people, and I think it is fair game that the social network assumes that other members might reach out to you, a member of the network.

If you do not like that aspect of the social network, do not join it.

<comment><USER20> Educated guesses are one thing; exact "guesses" are quite another, and one has to wonder where the 'guessing' is pulling its data.

Would it creep you out if I guess which month you were born in? Probably not.

Would it creep you out if I guessed your exact birthday, including month/day/year? Hell yeah it would.

It has nothing to do with whether or not one wants to be social, and everything to do with random, axe-murderer creepiness. Imagine if I walked up to you at a party and rattled off names of 5 random people from different aspects of your life; would that not freak you out? "Oh, you don't know me, but I know _you_ ;)". That's virtually the same thing that is happening here.

</comment></comment></comment><comment><USER21> I always assumed the suggestions were from other people importing their Twitters and email contacts. So if person A emails me and then imports their emails, Linkedin can suggest to both of us that we might know each other, increasing the chance of creating a connection (and creepy-ness factor for me).

<comment><USER22> I'm pretty sure that's the case. I got suggestions for 2 people I played WoW with and the only ways we communicated were in-game chat, voice chat, and we had a single e-mail chain where we (the officers) talked about....something, I forget what. I'm guessing one of them imported their mail contacts because I doubt LinkedIn has visibility into Blizzard's social network or private voice chat servers.

I think the creepy part about LinkedIn is you can actually see who views who. If Facebook did that it would be very embarrassing for a lot of people.

<comment><USER9> "I think the creepy part about LinkedIn is you can actually see who views who."

Is it any creepier than being able to stalk some stranger's Facebook profile anonymously?

</comment></comment></comment><comment><USER23> No creepier than other social networking sites.

I find it interesting that it has automated what some folks have done on their own for years. There was a woman at Netapp who managed these sorts of potential and known relationships in her head about the folks working at a couple of big Netapp customers.

I guess what I find amusing is that it is was my experience when introducing myself to someone new at a social event and saying "I work at <company>" or "Yeah, I grew up in Las Vegas" or something along those lines I would often get "Really, I knew this person <name> who worked/lived there, did you know them?" as social banter. It didn't creep me out then either, but I'm sure that for some folks it does.

</comment><comment><USER24> Yes, I also noted the creepiness of "viewers of the profile also viewed."

<https://twitter.com/joelandren/status/251417778643406848>

If I were a woman, I would be turned off to see something like this.

<comment><USER25> I'm not sure how much one should read into that. I mean, ok, there are probably _some_ guys (and some women, as far as that goes) who click on profiles solely due to the attractiveness of the picture. BUT... there are other reasonable reasons to explain a picture like shown above. For example, note that all of the people listed appear to work in related domains (marketing, event management of some sort). Given the nature of linkedin (business networking, with a heavy emphasis on recruiting) it makes sense that somebody looking to, say, poach an event planner or marketing person, would look at those profiles. And, from what I've seen, those are a couple of domains where women are heavily represented. Recruiting is another one.

Anyway, just as a little anecdotal test, I just logged into LinkedIn and looked at two profiles, both attractive women, where one is a recruiter and the other is a developer. In the recruiter case, every single entry in the "people also viewed" list was female (and also a recruiter), in the case of the developer they were almost completely male (with two exceptions) and are either developers or work for the same company.

I don't know... _maybe_ this is indicative of something that should be considered "creepy" but I have my doubts.

<comment><USER26> Further, there tends to be a high correlation between someone's success in a field such as marketing and recruiting, and their appearance. I don't want to generalize too much, but most recruiter emails I get are from very attractive women, and I have a feeling that's not unintentional, as gross as that sounds.

<comment><USER25> Yeah. I guess it says something about society, human nature, etc., but I think you're right. Heck, I can't even remember ever meeting a female recruiter who wasn't _at least_ moderately attractive. And most of the women I've met, who were recruiters, are what I'd describe as flat-out "gorgeous" or "beautiful".

So... are attractive women particularly drawn to recruiting for some reason, or is physical appearance a hiring criteria for recruiting companies? Both? Neither?

<comment><USER27> I know a woman who was thinking of joining tech recruiting, and she asked me about it. She went for an interview, and most of the to-be co-workers were young women, and also attractive. It seemed like one of the requirements though it wasn't explicitly stated.

She was interested in it primarily for the pay; they were promising something like 45-60k a year, and her current position was only around $30k. You start off as a recruiter, and then you move up into account management, which is better pay and a larger budget for wining and dining clients.

</comment></comment></comment></comment></comment><comment><USER13> I've had the same experience. Register on LinkedIn, log in, "Would you like to connect with <screwed up relationship from years ago>?" We hadn't spoken in years or connected on any other site, I could only come up with one thing: she emailed me once. I bet she gave LinkedIn her email credentials to find connections. I hate that feature.

<comment><USER28> I was thinking the exact same thing. It's funny that he wrote that entire post and never raised the possibility of OTHER people sharing their contacts with LinkedIn, and that may explain at least some of the "people you may know."

<comment><AUTHOR> You're right, I hadn't thought about that. The first person that commented on the blog pointed it out. You're also right, however, that it only explains _some_ of the suggestions they made. It still doesn't explain some of the others, and they still don't make any mention of that in their Help page explaining where they get the data from.

</comment></comment></comment><comment><USER29> For a while, Linked in was present a password input box that looked like "You failed to login, try again" at a glance, but in reality it was asking for your email address and password. From that point, they could read your email and extract all your contacts.

</comment><comment><USER30> The site is down for me. Here is the cached version: [http://webcache.googleusercontent.com/search?biw=1436&bi...](http://webcache.googleusercontent.com/search?biw=1436&bih=806&sclient=psy- ab&q=cache%3Ahttp%3A%2F%2Fwww.interactually.com%2Flinkedin-creepiest-social- network%2F&oq=cache%3Ahttp%3A%2F%2Fwww.interactually.com%2Flinkedin-creepiest- social- network%2F&gs_l=serp.3...12288.12981.1.13522.214.171.124.0.0.0.101.436.4j1.5.0...0.1...1c.1.12.psy- ab.bV51ytimoPc&pbx=1)

Update: Creepy. But I think most of this data can be lifted from other users who imported contacts from GMail. I think they must be matching only by name, because people could have been in touch with different mail addresses (at a previous employer, for instance).

<comment><AUTHOR> Sorry about that, I didn't expect the response the article got, should be resolved now. And thanks for posting the cached version!

</comment></comment><comment><USER31> On a throw away account.

Several people have hit upon the major method LinkedIn uses which is that someone you know who has your name/email/... (or likely many someones) uploaded an address book to LinkedIn. LinkedIn then infers that because that person knows you, that you may know the other people they know (which is often true). They then combine that when a bunch of far more complicated inferences to generate the list.

The goal of course is to provide suggestions to someone who just signed up. Sadly, the reason it feels creepy is because it seems like voodoo. They could do a better job explaining how it worked, but a lot of the bigger inferences are secret sauce.

</comment><comment><USER32> To me LinkedIn is basically a bunch of people circle jerking each other. Professionally.

<comment><USER33> _To me LinkedIn is basically a bunch of people circle jerking each other. Professionally._

Endorsed: Product Knowledge.

</comment></comment><comment><USER34> I think we all don't want to admit that we look up ex-girlfriends, neighbors, college roommates, etc. when we're on these social networks and we're bored (or lonely).

I searched for an ex once on LinkedIn and found nothing...until a year later when she finally signed on and there she was in my "you might know" suggestion list.

</comment><comment><USER35> LinkedIn recently suggested my neighbor from 1995. I didn't even have Internet access, let alone an email address back then. I haven't had any contact with this person since.

<comment><USER36> My guess is the neighbor put your name in LinkedIn's search box.

<comment><USER37> That or they have information on where you and your neighbor once lived. I have signed up for a couple of online brokerage accounts where they ask me questions about where I or my family have lived in the past.

I got questions like; "At which of these 5 addresses has $BROTHER ever lived before?" And one of them was correct.

<comment><USER38> I've had similar questions when opening online accounts before, I believe that information comes from your credit report.

</comment></comment></comment></comment><comment><USER39> I did the "attractive women" thing (took a hit for the team, for science) and that was absolutely true. The odd thing was, the first random girl I clicked on was this girl I kinda had a crush on in college (all my "People you may know" recommendations were from college, even as I'm three years out) who happened to be Asian. Then...all of the "Also Viewed" were fairly attractive, well-groomed Asian women. Isn't that interesting? I thought at the very least it would break me out of race, but apparently they're their own class.

The other thing I'll say is perhaps this author is tapped out of "People you may know" and LinkedIn is simply guessing . Mine looks fairly reasonable, random, and not like they were digging particularly deep.

</comment><comment><USER40> Google cache: [http://webcache.googleusercontent.com/search?q=cache%3Awww.i...](http://webcache.googleusercontent.com/search?q=cache%3Awww.interactually.com%2Flinkedin- creepiest-social-network%2F&aq=f&oq=cache%3Awww.interactually.com%2Flinkedin- creepiest-social- network%2F&aqs=chrome.0.57j58j60.2709j0&sourceid=chrome&ie=UTF-8)

</comment><comment><USER41> I routinely get suggested to connect with people I've never even emailed or who used email account I closed a decade ago.

It's reasons like this I wish someone would do a Public/Private key based p2p social network. Essentially you digitally sign a key that you know someone and that's how you derive connections. Seems like you could implement browsable profiles as well.

<comment><USER42> Its a great idea, but I think everyone who has had it is stopped when they look at just how unwilling people are to exchange keys (or understand them) and how unwilling browser companies are to put effort into interfaces for managing keys (both of these obviously feed into each other).

<comment><USER43> The type of user who uses public keys usually knows better than to use server- side key management on a social networking site (however pretty the interface may be.)

<comment><USER42> Oh definitely, that's why I highlighted the lack of innovation in browsers for handling keys and encryption/decryption. This all needs to happen locally (not the trendy thing these days) and the current tools aren't at the level where that's going to happen at a large scale.

There would still be the key-exchange problem (I can't imagine a system that would make it easy for non-technical people to exchange keys out of band, even if you could explain why that was necessary and what it means), but with good browser tools I bet the number of zero-knowledge type sites/p2p networks would explode.

<comment><USER41> I think if you take away the need to it to be really truly secure it's workable. Social profiles aren't nuclear secrets, they are just posts about topics and pictures. I think if you embed the private key with a symmetric key password that would be good enough. I do wonder why that hasn't been done especially in the era of native mobile apps.

</comment></comment></comment></comment></comment><comment> jack-r-abbit The OP site is down so I don't know what they are citing as "creepy"... but I never considered LinkedIn to be a _social_ network. It has always just been a _professional_ network. It is my always on, mostly up to date resume. It has the who/what/where/when of my employment history. I have only accepted connections from people that I have worked with (and even then only those I actually worked with... not just anyone that worked at the same company but does not actually know me in some way) or friends that are in similar fields (and the rare cases of recruiters I've dealt with regarding employment). It actually bothers me that people use it to post twitter/facebook style status updates. LinkedIn is the last place I would think to read about someone's breakfast choice... but I've seen those updates before.

<comment><AUTHOR> Sorry about the crash, its back up now!

</comment></comment><comment><USER44> I'm usually pretty careful about picking technologies and websites to use. I've steered clear of linkedin and as time goes on, I'm pretty happy with that decision.

</comment><comment><USER45> LinkedIn leaks privacy information through their "also viewed" section.

Applied to a new job and started working there, after a few months I decided to look up my managers LinkedIn profile, only to notice that on his page the "also viewed" section showed employees from my older company and family. So yeah, so now I know he was trying to figure out more about me through LinkedIn.

<comment><USER46> I'm not sure this is a bad thing. In your example isn't a good thing to know your new boss did this?

Social networks encourage creepy behavior amongst their users. LinkedIn lets you know who viewed your profile while Facebook doesn't. Personally I'd rather know.

<comment><USER45> Not a bad thing for me no.. this time!

I don't think anyone is giving explicit permission to let the world know they have been snooping around other people's profiles. Although this information is not directly published it leaks through their "features".

</comment></comment></comment><comment><USER47> Eh, LinkedIn says that there are other people that work for my company that I might know. The only problem is, I'm an officer of my company, I know everyone who works there and they're all on my Linkedin. The people its suggesting, work for a similarly named company, about 1000 miles away... Score 1 for accuracy...

</comment><comment><USER48> I don't like LinkedIn for similar reasons but I somehow feel I will offend people if I drop out, and I have had some decent leads from it over the years.

The import contacts feature is particularly nefarious, it says "import" but it actually keeps checking down the track (or at least it used to work like that).

</comment><comment><USER49> How was Doug connected ? Doug while only communicating with you via email imported his contacts. His contacts include you. There's the connection. Works similarly on FB. When that business associate imports contacts aka connections, they find you on the other side :) It's really that simple

</comment><comment><USER50> funny this should come up today. the girl i am currently dating happens to be both attractive and asian. i was on her linkedin yesterday and noticed that the "people also viewed" widget was 100% other young, good-looking asian women. so, add race as a vector to the linkedin creep graph...

<comment><AUTHOR> I'm glad I wasn't the only one who noticed that. I was admittedly hesitant to add that part to the story.

</comment></comment><comment><USER51> Looks like his site was taken down or something. Its redirecting to the wordpress setup page.

<comment><AUTHOR> Back up now, server couldn't handle all the database requests.

</comment></comment><comment><USER52> I see LinkedIn as something akin to going to networking events. They really really want you to network, and they make some reasonable assumptions about your inhibitions. That's what their paying customers are there for.

</comment><comment><USER53> Redirected to your install.php file at this URL:

[http://www.interactually.com/linkedin-creepiest-social- netwo...](http://www.interactually.com/linkedin-creepiest-social-network/wp- admin/install.php)

</comment><comment><USER54> probably worth pointing out that LI doesn't have ads and makes its money from subscribers, most of whom i'm guessing are sales/recruiting.

from a pure-business-no-ethics perspective, why would you care what anyone else thought? w/ that point of view: every connection or link, however creepy, makes the system as whole more valuable to subscribers.

personally, the feature doesn't have enough churn, so i always see the same 5 faces, 99% of the time it's background...otherwise it would probably creep me out slash annoy more.

</comment><comment><USER55> I also don't like how they recently changed the invitation email titles to "XXX, good to see you on LinkedIn", as it makes it look like it's a personal message, when it's not.

</comment><comment><USER56> As a hacker, I consider seeing

 _Error establishing a database connection_

as more creepy :)

<comment><AUTHOR> haha good point. It's fixed now.

</comment></comment><comment><USER57> I don't know, LinkedIn seems a lot less creepy than Facebook. I mean some of the ads I get hit with would make many folks blush.

<comment><USER58> "some of the ads I get hit with would make many folks blush"

I'm guessing the "likes" you have that cause the targeted ads to hone in on you would also make many folks blush.

At least, before I shut mine down some months ago, I had plenty of interesting likes but I never had any ads that didn't match my content.

<comment><USER57> I appreciate your insinuation about my "likes". I don't really have anything "liked" on my Facebook but please, go ahead and tell me about how my personal preferences are affecting my online experience.

I'm happy that your anecdotal experience was different from mine, but your empirical evidence does not undermine mine.

Good day sir.

<comment><USER58> Facebook tends to base these ads around collected data and demographics, the targeting is not generally random. Perhaps other sites you've browsed that share data with Facebook's advertising network?

I suppose there's also the possibility of malware replacing FB's ads with their own.

</comment></comment></comment></comment><comment><USER59> If you're a programmer I see no reason to have a LinkedIn profile. GitHub is better for résumé and networking.

</comment><comment><USER60> I don't have a linkedin account. Should I? Does it provide value I can't find elsewhere?

<comment><USER13> I think it's the best / most ubiquitous way to always have your up-to-date resume available, and to keep in touch with industry contacts.

<comment><USER61> I like the hard copies Careers 2.0 prints out better but the Industry contacts on LinkedIn can't be beat.

</comment></comment></comment><comment><USER62> Wow, it looks like interactually's site has been hacked

<comment><USER63> Yea, I would do something, I was redirected to the wordpress installation screen..

<comment><AUTHOR> Lesson of the day: Don't go to lunch after posting an article like this. I got it handled as soon as I got back!

<comment><USER63> lol

</comment></comment></comment></comment><comment><USER64> Just deleted my account today.

</comment><comment><USER33> Y'all know that I worked for Google. On this topic, I can only say good things about the place. When it comes to privacy and PII, Google holds itself to an extremely high standard. Many of these "social" innovations that are popping up on the market place were rejected out-of-hand at Google because it holds itself to an extremely high ethical standard regarding user data, as it actually respects them.

I was shocked, for example, when I learned that a certain social network gives universal profile access to employees as a perk. That would not happen at Google. If you looked at your high-school ex-girlfriend's email, you'd be fired immediately (and deserve it).

Social _is_ creepy, because it's all about being defined by other people, which is ridiculous and horrible. What, so do I suck at Programming Languages because I haven't trolled my 25 closest acquaintances for endorsements? Am I really going to become more credible in Machine Learning if I get 15 strangers to "endorse" me?

The major conflict in "Social" is what I call "Document vs. Improve" (or: Exploit vs. Explore). A social app can expand the web of social connections and make it more efficient, but (a) that's really hard, and (b) there isn't a lot of short-term money in it. Or it can document social relationships that already exist, and make a shit-ton of money off the data. That's easy, but it doesn't actually make anyone's life better. Guess which one the mainstream social players favor?

What I find depressing about LinkedIn is how much it has play-by-play replicated the old, broken way of doing things. Resumes. Titles and dates of employment. Recommendations. Recruiter spam. It feels like the Wayback Machine took us to 1995.

<comment><USER17> > When it comes to privacy and PII, Google holds itself to an extremely high > standard.

With all due respect, but you've gotta joking.

Google doesn't even hold itself to the standards set by the laws in countries it operates in. Laws that are for now still full of loopholes Google happily exploits with zero restraint, despite knowing full well (not in the last place because they've been warned on a regular basis) that this at the very least violates the intent of those privacy laws.

Also, Google has been actively lobbying _against_ privacy protection laws in the EU for several years now.

<comment><USER65> Considering that, for years, Facebook had a universal password that would log you into anyone's account, I'd say that Google's standards are significantly higher than other players in the social sphere.

[http://therumpus.net/2010/01/conversations-about-the- interne...](http://therumpus.net/2010/01/conversations-about-the- internet-5-anonymous-facebook-employee/)

<comment><USER66> This is a non-argument. Just because other actors do certain things does not excuse ANYTHING. Period.

<comment><USER67> Well, the claim was that Google's standard is higher than that of (some) other actors, so the behavior of the other actors is kind of directly relevant...

</comment></comment></comment></comment></comment><comment><USER68>

</comment><comment><USER69> As long as LinkedIn continues to get me high paying jobs, it is all good.

</comment><comment><USER70> Site's down.

<comment><AUTHOR> Back up now, sorry about that!</comment></comment>


Ask HN: Is gandi.net really this bad? - <AUTHOR>

So I have heard a lot of very good reviews of gandi.net here at HN. I tried it today for registering a domain. The experience has been outright horrendous.<p>- The UI is clunky and I would ignore this if it was atleast functional.<p>- Any updates to the DNS records take atleast 30 minutes. Note that I checked my TLD's name server directly. It just look that long for gandi.net to even get to inform the TLD registry.<p>- The free SSL cert provided for every domain first asks you to accept that you pay 16 USD! This amount will apparently will become 0 at checkout. WTF?<p>- I chose the DNS method for SSL cert validation. You just have to keep pressing refresh and sit there. It says nothing other than 'verification pending'. AFAICT, the domain records that it wants and that one my name server match completely and it has propagated as well. Even after a hour, I am just sitting there and nothing happens.<p>- So, I decide to setup  email. It doens't go past the account screen. It keeps saying 'The password that you chose is too short and/or too easy to guess. Please add special characters for more security.'. Out of frustration, I generated a password out of https://strongpasswordgenerator.com/ and used 'e*B8[3~3^~e9'2b' as the password. Nope, that is still not strong enough!<p>So... Long story short, gandi.net is terrible. I would avoid at all costs. I am somewhat amazed that route53 uses it. <comment><USER2> I tried it in the past due to people raving about it to. It was a garbage experience. After the one domain I had with them expired (never used it for much), I stopped using them.</comment>


General Electric workers launch protest, demand to make ventilators - <AUTHOR> https://www.vice.com/en_us/article/y3mjxg/general-electric-workers-walk-off-the-job-demand-to-make-ventilators <comment><USER2> > IUE-CWA Local 86004 President Jake Aguanaga offered his plant, located in > Arkansas City, Kansas, as an example of how much manufacturing capacity > could be converted: more than 52 percent of his workforce has been laid off, > and several football fields worth of factory space are currently sitting > idle. "If GE trusts us to build, maintain, and test engines which go on a > variety of aircraft where millions of lives are at stake, why wouldn't they > trust us to build ventilators?" he said.

This reminds me of the story of Audi's unions demand electric model for main German plant: [https://news.ycombinator.com/item?id=13986889](https://news.ycombinator.com/item?id=13986889)

Unions don't just exist for the workers. If management acts shortsighted in such a way that their jobs are impacted, they can force management to make better business decisions.</comment>


Building a startup? What's your "viral side-along"? - <AUTHOR> http://ericskiff.com/2012/02/14/building-a-startup-whats-your-viral-side-along/

<comment><USER2> Building a startup is hard and time consuming enough. Building a side along isn't practical for most people. In a test tube, yes of course I rather have one (isn't it obvious though?), but it's not practical.

<comment><USER3> Sometimes the side-along becomes the main thing.

See also: Groupon.

</comment></comment><comment><AUTHOR> P.S. Yes, "side-along" is a nod to "side-along-apparition" from harry potter</comment>