Bread is Broken - <AUTHOR> http://www.nytimes.com/2015/11/01/magazine/bread-is-broken.html <comment><USER2> Ironically, sliced bread is the worst.

Normal bread can get stale, dry and hard. But packaged sliced bread is much less perishable. I've seen sliced bread having the same texture and taste after a whole week of lying on a kitchen countertop. And when you read the ingredients on its packaging, you begin to understand why, as sliced bread is subject to the techniques of processed foods such as the addition of preservatives, antioxidants, stabilizers, anti-caking agents, or packaging gases, in addition to that bread being bleached, blanched, stripped of nutrients and with added sugar to make it taste better and because high- fructose corn syrup is so cheap, so why not. In addition sliced bread is subject to every health-related fad in existence. Low carb bread? Sure. Bread with Omega-3? Of course.

Basically the packaged substance in super-markets is anything but bread, then we wonder why our meals don't satisfy us and why we get fat.

<comment><USER3> > In addition sliced bread is subject to every health-related fad in > existence. Low carb bread? Sure.

How could you have "low carb bread"? Bread is a big bundle of carbohydrate. It'd be like low sugar caramel.

<comment><USER4> This one is fantastic, and only 1g carbohydrate per serving because it's primarily fiber and protein: [http://www.holdthecarbs.com/low-carb-fresh- baked/low-carb-wh...](http://www.holdthecarbs.com/low-carb-fresh-baked/low- carb-white-bread-fresh-baked)

(The company has some sort of patented flour substitute that they make by stripping digestible starches from wheat flour and replacing them with flax and resistant starch.)

But yeah, as bad_user points out this kind of thing raises questions about the semantics of what should be correctly considered "bread".

<comment> semi-extrinsic Fiber is still, by definition, carbohydrates. Not saying fiber is bad though.

<comment><USER4> Actually, that's an interesting challenge that the company that makes that bread (LC Foods) has run into with their nutritional labelling. Because fiber is technically carbohydrate (just not digestible by humans), there isn't really a consensus among regulatory bodies on how to treat it — specifically, Europe counts them as calorically empty while the US considers them equivalent to any other carbohydrates.

Normally, with the amount of fiber stuff actually contains, this doesn't make a practical difference, but in the case of LC Foods it means that their products' calorie counts are basically completely wrong (at least in the US; they may change them when they distribute internationally).

</comment></comment></comment></comment></comment><comment><USER5> I used to get bread from a old school French baker in downtown Dallas of all places. I don't know where he gets his wheat (he mills it himself) but the bread was like nothing I've ever eaten. One time I ate half a loaf for dinner with nothing on it at all, it's so tasty.

<comment><USER6> Not to discount what you're saying as I'm sure the bread was very good, but I've been thinking about whether knowing a bit more about the process and story behind food products helps enhance the experience.

So in this case, knowing that he mills it himself and that he seems to use old school methods, in addition to just baking great bread is a recipe for a better bread experience than that of simply eating great bread without knowing the story.

<comment><USER7> I went to Germany this past summer and bought amazing gas-station sandwiches for 4 euros apiece, with great quality meat, cheese, and bread. I came back to America and bought a Starbucks sandwich for $12 and almost threw it out, it was so bad in comparison.

Even if you have neutral perceptions of sandwiches you will definitely taste the difference between American bread and European bread.

<comment><USER8> Wow, that's 4x the price of Starbucks sandwiches where I live. Must be the same ones serving the $6 coffees (mine are $1.30).

<comment><USER7> It was in the airport, so I wouldn't be surprised. They looked about the same price as coffeeshops in downtown Indy, so I think it's more reflective of the cost per square footage than it is about the inputs to the sandwich. I would've hoped given Starbucks' "artisanal" bent for most pastries that their sandwiches would've been the best option given a layover, but it still didn't compare very favorably to gas-station sandwiches in Europe.

</comment></comment></comment></comment></comment><comment><USER9> I appreciate all the do-it-yourself fervor on this thread but baking seems like a decent application of the principle of economic specialization. I, for one, enjoy visiting my local bakery every few days, and they do a better job than I will ever do even if I quit my job and practice baking full-time, which I'm not planning to do.

<comment><USER10> The thing is, homemade bread ends up being a lot tastier than store bought if your only store bought options are big mass produced soft breads. The crust especially suffers on packaged breads.

You don't even need fancypants flour. Just an oven and a few minutes to prepare it (plus rise time and bake time of course). I prefer to do a half and half mix of wheat and bread flour, but everybody is free to do what they like.

You can get good bread at bakeries, but I find that they tend to way overcharge for it.

<comment><USER11> How much can they really charge that makes it worth spending ten minutes kneading, ten minutes washing your hands and the next two days pulling out arm hairs with caked on dough? That's my experience with bread making anyway.

No matter what bread I buy, bread isn't a major part of my weekly budget.

<comment><USER6> Here's a very simple, no-knead bread recipe that I've enjoyed baking several times. Some people enjoy the kneading process, but if you just want some bread, it is worth making: [http://cooking.nytimes.com/recipes/11376-no-knead- bread](http://cooking.nytimes.com/recipes/11376-no-knead-bread)

</comment></comment></comment></comment><comment><USER12> I buy Khorasan whole kernels from a local farm and hand mill it as needed into my own flour to make east african chapatis everyday, never will go back to zero nutrient, flavorless bleached flour in supermarkets. Takes me about 30mins, I roll it in an omlette they call a 'rolex' in Africa for breakfast and sometimes make more for dinner/curries. The rolex fills me all day no carb sugar burnout like I used to get with store bought bread.

<comment><USER13> Less flavorful, perhaps. "Zero nutrient", no way.

A 125 gram serving of commercial enriched white flour contains about 95 grams of carbohydrates, about 13 grams of protein, and about 1 gram of fat = 109 grams. All of those things are nutrients (about three grams of the carbs are in the form of indigestible dietary fiber, which technically isn't a nutrient, but is still good to have). In addition, it has 65% of the DV of thiamin, 57% of the DV of folate, 36% of the DV of riboflavin, 32% of the DV of iron, and several other good things.

<comment><USER14> If only the Times had someone (like, say, an editor?) to make similar points. Nearly all the criticisms of 'mainstream' wheat in their article amount to subjective praise of the magical goodness of obscure local strains. I'm sure they're delicious, but I would like to see some real research on just how bowdlerized typical wheat has become. Not to mention that while I like to bake my own bread, and I have the time to do so (occasionally), millions of people will have to settle for buying their bread from a grocery store.

<comment><USER15> Ditto, people seem to say the same things about bread that people said about wine & high-end audio equipment. Some actual empirical research would be nice...

<comment><USER16> Right. A Trader Joe's outlet has 20 to 30 types of bread. It's not like there's a lack of options.

</comment></comment></comment></comment></comment><comment><USER17> I've been making my own bread from [http://www.amazon.com/Artisan-Bread-Five- Minutes-Revolutioni...](http://www.amazon.com/Artisan-Bread-Five-Minutes- Revolutionizes/dp/1250018285/ref=sr_1_1) and it's better than any of the breads I can buy around here. I'd be interested in seeing how much difference non-industrial flour would make.

Contrary to what someone said, I think bread is _not_ a case where specialization pays off. Bread needs to be fresh, and it will basically take me longer to buy a loaf (if I could actually find a decent one) than to throw together one in the kitchen while I'm working on something else.

Not to mention that my half-assed bread, fresh, is better than the most awesome bread in existence if it's a day old. Hawaii is a terrible environment for bread, the crust is gone after a few hours due to the humidity.

</comment><comment><USER18> About a year ago I learned how to bake a good sourdough loaf, and have been doing it about once every week.

It's not exactly dense, but it does seem to be much more substantial than mass-produced squishy bread. A single buttered slice of sourdough toast is incredibly delicious, and is often all I need for breakfast. Though it's tempting to eat half a loaf right after baking...

Oh, and the same dough makes a damn good pizza. ([http://stellaculinary.com/recipes/70-hydration-sourdough- bou...](http://stellaculinary.com/recipes/70-hydration-sourdough-boule))

</comment><comment><USER19> This article felt incredibly familiar, and it turns out I've read pretty much the same article written about the same place, three months ago: [http://www.seattlemet.com/articles/2015/7/1/stephen-jones- an...](http://www.seattlemet.com/articles/2015/7/1/stephen-jones-and-wsu-s- bread-lab-are-designing-a-whole-wheat-tortilla-for-chipotle)

</comment><comment><USER20> It's not just bread, it's other wheat products as well.

Take a tortilla, for example. Taco Bell and Walmart have the worst of the worst. Chipotle's tortillas aren't much better, they still have that 'soapy' taste. Visit a local Mexican bakery _(panadería)_ and buy a package of fresh- made tortillas and you'll be amazed at the difference.

This expands to every other bread you think of. Pita, paratha, bagels...

</comment><comment><USER21> I feel pretty lucky to have access to whole-grain rye bread[1] here in Finland.

1\. [http://www.linkosuo.fi/uploads/images/tuotekuvat/240%20musta...](http://www.linkosuo.fi/uploads/images/tuotekuvat/240%20musta%20evas.png)

</comment><comment><USER22> Interesting article that made me incredibly hungry for my grandmother's bread.

<comment><USER23> Check no knead bread. Absurdly easy to make, foolproof, tastes like heaven (especially SeriousEats improved version)

</comment></comment><comment><USER24> I've been tracking what I eat for a while, and one thing I've noticed is that bread makes me hungrier and I feel worse. I've completely dropped bread, and my life has improved dramatically.

</comment><comment><USER25> supermarket white bread, beside all other strange ingredients, has key technological difference from "normal" bread - the bottom-line industrial optimization favors adding more yeast and sugar for faster rise instead of longer rise with less yeast and sugar for "normal" bread, and as the result in the "normal" bread this lesser amounts are processed more completely. The longer process in the "normal" bread also allows for more carbohydrates (starch) from the flour to be converted into sugars and be processed by the yeast. (i did my one summer time at a completely manual bakery 25 year ago in USSR - it was among the best bread i ever tasted, and we did have relative shortage of yeast and sugar, so we used less of it with warmer water and let it a bit more time to rise)

On practical note - here in SV the "German/Bavarian" or "Russian" breads or the bread from Acme bakeries seem pretty ok.

</comment><comment><USER26> As an aside, consumption of bread is strongly correlated with tooth decay. Whole wheat has only a slightly smaller correlation.

<comment><USER27> Eh, maybe modern processed bread that has sugar in it. Questionable otherwise, unless you have a source.

<comment><USER28> Agriculture was terrible for our health - even before sugar became a part of our diet.

[http://discovermagazine.com/1987/may/02-the-worst-mistake- in...](http://discovermagazine.com/1987/may/02-the-worst-mistake-in-the- history-of-the-human-race)

<comment><USER29> I'm happy for whatever health problems it incurred since it seems to have allowed and fostered modern civilization. I think a very important line from that article is this:

> The evidence suggests that the Indians at Dickson Mounds, like many other > primitive peoples, took up farming not by choice but from necessity in order > to feed their constantly growing numbers. "I don't think most hunger- > gatherers farmed until they had to, and when they switched to farming they > traded quality for quantity,"

Hunter-Gatherer works fine until you reach a certain population and it seems that that population/lifestyle is below the point where you start to really see civilization lifting up and starting to advance quickly.

<comment><USER26> Yes, I agree, I'm glad that people of the past sacrificed their dental health to build civilization to where it is now.

However, that's completely irrelevant to our food choices today. Modern agriculture is quite capable of producing foods which are more similar to foods we subsisted upon pre-agriculture. On an individual level, there's no reason for us to choose to eat grains. I suppose if everyone in society decided all at once to stop eating grains, it would cause problems, but that's unlikely; I think if society slowly shifts toward eating fewer grains, modern agriculture will be capable of adapting.

</comment></comment></comment></comment></comment><comment><USER30> This headline is broken. And so is every headline that depends upon the "X is Broken" trope.

<comment><USER31> Don't hate.

But I'm a bit disappointed that they didn't take the chance to make a "Bread Considered Harmful" headline.

Also: [https://i.4cdn.org/fit/1446067701357.png](https://i.4cdn.org/fit/1446067701357.png)</comment></comment>


The Errors of A/B Testing: Your Conclusions Can Make Things Worse - <AUTHOR> http://grasshopper.com/blog/the-errors-of-ab-testing-your-conclusions-can-make-things-worse/

<comment><AUTHOR> Just thought this was relevant to this community. We do a lot of A/B testing on everything.</comment>


Show HN: Burning Man has 3650 (crazy) events in one week. - <AUTHOR> http://burnerevents.com

<comment><AUTHOR> I thought HN may like this. Burners can print a schedule so they aren't trying to work a phone in a dust storm. You can also check out what events other peeps are going to by clicking their avatars. The feed is dynamic and events move into 'live' and 'past' as they come and go in time. Thanks for any feedback.</comment>


Best nations for expats - <AUTHOR> http://business.rediff.com/slide-show/2009/nov/27/slide-show-1-world-best-nations-for-expats.htm

<comment><USER2> Original: [http://www.offshore.hsbc.com/1/PA_1_4_S5/content/internation...](http://www.offshore.hsbc.com/1/PA_1_4_S5/content/international/2g_pdfs/expat/expatresults09.pdf)

</comment><comment><USER3> Someone clear this up for me: What is the difference between expats and immigrants?

<comment><USER4> expats don't intend to give up their original citizenship - my understanding.

<http://en.wikipedia.org/wiki/Expatriate> \- gives it a broader definition to include permanent immigrants.</comment></comment>


Show / Ask HN: Hacker News Linx - <AUTHOR> http://tweetlinx.com/hackernewslinx A couple days ago, Fred Wilson asked for an application that aggregates the links of the people he follows (http://twitter.com/fredwilson/status/1694722348). I told myself, "Hey, I could probably hack that together," and so I did:
http://tweetlinx.com
I feel like there's potential here, but I'm not quite sure what it is. I just realized I could build a nice RSS feed for HN by following the HN twitterbot. Anyone have any more ideas? <comment><AUTHOR> A couple days ago, Fred Wilson asked for an application that aggregates the links of the people he follows (<http://twitter.com/fredwilson/status/1694722348>). I told myself, "Hey, I could probably hack that together," and so I did:

<http://tweetlinx.com>

I feel like there's potential here, but I'm not quite sure what it is. I just realized I could build a nice RSS feed for HN by following the HN twitterbot. Anyone have any more ideas?</comment>


The Inside Story of Moto X: The Phone That Reveals Why GOOG Bought MOTO - <AUTHOR> http://www.wired.com/gadgetlab/2013/08/inside-story-of-moto-x/

<comment><USER2> What does it mean to be "A Google Company? _" Woodside would prefer that people not call it the Google Phone: "People don't associate Google with phones," he says. "Motorola's the brand that resonates to consumers."_</comment>


Pakistan dumps American produced border control software - <AUTHOR> http://tribune.com.pk/story/184568/pakistan-to-replace-insecure-us-border-watch-software/

<comment><USER2> I can imagine that using American-controlled immigration software, would be how American intelligence personnel secure access into foreign territories. A (IMHO) logical statement, though I haven't even dignified it with a Google search.</comment>


The Logo Design Process From Start To Finish - <AUTHOR> http://justcreativedesign.com/2009/02/04/the-logo-design-process-from-start-to-finish/

<comment><USER2> It seems odd that you would redesign the logo and homepage of an online store without considering any quantitative measurement. For example, how does changing the background to purple and showing less content "above the fold" affect conversion rates? Instead, the only criterion for success this author mentions is that "the client loved it".

Here's an alternative... rather than hiring one expensive artist who will make something pretty, get several cheap logos from a site like 99designs, and A/B test to see what actually works.</comment>


Ask HN: What to do with pre-launch emails? - <AUTHOR>

So I've had my pre-launch site up over at http://collectivejam.com/ for 3 or 4 days now, and have collected around 300 emails. It's steadily increasing, which is great.
The thing is, I've only got one email planned, and that's the launch email. I'm not sure when I should email the list, with updates, with questions, with requests for developers, etc?
The only other thing I've been doing is emailing people who's email or site I recognise.
What do you think? What sort of emails should I send out? <comment><USER2> If I had signed up, personally I would want an email when you go live (usable beta level). I don't want a confirmation, I don't want to know that you are 37.5% done, I don't want to know what your dog had for breakfast.

When you send me an email that you have gone live, either a link to continue to be on your mailing list or a link to request to be off would be good.

<comment><AUTHOR> I'll make an unsubscribe link pretty prominent, thanks!

<comment><USER2> Two other things on unsubscribing. One as an spam detector I use a different variation on email address for every site I ever sign up to, so "reply to unsubscribe" sucks (I note that you said a link, which I like).

I have been stupid enough to push a unsubscribe link by mistake. I prefer that it automatically unsubscribes me rather than having to push a button to confirm, but it is not a bad thing to also have a Whoops I made a mistake button.

</comment></comment></comment><comment><USER3> Invite them to an online poll inquiring about their hiring needs and frustrations. This will be a great way to validate that you're thinking right and to see how these quality leads themselves are describing the problems you are thinking about

If you really want to crush it, reach out and make friends with some of the people on your list. From the material you collected in the polls, you can get in touch with each of them and ask for specifics, tell them how you are adressing the problems they are describing and so on.

At this scale, don't think only of automatic emails. You are probably very eager to get to the stage when your email list is so huge that automated emails is the only way to go. But at this point, it isn't. Use that to your advantage.

</comment><comment><USER4> Whatever you do. Make sure you invite people to tweet about the signup page after they submit. That way it will spread virally.

<comment><AUTHOR> Great idea man, just done that!

</comment></comment><comment><USER5> Strangely, even though your pre-launch copy is an absolute and obvious lie (it can't be the top choice, it hasn't even launched yet) I still feel attracted to sign-up. So, um, well played. I guess it's a sign of how bad the tech recruitment market is that people are keen to throw themselves at vapourware. Anyway, good luck!

<comment><USER6> I have to say that copy put me off as well--and I didn't sign up. :)

<comment><AUTHOR> I don't think it put the above commenter off, as he signed up. Is it the top choice that put you off, or was it that you weren't actually interested in what it is we have to offer?

<comment><USER6> I'm a freelance developer so I assume I potentially factor into your audience in some way. I also encounter people who need developers so am a potential source of referrals.

To me "the top choice for entrepreneurs, designers and businesses to hire world-class coding talent" is an grandiose, empty and (certainly this early) probably untrue statement. I don't like to deal with people that make statements like that so it makes a negative first impression on me.

It also makes me ask the questions:

* "top" Compared to what? In what way?

* How do I know the coders are "world-class"? Is there vetting? Guarantees?

Possible replacement:

"CollectiveJam helps entrepreneurs, designers and businesses to hire coding talent."

I don't know enough about your product to be able to say what a reasonable and accurate claim is. :) If I knew more I could probably extend that above to say "...by something something somethinging the something."

Then again--I'm not a copywriter. :)

<comment><AUTHOR> The thing is, your replacement doesn't instill excitement or curiosity, it's a bit 'boring' if you know what I mean? But you're right, the coders are vetted, and there are guarantees! So I guess it's saying something.

<comment><USER6> Yeah, I agree it lacks a certain punch. But then again if that's the problem when you take the hyperbole out of the copy there's a bigger problem. :)

</comment></comment></comment></comment></comment></comment><comment><USER7> I quess a semi-personalised email asking for feedback on the service for each subscriber could make them more positively inclined towards it, plus, if you time it right, it could work as a reminder for people that have used your site in the beginning but then forgot about it.

How did you manage to get exposure in order to collect so many emails in such a short period of time? Ads or something else?

<comment><AUTHOR> 1\. I tweeted about it. 2\. I got everyone I knew that would tweet about it, to tweet about it. 3\. I got on CSSMania, which converted at about 40% 4\. I got on and am getting on a few more CSS Galleries (and designers are my target market!) 5\. I got a lot of attention in a HN thread.

<comment><USER8> Thanks for the tips here.. 300+ sign ups is a lot for a relative new site. I will give these a shot! I guess having a decent design help.. I'm launching my site ( www.tradesalerts.com ) in a few days too. So far, I got just 1 signup. :P

</comment></comment></comment><comment><USER9> If you are concerned about 'pissing' people off don't do it.

If you want to reward them for signing up you can try a couple of things:

1\. Thank them by letting them on before you go live. Let them know that you will go live later on but that you wanted to give them early access.

2\. Let them know that they can have early access if they want to help beta test it.

3\. Let them know pre-launch that you are offering free accounts via an affiliate/recommendation program. Dropbox does this well.

</comment><comment><USER8> One email to guide my users how to use the application through a video, or maybe a step by step guide, you are planning on a step by step guide, see dropbox. I think they did a good job to help new users on board.

</comment><comment><USER10> How have you spread the word about your site?

<comment><AUTHOR> 1\. I tweeted about it.

2\. I got everyone I knew that would tweet about it, to tweet about it.

3\. I got on CSSMania, which converted at about 40%

4\. I got on and am getting on a few more CSS Galleries (and designers are my target market!)

5\. I got a lot of attention in a HN thread.

P.S. Where is the formatting guide on HN?

</comment></comment><comment><USER11> You should be confirming those email addresses immediately (double opt in), what you don't want are most of those emails not reaching the inbox, because someone typed their gmail address wrong. Start getting your sender score up.

<comment><AUTHOR> I've hand checked most of them, and it's about 98% at the moment.</comment></comment>


12 year old devising new theory of relativity - <AUTHOR> http://www.dailymail.co.uk/news/article-1369595/Jacob-Barnett-12-higher-IQ-Einstein-develops-theory-relativity.html

<comment><USER2> Drawing some calculus on a window doesn't count as a new theory of relativity.

<comment><USER3> Here's the writing-on-window video: <http://www.youtube.com/watch?v=YFmrlIEpJOE>

This is a video of him talking Physics: <http://www.youtube.com/watch?v=f2A7BlKbZlM>

He appears to understand what he's talking about as well as any typical math/physics teacher. Whether he can come up with his own theories is not something I can tell just from these videos.

</comment></comment><comment><USER4> This kid is my hero...</comment>


Ask HN: How much code re-write to run on new processor architecture? - <AUTHOR> The app would run on top of an OS that is already compatible with the new applications. I can't use emulators and may need to directly access the CPU cores <comment><USER2> Not enough details</comment>


Ask HN: How are credentials managed at your company? - <AUTHOR> Access to servers, SaaS apps, crucial infrastructure software. There are tons of things that need to be accessed by people in the organisation. Although, in many cases, there is an option to create new users but sometimes it's not and often, creating new users is more of a hassle every time someone needs access.<p>How does your company deal with giving and managing access? <comment><USER2> Our authority for authentication is Active Directory, it may sound very enterprise and not-hip but it's great because basically everything supports it. A user just needs one password for all our systems - email, servers, laptops, internal applications.

For servers we use LDAP, so you just SSH to a machine and it creates an account if one doesn't exist. It authenticates against AD every time, so if an account is disabled there, their access to all servers is instantly revoked. You can still use SSH keys so you don't need your password every time.

Internal web applications (mainly Rails) are backed by LDAP too, but also support NTLM SSO for Windows uses (so they only need to enter their password once when they log-in to their machine). Not everyone uses Windows (or is part of the domain), so we use CAS on top of that to make switching between applications transparent for everyone.

We don't really use any external services that we need to share passwords for.

<comment><USER3> We pretty much just authenticate as much as possible via our Active Directory. It just works, pretty much every self hosted service we have can authenticate via LDAP.

I assume that we could just run an OpenLDAP server or something, but Active Directory is the easiest way to get started with LDAP.

One idea I've had, but never got around to is a OpenID/OAuth service that could authenticate users via the AD.

<comment><USER4> Take a look at the open source project Keycloak ([http://www.keycloak.org/](http://www.keycloak.org/)), it does exactly that and takes very little time to setup. The easy way is pretty much:

      1. Run the docker container (https://hub.docker.com/r/jboss/keycloak/)
      2. Login to the web console
      3. Create a "Realm"
      4. Go to "User Federation" and add a "LDAP" provider
      5. Go to "Clients" and configure keycloak to handle OpenID/SAML for your app

Disclaimer: I work for Red Hat, and Keycloak is one of our projects. If you want support, we recently released it as RH SSO.

<comment><USER3> That's sort of what I wanted, but on steroids :-)

Seems a little overkill for my use case, but nice.

</comment></comment></comment></comment><comment><USER5> We just use "c0mp4nyn4m3" everywhere, unless we just use "companyname". Or the same passwords on multiple servers, or a few well-known passwords which are used again and again.

I've tried and failed to change this culture. Why have full-disk encryption if it's secured with companyname/companyname? Why encrypt backups if the password is 12345? Apparently, it's so we can show we've fulfilled our data-protection obligations.

I've seen this at every company, large and small, including a defence contractor, I've ever worked at. It's an unwinnable battle.

<comment><USER6> We use a simpler alternative as password - abc123, I mean what could go wrong. Our accounting and budgeting software was hacked 3 years ago due to it being setup incorrectly and accessible via google search. Since then our security teams have spent more time enforcing smaller rules (comparatively) like blocking flash plugins than asking business users to create stronger passwords. Any attempt to incorporate 2-factor or OTPs is met with "business users time is very precious they cannot be wasting time on using 2-factor or OTP."

<comment><USER5> They just won't learn, will they? If they've been compromised but still don't want to do the right thing ...

</comment></comment></comment><comment><USER7> My primary role (these days) is as an Identity Architect. What that means is, I look at all the disparate systems in an organisation and design a better way to manage credentials.

My main client base is Blue Chip, so that means a majority of Windows based services, and a smattering of Linux, and even mainframe. Most companies have totally disconnected systems requiring manual user creation on multiple systems, with the user having to remember several sets of credentials just to do their daily job. This may be archaic compared to the proliferation of oAuth across the web, but large Corporates are rarely up to the curve, and in many cases are completely unaware the curve even exists. This is where I come in.

The main component of any credential management is an identity hub; I mostly work with Microsoft Identity Manager, but there are other options, such as IBM Tivoli Identity Manager and Cisco Identity Services Engine (to name but two). The identity hub takes data from [multiple] Authoritative Sources (HR, SAP etc.) and compiles a meta-identity of each user which is then forwarded as user attributes onto target systems. If the target system doesn't need or care about 'Job Title' for example, that can be excluded from the forwarded data. Any user changes in the Authoritative Source are then replicated automatically to any target system on a regular schedule.

Once you have a Single Identity, it is then a case of leveraging SAML, oAuth, or plain old Kerberos/NTLM for login authentication. In an ideal scenario all systems will be able to support a compatible logon provider service but that isn't always the case. Getting users down to a single id/password is always the end goal though.

Of course this also all scales out to the Cloud, with direct support for AWS, Azure etc.

If you want to know more, hit me up with some questions!

<comment><USER8> I'm currently P2Ving a lot of old servers. Identity management is in my hit list for the year. So yeah, I'm interested and would like to subscribe to your newsletter

<comment><USER7> Cool - I've been toying with starting a small IDM blog for a while now, I might just actually sort it out now ... :)

</comment></comment></comment><comment><USER9> We use SmartCards which contain our private certificates.

The certificate on the SmartCard is encrypted by a passphrase.

The OS has been modified to support the SmartCard reader and use our individual certificates to authenticate and authorize us.

All our applications have been modified to authenticate and authorize us based on the decrypted SmartCard certificate and the roles we are in.

We can order roles through a centralized self-service web application. When a request is created, we get an automated e-mail with the request identifier, which acts as a file handle in the C programming language. The request then goes into the local security officer's queue, where it is either rejected or approved; if approved, it then moves into the role owner's approval queue. The outcome of the decision process is e-mailed to us automatically by the system. If approved, the access to the system or application in question is instantaneous.

Even SSH has been modified to use the SmartCards or soft token certificates for technical user accounts. It took us years working with Oracle to get their PKI fixed, since their in-house experts never saw a SmartCard reader, but eventually we got to the point where even the Oracle database uses the certificate on the SmartCard for authentication and authorization. Authorization from the web self-service application is translated into Oracle roles inside of the databases.

Even our source code management system uses SmartCards.

We run our own certificate authority. All of our relevant software is preloaded with the certificate authority's certificate by the respective engineering teams (component owners), so that the entire chain of trust can be verified. Our certificates use 4096-bit keys.

We do not use logins or passwords anywhere.

<comment><USER10> Sounds awesome. How do you use sudo? Just plain NOPASSWD and trust the SSH auth?

<comment><USER9> Sudo is in LDAP. We are allowed to run specific commands based on which roles we are in. Those roles are used to generate sudo roles.

Nobody, including 2nd level UNIX support, has or knows what the root password is.

If there is an emergency, the sysadmins can temporarily generate a root password, which is then automatically reset with random garbage after a few hours, so nobody will know what it is after that.

</comment></comment></comment><comment><USER11> This is still a hard problem.

I use Google Apps OAuth for everything possible. This makes it pretty easy. You can also use SAML or any other SSO mechanism.

You should absolutely create new users when that is an option. Then, when someone leaves, it's easy to remove access without having to worry about things.

We use Lastpass to store all company passwords, and there are some shares done through it as well, but we don't share unless we have to.

If you are sharing an account with someone you should change the password for that account when they leave the company. If you're using something like Lastpass or similar this is easier to do than distributing the password another way.

<comment><USER12> How do you manage service specific permissions or groups if Google Apps is the auth provider?

</comment></comment><comment><USER13> Thycotic Secret server.[0]

it costs a lot and hasn't got functionality that couldn't be replicated by something open source, but for now it's that.

[https://thycotic.com/products/secret- server/](https://thycotic.com/products/secret-server/)

Additionally:

A centrally managed daily rotating EFS (windows) volume which gets called by some powershell scripts when you want to look up the daily rotated admin password for a machine.

For when machines inevitably get knocked off the domain.

I think it's custom. __

 __EDIT: it 's from SANS.org

[http://cyber-defense.sans.org/blog/2013/08/01/reset-local- ad...](http://cyber-defense.sans.org/blog/2013/08/01/reset-local- administrator-password-automatically-with-a-different-password-across-the- enterprise)

<comment><USER14> I've been meaning, for the last couple years, to see if WebPasswordSafe ([https://github.com/joshdrummond/webpasswordsafe](https://github.com/joshdrummond/webpasswordsafe)) is a viable alternative to Secret Server for basic password storage functionality. Secret Server is reasonably nice, but a bit expensive for what it does.

</comment></comment><comment><USER15> When I was at Microsoft (DevDiv) we used AD, Forefront Identity Manager and an internal webapp called RAMweb to request to join controlled groups.

Them being Microsoft everything was in-house, though I did work on a team that did use some external resources - we traded passwords on an ad-hoc basis - "trusted" SharePoint pages or shared OneNote documents mostly - but this was never anything sensitive - think: accounts for sites like HackerRank or Lynda.

All of the startups I've been at use LastPass Enterprise, it works well.

</comment><comment><USER16> Over the past ten years, I've seen a mix of LDAP, oAuth, passwords/SSH keys provisioned via orchestration tools, handing everything over to Google/Okta, and a binder full of root passwords and revocation keys.

My favorites (I'm in DevOps) include LDAP (as long as I don't have to maintain it personally) and orchestrated keys. Anything that makes it easy to go to one place, change a file, deploy, and someone is created or erased. I used to love 2FA, but the cost for misplacing your token for a day is too high. I haven't come up with a good alternative for that, though.

</comment><comment><USER17> Before posting details of your company's security infrastructure here, ask your security team. Even if your infrastructure is technically perfect, there may be good reasons not to publicize its details.

<comment><USER18> And that is part if the reason why quite a number of us use pseudonyms:

A number of things are much safer to talk about once it isn't tied back to you, your family or your job in any obvious way.

Still agree that even on top of that, great care should be taken. (E.g. in case someone suddenly figure out and blurts out: "you must be x from y, aren't you?".)

</comment></comment><comment><USER19> We're a small company, but we have a lot of credentials that go around and we generally use Lastpass with a shared folder because it's supported on all platforms and free.

The only thing that bothers me (and can't be circumvented because of browserdesign) is the ability to get plaintext passwords from autocompleted forms. So if an employee wants to write down a password, there's nothing stopping them.

For access to our servers we require everyone to use SSH keys.

<comment><USER20> Meldium says they login remotely and then push the session to your browser (thus never revealing the password to the user) which sounds awesome in theory. I questioned them on this as I was able to save and view completed passwords, and it turns out they can only do it on about 10% of the services we use.

</comment></comment><comment><USER21> I'm a system admin with about 40 passwords for work I need to remember so this year I've been using keeweb to keep a encrypted password file/searchable file. This year I started throwing the dreaded htaccess passwords around company only sites we control incase a old employee wants to jump back in until we can decide on a better system/ clean up how we do things.

</comment><comment><USER22> We use ScaleFT, wrote a blog post about it here: [https://www.jungledisk.com/blog/2016/07/13/behind-the- scene-...](https://www.jungledisk.com/blog/2016/07/13/behind-the-scene-at- jungle-disk-first-peek/)

</comment><comment><USER23> We use RatticDB[1] which is a bit bare-bones (all the passwords are stored plaintext in a database) but does the job well enough (audit logs and credential groups with view/edit permissions).

It's less slick than commercial solutions like LastPass, but it's cheaper, and outside of proper authorisation models in web applications, which Facebook does well, it's all just copy-pasting passwords with more obfuscation.

You'd think that with so many engineers and so much love for brands Twitter could at least develop a proper concept of shared accounts, so I wouldn't have to venture into some deep dark settings menu to tweet from a company account instead of my personal one.

[1]: [http://rattic.org/](http://rattic.org/)

</comment><comment><USER24> Just some ideas:

Giving and managing access:

Have a very clear flowchart for when someone joins/leave a role what their privileges are. Ensure all departments sign up to this understanding.

Write in all department SOP/flowcharts/guidelines what to do when someone joins/leaves a role. This is your field, and by using their server they're running on it. So ensure they comply.

Audit:

Run monthly checks to the above have been done. Above should be approved by all dept. heads so just get whoever's in control approval of policy.

Use SOX404 style checking of access/other access. This just means taking samples of actions that could be taken, and checking them. 10-15% should be OK, depending on process/function.

These are all non-technical checks. Do check in with your compliance/legal function for their perspective of what's needed (and what to avoid keeping on disk - just disregard). They will likely have a lot of insights which are both technical and non-technical.

</comment><comment><USER25> 1Password for teams. Works great

<comment><USER26> My company is also using 1Password for Teams, but found it surprisingly hard to get everyone to use the same naming scheme. At my company there are few existing 1Password users (personal license) who already maintain a large database of passwords. Then someone link team vault to their 1Password. Open the All Vaults view. OCD kicks in. Chaos ensues.

(e.g. "news.ycombinator.com/username" vs "Hacker News" vs "news.ycombinator.com" vs "Hacker News/username" vs etc.)

</comment></comment><comment><USER27> Azure Key Vault + some internal wrappers to integrate with our production and testing environments. We've got Just-in-Time access for our environments.

For the work network, different teams have different strategies, but generally a password safe. No shared creds.

</comment><comment><USER28> The previous company I worked for used a combination of LDAP with Yubikeys for 2F. Was very secure and lots of services ran on an internal network which you had to use a VPN connection to access.

The company I'm at now is using LastPass shares (which the creds can easily be obtained as others here have mentioned) and for a lot of other services there is a default username and password based on your name.

I'm trying to change the security culture at my current company, but it's hard since a lot of "security" is more of a pain in the ass. Example, "Why do I need to put in this code if I already put in my username and password?"

</comment><comment><USER29> Anybody here have experience with storing SSH public keys in LDAP or an alternative to syncing them across a range of servers?

I've had LDAP authentication to servers but it's always been with passwords.

<comment><USER30> I just recently had to solve this problem. I ended up using this Python package: [https://github.com/jirutka/ssh-ldap- pubkey](https://github.com/jirutka/ssh-ldap-pubkey)

<comment><USER29> Ah very nice! This is exactly what I'm looking for. Couple questions.

Does this support multiple sshPublicKey attributes or just one per user?

Any performance issues with constantly hitting LDAP?

<comment><USER30> Multiple keys seem to be fine.

I haven't seen performance issues, but it's a relatively small deployment in the scheme of things. There are also existing solutions for caching here. NSCD seems to be the go-to for caching LDAP query results directly. Alternately, you could cache credentials at the PAM level with pam-ccreds (Debian package name).

</comment></comment></comment></comment><comment><USER31> We, uhhhh, have a password tab on our team onenote?

It's _fiiiiiiiiine_... :)

<comment><USER32> We have an Excel workbook "hidden" on the file server.

About a week ago Excel decided to change ... (3 dots) in one of my password to one Unicode char. About an hour lost.

</comment></comment><comment><USER33> I've always worked at large companies with dedicated Infosec groups, so I'm surprised to hear security is so awfully lax at so many places. I thought maybe small companies would be using open source software and something like:

[https://www.nitrokey.com/](https://www.nitrokey.com/)

although it clearly takes some know-how to get set up with something like this.

</comment><comment><USER34> Shared spreadsheet in Google Docs. [sigh]

<comment><USER35> Super insecure, move to a encrypted team password tool ASAP.

</comment></comment><comment> UK-AL Active Directory for internal + Azure Active Directory(With sync) for SAAS/Web products.

</comment><comment><USER36> Internal auth strictly over LDAP or SSH keys, so we don't have to worry about that.

For external things we can't integrate into that we use a password manager (self-made). People get dropped into the categories they're supposed to access, and done.

</comment><comment><USER37> Does anyone's company use Okta combined with Active Directory? It seems to work well for handling access to internal apps and integrates with a lot of the business focused SaaS, like Salesforce and our project management tool (Mingle atm).

<comment><USER38> My previous company used Okta, and it was a positive experience, though not overwhelmingly so. Web apps that don't integrate it are clunky, but there's no getting around that.

</comment></comment><comment><USER39> In my previous company which I left just in half day/ during lunch break.

They were having 'admin123@companyName' in case that password doesn't work they generate SHA and then put in the database field 'password'

</comment><comment><USER40> Active Directory for everything internal

external stuff is managed via Teampass (on premise shared pw manager), which supports shared credentials and user-only credentials

although teampass is a bit wonky at times, it works pretty well for us

</comment><comment><USER41> Web apps authenticate against a SAML IdP. The SAML IdP is among the very small list of things that is allowed to talk directly to Active Directory.

Access to specific applications is usually controlled by group membership.

</comment><comment><USER42> Active Directory. Except for those services guarded by an owner who is always on vacation or too busy processing other requests when you need him. Typically shared passwords for nonprod.

</comment><comment><USER43> We have all the passwords managed through Meldium, I find it pretty convenient although it's security is as strong as your google account.

<comment><USER44> It took me several reads to figure out how you could use a blog site to share passwords. And this is why you don't read HN before coffee.

</comment></comment><comment><USER45> In most cases I've seen: not well.

</comment><comment><USER46> in github :(

</comment><comment><USER47> We've just started using Google auth. So far seems to work pretty well.

</comment><comment><USER48> Keepass in shared folder

<comment><USER20> Do you know if there is a trick to granting different passwords to different users using Keepass/WebKeePass?

</comment></comment><comment><USER49> Surprised nobody has mentioned Hashicorp Vault.

<comment><USER50> Same. Are you using this to success? Do you mind if I asked you a few questions about it?

</comment></comment><comment><USER51> shared google drive folder with 1Password files

</comment><comment><USER52> Azure AD

</comment><comment><USER53> AD

</comment><comment><USER54> post-it notes

</comment><comment><USER55> git-encrypt

</comment><comment><USER56> I really like your approach, just ask people to share sensitive information on a public website. Anybody sharing their company credential storing policy here should be up for an early performance review by their managers, boss.

Here we start with not writing our policy on public websites.

<comment><AUTHOR> I would argue the opposite. If your credential storing policy is so sensitive that it's not sharable, then it's probably not that secure in the first place. Besides that, how can I even possibly make use of that information when I don't even know the name of the company?

<comment><USER56> Not sharing the policy and not being secure are too different things. And ideally yes, you should be able to share it without increasing any risk, though real world tells us this is not the case. And not sharing this information is a more secure action then sharing it, even though there is no security through obscurity, there is certainly not security in telling people your credential storing policy on a public website.

It narrows down the interesting target(s) quite a bit for malicious script kiddy or hacker.

And regarding not knowing the company, you and quite a few others here, link quite a bit in your profile page, and leave a huge footprint on the internet with all sorts of information to use. So it's quite easy to make a profile of you, determine where you work, where you live, what you look like, and then knowing where your company stores the interesting bits... well its going to be a lot easier then going into something blind.

But what do i know, i'm not good at 'Hustling and exerting confidence.'

;)

<comment><USER57> You share the the policy with every employee that has a very real likelihood of becoming disgruntled in the future at some point. So arguably (and historically accurate, if I were to take a guess) you are sharing your policy with the most dangerous actors already. If sharing your policy has any affect on your security at all then you aren't secure and obviously you're sharing it with employees who are probably the highest risk of becoming malicious actors already so don't pretend not sharing it here does anything of consequence.

<comment><USER56> I tend to trust people i work with slightly more then random people on the internet i don't know. (almost tempted to explain how to avoid your 'issue' but then i'd be sharing what i warn against myself people should not share).

There probably also is a sticker on your frontdoor that says spare-key under the 2nd fake rock? Because any disgruntled visitor or family member you had might post that on Facebook anyway? Same principle applies, there is no benefit in having the public know this. Though when you did have a fight or disagreement with that visitor or family member you have chance to relocate the spare-key before that information is disclosed on their Facebook page.

So besides the negative effects i described, what good could come from posting your company (not yours to decide to share anyway) policy regarding login credentials?

Also i'd advice to check up on your contract what it says about sharing company policies and or secrets to 3rd parties (this site for example), before doing so. Because chances are somebodies' boss considers the credential policy as something that should be kept in-house and not public and made a point of this in his/her contract. No matter what you or i think about it, if they can argue you 'potentially hurt' the company you are screwed.

</comment></comment></comment></comment></comment><comment><USER58> Thank you very much for the public information disclosure about important infrastructure elements of your company!

Also very appreciated is the fact that many of you brilliant uberhaxors link to your company websites!

There is already a lot of valuable information available from the various "I am using an online service for all passwords"\- discussions.

I guess the next step will be:

ASK HN - what are your top ten favorite passwords you use for your company infrastructure?

Best value generated by these threads: spot the brightest minds in the "Hacker" News community quickly! Do not forget to ask for the HN handle on every new business contact!

<comment><USER59> Either you're answering the wrong message, or your comment isn't useful at all. The question is VERY interesting and VERY OFTEN it's a critical point in many companies' infrastructure.

<comment><USER60> Agreed, but those who answer in detail should be mindful of if their handle or user description correlates or links to their business.</comment></comment></comment>


Fuck You Startup World - <AUTHOR> https://medium.com/@shemag8/fuck-you-startup-world-ab6cc72fad0e <comment><USER3> This article explains well why I avoid startups. I've considered joining some, but always get turned off by the interview phase. The ones that bug me the most...

> Fuck your crazy work hours

In my opinion, if you're working crazy hours, you've already failed, likely due to poor management of the project. The only exception I see is if you don't really have a life outside work and are working on a project that you're really passionate about, but even then it should be a temporary thing.

> Fuck your open space floor plans, You really think Zucks builds a Facebook's > 2017 roadmap while a nerf war is ranging outside

I want to get work done and move on with life, not play silly office games. Open space floor plans kill my focus.

> Fuck you startups with your extravagant parties and crazy off-site events > that cost way too much money

I've never understood this. I want to work for your company. If I want to go on vacation, I'll do it with my family, not my coworkers. I have no desire to be best friends with all my coworkers.

<comment><USER4> > _I want to get work done and move on with life, not play silly office games. > Open space floor plans kill my focus._

I always found the people against cubicles but for open floor plans strange. In reality, it's pretty much impossible to build offices for every employee. Cubicles were supposed to be the fix for that. You have a open office with space and partitions to separate you from other people. Then someone said that open offices offer substantial collaboration for employees. The people who were drones in a cubicle farm bought into it, because I supposed it was a change from the Office Space type scenery.

But now all we get are interruptions with no recourse. We have desks that are fixed to other desks or desks that are clustered together where the only thing that separates you from your neighbor is your monitor. Everything is open, so now the collaboration areas (they're meeting areas, but calling it collaboration areas make it agile or some crap like that) aren't fully enclosed. Everyone in a 30 foot radius gets to sit in on the meeting as well!

From the other side, I get management types telling me to keep my voice down, because I'm disturbing the collaborators. Never mind that I'm trying to get work done by hammering out details with other devs and testers - their meeting that encroaches on my space in always more important. So much more important that their jokes, their laughs, their applause, their voices, and any other other form of noise have no upper noise limit. No sweat though, it's not like I'm working or anything.

Heaven forbid I do anything like open personal email, bank account info, etc. The person to my left, to my right, behind me, and that small cluster of 5 people in that collaboration area can see my screen as plain as day.

But cubicles are somehow terrible.

<comment><USER5> > _Then someone said that open offices offer substantial collaboration for > employees._

> _From the other side, I get management types telling me to keep my voice > down, because I 'm disturbing the collaborators._

> _But cubicles are somehow terrible._

As someone who grew up in the Eastern Bloc, I find this kind of Doublethink almost... nostalgic? Ahhh, the good old days, when we were all following Dear Leader's flawless directives!

<comment><USER6> Sorry...totally unrelated but I remembered your name fellow telescope maker ;) I think I read about your atm journey on cloudynights. Are you the one who did simple turntable grinding machine?

</comment></comment></comment></comment><comment><USER7> This feels like a bizarre mixture of sensible criticism and sour grapes.

Standing desks? Actually pretty great for those who want them! If your back hurts after a day of sitting, go find some option you like better - why should the rest of us be upset by it? Yeah, they're not an option at a lot of jobs, but demanding that everyone standardize on a bad experience because "you're not special" is a great way to make every job awful.

A book a week? Not so bad, especially if it's something light! There are plenty of books you can read in <10 hours, even content-rich ones.

Understanding complexity? Interviewing is a mess, that's a standard belief, but constant time versus exponential time isn't meaningless yet. Start by getting rid of tree reversal questions, not declaring Big-O a useless concept.

And yet there's something pretty good buried under all the impractical complaints. Putting together a "user story" shouldn't be necessary when the task is "our login page is broke, let's fix it". Adding layers of media references and cultural touchstones to every possible concept just creates useless barriers to entry. A/B testing a hundred different features in isolation isn't a viable way to build a product.

So yes: there are a lot of things to criticize, and I know this is hyperbole. It's still a weird mix of justified and left-field attacks.

</comment><comment><USER8> >I never had to shift a bit in a C array in my life! And I never got a compilation error on a white board, when I need an hash set in Java I just use HashSet- _I don't fucking care about the complexity of this code block because I can afford another EC2 instance!_ So fuck you.

No, fuck _you_ for making everything run so slow on our pocket and desktop supercomputers.

<comment><USER9> ...I said, as I shared this article in a JavaScript-powered desktop team collaboration application, and went back to writing a JavaScript-powered server-side application in a JavaScript-powered text editor.

</comment></comment><comment><USER10> Haha, most excellent.

One thing that I'm only now (and stupidly late) realising is that tech journalism almost never critiques new trends.

Sure there are some gut "this fucking sucks" but there is never a real effort to provide some critical thinking about the PR emanating from whichever source.

For example, soylent is the brain child of someone who has possibly crippling [OCD]([http://robrhinehart.com/?p=1331](http://robrhinehart.com/?p=1331)) (Having been blighted by it for most of my teenage and childhood.) It looks like one of his coping mechanisms.

I'm sure its a great product, but I wouldn't want to emulate someone's OCD lifestyle. Yet we are asked to "emulate the habits of these successful XXX" without stopping to ask, are they happy?

Yet no one seems to ask the question: "is this good?" or "whats the logical outcome?" They just seem to be keen to breathlessly relay the PR line, possible with a pithy snap reaction.

I'm not suggesting a flame war for every press release, just a health helping of critical thinking, and some research.

</comment><comment><USER11> _Fuck reading a book a week. No one can read that fast. Let me repeat that -NO ONE CAN FUCKING READ THAT FAST._

Finally someone has the courage to tell the truth. I mean, I get the part about the necessary skimming one has to to do not just get through school, but be a practical, working academic (as described in the HBR article). Or the way that techies need to skim lots of tech books to stay ahead in one's career.

But that's not _reading_ (in the sense of works meant to be _read_ and not just "understood" \-- that is, fiction, or high-quality non-fiction). Which means getting in the author's head; making their language your own (to the point of it sometimes actually does become the language you use, in ordinary speech and writing); getting to know their characters to the point where they have at least a partial feeling of tangible reality to them (like people you actually do know from the physical word); and their stomping grounds, to a point where they feel like places you've actually live in.

That's why it often takes me weeks, sometimes months (and multiple readings) to "read" a book. Very part-time, mind you -- I suppose I could make it go faster, if I made a "system" about it. Yeah, I suppose if I put my mind to it, I could get through a good-sized book in a week or so.

But then I would probably just end up "understanding" the book. Not _reading_ it.

<comment><USER12> Sorry that's not the truth, I read about a book a week. This week I've read 3 and started another 2. The secret is to read for enjoyment, a lot, and eventually you get fast. If it feels like a chore, you're not reading the right books: read something else. If you're enjoying it, it's easy to get carried away and read for many hours at a time.

<comment><USER11> Yeah, I get the "enjoyment" part. What it comes down to is that some people just like to read (certain kinds of things) more slowly, even though they could be reading them more quickly. Guiding principle being: it's not the number of words (or the number of books read in a year), but the intensity of the experience that they're after.

</comment></comment></comment><comment><USER13> > Fuck your crazy work hours.

Yeah!

> Fuck you drinking culture too.

Yeah!

> Fuck your open space floor plans

Yeah!

> Fuck the transparency trend, the post mortem and the 5 whys.

Yea---wait, what? Those other things are reasonable complaints, but wondering why things go wrong and trying to stop them from going wrong for the same reason tomorrow is, you know, good.

<comment><USER14> To be fair, "5 whys" is more of a feel-good rule of thumb way to determine the root cause of errors, but it's rarely as effective as you'd think[1].

[1]:[https://en.wikipedia.org/wiki/5_Whys#Criticism](https://en.wikipedia.org/wiki/5_Whys#Criticism)

<comment><USER13> I concur. Incidents have many causes and different levels of failures, and "5 Why" documents make it too easy to target an easy or politically convenient solution without needing to mention the other failings.

Postmortems in general are fantastic, though. "Here is what (not who, what) went wrong, here is the list of things that made it go wrong, and here are the steps we're taking to make sure that this can't happen again or will not be as bad when it happens again."

</comment></comment></comment><comment><USER15> The irony of the fact that I read this during my morning 30 minute read through of tech news—at Hacker News, the über site, no less—is not lost on me.

Although a funny essay, there's a great deal of truth here, and should make us ask some hard questions about how, why, and when the technology world and its culture should infiltrate the everyday.

<comment><USER16> Now that the 30-minute routine of tech news is done, we shall reflect on this essay during the 30-minute meditation session and add appropriate actionable items to our quarterly and yearly goals.

;).

</comment></comment><comment><USER17> I don't work or live in the valley but that was hilarious and based on the blogosphere probably on point too. Except for the part of the hash map complexity. In fact as the volumes of data grow the complexities become more important, not less. You simply cannot brute force your way out of a bad complexity.

</comment><comment><USER18> Hoping this is the vanguard for a new rebellion against toxic SV-style startup culture, and the nitwits that propagate it

<comment><USER19> Toxic SV culture is ripe for parody, but words won't stop it. What will stop it is when the money stops flowing so easily and the wider economy improves so that it's no longer the place to be for the greedy. Not sure I see both those things happening any time soon, in the meantime Tech is sadly the new Finance.

<comment><USER20> Or, we (engineers) could all take a cue from workers of the past and organize to demand an end to abusive labor practices.

Seriously guys, just because we're making 10x the salary of a miner doesn't mean we're not also generating 100x the money for our employers without being allowed to take part in decisions that effect our lives.

<comment><USER21> You probably aren't making 10x what a miner makes. Mine foremen make around 95K[1]. A regular miner makes somewhere in the range of 40k-55k. Do you make 400k as a software developer? I'm making a broader point here, in that you aren't as seperated from blue collar workers in terms of your economic interests as you may think.

[1][https://www.google.com/search?q=mine+sallaries&oq=mine+salla...](https://www.google.com/search?q=mine+sallaries&oq=mine+sallaries&aqs=chrome..69i57j0l5.2655j0j7&sourceid=chrome&ie=UTF-8#q=mine+salaries)

<comment><USER22> Yeah, but you get to make it without hugely-out-of-your-control health complications. Developers can get fat eating a lot of pizza, but they can run it off. Harder for a miner to avoid all the hazards with the job. As much as I hate the open workspace, I also would prefer being at a computer than doing manual labor in a claustrophobic mine.

<comment><USER21> Yeah, of course. I meant you income -> social position relative to the people who own the capital. There are interesting parallels. Mining companies operate on leased land with leased equipment backed by institutional investors... they keep it lean. The contemporary mine operator isn't totally dissimilar to the CEO/founder of a largish startup in how they approach their business. Yeah, of course writing code won't give you black lung, but you're still working for the man. The coal mine machine operator is a lot more like me than I am like Jack Dorsey.

</comment></comment></comment></comment></comment></comment><comment><USER23> This was so much fun to read. You know why it's funny? Because it's so true. That's why.

<comment><USER24> Seriously, there are so many great points in there hidden between the expletives. Here is one that really touched me:

> And what the fuck all those parties after raising money. Don't you get it? > You just dug your grave a little bit deeper. You should celebrate any day > that you don't have to sell off another part of your company.

</comment></comment><comment><USER25> Although I genuinely miss Valleywag and all the absurdity that it covered (e.g. Clinkle), I'm not sure if this is a fair critique of startup culture outside of having the excuse to say the F word a lot. As someone living in San Francisco, I can say that there are more to startups and startup culture than the stereotypes seen in Medium thought pieces and the Hacker News front page, although given the end of this particular Medium thought piece, that may be the point.

<comment><USER26> > _I can say that there are more to startups and startup culture than the > stereotypes seen in Medium thought pieces and the Hacker News front page._

Yes, but not much.

</comment></comment><comment><USER27> He either completely misses the point, or completely gets it.

Every single one of these "benefits" are very well thought out and calculated shams meant to deceive and manipulate impressionable kids into working insane hours for less than a realistic living wage. _That 's the whole point._

It's just like that circus in the Pinocchio movie.

<comment><USER28> Not quite as exploitative as the music industry prefers to behave in pursuit of profits, but I concur the general top-down structuring of environments like that is not particularly an accident. Like hard seats in a fast food restaurant - they're not supposed to make you want to stay for an extended period of time, in theory.

</comment></comment><comment><USER29> The only takeaway for me is the wondering whether or not the author really thinks you can't read a book a week. I mean, yeah, you have to make time to read the books, but an average length book takes something like 6-8 hours to read, so if you allocate an hour a day (which I maintain is worth doing), you're generally going to be able to comfortably knock out a book a week.

Sure, you're not churning through War & Peace every week, but for regular books, it's really not that hard.

<comment><USER30> His point is that reading is about the journey not the destination. Better to read less books but savour and enjoy them (or if non-fiction is your thing take the time to learn the materials properly) then finish them to say you finished them.

<comment><USER29> I mean, sure, and of course that's right -- but you can do that and still easily read a book a week at the same time.

<comment><USER30> Yeah but don't make that the target. Make having time to read and enjoy it the target.

<comment><USER29> I've known a number of folks who have done "read more" challenges, whether 50 books a year was the target or some other number, and while this is surely anecdotal, the _real_ goal wasn't hitting some arbitrary number, but simply to encourage reading more, and prioritizing reading as a hobby.

As someone whose greatest pleasure is a day off with a good book, it's hard to balance reading with all the grownup responsibilities we have, and as a leisure item, it's usually the first thing cut from a busy day's schedule. Reading a book a week isn't as much about the number, but by gamifying the outcome, you prioritize it above things you might otherwise not.

</comment></comment></comment></comment></comment><comment><USER16> > _Fuck your eating disorders, why the fuck does everything has to be so > extreme with you? On one end of the scale you've got the pizza-guzzling, > office-snack hoarding monster, and on the other end you have the 'I-must- > optimize-every-living-second' douche that only drinks fucking Soylent. > Seriously, what the fuck?_

And from me: also fuck your third extreme, of eating fucking hipster fruit salads all day every day, because everything has to be healthy and natural and organic and stuff. And fuck the way you force it on the industry events, so that I can't get a goddamn pizza on a programming conference because everything now has a catering company providing various kinds of weird-ass vegetarian food. I can eat healthy at home; I come to industry events for the fucking pizza.

There, I said it. I feel a little bit better.

\--

As for the rest of the essay, it's a little heavy on the expletive side, but pretty much spot-on if you look at the media side of things. I'd say things aren't so bad in individual startups, but the overall culture - <USER2> blogosphere, the professional publications, etc. all feel like encouraging and glorifying this kind of nonsense.

<comment><USER31> > I can eat healthy at home; I come to industry events for the fucking pizza.

Really? In most realms outside IT, that's the food you buy when you consider the people eating it not worthy of actual catering. I can understand wanting pizza if the alternative is salad and water, but still.

<comment><USER32> ...And where do you live? If you live in a town with good pizza (New York, New Haven, Chicago, etc.), trust me, pizza shows up at events.

</comment></comment></comment><comment><USER33> I stared coming to hacker news for the tech conversations reading this made me realize how much I have been sucked in to the dark side of it.

</comment><comment><USER34> I keep thinking it's time for the next dot-com collapse. The level of excess is too high. But we haven't had the first really big failure yet. Yahoo and Twitter are almost ready to collapse. Uber is still iffy, because they subsidize rides with investment capital to buy market share and lose money.

<comment><USER35> Theranos was a pretty huge investment (~700M). Would that count?

<comment><USER36> I don't think so, because its failure didn't precipitate a crisis of confidence in the Web 2.0 economy.

</comment></comment></comment><comment><USER37> awesome. so awesome. (actually I did have to shift bits once in a C program..I did some AND'ing and OR'ing. I felt like a man.)

<comment><USER38> You should look into getting an embedded systems job, those programs are full of shift / AND / OR / bit twiddle galore. You'll feel awesome for awhile, but trust me, all that low level bit stuff is sometimes a huge pain.

Now UI stuff, that's where the real fun is!! ;-)

</comment></comment><comment><USER39> I feel like most of the people commenting here missed the closing line.

> But more than all, start-up world, fuck you for making me one of you.

</comment><comment><USER40> Am I... on your lawn?

I'm on your lawn, aren't I?

I should get off, shouldn't I...

<comment><USER26> "Get off my lawn" implies some curmudgeon against newness and progress.

Doesn't say anything for people against things that legitimately suck though.

</comment></comment><comment><USER41> This is pretty much exactly how I felt when I left the startup scene in Denver. So much bullshit.

<comment><USER42> which industry may I ask?

<comment><USER41> I was doing software development for a couple of different tech startups

</comment></comment></comment><comment><USER43> " You should celebrate any day that you don't have to sell off another part of your company."

</comment><comment><USER44> I can't wait to watch this video at the top of Hacker News. I imagine something a la Ed Norton in 25th hour. [https://www.youtube.com/watch?v=TgL_5QcZCMo](https://www.youtube.com/watch?v=TgL_5QcZCMo)

</comment><comment><USER45> > you're not going to get to space

:(

<comment><USER46> Seriously, why'd he have to go there! I've had that dream since the day I was born, and now it's shattered.

<comment><USER16> Here I say, fuck him, I'm going to space no matter what. Low Earth Orbit is the minimum I aim for in this life.

</comment></comment></comment><comment><USER47> > Fuck reading a book a week. No one can read that fast. Let me repeat that > -NO ONE CAN FUCKING READ THAT FAST. How about actually reading that god damn > book?!

What the hell are you even talking about? Can't read one book a week?

<comment><USER48> This one was pretty strange. I often read several books a day...

<comment><USER49> Yeah true, I've read several while writing this comment.

</comment></comment></comment><comment><USER50> Reminded me of this from 25th hour.

[https://www.youtube.com/watch?v=TgL_5QcZCMo](https://www.youtube.com/watch?v=TgL_5QcZCMo)

I was hearing Ed Norton say "fuck you!" as I read this.

</comment><comment><USER51> Aside from what others have said, I got a great laugh out of reading it.

</comment><comment><USER52> Stereotypically entertaining.

Living in the bay area and working for a startup it's easy to relate and it's funny, i'll five the author that.

After the second paragraph it starts getting pretty old though...

</comment><comment><USER53> I don't think you need to censor titles on Hacker News.

<comment><USER48> I wasn't entirely sure. But, hey, this version got to the front page while at least two others didn't -- so I guess it worked.

<comment><USER53> Yes. Censoring a vulgar word makes it seem more naughty than if you spell it out.

</comment></comment></comment><comment><USER54> > Fuck you and your stupid interview questions. Who the fuck thinks of these > stupid fucking questions? I never had to shift a bit in a C array in my > life! And I never got a compilation error on a white board, when I need an > hash set in Java I just use HashSet- I don't fucking care about the > complexity of this code block because I can afford another EC2 instance! So > fuck you.

Startup or not, I wouldn't hire that guy.

<comment><USER54> > Fuck you startups with your extravagant parties and crazy off-site events > that cost way too much money, you're supposed to buy some fucking servers > instead!

So he can continue wasting CPU cycles out of pure ignorance ;)

</comment></comment><comment><USER55> Serious question, what's wrong with deploying 100 times per day? I'll take that over one monstrous semi-weekly deploy.

</comment><comment><USER56> Look, I get the issues with startup culture but this guy doesn't offer any reasonable suggestions on how to fix them and just uses his Medium soapbox to throw a tantrum. If you want things to change, writing an article with 35 "fucks" is not the way to do it.

<comment><USER48> There's a system that more or less works, and generates a much greater innovation to hype ratio. And, that's the system of normal small businesses. The alternative shouldn't need to be mentioned, because everywhere other than SV, it's omnipresent.

</comment></comment><comment><USER57> I'm going to finish building my solar panels cell by cell and learn to live off the land.

</comment><comment><USER58> Hey I like my standing desk :(

it's one of the automatic deals and has presets and --

i don't even eat doritos

</comment><comment><USER59> Funny read. It was certainly comprehensive. I don't think they missed anything.

</comment><comment><USER60> fuck your anger. :)

<comment><USER27> Sometimes anger is justified. And sometimes it calls for a good venting. Sometimes it even calls for a little activism. And sometimes all of these are just futile, because richer people are in control of what you see and hear, who have interest in keeping their pockets full using the hard work of young impressionable kids who don't know the real value of their own time. It's sickening, and the anger is justified. The rant is probably going to be forgotten tomorrow though, and unfortunately won't save a single soul from the startup world.

</comment></comment><comment><USER61> That is so punk rock.

</comment><comment><USER62> I stopped reading at "dwont".

</comment><comment><USER63> I fucking love this post!

</comment><comment><USER64> > Fuck reading a book a week. No one can read that fast.

Now the rest of the complaints are... well at least reasonable to rant about (well, the technical ones are kinda crap, but culture ones are apt).

But this? This is just silly.

Reading a single book shouldn't take someone a week. A good sized book can be read in weekend afternoon if you're really into it. But 3 days of occasional reading should get most writing that isn't incredibly dry polished off.

All that complaint is is the author saying "I don't want to, and I won't make the time to."

<comment><USER65> really? try to read the joy of clojure in one weekend.

<comment><USER66> thanks for reminding me I have to continue reading that book :D

</comment></comment></comment><comment><USER67> Upset ratio means something? Because you irritated a lot of people here in HN.

</comment><comment><USER67> Great article. He knows what he's talking.

</comment><comment><USER68> Meh. I could write this same post about the corporate world stereotypes, but that would be dumb. This person has a problem with healthy people, fat people, people who have an interest in their field, people who work hard and overachieve, just an absurd breadth of random adjectives and interests that make people unique.

It just seems like they wish everyone was the same so they wouldn't be compared to the tons of people who've found success in the 'startup world'.

2/10, barely entertaining.

<comment><USER69> Maybe we need a HN edition.

Fuck you HN, and your overly critical and serious comments complaining about how the article isn't new, isn't cool, isn't specific enough.

Fuck you HN for feeling the need to comment just to get your voice out there, just to put something down, just so you can add your snide remark at the end to prove your own intelligence to your peers.

And fuck _me_ , for doing all of the above in pointing that out.</comment></comment>