Right to Privacy a Fundamental Right, Says Indian Supreme Court - <AUTHOR> https://thewire.in/170303/supreme-court-aadhaar-right-to-privacy/ <comment><USER4> A lot of conversations about expanding rights, end up with a distinction between positive and negative rights. A right to water, is different to free speech. For everyone to have a right to water, someone needs to provide the water or be held accountable for not providing it. A default, state culprit needs to be designated.

Privacy though, privacy is like speech or equality before the law or presumption of innocence. You have it by default and if it's denied there is a culprit.

Even in this case, we seem to have a hard time expanding rights. I say expanding, but privacy is a right in many places, formally. But, the interpretation of that right is very weak.

Anyway… if we're to make privacy a right with serious intent then there needs to be a willingness to break eggs, bear a cost. The right to free speech, conscience, affiliation , assembly and other political freedoms mean we need to tolerate and protect the proverbial nazis' rights to try and spread their politics. Bitter pill for anyone scared of a proverbial nazi takeover.

Are we willing to bear the (fear-based, mostly) costs in the fight against the terrorism demon. The economic costs that will be claimed by companies relying on data? If we have a strong yes, I think we can start building the real framework of laws and conventions that will secure a right to privacy for the next few generations.

Absolute principles require some sacrifice.

<comment><USER5> > _The right to free speech, conscience, affiliation , assembly and other > political freedoms mean we need to tolerate and protect the proverbial > nazis' rights to try and spread their politics._

I'm not convinced I know how I feel about this. I want to believe this is a false dichotomy. Can we have _limits in polite society_?

I keep thinking of the _paradox of tolerance_ [1], which states, in brief, _that if a society is tolerant without limit, their ability to be tolerant will eventually be seized or destroyed by the intolerant._

1\. [https://en.wikipedia.org/wiki/Paradox_of_tolerance](https://en.wikipedia.org/wiki/Paradox_of_tolerance)

<comment><USER6> Are we really to the point where Nazi ideologies are spreading like wildfire, to the point that their "intolerance" will be seized by our "tolerance?"

To me it seems like the opposite is happening. Nazi ideologies are marginalized and meaningless, yet propped up like some huge threat to us... like they might take over. And this is being used as justification for limiting free speech, in a hyper-politically correct society where even micro- aggressions could be categorized as "hate speech."

Perhaps we could just recognize and acknowledge that, while reprehensible, it's not like Nazi believers are anything more than a rounding error in normal society. And then move on with our days.

<comment><USER7> I would argue we have gone the other way: we are so busy stomping down Nazi like ideologies that the stomping it down has become as bad of hate speech as the Nazis were.

<comment><USER8> Until the government begins a mass extermination program for haters, I can't help but feel this is a hyperbolic argument. Not granting permits to march is totally incomparable with genocide.

</comment></comment></comment></comment></comment><comment><USER9> A word of caution before being carried away by the words "fundamental right". According to the judgement, the right to privacy is fundamental (as an offshoot of the fundamental rights of freedom of life and personal liberty guaranteed under Article 21 of the Indian Constitution).

Asserting it as a "fundamental right" raises the bar on what restrictions can be put. But reasonable restrictions can still be put.

A separate bench of the SC is now going to test the validity of the Aadhaar Act on the basis of whether the restrictions are reasonable in the light of privacy being a fundamental right.

Edit: The Aadhaar Act is an act that allows for the government to collect biometric and other personal data that can be used to identify an individual for various services (including but not limited to governmental benefits).

<comment><USER10> At least put in some effort to explain on what you mean. You didn't mention what type of restrictions can be put in as well as why getting carried away by the words fundamental right is something to be cautious about.

<comment><USER11> "Reasonable restrictions" are not very well defined in the Indian constitution. They are quite broad and open to interpretation on a case-by- case basis.

      "... the State can impose reasonable restrictions in the
      interests of the sovereignty and integrity of India, the
      security of the State, friendly relations with foreign
      States, public order, decency or morality or in relation
      to contempt of court, defamation or incitement to an
      offence."

<comment><USER10> Can reasonable restrictions be put on fundamental rights as well? So you are suggesting that the right to life has reasonable restrictions -- that in order to be friendly to a foreign state, the nation state can murder their citizens?

<comment><USER12> > So you are suggesting that the right to life has reasonable restrictions

Please read what he said, he is not saying that, the thing he quoted is, and that thing I believe is the constitution as it stands now.

</comment></comment></comment></comment></comment><comment><USER13> As an aside, this is a decent example of why some people oppose bills of rights. As I understand it, the argument is that a bill of rights is considered exhaustive; if it's not in the bill, it's not protected.

By contrast, countries without a bill of rights are free to interpret their constitutions through implied rights, in ways that make sense in the context and allow the constitution to adapt to new or developing circumstances.

See for example, [https://en.wikipedia.org/wiki/Australian_constitutional_law#...](https://en.wikipedia.org/wiki/Australian_constitutional_law#Implied_rights)

Not entirely sure which side of that argument I'd sit on.

<comment><USER14> At least in the U.S., that is not the real issue. Nobody disputes that the Bill of Rights is not exhaustive. But just because the Bill of Rights is not exhaustive does not mean that the Supreme Court may make up new rights over time. Legal conservatives in the U.S. adhere to the idea that for a right to exist, society must have recognized it as a right at the time the Constitution was written. In other words, you do not have to find the right in the Bill of Rights, but you do have to find it _somewhere_.

<comment><USER15> > Nobody disputes that the Bill of Rights is not exhaustive.

Unfortunately, that is not true. Robert Bork famously disputed it, even going so far as to deny the validity of the ninth amendment. Many conservatives support Bork's position today, e.g.:

[http://www.nationalreview.com/article/336142/judge-borks- ink...](http://www.nationalreview.com/article/336142/judge-borks-ink-blot- ramesh-ponnuru)

They do this because it's a logical pre-requisite for overturning Roe v. Wade.

<comment><USER16> > They do this because it's a logical pre-requisite for overturning Roe v. > Wade.

It's really not, though, it's just a convenience; one could easily find grounds tomreverse Roe.and even the subsequent abortion decisions without just ignoring the Ninth Amendment. The real reason is that the Ninth Amendment is irreconcilable with the narrow mode of textualism that I personally think of as "four corners" or "sola scriptura" textualism, that seems to portray the Constitution's text as complete and needing no external historical, cultural, etc., understanding to interpret. Because the Ninth Amendment specifically lays out that their are rights which existed and remain protected wothout being enumerated in the Constitution, it necessitates looking beyond the four corners of the Constitution to identify what those rights are.

<comment><USER15> > one could easily find grounds to reverse Roe

No, it's not so easy. Conservatives have been trying unsuccessfully to overturn it for 44 years. (Actually, that's not quite true. The effort to overturn Roe didn't actually start until 1979, fully six years after Roe was decided on a 7-2 vote. And the truth is they don't really want to overturn it. They really just want to use it as a wedge issue.)

<comment><USER16> > No, it's not so easy.

It's easy to construct a coherent interpretation of the Constitution that invalidates Roe without nuking the Ninth Amendment (the thing with fuzzy penumbras and unenumerated rights is that it is very _easy_ to come up with equally coherent interpretations of what their scope is.)

It may be hard politically to get a Court majority appointed and confirms that agrees with eliminating abortion rights whatever the logical basis (or even without consensus on the basis; court decisions where there is a majority on the result but not the rationale are possible, so you don't need a unifying rationale to get a result.) But that's a different issue and nuke-the-Ninth types don't help that.

<comment><USER15> > It's easy to construct a coherent interpretation of the Constitution that > invalidates Roe without nuking the Ninth Amendment

Really? What is it?

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> " _The petitioners, former Karnataka high court judge Justice K.S. Puttaswamy and others, had contended that the biometric data and iris scan that was being collected for issuing Aadhaar cards violated the citizen's fundamental right to privacy "_

I find the above interpretation of privacy troubling. In order for the government to effectively distribute social services to the needy, cutting out corrupt/inefficient middlemen, it needs a way of effectively verifying someone's identity, so that people can't dual-enroll themselves. Having people provide biometric identifies such as Iris scans, if they want to qualify for government services, seems like a perfectly reasonable way to do this. I would also contend that when most people declare the importance of privacy, they are talking about their actions and lifestyle, not fingerprints or Iris scans. It would be sad if this ruling prevents the government from efficiently providing social services to help the poor.

<comment><USER18> Not really. He means that govt cannot _force_ every citizen to undergo iris scan etc. for obtaining Aadhar card. I would like to get Aadhar without iris scan (and am willing to let go of secondary benefits like LPG subssidy etc). Such an option doesn't exist as of today. _I_ , as an _individual_ , will exercise my right to privacy by deciding whether to give my biometrics or not. Govt should not decide on my behalf.

<comment><USER19> An Aadhar card is just an identity document. You don't have to get one if you don't want any benefits linked to it. Just use some other ID.

<comment><USER18> There are already "benefit" cards like LPG card, ration card, BPL card, etc to get those benefits. Why bother with Aadhar then? The answer is, consolidation. Aadhar is meant to be _the_ identity card. I don't want to carry big passport book, etc. wherever I go.

<comment><USER20> That consolidation, when combined with biometrics, means you can never get it replaced. Your only recourse to identity theft with your biometrics, or the fact that biometric error rates are very high, is to just live with it.

</comment></comment></comment></comment></comment><comment><USER21> I was a bit surprised by the fact that all of the judges' opinions, which are embedded in the article, were in English.

But it turns out that English is the official language of the Indian Supreme Court, and the court has even gone so far as to rule that it need not provide a Hindi translation of its rulings:

[http://economictimes.indiatimes.com/news/politics-and- nation...](http://economictimes.indiatimes.com/news/politics-and-nation/court- language-is-english-says-supreme-court/articleshow/50080870.cms)

It seems kind of bizarre to me that as an American English speaker half way across the world, I'm in a better position to read and comprehend the Indian Supreme Court's rulings than a great number of non-English-speaking Indians.

<comment><USER22> Language is political in India and I don't claim to understand half of it. Probably since the establishment of the republic after attaining independence there's been a tension between Hindi-speakers (who were the plurality of the population) and others. English was a "neutral" language and it helped that a lot of the administration, bureaucracy, and law carried over from the British already used it. Not to mention that the most influential leaders of the independence movement (Jawaharlal Nehru, Mahatma Gandhi, Sardar Patel) were lawyers educated in England.

</comment></comment><comment><USER23> As it should be. The world is quickly approaching a very Orwellian feature unless we take steps to stop it. Right to privacy should be right up there with the right to free speech.

<comment><USER24> It is, according to the article 12 of the Universal Declaration of Human Rights [0]. It just gets conveniently sidetracked when money is to be made.

[0] [http://www.un.org/en/universal-declaration-human- rights/](http://www.un.org/en/universal-declaration-human-rights/)

</comment></comment><comment><USER25> The Indian government has been mandating all utility providers to link the biometric details of the subscribers to their account. With the rising number of criminal cases due to misuse of laws such as those used in marital disputes, the government can easily control what services to provide or deny its citizens based on centrally available biometric database which it could not have done before. Of course this is just a crazy theory for now which can hopefully never happen due to this much needed judgement.

</comment><comment><USER26> A lot of comments in this thread are misleading. What the Supreme Court has done is that it has expanded the interpretation of an existing Fundamental Right ('Right to life') to include a 'Right to Privacy'. Now this means that if any law is made that infringes on an individuals privacy then it'll be tested for reasonableness.

So before this judgment, the legislature could have for example made a law requiring all internet activity to be reported to the government or criminalized homosexuality (existing law) and anyone challenging the law could not claim that the law violated his privacy as such a right was not recognized.

After this judgment, such an argument could be made and the courts would test whether the violation of one's privacy is a reasonable restriction or not. So a law requiring you to have number plates on your car to be captured by traffic cams, or KYC norms for Bank accounts, reporting of your financial data to tax authorities could be held to be a reasonable restriction whereas laws such as criminalizing one's sexual orientation could be held unreasonable.

What prompted this constitutional reference was the governments 'Aadhar Scheme' which compelled 1.2 billion citizens to hand over their private biometric data to the government if they wanted to claim any government services. This judgment provides the test to be used while deciding whether the law and its applications are constitutional. Most likely the scheme will not be struck down in total but specific instances will be tested on a case by case basis. (eg. Aadhar can't me made compulsory for getting health services but can be made so for a Gun Licence as the latter seems reasonable but the former may not)

</comment><comment><USER11> I'll wait for the full text of the judgements before celebrating. The ruling apparently consists of 6 judgements and should be available shortly. Hope this reins in the Aadhaar monster without leaving any wiggle room for the government to exploit.

edit: The judgement is now available here: [http://supremecourtofindia.nic.in/pdf/LU/ALL%20WP(C)%20No.49...](http://supremecourtofindia.nic.in/pdf/LU/ALL%20WP\(C\)%20No.494%20of%202012%20Right%20to%20Privacy.pdf)

<comment><USER27> What a fantastic document. Quotes from John Stuart Mill, precedents from India, UK, US, South Africa, Canada, and the European charter. Looks like a very scholarly judgment, worthy of study, worth every one of the 597 pages!!

<comment><USER20> I've read only a few parts of the judgment, but it reads like poetry while at the same time being crisp and powerful! Even when the hearings were on, there were many references and discussions that showed the broad scope of accepting and considering jurisprudence from elsewhere and seeing what would benefit people.

That this was an unanimous verdict makes it even better. I was apprehensive until today morning, and after hearing the verdict, I've been ecstatic!

<comment><USER12> Sorry that someone down voted you. I used to get puzzled by such behavior, now no more. I just upvotes it back to compensate, if only partially.

Lot of partisan voting going on here

<comment><USER20> Thanks. I'm kinda used to that on HN since many people who read my comments seem to be absolutely pro-Aadhaar/pro-government and don't seem to like any critique of the system and how it's putting people in danger (existentially and otherwise).

</comment></comment></comment></comment></comment><comment><USER28> This is such a relief ...

Also this is the man behind the fight

[https://barandbench.com/expecting-unanimous-decision- justice...](https://barandbench.com/expecting-unanimous-decision-justice-ks- puttaswamy-right-privacy-verdict/)

</comment><comment><USER29> Here's what the Attorney General - the government counsel - <USER2>

> He said that in developing countries, something as amorphous as privacy > could not be a fundamental right, that other fundamental rights such as > food, clothing, shelter etc. override the right to privacy.

It's a question which has alway bothered me. What happens when two fundamental rights clash with each other?

<comment><USER11> IMO, this is a specious argument, especially in the Indian context. Access to food, clothing, and shelter are NOT fundamental rights[0].

On the other hand, the Aadhaar program (which is the context the above argument was made for) can be viewed as impinging on the fundamental "Right to Constitutional Remedies" as its governing body the UIDAI is set up in such a way that the UIDAI itself has sole authority on whether or not a grievance needs the intervention of the established judicial system[1].

[0][https://en.wikipedia.org/wiki/Fundamental_Rights,_Directive_...](https://en.wikipedia.org/wiki/Fundamental_Rights,_Directive_Principles_and_Fundamental_Duties_of_India)

[1][http://www.firstpost.com/tech/news-analysis/the-uidai-has- in...](http://www.firstpost.com/tech/news-analysis/the-uidai-has-insulated- itself-from-any-blame-or-responsibility-for-leaks-in-the-aadhaar- ecosystem-3702123.html)

<comment><USER29> > Access to food, clothing, and shelter are NOT fundamental rights

This is not true. Food, water, education and shelter are fundamental rights under Article 21.

<comment><USER11> IANAL and I could be wrong here, but I think thats only partially right.

Although article 21 itself doesn't say anything about food, shelter etc, the courts have established precedent by including those in their interpretation of article 21 and the directive principles in the past. However, I'm not sure there has been a ruling specifically affirming those rights as being fundamental, and the text of the constituion definitely does not mention them as fundamental rights. The full text of Article 21 is simply: "No person shall be deprived of his life or personal liberty except according to procedure established by law."

Since the right to education is specifically included under Article 21(A), it is a fundamental right.

In the specific case of Aadhaar and UIDAI as they currently exist, I think the "Right to Privacy" which has now been affirmed, and the "Right to Constitutional Remedies" (Article 32) should take precedence.

Right to clothing isn't mentioned anywhere as far as I can tell.

<comment><USER29> > However, I'm not sure there has been a ruling specifically affirming those > rights as being fundamental, and the text of the constituion definitely does > not mention them as fundamental rights

Yes, there are rulings specifically affirming food, water etc. as fundamental rights.

</comment></comment></comment></comment></comment><comment><USER30> To HN readers outside India, who are unaware of the BG behind this historic judgement. It all started off with a series of litigations against the govt's mandate to link India's unique identity system - Aadhar (which includes biometric data) to existing Indian identification systems for different purposes.

In HN fashion, if you are interested to know about how the govt pulled of the huge technical overhead of storing billion records; it could be seen in talk here by it's chief architect - [https://www.youtube.com/watch?v=08sq0y8V1sE](https://www.youtube.com/watch?v=08sq0y8V1sE)

</comment><comment><USER31> seems like they had a good session - from other news they took down that instant Muslim divorce. As one can guess that divorce procedure isn't gender symmetric.

[https://www.nytimes.com/2017/08/22/world/asia/india- muslim-d...](https://www.nytimes.com/2017/08/22/world/asia/india-muslim- divorce-triple-talaq.html?mcubz=3)

"In India, Muslim men have been able to end their marriages by saying the word "talaq" — Arabic for "divorce" — three times. They could do this in person, by letter or even over the phone."

</comment><comment><USER32> Can someone more well-versed in Indian law help me understand : Does this ruling prevent collection of biometrics or restrict it somehow under the Aadhar system?

Also, I recall the Indian Government was pushing Aadhar Pay - a biometric fingerprint scan based PoS payment / verification system (likely it is already deployed, I don't live there so I don't know). What happens to that now?

<comment><USER33> (not a lawyer, but have friends who are)

When the Government of India (GoI) mandated Aadhar for provision of many services (subsidies, marriage certificates, death certificates, collect taxes- people without aadhar can no longer pay income tax - etc) it was challenged legally in the courts. One of the main arguments was that Indian citizens had a fundamental right to privacy, and such 'enforced' collection of biometrics violated that right.

The Attorney General (appearing for the government) argued that there was no such fundamental right, and that citizens had no right to privacy.

This (whether or not privacy is a fundamental right) had to be resolved before these cases could move forward.

So the question was 'forwarded' to a 9 judge 'constitutional bench' to rule upon. Today all 9 judges ruled that Indian citizens had a fundamental right to privacy.

so now the Aadhar specific cases can go forward, now that there is a 'constitutional bench' ruling. A 5 judge bench will now consider those cases and rule upon the legality of Aadhar enforcement.

This ruling, that privacy is a fundamental right, will obviously affect the outcome of the Aadhar specific case(s) but how exactly - including what restrictions if any, could be placed on biometric collection via aadhar - <USER3> not known (yet).

That is my _non lawyerly_ understanding of where things stand.

<comment><USER32> So, basically, this has opened the door to debate about the legality of collecting biometrics, but we still have to wait for official rulings to see if a stop is put to collecting that data under the Aadhar umbrella?

<comment><USER33> That is how I understand it, yes.

This is a 'high level' ruling, which unlocks the 'deadlock' on the cases about the legality (or otherwise) of biometric collection via Aadhar for specific government schemes.

The Attorney General's argument that citizens have no fundamental right to privacy has been invalidated/overruled/whatever-the-correct-legal-term-is, by the constitutional bench. He (and his team) have to find new arguments now. [1]

The lawyers of _both_ sides on _those_ cases, now have to proceed on the assumption that privacy is a fundamental right. The pro-govt (so pro -aadhar) side will likely argue for 'reasonable restrictions' on the right. The anti govt side will likely argue that such restrictions are not 'reasonable' and that aadhar violates fundamental rights (or so my lawyer friends tell me [2]).

[1] Tangential: The AG who made that argument has retired, and there is a new AG who will appear for the government.

[2] They are probably oversimplifying, so I can get the gist, the same way I would if I had to explain some complex programming to them. I'm _not_ a lawyer. :-)

</comment></comment></comment></comment><comment><USER34> This is what Indian government said:

Citizens don't have absolute right on their body, privacy argument bogus, govt tells SC

[http://www.firstpost.com/india/aadhaar-mandatory-citizens- do...](http://www.firstpost.com/india/aadhaar-mandatory-citizens-dont-have- absolute-right-on-their-body-privacy-argument-bogus-govt-tells- sc-3420398.html)

</comment><comment><USER30> "Privacy is about the freedom of thought, conscience and individual autonomy and none of the fundamental rights can be exercised without assuming certain sense of privacy". argued Mr.Subramaniam.

It would be interesting to see if there are more specifics w.r.t data security in the judgements. I smell a criminal lawyer cooking up the ways this judgement would aid his clients for not opening their computer, smartphones to police!

The judgement would be widely shared worldwide, the people outside India who isn't familiar with Supreme court judgements from India; keep Merriam-Webster nearby.

</comment><comment><USER35> Not sure what will happen, I want both this and Aadhar.

<comment><USER12> Could you elaborate on your definition of 'Aadhaar', or stated in other words what is it that you want 'Aadhaar' to provide ?

<comment><USER35> The plea is also about invalidating Aadhar, if that is also done it would be a huge setback to all developmental activities. A safeguarded, private Aadhar is the way to go in my opinion.

<comment><USER36> Any development activity that can be done with Aadhar, can be done without it too.

<comment><USER35> That has been tried for decades with rampant corruption and needy missing the aid.

<comment><USER12> And why would that change with Aadhaar ?

Corruption is hardly a technology issue, especially in an environment where corruption is so passe and enjoys patronage from the entirety of the polictical spectrum. Example, to disrupt the blackmarket of kerosene they started dyeing it, and that mattered zilch, because people were selling and buying dyed kereosene in the blackmarket without batting an eyelid. Everyone looked the otherway... wink wink.

<comment><USER35> It's not a matter of would, it already has. So many subsidy/benefits accounts have been closed. Just search for news stories on this.

<comment><USER12> I doubt that is anything new. Political parties in power try to squelch the money stream of its competitors. Aadhaar or no Aadhaar they will find a way and have (sometimes they would rather look the otherway and share the 'profits').

On a related but tangential set of events: none of the bigwigs caught in the demonetization net had connections with the current party in power, but had patrons among the others. It is possible that the current party (/alliance) is so pristine and pure that they none of their members have any link with the illegal cash hoarders and there is no actionable evidence. I just dont find that a realistic explanation. A claim like that will need a lot stronger evidence.

But anyway, you did not comment on the fact that corruption is not a technological problem and technology will not solve it (and has not solved it). It still would be great to know why would Aadhaar succeed where others have not.

BTW I am sincerely willing to be convinced, but I do swear by the guideline that exceptional claims need comparably exceptional evidence or a reason.

<comment><USER35> You may think I don't have an argument and rightfully so, but honestly I don't care enough to search for all the news items where this was established.

<comment><USER12> > You may think I don't have an argument

Not at all. I want to learn and soak in the opinion and form/reform my own. I am quite sure citizens on the different sides of this argument have sincere good intentions as their motivations.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> On the one hand Aadhar is so convenient. If I want a phone number or a bank account, I can simply identify myself with my thumbprints and iris scans and get it activated immediately without paperwork. This has really made things easier for people. Using biometrics also reduces fraud when claiming benefits from the government and maybe makes the process easier as there is again no paperwork, and it is easy to make claims.

But on the other hand, all this makes it so easy to track anyone. All your bank accounts, cards, phone numbers, internet connections would be linked to your Aaadhar number and would be centrally accessible. This is a privacy nightmare. I am already getting frequent messages from my phone company to link my phone number with my Aadhar number, or let it be deactivated.

All this information would be in the hands of government officials. The Indian bureaucracy is notorious for the corruption everywhere. What if you could purchase somebody's data through an "agent" \- get access to everything that they do, everything they buy, everyone they transact with, everyone they communicate with, contents of every message they send to anyone at all - imagine the kind of possibilities this opens up for negative minds.

Besides this, someone could just hack the data and maybe leak all of it. Someone recently created an app that would let you get anyone's details including their phone number, address, etc. by typing in their Aadhar number. It was taken down a month ago. I'm not sure about the exploit but it was related to using plain http instead of https somewhere. I checked one of the Aadhar linked projects and found that they were using an open source library in the backend which wasn't up to date, and the version being used had some documented security vulnerabilities. I wonder how safe peoples' data really is.

A large number of Aadhar numbers have already been leaked thanks to government websites. It is possible to extract a person's fingerprint or iris scan using photos of their hands or the face in specific conditions. If the person has linked their bank account with Aadhar which is getting compulsory, one could take out money from their accounts by impersonating their prints or iris scans. Fortunately there is an option to protect yourself from this - go to the Aadhar website and lock your biometrics data. If used regularly this can protect people from "biometrics theft", but the biometrics are unlocked by default, and for 99% of the people they are going to stay that way.

</comment><comment><USER38> An amazing talk from couple weeks ago on the details of Aadhaar and how it was "implemented" and why this court ruling is super important both in India and closer to the west: [https://www.youtube.com/watch?v=iCkhupMROZU](https://www.youtube.com/watch?v=iCkhupMROZU)

</comment><comment><USER39> After 70 years of independence - right to privacy is recognised as a fundamental right by the Supreme Court of India. Individual rights especially privacy underlie the cornerstone of democracy - Liberty. A small step for Indian Supreme Court - a giant leap for 1/5th of mankind!

Welcome democracy. Bye bye mobocracy!

</comment><comment><USER11> Full text of the judgement is available[0]

Fair warning: its pretty long (547 pages!)

[0][http://supremecourtofindia.nic.in/pdf/LU/ALL%20WP(C)%20No.49...](http://supremecourtofindia.nic.in/pdf/LU/ALL%20WP\(C\)%20No.494%20of%202012%20Right%20to%20Privacy.pdf)

</comment><comment><USER40> I'm not sure if I read it here, but there was a great example given on how to answer people with approach of "if you are not doing anything wrong, you have nothing to hide".

Using this logic, just recently I somewhat won an argument with my fiancee. She always believes that I'm hiding something on my phone because she doesn't have PIN to it and because I'm unwilling to give it to her, she assumes the worst.

Therefore I made a bet. I asked her what is she doing in bathroom? She answered she does what everyone else's is doing: #1, #2 or showering. I replied you must be doing something wrong or maybe illegal, since you always not only close the door, but you lock it as well! We had short argument back and forth about obviously how it is not about hiding something, but rather about enjoying your own time in privacy, and I think she kind of got it.

We have a bet in place for 3 months now that when she leaves the door wide open while in bathroom, I will give her code to my cellphone. So far I haven't had the need to give it out just yet :)

</comment><comment><USER41> Privacy is a tricky thing to make a right in terms of where you draw the line. Hidden cameras in the bedroom illegal, but a right to a private table at restaurants wouldn't be practical.

I'm not quite sure where you'd set the boundaries.

</comment><comment><USER42> Will this help push more privacy centric companies toward operating out of India?

<comment><USER43> It didn't really help push them to operate out of Germany, and the German constitutional court established privacy as a fundamental right in 1983. So ... hopefully, but I wouldn't hold my breath.

</comment></comment><comment><USER44> Copy of the judgement

[https://drive.google.com/file/d/0B8zp4Q3w9CfqRTA0YUd4clY1RFE...](https://drive.google.com/file/d/0B8zp4Q3w9CfqRTA0YUd4clY1RFE/view)

</comment><comment><USER45> They also made sexual orientation a right as well. read further into this ruling, it is just more than privacy at the top level. they went on to make sure people/prosecutors understand what they really mean

</comment><comment><USER46> I'm not sure what this has to do with Aadhaar, although the initial petition mentions it I think.

Aadhaar is setup as a way of proof of identity and not proof of citizenship. I for one did not get an Aadhaar until a week ago! The only reason I had to was a company that I applied to, said that please use your full name as mentioned on your Aadhaar card.

India is a bureaucratic mess. And as UG Krishnamurti put it very succinctly, India is a failed country. As mentioned elsewhere in this thread, we desperately first need to focus on poverty first.

<comment><USER47> > India is a bureaucratic mess. And as UG Krishnamurti put it very succinctly, > India is a failed country. As mentioned elsewhere in this thread, we > desperately first need to focus on poverty first.

Poverty is difficult to address in a nation as large as India. Such a problem quickly approaches intractability. What are some solutions you envision to help alleviate poverty? There could very well be a huge opportunity for a startup in this space.

I feel like without requiring Aadhaar for benefits, it's impossible to ascertain or measure who is really under the poverty line or not.

</comment></comment><comment><USER48> But they also prohibit use of strong encryption, so that internet traffic could be snooped upon...

<comment><USER49> Are you confusing the Indian govt/courts with some other country?

<comment><USER11> This is currently a grey area. All ISPs in India have to abide by their licensing terms with the Department of Telecommunication which restricts encryption to 40 bit RSA or equivalent. Any higher grade encryption can only be used with special permission and requires the decryption keys to be submitted to the DoT.

Whether or not this restriction also applies to end users and non-ISP organizations hasn't yet been tested in the judicial system AFAIK.

<comment><USER49> You have a link to that? Either way, I'm not sure how that would be implemented, other than outright blocking sites that are HTTPS-only. But I don't think blocking Google, Facebook, Whatsapp and other major websites is going to fly. I have no doubt that the Indian government would like to read people's communications and internet history, but that's not possible today.

<comment><USER11> [https://cis-india.org/internet-governance/blog/how-india-reg...](https://cis- india.org/internet-governance/blog/how-india-regulates-encryption)

AFAIK, the government has not attempted to prosecute anyone for using stronger encryption, and other government departments/organizations have made conflicting recommendations, especially when it comes to online banking and capital markets. Barring new regulations that clarify the government's position, the status quo is that ISPs cannot apply strong encryption themselves, but are not obligated to prevent their users from doing so.

At least one ISP has gone beyond this mandate and tried to block the use of stronger encryption by their customers[0].

[0][https://www.privateinternetaccess.com/blog/2017/07/indian- is...](https://www.privateinternetaccess.com/blog/2017/07/indian-isp-wont-let- users-use-128-bit-256-bit-encryption/)

</comment></comment></comment></comment></comment><comment><USER50> Would this verdict affect Joint Cipher Bureau's SIGINT ops?

</comment><comment><USER51> Thank goodness someone did it.

</comment><comment><USER52> I for one, have no idea what this really means. Can anyone explain why this ruling is not totally useless ?

<comment><USER53> Currently, Indian govt is making it mandatory for everyone to have AADHAR card(enrolment of which requires biometric scan) for basic services like opening bank account, provident fund, filing income tax returns etc, making it necessary for everyone to enroll for AADHAR. This judgement will be used for removal of AADHAR requirement.

<comment><USER52> Biometric is just stronger identity. This can be done in a weaker way using Passport/PAN card.

Does Right to Privacy mean that the govt. cannot identify individuals ? How does it then provide differential services ?

<comment><USER12> Thats moot unless every significant access point has a means and financial viability to verify the biometrics.

Even with such existing 'weaker' identities we are nowhere close to the quality of service that such 'weak' identies can support. Lets address the problem and not divert the issue with "shiny tech... look a squirrel". I would be more sympathetic if we are already in the ballpark of the quality of service that these 'weak' identities can support and we are getting bottlenecked there.

To put it charitably, with Aadhaar we are optimizing something that is not the bottlneck.

<comment><USER53> Right to privacy here mean, govt cannot force citizens to give up their biometric for simple things like creation of bank accounts. Till now, PAN card was the only identification needed.

</comment></comment></comment></comment></comment><comment><USER54> It says a lot about where we are headed that the Supreme Court had to say this.

<comment><USER55> I think this is needless alarmism. I am glad due process was followed, and what was previously a grey area has now been made clear.

You must read the judgement & the cases they cite before making such blanket, unsubstantiated assertions. There's been a history of cases that this judgement rests on, many of which guided & led to the conclusions drawn by this 9 panel of judges. [1]

I don't understand what value a blanket statement such as this adds to the conversation. Do you believe things were better in the 1970s? 1980s? If so, please substantiate your belief with evidence.

Do you subscribe to the trivial, cynical notion that our society is going to dogs? if so, let us have a conversation on why I disagree. But seemingly empty, vacuous but emotive statements such as these do not necessarily lend themselves to constructive discussion, IMO.

[1] [http://supremecourtofindia.nic.in/pdf/LU/ALL%20WP(C)%20No.49...](http://supremecourtofindia.nic.in/pdf/LU/ALL%20WP\(C\)%20No.494%20of%202012%20Right%20to%20Privacy.pdf)

<comment><USER20> When considering the fact it took close to two years to even constitute a bench to hear this case, it doesn't really sound alarmist to me. Plus, many Aadhaar related cases have been pending hearing for years now while the government blatantly ignored multiple directives from the Supreme Court to keep it optional and not deprive anyone of any benefit "until the matter is decided one way or another" (paraphrasing what the court said).

Aadhaar could still be a fait accompli for the government and continue, which would be sad in many ways. If you believe Aadhaar is the best thing since sliced bread and has no issues, please check Rethink Aadhaar [1] for the issues as well as the history of the cases and have a look at Scroll's Identity Project. [2]

[1]: [https://rethinkaadhaar.in](https://rethinkaadhaar.in)

[2]: [https://scroll.in/topic/38792/identity- project](https://scroll.in/topic/38792/identity-project)

</comment></comment></comment><comment><USER56> When the US Pentagon website has been hacked quite recently, some in this Government think they can make the Aadhaar data completely secure.

<comment><USER57> A website being hacked has nothing to do with private information being leaked. The website is just a facade, it doesn't contain Pentagon secrets.

</comment></comment><comment><USER58> Can we expect such Judgement from Chinese regime?

</comment><comment><USER59> Privacy : You have a right to try to keep things as private as you want. You should not be prosecuted for merely trying to keep things private.

Your responsibility :

1\. Don't share things that you want to keep private.

2\. Carefully weigh the trade offs when you agree to share things about you. There is no retroactive privacy on things that you yourself shared.

3\. You can attempt to retract what was shared about you, but you can't hold society responsible for successful retraction of that piece of information, from media or minds. You can add addendum e.g. an apology from someone, you can claim damages, but we can't rewind time.

Government responsibility:

1\. Don't criminalize people trying to keep things private. This would be similar USA Fifth Amendment, do not force people to share what they don't want to share. Government can ask "What crimes you committed in the privacy of your home?", but it can't force people to answer that question or punish for not answering it.

2\. You can't plead fifth and deny proving your identity when you want to take food stamps from government, or when you get unearned tax credit. Just like in any transaction, Government can ask you to prove who you are and may demand increasing levels of proof depending on the transaction. Your choice would be to not participate in such transactions, in certain situations you implicitly give permission to Government to demand proof of identity from you, e.g. if you request a loan to dig a well or subsidy to buy fertilizer or collecting unemployment benefit. Security of exchange of money from government to people is Government's responsibility and it may demand increasing levels of identification depending on the nature of the transaction, as deemed appropriate by abused observed or potential for abuse. In places with high corruption rates, strong identification would be required and would be appropriate. I don't think people would be OK if someone collects their pension using just name, address and birth date, and government throwing hands in the air accusing you for not protecting your name, address and birth date.

What you can't do:

1\. Make the world forget what it already knows. Can't ask Google to delete a piece of information about you from entire internet, once you yourself post it on Blogger. You can delete the post from Google, you can delete your account, but you must realize that once something is not private, you have no control over who has seen it and how many formats/copies of that information got created.

2\. Get into a contract to drop certain privacy and then deny fulfilling the contract because of privacy rights. E.g. a model can't say that she won't show her face on a fashion ramp because of privacy after taking payment. A storybook author can't say that she won't share her book with publisher because of privacy after taking payment.

3\. Make a demand that a private entity, on its private premises, can't have monitoring equipment. A store may decide to have cameras at the self checkout lanes, and it may deny self checkout to folks with full face covering. Your choice would be to not shop at such places, you can't use law to shut down the business's ability to monitor their private premise as they wish. An employer may make alcohol breath analyzer test required e.g. for a surgeon before surgery, a pilot, air traffic control at the start of the duty, or a long distance train driver. The employees in this case can't claim privacy rights to deny such tests.

4\. When you are in public place e.g. a sidewalk, you are participating in a public endeavor that comes with you dropping the privacy protection e.g. compared to what you would get in your bedroom. The rays of light that bounce off of you or your belonging are fair game to be captured. Photographers do not need to take your permission to capture rays of light that are travelling in their direction when they stand on a public place or a private place they own or a private place where the owner has given them permission to capture the rays. Those photographs can only be used for personal consumption or for non-profit activities e.g. an investigation, news reporting. Any commercial use of the photo e.g. in an product advertisement, would require release agreement from the person in the photo.

I think Strong Privacy and Strong Identification both are required, for some things they are mutually exclusive, in some parts you trade one for another. Authentication/Authorization/Encryption/Non-Repudiation is needed to deliver these rights.

Consider this, if privacy laws are absolute in every aspect of life then you can't have antitrust laws that stop competitors from fixing prices or agreeing to anti-competitive behavior. If privacy laws are absolute then smartphone apps that capture photo/video of an crime unfolding won't be allowed due to privacy concerns of the criminal. If you can keep something private (lock the door to your room, your safe deposit box), no one will force you to expose it, but one can't demand privacy in situations that naturally expose information to others, unless you explicitly set the expectation of privacy (attorney- client, doctor-patient, a service provider) as part of a contract. Government may make laws to cover most common situations e.g. your real estate agent sharing your budget with the seller of the property, your medical records etc.

Privacy law is natural. What I draw and erase on a doodle board in the privacy of my home is my business, you can't force me to divulge it. What I say in my head to myself is my business, there is no thought crime. What I sing when on a trail is my business, no one can force me to say which song I sung. When government or corporation tries to invade the natural privacy, it should be stopped. In that regard, privacy is a fundamental right. But, privacy can't be claimed to hide criminal record from your neighbors or employers.

More of me trying to sort it out in my own head.

</comment><comment><USER60> Finally some good news after the countless train pile-ups.

<comment><USER61> Did you miss the yesterday's judgement regarding the Triple Talaq?

</comment></comment><comment><USER34> This is epidemic. SA government is trying this now.

[http://www.planetbiometrics.com/article- details/i/6211/desc/...](http://www.planetbiometrics.com/article- details/i/6211/desc/south-africa-to-protect-welfare-beneficiaries-with- biometric-id/)

[http://www.planetbiometrics.com/article- details/i/6206/desc/...](http://www.planetbiometrics.com/article- details/i/6206/desc/zwipe-inks-deal-with-south-african-security-provider/)

[http://www.planetbiometrics.com/article- details/i/6219/desc/...](http://www.planetbiometrics.com/article- details/i/6219/desc/south-african-rights-group-demands-end-to-biometric- cards/)</comment>


Utterly sensible HTML templating in Common Lisp - <AUTHOR> http://trapm.com/vana-templating-an-utterly-sensible-templatin <comment><USER3> Or don't template at all. Let your designers design documents, then you write code to modify the markup at key integration points:

<https://github.com/cgrand/enlive>

This has some really nice properties:

1\. The only thing your devs and designers need to agree on is some basic semantic markup and tag IDs. Then they can make a full comp (complete with sample data) for their purposes. You simply rewrite that data.

2\. The approach is very declarative, which makes it a lot easier to reason about what is actually being shown and what is actually changing.

3\. It's amenable to all the same functional properties of the sexp->xml stuff that you see here.

Enlive's approach is a nearly 100% win for doing site templating over these sorts of sexp->xml libraries.

</comment><comment><USER4> The problem I always see with practically all templating systems is the lack of proper escaping of input data.

For example, the function 'tag-name' really needs to HTML-escape the input parameter content. The simple example (tag-name "div" "Hello world") breaks down when "Hello World" is replaced by a variable reference.

Fortunately this is an relatively easy problem to solve. A better definition for tag-name is something like:

(defun tag-name (name content) (html (format nil "<~A>~A</~A>" name (to-html content) name))

The function to-html will return the HTML-escaped version of content. The function html returns an object/string that marked as already being HTML- escaped. They work together so that (to-html (html x)) just returns x.

A similar type system can be set up to handle url escaping rules.

If the templating system doesn't keep track of what is escaped and what isn't then that burden is left to the programmer with all of the associated risks of producing malformed output and creating opportunities for injection attacks.

</comment><comment><USER5> Anything that requires you to write HTML in something that isn't HTML isn't sensible. Sure, go ahead, add tokens to the HTML that can be parsed out and rendered differently, stored in a cache or something. But as soon as you're forced to write in another language to get HTML, you've lost.

Edit: To elaborate, as some have asked: I'm speaking in terms of HTML templating. Having the software render your HTML form for you, or rending out a table full of data is fine. But by and large, the HTML should remain HTML. Granted, in this case, your not writing HTML, your writing code to generate a form. Not sitting there adding HTML attributes, which is handled for you.

As to why I disagree with this approach? At it's core, portability. You can now no longer take an HTML file and use it. You have to rewrite everything into your strange, personal, customized, non-standard language and hope everything comes out alright. Their is also the learning curve in bringing anyone else on board. You also suddenly lack the ability to use any of the tools associated with HTML. Abstraction for the sack of abstraction is silly.

If you have multiple functions for every single tag, your essentially taking HTML and just making the syntax your own. This "(ul '(id "navbar" class "horizontal_list")" is no better than HTML, but it isn't special or unique. It's cumbersome. Your also limited by the framework (which you hope will add new tags as they appear, and support the customization HTML offers).

I'm not against HTML generating code. I'm against rewriting HTML as code. Maybe someone can explain how

(ul '(id "navbar" class "horizontal_list")...

is better than

<ul id="navbar" class="horizontal_list">...

Edit 2: Also, it should be fairly obviously, but all of this is of course just my opinion. =)

<comment><USER6> How have you lost? I write my HTML in a very similar way to the linked article, and I don't think I lose at all. In fact, I much prefer it.

It is more consistent. All of my code is now (in my case) Scheme. This makes it easier to change things as you don't have to go between two different languages. And it is simpler.

My favorite reason is the fact that I can use S-Exps. I no longer have to type the ending tag. I remove the possibility for spelling it wrong, or forgetting the slash. And it takes less space and is easier to get the placement correct, as you just utilize paren matching.

<comment><AUTHOR> The paren matching really is key. I was blown away by how intuitive it is. Previously I had preferred haml, but without paren highlighting it can be hard to tell the depth you're working at relative to another tag.

This could be solved by some editor placing arrows showing which tags are parents to your current position, but I don't think that's available (at least not in emacs, sadly), and paren highlighting is.

Also, never missing a closed tag, mispellings, abstractions, etc. All very nice. When loading a broken page in chrome, it's crazy how much the html will be transformed, so that it's hard to tell why the page renders a certain way. A bit easier with this approach.

<comment><USER7> I agree. It looks really clean. I'm not about to throw out haml for it yet, but I'm definitely intrigued.

</comment></comment></comment></comment><comment><USER8> For those who didn't know already, cl-who (<http://weitz.de/cl-who/>) is a well known sexp-to-html converter. This one works a little differently from cl-who (uses functions instead of macros), but the input is similar.

</comment><comment><USER9> I am spoiled by nodejs and its live server side DOM rendering. Having one layer of template code reusable on the client and server is too powerful. You would think people would be sick of writing duplicate server templates and ajax templates. To me anything else is a step in the wrong direction.

<comment><AUTHOR> I think you're pointing out Dave Glass' technique over at yahoo, right? This one [http://www.yuiblog.com/blog/2010/04/09/node-js-yui-3-dom- man...](http://www.yuiblog.com/blog/2010/04/09/node-js-yui-3-dom-manipulation- oh-my/) ?

The ideas there are definitely very powerful... and just plain _sensible_. I'd like to find a way to work this in, but it will take time. Do you see any fundamental reason a lisp equivalent of this technique couldn't be reproduced, using something like parenscript?

<comment><USER10> It's been done already: <http://code.google.com/p/cl-closure-template/>

<comment><AUTHOR> That's _extremely_ different from the technique that Glass is demoing - <USER2> fact, it's the antithesis. It takes care of unifying the server/client templates (by introducing an unnecessary layer, imo), but it's very obviously string-based output rather than live DOM manipulation like Enlive or YUI on node.js

</comment></comment></comment></comment><comment><USER11> I still think the new gold standard for functional and extensible HTML templating is Enlive - people should look into this before coming up with variations of the same old wheel - <https://github.com/cgrand/enlive>

<comment><USER12> I think there's a difference: Enlive is meant to manipulate the DOM using familiar CSS/jQuery like selectors. The article however, is a way to _write_ the HTML in the first place.

I've myself been using a declarative style HTML output engine that I wrote in Python. It's simple, easier, outputs correct HTML and it merges well with my workflow. I don't have to write HTML, nor JavaScript to programmatically generate what I need. It may sound naive, but I find myself comfortable indenting code in Python than write matching HTML tags. If there are errors, the Python code wouldn't run, but HTML code would still render, though it wouldn't be what I want.

Relevant: <http://code.google.com/p/zen-coding/>

</comment></comment><comment><USER13> You should learn about WITH-OUTPUT-TO-STRING.

(string-downcase (string thing)) should be written (string-downcase thing)

The fdefinition trick is not a good one. Define the functions at compile-time, not at runtime.

<comment><USER8> > (string-downcase (string thing)) should be written (string-downcase thing)

I learnt this trick only after working on CL for a couple of years!

<comment><USER13> Maybe <http://l1sp.org/search/designator> will teach you a few more tricks and save you some time...

<comment><USER8> Nice. Today I learnt about the file position designator :)

</comment></comment></comment></comment><comment><USER14> This looks to me like an HTML generation library, not an HTML templating tool. Common Lisp has a number of both, and I'm wondering what advantage this would have over cl-who, for example?

</comment><comment><USER15> Can also be done, in runtime including, more cleanly and without parenthesis with coffeescript: <http://news.ycombinator.com/item?id=1786002>

</comment><comment><USER16> Not trying to pick on this particular project because it seems cool enough, but,

I don't get all this html templating. With ajax and websockets on the way, why are we still generating html in the application? This all seems like a solution to a problem we should be leaving behind.

<comment><USER17> _on the way_

You said it - websockets aren't here yet.

Plus I think there are still plenty of good applications for static HTML. For starters, even full AJAX apps should work without JS enabled if you care about accessibility.

<comment><USER18> _For starters, even full AJAX apps should work without JS enabled if you care about accessibility._

This should be just about possible using Node.js these days: You can run your entire client-side templating system—and even the <canvas>—on the server, and then server static HTML and PNGs to the browser. Unfortunately, quite a bit of elbow grease is still required.

<comment><USER17> But my point is - you're still templating. The only thing you're gaining is using the same language on the client and the server. I'm not saying that's a small thing, but the OP could have achieved the same using parenscript.

The GP seemed to be implying that we should only generate our HTML programatically on the client. Thinking about it more, I don't agree with this. I don't write webapps these days, but in our platform we do a lot of code generation. We use a programmatic method to do this because we have to manipulate the intermediate representation a lot - add or remove fields added by earlier phases in the generation etc. This is much more flexible but it's much harder to maintain, and looking at the code generation code it's very hard to see what the end result will be. If we were simply generating code in a single pass I'd definitely use templating, it's just much simpler, easier to develop, and easier to see what the end result will be.

Add in the need with HTML to work with designers and I think templating will be with us for some time to come.

</comment></comment></comment></comment><comment><USER19> Am I missing something or is this code defining "global scope" functions whose names include things like a, b, i, p, command, etc...?

What are the chances that such global names will collide with something else?

<comment><USER20> You could easily put them into a separate package if you wish:

[http://gigamonkeys.com/book/programming-in-the-large- package...](http://gigamonkeys.com/book/programming-in-the-large-packages-and- symbols.html)

</comment></comment><comment><USER21> One a little like it for emacs: <https://github.com/philjackson/xmlgen>

</comment><comment><USER22> Are there any big diffrence to clojure's hiccup?

</comment><comment><USER23> Sensible html templating exists already. It's called HAML.

<http://haml-lang.com/>

<comment><AUTHOR> Actually, while developing this I was really struck by the similarities. With the automatic indenting in emacs for lisp (really quite good), it _looks_ very similar, and it's impossible to leave a tag unclosed, but there's a further gain for using parentheses in that with paren-highlighting, you can tell exactly which tag your in. While I converted several dozen pages to this system from straight html, I was saved again and again by this.

HAML's great, and I disagree with the other "I hate haml" post on the frontpage today, but this approach actually alleviates the issues pointed out with haml's whitespace-is-meaningful approach.

Anyway, it's all in good fun.

<comment><USER7> Yup I'm a huge haml fan, and saw the similarities. I thought your post was great. Very clean, and you can keep optimizing it. I'm learning CL right now and this added some fuel to the motivation fire ;)</comment></comment></comment>


Ask HN: How to be a responsible single founder? - <AUTHOR>

I'm on the cusp of launching my own startup in the near future. I've never been so excited about anything I've ever worked on and I think it shows in the near-final product (damn thing looks and works great).
I also happen to be in the single founder camp. This was just some small side-project that I realized had the potential to provide a nice little side income.
But I have more than a few worries. Don't get me wrong, I have good people around me to lean on for legal, business, and financial matters - but not too many technically-minded folks.
I'd love to hear from you guys about what specific tools and processes you've put in place to be sure your site(s) are always online, or that you can easily put up a "down for maintenance" notice on your frontpage if your server starts throwing lots of 404's, etc.
I imagine you guys have some pretty cool mobile apps specific to your company. But anything you can share with me about me a responsible business owner would help put me at ease.
I'm afraid of scenarios in which I go out with friends on a Friday night to see movie, the site goes down, I have no idea until the next morning - and then come Monday half my userbase has evaporated. <comment><USER2> You've got two questions here, I think, and they both deserve careful consideration.

1) How do you monitor your site to alert you of problems?

2) How do you prevent your site from going down in the first place?

In my opinion, #1 is more straightforward than #2, and the more uptime you need for #2, the more you're going to pay.

a) Write a script to send you an email / SMS when your site is down. Run it on a separate server, or run it on something like Google App Engine.

I'm sure there are some simple free tools out there to achieve this for you. A quick search provided:

<http://www.siteuptime.com/>

They offer a check per 30 minutes for free. Can't beat free, but this is not an endorsement, I've never used them.

b) Use something with more features. Run it on a separate server or use someone who provides it SaaS style.

Nagios, ZenOSS, Zabbix, Groundwork, OpenNMS. I can personally vouch for Nagios. It's pretty easy to get a simple configuration going, and then it can get very complicated (you might want to monitor the monitor, right?).

2) If you've got two servers that you can connect to a load balancer, you may be able to run in active-active mode so that if one fails, you simply lose 50% capacity. For your data store, options include a database solution like MySQL in master-master form, or a relational database that has data redundancy as a feature. In my opinion you don't choose your data backend solely because of it's redundancy and failover capabilities, but it could be a factor.

If you can't do active-active mode right now for some reason, then active- passive can allow you to stay up enough to deliver that message until you restore your services. If you can get an "extra" IP address, you can even do this without a load balancer involved. Take a look at keepalived.org to see how you can float an IP address between multiple servers. CDNs such as Akamai also provide site failover features that might be worth investigating.

There are so many ways to skin the cat on this one, and I'm just scratching the surface. If your site is more than informational (e.g. if you're building a web based service or application), then monitoring and failover / redundancy are critical to your success. If you just want your informational site to be up, it's still pretty important. The fact that you're thinking about this now and not after your first 24 hour window of downtime is a good sign!

If you provide more information about what your startup is doing (at least from an tech architecture perspective) and what sorts of resources you're willing to spend to improve your uptime and failover capabilities, you might get more specific suggestions.

Best of luck, and congrats on the startup!

Pete

</comment><comment><USER3> Automation, Automation, Automation

Hire part time or temporary first, then full time.

Get a phone with push notifications. Setup a second system to constantly check for failure in the primary system. Get the second system to notify you in case of failures. Better yet, if you can, have the second system be a failover clone and have the notification dashboard be a third system. Base all these systems on different vendors systems if you can.

Buy 3g/laptop/other mobile ssh solution and use this to fix things when you're more than 30 minutes from your office/home.

And lastly, don't worry so much. Money isn't everything, and you honestly sound like you're possibly going to worry so much about this, it will make your life a net negative.

</comment><comment><USER4> "damn thing looks and works great"

If this is the case, don't worry so much. If your app uses a well-understood (by you), proven (by others) software stack and you've been testing well enough, your worries may be for naught.

Some folks around here recommend tools like pingdom. Get something like that if it helps you enjoy a break with your friends.

Good luck!

<comment><AUTHOR> Something like pingdom is exactly what I was looking for. I'm loosely familiar with such services, but never given one a shot myself - so I really don't know which ones are considered the best.

<comment><USER5> Pingdom is great. We use if to monitor all our client sites and it is awesome.

</comment></comment></comment><comment><USER6> Oooh, this would be a _great_ topic to go in depth on for a blog post. I'll get something done for you this weekend because this is a topic near and dear to my heart.

<comment><AUTHOR> It would be awesome to get even more in-depth perspective. I'll keep a lookout for your post.

</comment></comment><comment><USER7> Hi matth,

Not in a single-person startup, but there were some useful HN-linked articles in the past. In particular, I found patio11's article about running a software startup as a single-founder (and on 5 hours a week) particularly useful: <http://news.ycombinator.com/item?id=1206649>

I think he's made some really good points about doing a lot of time-as-asset stuff (go read the article, it's really good). Maybe you should get in contact with him?

I wish you the best of luck.

<comment><USER8> Not being technical experienced I don't know how this works, but Patrick's downtime alert is my favourite 'here's how amazing technology is' story to people with less knowledge than me.

Not sure exactly how he set it up (possibly through Twilio as well - [http://www.kalzumeus.com/2009/12/29/twilio-phone-call-web- ap...](http://www.kalzumeus.com/2009/12/29/twilio-phone-call-web-api-is-crazy- fun/)) but his phone calls him playing Ride of the Valkyries anytime the site goes down.

<comment><USER6> Really simple actually: monitoring service set up to mail my Japanese cell phone, cell phone has custom ringtone for emails from their address.

</comment></comment></comment><comment><USER9> I'm a single founder as well, and here is what I've done:

1) Look into chef to automate 99% of your sys-admin tasks (setup, tear up, tear down, deployment)

2) Set up pingdom for monitoring your servers externally

3) Set up hoptoad (<http://www.hoptoadapp.com>) to monitor for exceptions and errors internally with e-mail notifications

4) Set up a laptop with a MiFi for remote access - you're going to keep this in your car whereever you go (if you're in a city or something, set up VNC on an iPad or something and have access to a workstation where you can look into emergencies)

The above will a) notify you of critical things happening and b) give you a way to act upon them. Thats pretty much all that you can do at this point -- and I'd look into Rackspace managed services to see if you can leverage them for basic system troubleshooting (this is on my ToDo list).

By the way, we've got a single founder community going, its new and we're still getting to know eachother but it is great for moral support - let me know if you want to join.

</comment><comment><USER10> Pingdom is pretty cool. So is <http://aremysitesup.com/> Here are some others too: [http://sixrevisions.com/tools/12-excellent-free-tools-for- mo...](http://sixrevisions.com/tools/12-excellent-free-tools-for-monitoring- your-sites-uptime/)

</comment><comment><USER11> I use Binary Canary to alert me for down-time, which is about the same thing that Pingdom does.

Just do whatever it takes for you to fall asleep at night. I recently bought a smartphone (N900) that allows me to ssh into my server from anywhere, so if a small fix is needed, I can do that quickly. Before I had that, I actually took my laptop camping with me during a busy period last year and drove to a nearby coffee shop periodically to check for any important issues.

Other than that, I'd say to scale up your architecture as your site gets more popular. If you later need some dual-DB setup with a heartbeat monitoring system then you can add that when the time comes.

Have good backups too. That might be more important than just uptime.

</comment><comment><USER10> Also, no affiliation with these guys, I have been watching a company that has an interesting offering. If you run Rails, or can run a ruby script on your server, this offering looks very interesting: <http://scoutapp.com/>

</comment><comment><USER12> We use site canary for www.trailbehind.com.

It ran smoothly for months, and then we had a bit of a problem, but site canary alerted us right away.

Also, site canary was recently made free, so set it up! It will email you when you have an issue. Should definitely have some sort of uptime tool like pingdom or site canary.

Disclaimer: I have nothing to do with site canary, other than I use their software.

</comment><comment><USER13> <http://pingdom.com> is great for monitoring, they can send you an sms message when your site is down too.

As for automating restart, are you running on AWS? Then you can automate that. For that part of your question, you have to give some technical background on your setup etc...

</comment><comment><USER14> I've been doin this for a while now. The problem is more mental than technical.

The first thing to accept is that this is by definition an irrisponsiable thing to do...;)

Then you need to flow with it. The main thing is not aiming at fixing everything as fast as possible but rather in a way that will be as reliable as possible. Or in other words, your primary consideration should not be an early alert on Friday night, but rather a wilingness to work the weekend making sure whatever happened will not happen again.

The tech details really depend on the specific application.</comment>


How to Invest in Yourself - <AUTHOR> https://medium.com/the-mission/how-to-invest-in-yourself-417fab1bc665#.t6iz344wx <comment><USER2> This is a far more structured and formal approach to a process I recently devised and have been following. It started with a realization that this idea of 'finish it later' was shooting me in the foot, and after almost a decade of half finished and abandoned projects/ideas/wishlist items I needed to change to make things happen.

If i were to add one component to this framework it would be the act of finishing things. Break down immediate and long term items to the point where you have that feedback of completion. Build it up from your minimal attention tolerance all the way til the item demands your attention until its done.

I recently finished a first (AND second) draft of a novel for NaNoWriMo using this philosophy. 1600 words a day every day. And before that I practiced with blurbs building up to Writing Prompt responses that went up to short story scale.

<comment><USER3> That's pretty good. You might enjoy this article that I came across recently, which I found interesting and relevant: [https://www.scotthyoung.com/blog/2015/04/01/finish-what- you-...](https://www.scotthyoung.com/blog/2015/04/01/finish-what-you-start/)

<comment><USER2> That was super valuable. The distinction and clearly drawn reasoning between commitment and experiments was immediately helpful.</comment></comment></comment>


Fake Work is Destroying Our School System\ - <AUTHOR> http://www.lifestyleignition.com/2010/11/fake-work-destroying-our-school-system/

<comment><USER2> Gratuitous backslashes are destroying our web sites.

</comment><comment><USER3> <http://imgur.com/Lr6aI.png>

Social Networking is Destroying The Other Parts Of Our Internet\</comment>


Notes on brand positioning statements - <AUTHOR> http://solutious.com/blog/2010/04/05/positioning-statements/

<comment><AUTHOR> As a side note, there was only a single reference to brand positioning statements on HN:

<http://news.ycombinator.com/item?id=360069>

I find this surprising since they are generally regarded as being pretty valuable for understanding when you're building and who you're selling to.</comment>


Ask HN: How do I get a Linux admin job with no degrees? - <AUTHOR>

  I live in central Kansas. I am 20+ years old. I've been playing around with Linux, networking, and virtualization at home for roughly 5 years.

  Today I had an opportunity to work along side some Linux admins from a company that provides dealerships with hardware, software, and support solutions.
  I was able to help with numerous parts of their script that they were not sure how to work with, as this system was an older unsupported system.
  I would love to get a job doing something like this, i.e. Linux server/networking admin, but I have no degrees, and no experience doing this as a job, only for a hobby.
 So the question is: When I find a job listing that I would like to apply for, how do I get an interview to prove my knowledge, even if I have no degrees or experience working with this as a job?
Thank you for your insights! <comment><USER2> Maybe I'm wrong but I would suggest you looking for a job and show them what you can do.

I've been working as a developer for a few years now and although I don't have any CS degree and I'm pretty young (low 20s) employers trust me after a couple of weeks.

Look for startups or entities that don't have too much burocracy and show them what you have done before. What usually happens is that you will get a freelance job for a couple weeks and they will hire you.

Real companies need real people doing real things, they don't care about bullshit. If you ship you are in.

<comment><AUTHOR> First of all, most startups (and there aren't many in central KS!) probably don't want a dedicated Linux admin. Also, the jobs I've found all would be companies with bureaucracy. :)

Edit: Does it ever do any good to show up in person and ask for an interview?

<comment><USER3> It's probably not a great idea to show up in person and ask for an interview. That doesn't mean that you need to go through their bureaucracy to get a job though!

For any company that you're interested in, I would recommend trying to find a person who would be your direct supervisor if you were to get the job you wanted there and sending them a nice, personal email asking what sorts of opportunities are available at their company. Finding this persons contact information can sometimes be a bit of a challenge, but for most companies, some clever googling can get you close.

The great thing about emailing a human (rather than trying to go through the corporate bureaucracy), is that you're likely to get a human response. Even if they don't have a position open right now, they might be able to refer you to someone else in the industry. And, if they do have a position open, you'll have a contact to help you navigate HR, which can be especially helpful if you're missing some of their "required" qualifications.

I've used this approach in the past, and it totally works. It does require quite a bit of research and talking to quite a few people, but it feels a lot better than sending resumes to HR departments and never hearing back from them.

<comment><AUTHOR> Thanks! I'll see what happens with the email route!

<comment><USER3> Another important piece of advice. I see elsewhere in this thread that you've "applied for a couple jobs." Given that you don't have any professional connections right now, you're probably going to need to apply for 50+ jobs before you get your first offer.

With that in mind, you absolutely cannot apply for one job at a time. If it takes two weeks to hear back from someone, and you're only applying for one job at a time, you'll be spending two _years_ looking for a job. Once you get out of the one job at a time mindset, it's totally possible to reach out to 5-10 people a day. You should be getting in touch with so many people that you need to keep a spreadsheet (or notes file, or something) to remember who's who in your job search.

Also, Don't let any individual rejection get you down, just treat is as another possible future connection and move on. Fortunately, when you're talking to 5 new people every day during a job search, it's a lot easier to not take rejection personally.

Good luck! I'm sure there's a position out there for you.

</comment></comment></comment></comment></comment><comment><USER4> You need to crawl before you can walk.

Get a support job. With no degree and no prior relevant work experience nobody will trust you in an admin role. Not all the skills you need to be successful as an admin are hard tech skills either.

\- an ops guy without a high school diploma or greater

</comment><comment><USER5> Why don't you get one? You are still young and your brain is still developing. Get a degree in comp sci and be on your merry way.

<comment><AUTHOR> Partially religious reasons. Also, getting a degree takes a lot of money/time, and I don't feel (from what I've heard from academia, both students and teachers) that it would benefit me much, besides being able to say I have a degree.

<comment><USER6> > I don't feel [...] that it would benefit me much, besides being able to say > I have a degree.

It would get you past the screening processes that you are having a hard time with for one. That seems like a benefit.

If I were you, I'd seriously reconsider this standpoint. Having a degree certainly isn't going to _hurt_ you, and there are a lot of ways that it _could_ help you. If money is the main concern, I'd like to point you at [https://www.uopeople.edu/](https://www.uopeople.edu/) \-- they're accredited and tuition free. You only pay for exams - $100 each for a total of < $5000 for a BSc.

<comment><USER7> Nice link. I'd not heard of them.

This shows what can be done:

[https://www.scotthyoung.com/blog/myprojects/mit- challenge-2/](https://www.scotthyoung.com/blog/myprojects/mit-challenge-2/)

OK so this is hardcore, but even if a few of the modules were completed that would prove something.

</comment></comment></comment></comment><comment><USER8> How wedded are you to _central_ Kansas? I see from your other posts you want to stay in the area, but how about Kansas City (either side of the border)?

It's a large enough metro area to have quite a few jobs, and I know several people (non-degreed) working in software development and sysadmin work there. I'm not connected enough to offer any greater insight than that, unfortunately (I live very far from the area) but you'd probably have better luck there than your current area.

But I'll also reiterate jklein11's and others' point: If you impressed these guys they can help you out. If you're getting rejected immediately by systems due to lack of a degree, you _need_ a network to help you. Even if they don't hire you, they can vouch for you to other employers for at least an entry level or internship/apprenticeship position.

</comment><comment><USER9> I would talk to the Linux admins you worked with yesterday. It sounds like you have already proved to them you know what you are doing. They may be looking for a greenhorn to take in and mentor. If not, they likely have had other Linux admin jobs and know other people in the industry.

I would frame it as a way to learn about the industry and make it clear that you are looking for a new role. I would be cautious about asking them for a job straight out because if they aren't in a position to help they might just say no and be done with it.

The key to getting a job, especially if your resume isn't conventional, is to skip the automated resume submission entirely.

<comment><AUTHOR> I actually did speak to them. They are not hiring right now. However, good idea on using them as an entry to the network.

</comment></comment><comment><USER10> Study the job listing. Even if it is written badly, there are usually a lot of clues about what technologies are important. Spend some time getting your hands on those technologies if possible. If it is a database, get an aws account, install it on ec2, set up a schema, and ingest some data. If there is a scripting requirement, what libraries might they be using? Roughly mimic what they have and write against it.

Then, on your resume, list that you have experience with those technologies. You don't have to lie, but if you used a specific library and know it, then you know it.

<comment><AUTHOR> All the points on the job listing that were recommended or even suggested I do have experience with, except I don't have experience using the company's own products (not a requirement anyways).

</comment></comment><comment><USER11> Just apply to some entry level jobs. I've worked with many Linux admins who didn't have a degree, or e.g. had a degree in something unrelated like film.

Given lack of formal experience, maybe start with companies where you know someone already? Or e.g. you've met these admins, talk to them and see if they can help you out.

<comment><AUTHOR> The admins I've "met" (phone) are for a company that is not hiring, and are in Dallas TX. I'd love to work for them, and believe I would have no problem getting a job with them, if 1) they were hiring and 2) I was within commute distance of an office of theirs.

<comment><USER11> At a minimum you can use them as references.

</comment></comment></comment><comment><USER12> volunteer with an open source project's tech/infrastructure teams, this site may lead you towards projects that have infrastructure demands:

[https://opensourceinfra.org](https://opensourceinfra.org)

</comment><comment><USER13> What about an entry-level job at a web-hosting company?

</comment><comment><USER14> Nobody with a degree would do a Linux sysadmin job. I never saw anyone with a degree doing this.

<comment><USER15> I'm not sure when it happened, but at some point getting a CS degree became a requirement for sysadmin jobs and it's starting to become necessary for tech support too. Gone are the days where installing a linux distro got your foot in the door.

<comment><USER7> Agreed - at most of the companies where I've worked the sysadmins / devops have all had degrees.

</comment></comment></comment><comment><USER16> Get certificated, RHCSA - RHCE.</comment>