Google, Facebook make statements to staff about working from home for 2020 - <AUTHOR> https://www.bloomberg.com/news/articles/2020-05-08/internet-giants-to-staff-plan-to-work-from-home-for-the-year <comment><USER2> Ubisoft is going to start letting people return to the office starting from the 11th of May (this Monday).

It will be in stages, where people who use specialised equipment (such as high end artistic systems such as well calibrated touch displays, or people who have sound design rooms) will return first, and they will be required to keep at least a seat of distance from their nearest neighbour. I believe we will rapidly return to the office assuming nothing bad occurs following the first wave.

To say we as a company are not truly ready for remote work would be a major understatement, our entire security model depends on us being on premises, in fact, if it weren't for our recent migration to office365 (and AzureAD) it would not have been possible _at all_. File shares are inaccessible, along with HR resources, basically nothing except outlook is available externally.

That said: this has been a fantastic experience for me, my backlog of tasks has become anemic, I attribute this to the fact that I have a home office with real visual and auditory privacy, we aggressively pursue even denser open office landscapes in our studios.[0] I wonder if it's the same in Google, though I somehow suspect not...

I really hope there is some permanence to the remote working situation for us. Does anyone have a similar experience to me?

[0]: Our office: [https://youtu.be/Nse-7cJhxpQ?t=92](https://youtu.be/Nse-7cJhxpQ?t=92) (screenshot: [https://i.imgur.com/km0UcVk.png](https://i.imgur.com/km0UcVk.png))

<comment><USER3> How is Ubisoft planning to handle wrongful death lawsuits if their employees -- or their families -- get sick and die as a result of returning too soon?

<comment><USER4> Probably by citing government easement of lock downs and making common sense workplace decisions to hamper the spread of coronavirus as recommended by the CDC.

The coronavirus isn't magic. You can take sensible precautions and not catch it.

<comment><USER5> > You can take sensible precautions and not catch it.

A bit nitpicky, but significant: you can take sensible precautions and _reduce the risk of transmission_ \- but there's no reasonable strategy to not catch it.

<comment><USER6> Correct. Even lock-downs haven't slowed this down much.

<comment><USER7> What? Lockdowns are having a tremendous and mathematically obvious impact.

</comment></comment></comment></comment></comment></comment><comment><USER8> The headline overstates the body of the article a bit although it's not really inaccurate.

It is an interesting question to ask, come fall or winter, whether--if plenty at some companies can work from home and life/productivity goes on for much of a year--what does office life look like going forward?

Most companies will still have offices but I wonder if things shift to more of a hoteling type system with conference rooms and other collaboration spaces with people coming in a couple days per week or so.

<comment><USER9> As WFH becomes the norm, office life will become shittier over time. Less budgeting will go into fancy offices, they will become more spartan unassuming buildings. People who have to go to offices to work will be seen as second class citizens too poor or too unequipped to do any work from home. They will be seen as slow, old school workers who become more of a liability for workplace harassment policies or accidents. If you have an excellent home with a great internet connection then why go to a dirty, _nasty_ , public office where you sit in an uncomfortable chair using cheap equipment and even risk being groped in a hallway or break room? Not to mention the risk of being killed along your commute twice a day. All while the remote workers sit gently in their favorite spot by the warm glow of a sunlit window, quietly getting tasks done as they listen to soft music coming from their home speakers. When the workday ends the office worker has to make a mad rush and brave traffic to get home. The remote worker can end the day whenever the time is right, with all the ceremony of an index finger bringing their laptop lid down to a close; _what's for dinner honey?_

Very few people will choose to go to an office, working from home is a status symbol and a sign of being a well educated knowledge worker. This is even the case now during the pandemic where plenty of people boast they would be fine staying home all year while the poor and destitute are _begging_ to go back to an office or worksite because it's the only way they can put food on the table. Their value is mostly in their physical bodies, not their pure knowledge.

And if you can't work from home, you'll choose to work from some communal workspace or cafe of your choosing before ever choosing to make a dreaded commute to an office.

<comment><USER8> You're overstating it. I gave up a dedicated space in my local office before all this. But I'd be happy to go in a day or two a week if there were good reasons to do so. But most of my team is very distributed and (during normal times) most of us travel a lot so there aren't going to be a lot of serendipitous encounters.

What is probably true is that those who thrive with office socializing and activities will find the norm at companies where coming into an office becomes more about having scheduled team meetings and collaborative work on specific days less pleasant than in the past.

<comment><USER9> If it becomes less pleasant those people will cease to exist, nobody will be left to pine for the days of jocular office socialization.

<comment><USER10> It's about socializing with your coworkers, not the office environment itself. Many of us just really like to personally know the people we do business with.

<comment><USER11> That and my boss' boss really likes 'managing by walking around'. He tries to make up for it now by sending weekly updates, but just like he says, it is just not the same.

</comment></comment></comment></comment></comment></comment><comment><USER12> Some of this is due to local coronavirus lockdowns and the uncertainty around when they will be lifted, but there is also uncertainty about when schools and day cares will open again. Providing child care will keep a lot of people at home even if they aren't required to be.

On top of that, a lot of people won't want to go back to the office, not because they enjoy working from home, but because they will still be afraid of getting the virus. Being at the office probably won't feel normal anyway due to continued social distancing and the use of masks.

Combine that with concerns that the virus may surge again in the Fall, maybe necessitating another lockdown, and you have a recipe for working at home much longer than what might be legally required.

<comment><USER13> >On top of that, a lot of people won't want to go back to the office, not because they enjoy working from home, but because they will still be afraid of getting the virus. Being at the office probably won't feel normal anyway due to continued social distancing and the use of masks

That's where I'm at. My workplace put out a survey to see how people felt about going back to the office next month, and I don't think anyone was willing to risk it. We'd be wearing masks, taking public transit to/from the office, and sanitizing our hands every 15 minutes.

Having spoken to some management people, this survey is mostly being done just to confirm that we should discuss getting rid of the office entirely. Which would be a huge cost saving for us.

<comment><USER14> Same discussion happening at my company. Makes me wonder if office real estate is going to crash and burn...

<comment><USER15> yes it is

</comment></comment></comment></comment><comment><USER16> As someone who has been closely engaged in the tech world, but is outside of the culture of Silicon Valley, one cultural pattern I've noticed over and over again is the tendency for people in SV to state with utter confidence and conviction that we'll all be living our lives completely differently than we have been by this time next year, and it will be a permanent and culturally sweeping change.

The fact that inevitably only about 10% of those transformations turn out to be sort of true, and happen 10x slower than predicted, never seems to break this cycle of breathless certainty.

Maybe it's true, maybe this is really it, and the whole idea of closely clustered cities around shared commercial goals and people working closely together in the real world is finally ending. We shall see.

<comment><USER17> Seen an anecdote saying we overestimate the impact of a technology over 5 years but underestimate it over 10 years. Seems relevant here

<comment><USER18> I'd say it's more akin to how fusion power is always 30 years away.

<comment><USER16> And self driving cars, and augmented reality, and personal assistant robots, and so on and so forth.

</comment></comment></comment></comment><comment><USER19> If my company announces WFH for the rest of the year, I'll be moving out of San Francisco in a heart beat. The office has been the only thing keeping me here for a long time now.

I imagine SF natives might say, "Good riddance, don't let the door hit you on the way out," and I completely agree. I don't have issues with the city itself, but the value you get for your money here is completely abysmal if you're a renter or potential home buyer.

<comment><USER20> Come to Atlanta!

There are satellite offices for many of the major tech companies (some of them not so "satellite" at 200ish engineers).

The cost of living is cheap, it's not cold in the summer, and there's so much culture. Atlanta is in a forest, so if you like outdoors stuff, you'd be in the right place.

<comment><USER21> What's the political situation like there? I hear about things like voter suppression by the Republicans and other shenanigans in those states.

<comment><USER20> The city and (most) of the suburbs are very blue. Atlanta itself is rated as one of the most LGBT-friendly cities in the country [1].

Unfortunately, the state is still red due to the population living outside of the MSA. The city and the suburbs are resoundingly blue, though [2].

The governor pulled some very shady voter suppression tactics in the last election. [3, 4] They're afraid, and they know their time is short.

We need more blue voters. We're close to turning the state, and that would be a huge victory.

[1] [https://www.realtor.com/news/trends/top-places-for-lgbtq- fol...](https://www.realtor.com/news/trends/top-places-for-lgbtq-folks-to- live/)

[2] [https://www.ajc.com/atlanta- neighborhood-2016-presidential-e...](https://www.ajc.com/atlanta- neighborhood-2016-presidential-election-results-map/)

[3] [https://www.washingtonpost.com/politics/2019/10/30/did- racia...](https://www.washingtonpost.com/politics/2019/10/30/did-racially- motivated-voter-suppression-thwart-stacey-abrams/)

[4] [https://www.vox.com/policy-and- politics/2019/3/6/18253689/vo...](https://www.vox.com/policy-and- politics/2019/3/6/18253689/voter-suppression-georgia-kemp-investigation- cummings)

<comment><USER22> Why are the red suburbs red?

</comment></comment></comment></comment></comment><comment><USER23> Amazon and Microsoft have announced similar plans through at least October already as well:

[https://www.seattletimes.com/business/local-business/many- bu...](https://www.seattletimes.com/business/local-business/many-businesses- may-follow-amazon-in-stretching-out-work-from-home-policies-crimping-downtown- recovery/)

[https://www.geekwire.com/2020/microsoft-updates-wfh- policy-a...](https://www.geekwire.com/2020/microsoft-updates-wfh-policy- allows-employees-work-remotely-october/)

</comment><comment><USER24> This is going to have a slow, but material impact on house prices in the Bay area over the next few years.

<comment><USER25> Upward or downward?

<comment><USER17> Clearly downward? If you don't have to work at an office in the Bay Area why would you continue paying $3K/mo in Rent or praying your startup has a good exit so you can pay $1M cash for a starter house?

<comment><USER26> Not clear at all. Effective WFH requires a bigger house, which would tend to favor remote areas. But partial WFH, where you're still in the office ~1 day/week on average, will push for _both_ larger and closer housing.

<comment><USER27> An hour and a half commute five days a week is a brutal grind. Once a week it doesn't sound so bad.

<comment><USER8> Definitely. The Bay Area is a bit tougher to get out of really expensive housing depending upon where you work. But I'm (at rush hour) something like 90 minutes out of Boston whether driving or rail/subway. And housing is, if not depressed Midwest cheap, pretty reasonable in many towns that far out.

That is, as you say, pretty brutal daily--which I never really had to do even when I worked in the city. But it's only a mild PITA once a week or so.

</comment></comment></comment></comment></comment></comment><comment><USER28> I worry about offices that open but still allow people to work from home. I think there will be pressures for people to go into the office, creating density issues, or miss out on promotions, etc.

<comment><USER29> Our offices have been "open" but absolutely no one is going there. I actually wonder when people will start going back because it doesn't really make much sense to go there if no one else is there.

<comment><USER28> The C level will instruct the managers to work in the office, then the brown nosers will follow, then everyone else will feel the need to ensure the brown nosers aren't given a leg up over them.

<comment><USER30> >The C level will instruct the managers to work in the office, then the brown nosers will follow

there is a risk that covid may turn that into a natural selection process ...

</comment></comment></comment></comment><comment><USER31> My employer has told us that no one will return until the 2nd week of September. Starting then a few employees in certain roles will return to the office. Over the following months the number of employees returning will gradually be increased but even then it will only be for a couple of days a week with a set schedule so that social distancing is maintained.

</comment><comment><USER32> My company with 250 employees with offices in Europe and US announced last week that it aims to be 100% remote after this. Of course there will be a transition period, but i won't see myself in the office even after summer.

To be honest, i have worked remote for at least one year in the past, and i can safely conclude it was way better and more productive than the last 2 months mainly because it was by choice, as well as it was part of an overall remote culture (e.g. meeting regularly in cafes, doing fun activities as a group). However, even after this perfect year i personally couldn't do it no more.

People are probably making wrong assumptions of how nice the remote work might be due to the last 2 months because there was an overall excuse for their drop in productivity, or their lack of confidence (the world is collapsing how do you expect me to perform 100%?), and some extra time for family, netflix, spotify and social media due to the latter. IMO, in the wrong run the vast majority of people will definitely hate it and beg their companies to return to their offices.

With all the above i am not underestimating the health concerns. Of course companies should take minimum risks while the threat is still ongoing. In the positive scenario where it is eliminated companies should rethink their full remote policies (if they apply such) which were imposed during this weird period.

</comment><comment><USER33> What's going to change Jan. 1st? Nothing. I read this as the companies basically saying WFH in perpetuity till the corona virus ends. Or maybe that's just common sense I'm reading into a press release where I shouldn't be. The only question now becomes: if governors can shut down all businesses, why would they allow anyone who can WFH to go into the office and endanger others? At this point, we are definitely not ready to reopen safely, but a reopening will happen soon (next few months). Why risk more lives than necessary? I bet we will see this gamble though and thousands will die unnecessarily. Based on the plans Clearly, companies like Tesla show that you cannot leave this in corporate hands. How can governors be so shortsighted and callous with so many lives?

</comment><comment><USER34> It would be interesting to see how productive Google's employees are remotely vs. in-office.

<comment><USER35> There's an expectation that productivity will be lower while WFH and higher- ups have said that's okay and expected. That being said... the people around me at least seem to have adapted fully to the new working conditions despite the rough start. I suspect this trend is similar across the company (and other companies).

<comment><USER36> Honesy question. How many of those peoe have kids? On my team/in my interactions with my company, the people with kids seem to struggle however the people without kids are thriving.

<comment><USER37> I find this to be a revealing time for people with children - as in, it's made clear to them that their children are an incredibly annoying burden which they only survived previously due to the system of offloading them to professionals.

<comment><USER38> My wife is a SAHM. Usually during summer vacation she does just fine handling the kids without their being offloaded to professionals.

The current situation is a lot tougher, though, since a lot of the things she'd normally do with the kids during the day are denied right now: the zoo is closed, museums are closed, playgrounds and parks are closed, gymnasiums are closed, no play dates with friends, no visits from family, etc.

I think it's unfair to try to draw your conclusion from the present situation.

<comment><USER37> That's a good point that we are experiencing exceptional circumstances. Many people can't handle being home this long on their own, children aside. However the zoo, playgrounds, museums, play dates and family are all systems for offloading the burden of one's children onto something external.

</comment></comment></comment></comment></comment></comment><comment><USER39> I wish more companies could be this rational.

My partner's team has been almost fully remote for two months, delivered all their work on time, but is expected to be back in the office June 1st because a higher-up wants an in-person meeting. There's no other reason. It's absurd.

</comment><comment><USER40> I wonder how 10-50 person startups companies will handle the move back to working in the office, and how much more bullish they'll be than Big Tech

<comment><USER41> Work at a startup of about 70 - so just slightly larger than your ask. M n of 1 data is that we're out until Labor Day, for all of the same reasons as the big boys

</comment></comment><comment><USER42> This doesn't seem terribly surprising. If there's no vaccine anticipated for 2020 and office layout was never designed with social distancing in mind, it seems like those who can work remote should. Personally, I know I rather work in person with my teammates, but I also wouldn't want to risk my health or theirs (or any of our loved ones') over it. This feels like the responsible thing, to just allow the remainder of the year to be remote/from home.

I'm curious what this means long-term for other industries, though, and what a potential recovery looks like. From real estate to hospitality to services, I can't begin to comprehend the ripple effect that's currently taking shape.

</comment><comment><USER43> I was asked to return to the office last week. Open office in Berlin :/. Everybody of the company will be back in 2-3 weeks.

</comment><comment><USER44> I have some personal items I'd like to collect from the office. A board game or three, a bottle of ink, headphones... But beyond that, I'll likely work from home until there's a vaccine and I've been vaccinated.

Time will tell though.

</comment><comment><USER45> [https://archive.md/Gvsop](https://archive.md/Gvsop)

</comment><comment><USER46> still from working from home here. our office is open but my side boss said for the group to stay home. Im sure he will let us go in June but probably wont pressure people so WFH will probably be extended.

</comment><comment><USER47> I've been WFH since March 3rd due to a persistent cough I had from a cold I had the previous week. I really need to replace my recliner as my workspace...

<comment><USER48> I've purchased a desk and workstation... But I'm still typically on the couch with my laptop. Its difficult.

<comment><USER49> If you can setup a dedicated work area, even if it's temporary, do it and restrict work to that space. That means you only use that space for work, and don't use the rest of your home.

Your sofa is for relaxing, don't let work ruin a perfectly good sofa.

CCP Grey [^1] has an excellent video on this.

[^1]: [https://www.youtube.com/watch?v=snAhsXyO3Ck](https://www.youtube.com/watch?v=snAhsXyO3Ck) (Video warning)

<comment><USER50> I literally cannot stress how important this is. It's all fun and games until you're working from your bed, and then find that you can not stop thinking in bed and then never fall asleep.

~ Signed, someone working from home full time for the past 6 years.</comment></comment></comment></comment>


Ask HN:  Landing page / coming soon saas app - <AUTHOR>

Wanting to get a coming soon page up for StartupMonth.org today (see http://news.ycombinator.com/item?id=1773398), and I seem to recall seeing a saas app that hosted "coming soon" pages.  Anyone remember the name of it/them?<p>Thanks! <comment><USER2> Try unbounce.com</comment>


Don't Look Now, But Flash Is (Kind Of) Working On Chrome For Mac - <AUTHOR> http://www.techcrunch.com/2009/08/01/dont-look-now-but-flash-is-kind-of-working-on-chrome-for-mac/ <comment><USER2> Chrome for mac still doesn't scroll as smoothly as safari. It's most noticeable on a macbook using two finger scrolling. I keep checking to see if they've improved it, I hope it isn't some unavoidable side effect of their design.

</comment><comment><USER3> <http://stainlessapp.com/>

Process-per-tab with vanilla WebKit instead of Chrome's V8 hybrid.

</comment><comment><USER4> Well Flash only kind of works on the rest of Macintosh browsers, so this is a good first step.

</comment><comment><USER5> I guess this is a sign of progress, but honestly this news just serves to remind me how incredibly slow this project is going.</comment>


Woz finds flaws in Apple's latest offerings - <AUTHOR> http://www.theage.com.au/news/biztech/woz-finds-flaws-in-apples-latest-offerings/2008/03/03/1204402340251.html <comment><USER2> macrumors has a little note on this, including a quote about how sometimes reporters distort his comments causing him to get phone calls from Steve Jobs. [http://www.macrumors.com/2008/03/03/woz-on-macbook- air-3g-ip...](http://www.macrumors.com/2008/03/03/woz-on-macbook- air-3g-iphone-reporters/)

The theage.com.au is a handful of sentences culled from a one hour talk and thirty minute Q&A to support an intriguing headline. After reading the headline and first opening you might be surprised to also know...

Mr. Wozniak carries an iPhone everywhere, but also carries several other phones for different purposes. (Including a razr for its 3G.)

He likes the design of the air and sounds like he lusts for it but wants to be able to burn DVDs anytime anywhere and have multiple batteries in case he is caught on a plane without a power source.

A more complete article is [http://www.macworld.com.au/blogs/view/macbook-air- won-t-be-a...](http://www.macworld.com.au/blogs/view/macbook-air-won-t-be-a- hit-steve-wozniak-286)

In the realm of the unrelated... I wonder if there will be an external battery market for the air? Back in the early 90s you could get batteries that were the footprint of your computer and about 3/4" thick to stack your computer on and extend the life. Lead acid, ah... those were the days. Today I would think a nice lithium job, sort of log shaped with a padded groove on the top might be a winner. Leave it in the bottom of your bag to serve as ballast and the all important edge protector. Pull out a power cord from the bag when you need to plug in the laptop. Charge the bag overnight. (Guess at number without looking up data...) 4lbs of battery device might give you 15 hours of extra runtime.

</comment><comment><USER3> This story gets written everytime Apple comes out with a new product.

I know Woz did great work in the past -- and reporters I guess love disagreement between founders -- but Woz's analysis is no better than a layman's when it comes to Apple's modern ventures.

</comment><comment><USER4> Woz should be careful not to piss Jobs off... Steve Jobs is really sensitive.

<comment><USER5> Woz is one of the few people in the world who likely pisses Jobs off _just for fun_. I'm sure he can do this and they still remain friends and have a laugh about it later.</comment></comment>


I'm building a content curation tool - <AUTHOR> https://www.vancano.com/content-curation/ <comment><AUTHOR> I'm not a coder, but I do enjoy the engineering behind processes and tools that help content teams.

So this is the sketch and requirement spec I created before stiching together a number of 3rd party tools. The tool is working quite well :)

I thought it might be of interest to any coders out there working in content curation/social media tools.</comment>


A Million First Dates - <AUTHOR> http://www.theatlantic.com/magazine/archive/2013/01/a-million-first-dates/309195/2/?single_page=true <comment><USER2> For a certain subset (perhaps minority) of the population, these sites are nothing but a bait-and-switch. And I think dating sites attract many of us (as I am indeed a member of this subset.)

I'm talking about people who lack the pre-requisites women require for mate selection which if not fulfilled, no other characteristics typically matter. Firstly - height - if you are significantly below the national average, you will find obtaining a partner extremely difficult. I am 2 sigma below the average in my country (5'5", UK). Oh dear. I think those who are not height- impaired find it hard to believe how much of a factor this is, but it really, really, really is.

If you lack a certain kind of (I venture to suggest, actually somewhat unpleasant, cocky) confidence, especially good looks or social standing, then your odds drop even more significantly.

From what I have read, the general experience of dating sites is that men get very few replies, and women are inundated, so the task for a man is to do anything to stand out, and the task for women is to filter. I think this exaggerates the already heavily filtering criteria listed above for those like myself.

However, dating sites give people like me hope, the idea that somehow we might get around this problem, somehow say the right thing or after enough messages sent we might find somebody. I wonder how many people like me fund these sites (OK Cupid have a blog with lots of stats, perhaps some data to work with there.)

I say 'from what I have read', as I have sent > ~150 messages with no reply whatsoever. After losing vast amounts of weight, optimising profile, following advice, etc.

Apologies for the rantishness/possibly OT-ness of this post, but obv. quite a personal issue for me.

UPDATE: Amusing news piece on short men dating - <https://www.youtube.com/watch?v=3LwRe6tyqY8>

<comment><USER3> You should really try a pay site, OKC in my experience has just been for hookups. People are way more judgemental there. Also I would think a dating site where you could search for shorter girls would be helpful than real life, no?

<comment><USER2> Have tried many, paid/non-paid, with same outcome. And shorter women hilariously still generally prefer >= av. height men. It seems to be a major genetic thing.

I shouldn't gonzo myself into this too much, as I've decided to give up on relationships altogether, so this isn't about me finding some site that'll work (not feasible IMHO, since real life is equally impossible), but rather whether people like me are being baited-and-switched much by these sites...

<comment><USER4> Remember that dating works much like a market. There is supply and demand, and since there are about as many men as women, the supply and demand is roughly equal. But in some places this ratio is not equal. I'm not sure about dating sites, but that could be such a place. Simplifying a lot: if there are 1000 women and 2000 men then the women will date the 1000 most attractive men, and the rest have basically no chance. You need to find a place where the numbers are reversed.

The good thing about dating being a market is that you _can_ find somebody. The thing is that you have to place your standards around your level of attractiveness or lower. Contrary to the popular romantic image of a non attractive male dating a very attractive female, almost all relationships happen between people of very similar attractiveness. You may be less popular height wise, so you might need to compromise on an attribute that makes a woman less popular (e.g. weight or age). Perhaps you have decided that the compromises you would have to make are too great, and you'll rather stay single instead. That's fine too, but it's a choice.

You also have some control over your attractiveness. You have some control over physical attractiveness with clothes, sport and grooming. Fortunately for you, for men physical attractiveness and age are not of overriding importance they pretty much are for women. As you note, confidence and social status are also very important (see Berlusconi for an extreme example). These are things you can work on! Intelligence is important too, and you're probably already doing quite well on that front.

<comment><USER2> Thanks, very thoughtful post, indeed I think it is a market.

My point is that there are attributes of mine which rule out women who I find at least vaguely attractive (and I'm _not_ being picky, honestly), so perhaps I'm simply not able to compete in this market.

I wish the physical factors such as height weren't such a big factor, as that is obviously impossible to change. If I believed I could eliminate it, I'd gladly start hitting the gym hard right now. But I am so convinced that it's such a huge thing that I find it very hard to believe that'll make all that much difference.

<comment><USER4> I can assure you that a fit small body is more attractive than an unfit large one to a sizable amount of people (for what it's worth, Tom Cruise is not tall either). From what I've heard the importance given to height may be a US phenomenon. It's still a plus elsewhere, but less so. Are you in the US? Height also varies a lot between countries: you would would be tall in Indonesia (average 5'2), but here in the Netherlands you would be quite small (average 6'1). My father and brother are also small (perhaps even smaller than you relative to the population average), but they are doing fine relationship wise. Not all is lost!

<comment><USER2> I wish I could believe that, but that hasn't been my experience, nor that of others. I would gladly lose weight and hit the gym hard if I believed that (and I have done in the past, only for all + any health/fitness improvements to make no difference.)

I'm in the UK, average is around 5'10" here. I am in bottom 2.5% of male population height-wise.

Tom Cruise is considered to be rather good looking + confident is he not? He's a good example of the factors which can counteract short height. Note he's a couple inches taller than me also :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> FWIW, the Portland regulars on /r/OkCupid complain that it's an inversion of the classic pattern everywhere else. Men are apparently in the position of scarcity.

NYC OKCers talk about the scourge of "trade ups".

Still, living as I do in Perth, this all seems like hearing about the problems of people living on Planet Donuts. Oh, you can't settle down because there are just _sooo many choices_? No no, please continue, I'll be over here stewing in my own bile.

<comment><USER6> Weird, from what I've seen male friends who were fairly attractive (over 6 feet tall, blonde) would consistently land with girls that were one to three notches below what they would get "offline."

I've attempted to use dating sites on and off several times over the years and barely could get the attention of ugly women. In the end I found it amusing considering the girls I date tend to be models that have appeared in magazines starting with the letter P.

<comment><USER7>
      | the girls I date tend to be models that have appeared
      | in magazines starting with the letter P

Like Pyramid[1]? Did you paint the models before you dated them? Did any of them leave you for a Space Marine? </sarcasm>

Please leave this chest-beating off of HN.

[1]: <http://en.wikipedia.org/wiki/Pyramid_(magazine)>

</comment></comment></comment><comment><USER8> This article is a good read, but this following excerpt is an angle I would love to see a more expanded look into:

 _Indeed, the profit models of many online-dating sites are at cross-purposes with clients who are trying to develop long-term commitments. A permanently paired-off dater, after all, means a lost revenue stream. Explaining the mentality of a typical dating-site executive, Justin Parfitt, a dating entrepreneur based in San Francisco, puts the matter bluntly: "They're thinking, Let's keep this fucker coming back to the site as often as we can." For instance, long after their accounts become inactive on Match.com and some other sites, lapsed users receive notifications informing them that wonderful people are browsing their profiles and are eager to chat. "Most of our users are return customers," says Match.com's Blatt._

<comment><USER9> OK Cupid's OK Trends blog had an article titled "Why You Should Never Pay For Online Dating", but they removed it after they were acquired by match.com, a paid dating site. You can Google around and find a few copies of the article.

<comment><USER10> The irony is that their profit model is based on advertising which has the same incentive to not get you into a long term relationship.

<comment><USER9> OK Cupid has (had?) both ads and an ad-free A-list subscription package. However, I doubt either of those were their primary sources of income. OKC has an extremely robust survey platform baked into their question and answer system. I suspect that the demographic and market analysis data is extremely valuable and that selling it to advertisers, consumer packaged goods companies, etc. would be very lucrative.

</comment></comment></comment></comment><comment><USER11>
      "Societal values always lose out," says Noel Biderman, the founder of Ashley Madison, which calls itself
      "the world's leading married dating service for discreet encounters"—that is, cheating. "Premarital sex
      used to be taboo," explains Biderman. "So women would become miserable in marriages, because they
      wouldn't know any better. But today, more people have had failed relationships, recovered, moved on, and
      found happiness. They realize that that happiness, in many ways, depends on having had the failures. As
      we become more secure and confident in our ability to find someone else, usually someone better, monogamy
      and the old thinking about commitment will be challenged very harshly."

Oh man. Societal values will always lose out? _Women_ (just women, mind you! Not men, or women _and_ men?) were miserable in marriages because premarital sex was taboo? The lack of premarital sex directly leads to unhappy marriages? Some of these quotes border on the ridiculous. Personally, I'm glad the societal value of "Murder is wrong" hasn't lost out to these dating websites. I'm going to pile on real quick and also point out that commitment is hard. It's a disturbing trend that people can now just not deal with commitment (an important societal need, not just in relationships but in business as well) since sites like these offer them an easy way out.

I'm far from the evangelical Christian right, but there is no denying family values play a part in a functional society. Stable homes and good role models are invaluable to children growing up. Good marriages can demonstrate valuable social skills, such as compromise, respect and as corny as it sounds, love. Such things should never "lose out".

Let's not forget that, as the article mentions, most of these people's goal is to generate repeat users, not create healthy relationships. I'm not denying that online dating can be a great tool, but let's take some of these opinions with a grain of salt.

<comment><USER12> Note the quote comes from the founder of AshleyMadison. For his clientele, at least, and for the duration of their patronage, the traditional values lose out. (He's 'talking his book'.)

</comment></comment><comment><USER13> My personal experience doesn't match some of the ideas presented in that article

>> At the selection stage, researchers have seen that as the range of options grows larger, mate-seekers are liable to become "cognitively overwhelmed," and deal with the overload by adopting lazy comparison strategies and examining fewer cues

I find exactly the opposite. People that I would be happy to talk to if I met them in person with no knowledge about them I easily reject because some minor thing in their profile suggests some incompatibility even if it might not be in actuality.

>> Easy

For whatever reason it's not been easy for me. I'm on several sites. The issue above means I don't write that many people. Of those I write they rarely respond. Through online dating I've not managed to meet more than 1 person a year, probably less.

I could go on. Maybe it's that unlike Jacob I actually am looking for "the one" so it makes me more picky.

<comment><USER14> You're doing it wrong, skim a bunch of profiles and copy and paste short messages with very slight variations. Investing time in a first message, hell even reading a whole profile on an online dating site is a huge waste of time. Also, stop being so picky.

<comment><USER15> You're right, but I wish you weren't. It's a classic case of tragedy of the commons. Spamming is individually optimal, but _highly_ detrimental to overall outcome as the signal to noise ratio drops through the floor.

The worse the signal to noise ratio the more people need to spam to get a hit. At this point OKCupid is just one massive cesspool of copypasta flying around at great volume.

</comment></comment></comment><comment><USER16> Does anyone else want to take a different tack here?

Perhaps we need to start considering if we're entering a somewhat polyamorous age. Perhaps monogamy makes less sense today. This is a dangerous subject... it certainly isn't something I can talk to my partner about openly. But that's why I bring it up: perhaps as a society we need to start admitting that we have changed our level of expectations on what is okay for activity partners and perhaps even sex partners, with members of the opposite sex.

Perhaps we can have our cake and eat it too. We should acknowledge that long- term relationships built on friendships may not always provide all the perks we expect in this internet age. Perhaps we need not lose these wonderful relationships in the wake... rather have both.

I'm not offering a clear path for how it would work or how to get there. But I'm challenging the baseline assumption here that, somehow, a more liquid market for cross-sexual meeting is a bad thing. It's the reality of today, so perhaps we need to update our lifestyles.

<comment><USER17> Polyamorous relationships are on the rise due to the age of self-centered and narcissistic people. Don't get me wrong, I don't like the nuclear family for everyone credo. But let's not fool ourselves about being more open minded. It's just the basic irrational impulse, now unrestrained.

</comment></comment><comment><USER18> TL;DR: anecdotally, "internet dating has made people more disposable"

<comment><USER19> The argument goes that internet dating has made commitment less attractive, and divorce more common.

That's not necessarily a bad thing. In the future we will have fewer people clinging to abusive partners and putting up with destructive relationships. Online dating provides more options.

On the other hand, a lot more children are going to grow up without both their biological parents. Is that such a bad thing? I'm not convinced it is, but I've never really bought into the concept of family.

<comment><USER20> Counterpoint: I'm young, but I still measure my core friendships in decades ...

I'm not going to settle for a life where 'romantic partner' is not a core friendship, one which I can rely on in the same way as my lifelong friends and close family.

I think that a lot of people feel the same way.

To me, that's more persuasive even than the 'think of the children argument', and much less likely to change.

The 'think of the children' argument is pretty strong here. We all know the stats: kids from single-parent families tend to grow up in more negative environments, tend towards worse outcomes.

But maybe society can solve that problem! For instance, if a kid's parents are divorced, but are constantly in caring relationships, maybe society can evolve to a point where those kids aren't disadvantaged, and where they have a relatively stable upbringing.

But that won't change my mind about 'romantic partner' belonging in the category of 'secure, long-term friendships.'

<comment><USER19> People change; they come and go.

To me, the notion of marriage flies in the face of this basic observation. How can you possibly commit to spending the rest of your life with someone when you know so little about how they will change, intentionally or not?

> The 'think of the children' argument is pretty strong here. We all know the > stats: kids from single-parent families tend to grow up in more negative > environments, tend towards worse outcomes.

This sounds like selection bias to me.

At present, in Western society at least, members of certain socioeconomic classes are significantly more likely to become single parents, and it is likely the socioeconomic conditions their children grow up in that have the most significant effect on their outcomes.

Conversely, abusive relationships and unhappy marriages also provide negative environments for children to grow up in. A future in which relationships are more fluid could reduce the number of children growing up in these environments.

<comment><USER21> People don't change totally randomly. Relationships take work, like any other hobby or vocation

<comment><USER3> People don't change as much as they'd like to think too. Especially after a certain age, 26-30? They are more predictable than not

</comment></comment></comment></comment></comment></comment><comment><USER22> This article considers only the people whose aim in relationship is to aid in their lonliness, find someone to be with, blah blah. What about those who want to have kids, and a family. I dont think anyone will have the same line of thought after having kids.

<comment><USER23> The goals may change, but lots of people leave their spouse even after having kids, so it's not a perfect guarantee. Not saying that is right, or desirable, but it's definitely something that happens.

</comment></comment><comment><USER24> One question that's come up for me a number of times in the past 2 years or so is "how permanent does a healthy relationship need to be?" Traditional values suggest that "'til death do us part" is the desired level of permanence, but as a society (even preceding online dating) we've been moving away from that idea. More specifically, it used to be somewhat taboo for a widow to remarry, but now it's almost expected that a young widow will eventually find another spouse.

As our expected lifespan grows, are the costs and benefits of fully committing to a single person changing? As far as kids are concerned, you want a marriage to last long enough to get the kids to a certain degree of autonomy, but is that level changing too (which is interesting, because it might seem that kids are taking longer to gain autonomy compared to a hundred years ago).

But we all expect to become grandparents. This is clearly beyond the point where you need to commit to a spouse for childhood reasons. Is our changing environment enough to justify an expectation that marriage should no longer be permanent?

</comment><comment><USER25> Stop investing your time in dating sites and go outside.

</comment><comment><USER26> OP Singular,

I have felt your pain, and I cured it for myself. The answer is not to become someone you dislike or are uncomfortable with - but instead, to grow the person you are into a person you are MORE proud.

Besides this arbitrary idea of dating quantities and success score numbers judged by the numbers of responses, let's presume to say you would be happy finding just ONE person to start with who mutually is attractive and fun to be with. Let's not get overeager just yet looking for THE ONE for all eternity, if there even is such a thing (See Dan Savage videos). Let's take this process one step at a time - just get a date, any date. Ugly, fat, tall, short, pretty, sexy, smart, boring. Doesn't matter. Get a date. Then get two. Then three. Then more. And as you realize that people are people regardless of their exterior, you are going to become a far more likable, confidently social, comfortable, and engaging person - who SINCERELY unconditionally appreciates women - your charisma will naturally improve.

And women will sense that, because indeed you accept them absolutely regardless of what they would wish to do or say or act around you. You must learn and internalize that you are impervious to any of their negativity. To anyone's negativity, man or woman, because you utterly believe in yourself and the rich, successful, beautiful life journey that you are on. Your positivity is too strong, indeed. You don't beat yourself up, and think YOU are unlovable just because there IS SOMETHING WRONG WITH THEM. If you do these things, if you accept the things you can't change, your height, facial structure perhaps (plastic surgery?), whatever else you consider your lot in life, at the very least, you are going to become an extraordinarily popular personal energy to be around.

Now taking this self-embrace further, why not do things that will only better you? For instance, post a picture of yourself here, now that you have such a popular thread. Begin that effort you are no longer sensitive to the negativity anyone might bring to you commenting how you look, what height you are, or any other feature about you. 'Tis all just fodder to be examined, if there is or isn't something you can do to improve your situation. There ARE always things you can do, even if some things you have no control over. Proactivity, unconditional positivity, and pragmatism are your main principles now!

If you are indeed a bit scrawny and unhappy with your body structure, then learn to weight lift and grow your body. Take dancing classes, where your skills in dancing might overcome your physical structure. Do whatever else is active and physical, if you think that is the realm in which you lack.

I promise you, if you post a picture, or better yet, a video of yourself talking to us about your life situation, you are going to get immense and valuable feedback, far better than you are from the one dimensionality of textual defense and argumentation.. We don't, unfortunately or fortunately, live in merely a world of literal characters, so much as unique, unpredictable, infinitely dynamic human characters. =)</comment>


Ask HN: Disrupt Sensationalistic Media - <AUTHOR>

I was wondering if there is a way to mask a site visit. Instance, someone clicks on an article and their site visit is not recorded or is somehow made unverifiable.
The goal is to disrupt "journalists" from pandering to the most sensationalist headlines to get more clicks.
I find that the state of news is deteriorating to the point of gossip - even more so than the Citizen Kane scenario - because some people are paid proportionally to the number of clicks they receive. A problem is that this would also disrupt Adsense revenue and other click-through programs. <comment><USER2> I think it's great that you want to disrupt the media, but I don't think this idea is the way to do it. You're talking about taking a glass full of water out of an ocean.

If you're a developer wanting to make a difference I HIGHLY recommend checking out "The Information Diet: A Case For Conscious Consumption" by Clay Johnson.

I spent many years working in broadcast news and I can say that many of Clay's observations rang true with what I've observed over the years.

</comment><comment><USER3> You can just view the Google cache rather than go straight to the article. But that won't stop people from posting sensationalist headlines - everyone knows that's what people want. Just because a few rational geeks frown upon it won't make them change.

</comment><comment><USER4> And what is your alternative to Adsense so that journalists make money?

<comment><AUTHOR> AznHisoka>I dont' consider myself rational, I don't think it is just to discourage an idea because it is not perfect. You also don't need to reduce traffic, all you have to do is to make the article view count unreliable.

People can print what people like, but without compensation they won't benefit from the attention.

I read part of the Clay book. I am not interested in defining news to "make people think logically." Just the opposite, I expect people to think differently. I am interested reversing the tide of attention-seeking headlines which decreases focus on real news. If a reporter suggests a real news segment I am sure they will get shot down because the boss can see what articles make the most money, attention seeking articles. If the numbers are unreliable, the playing field becomes level since advertisers can no longer directly differentiate articles' popularity.

olalonde>An Alternative to Adsense income. One consequence might be sites offering services or products. Newspapers might need to start charging for their services. The New York Times has already done this.

In this scenario, attention seekers might be starved of cash, because who will pay for hyped news. From my experience there is a market for real gossip and real news, but no so much sensationalistic news.

The justification for this comes from the fact that news is nothing now.</comment></comment>


Wikipedia - Thank You for stopping SOPA - <AUTHOR> https://en.wikipedia.org/wiki/Special:CongressLookup?new=yes

<comment><USER2> Yesterday's blackout was simply incredible. When I woke up and saw all of the sites that were protesting I got chills down my spine.</comment>


Getters, Setters, and Class Decorators in ES 6 - <AUTHOR> http://raganwald.com/2015/08/24/ready-get-set-go.html

<comment><USER2> One repeated theme in this article is that `currentUser.id = 42` is _bad_ and `currentUser.setId(42)` is _good_ because it helps us organize our code (here are some quotes FTA[1]). Then the article builds up some complicated metaprogramming thing to turn the former into the latter. (Poe's law?)

BUT! Compare to the React.js way of doing things. React.js encourages us to store our models in plain old javascript data, e.g. nested JSON-y blobs, not encapsulated by classes and methods, you don't have getters, and setters have major limitations. Yet we can still separate concerns, re-rendering can still be organized to the right place, we can still log updates and cleanly validate. Without subclassing, or writing change callbacks, or resorting to metaprogramming. (Hasn't J2EE and Rails taught us that metaprogramming leads to really complicated systems? Also React.js is just an example, there are other systems where we access data directly)

I don't think it's direct property access that's the problem, but rather, mutability.

[1] "There was no way to decorate such operations with cross-cutting concerns like logging or validation"

[1] "Direct access does not allow you to organize the functionality associated with getting and setting properties, it forces the code doing the getting and setting to also be responsible for anything else associated with getting and setting."

[1] "Whereas we can't do anything like that with direct property access. Mediating property access with methods is more flexible than directly accessing properties, and this allows us to organize our program and distribute responsibility properly."

<comment><USER3> I think the "React.js way" through a Flux flow takes this idea even farther. Now, instead of an individual object being allowed to change itself, we go through an even greater indirection, firing an abstract action and letting a store figure out how to make changes to the appropriate data.

The real question is: if our data has real validation and invariants, who maintains them?

\- Does every piece of code that might change one attribute have to worry about it?

\- Do individual objects protect themselves through methods and take responsibility?

\- Or does a whole managed context take responsibility, allowing it to guarantee invariants about groups of objects together?

Experience tells us the first option quickly becomes problematic. The second certainly works, but requires discipline in how you design objects (the origin of many of the DDD patterns). The third is less widely used, seems to work better, but has some overhead. But don't kid yourself that it's less indirection/metaprogramming. It's more.

<comment><USER2> Great post, I'm gonna take this off topic now because I've been thinking a lot about this and curious your thought:

> we go through an even greater indirection, firing an abstract action and > letting a store figure out how to make changes to the appropriate data

Can't this indirection just be modeled as a function? Instead of firing an action we call a function, which returns the appropriate state updates. No metaprogramming, and composable when used with cursor pattern to run the actual state update effect. (ActionStoreDispatcher flux doesn't compose)

<comment><USER3> Yeah!

(You probably know about this but others may not.) I like Elm's architecture, which has typed update functions that can be nested. This makes the full stack of the component composable and is something like a cursor: [https://gist.github.com/evancz/2b2ba366cae1887fe621](https://gist.github.com/evancz/2b2ba366cae1887fe621)</comment></comment></comment></comment>


ACME v2 and Wildcard Certificate Support is Live - <AUTHOR> https://community.letsencrypt.org/t/acme-v2-and-wildcard-certificate-support-is-live/55579 <comment><USER4> First, congrats, this is great news! There's a lot of use cases out there that require a wildcard cert or work far better with them.

> It is our intent to transition all clients and subscribers to ACMEv2, though > we have not set an end-of-life date for our ACMEv1 API yet.

Please don't do this. It will break millions of sites needlessly. Most installations of lets encrypt plugins aren't going to auto update to v2. A lot of us are also using custom v1 code for various reasons that may not be easy to change.

The preferable end-of-life date for ACMEv1 (sparing any existential security issues) should be never. Otherwise you will be executing a Geocities-sized web meltdown every time you phase out a version of the API.

<comment><USER5> The reason we haven't announced an EOL for ACMEv1 is that we won't announce one until we are confident we won't cause the kind of meltdown you describe.

<comment> irq-1 You could block new domains (new to Lets Encrypt) from using v1.

<comment><USER6> This will break many tools which currently rely on LE. E.g. mailinabox, which uses LE to set itself up.

<comment><USER7> I doubt they would just break it. I imagine if they do this then this will be announced sufficiently in advance (probably around two or three years) to allow people to update their ACME clients. Then you can just operate the ACMEv1 for existing domains until noone is asking for more (and scale down the architecture).

<comment><USER6> The problem is that LE is being used as plumbing. I noticed MIAB was using LE because I recognise that SSL-out-of-the-box is something interesting, and I investigated. But I wager most people who use it will have no idea. They just install it, and "it works", as it should. great. What's HTTPS? That's the entire point of tools like MIAB, mind you:

 _> Technically, Mail-in-a-Box turns a fresh cloud computer into a working mail server. But you don't need to be a technology expert to set it up._

[https://mailinabox.email](https://mailinabox.email)

I'm just choosing MIAB as an example here. This applies to anything that LE now enables. People don't know they're using LE, much like IOT users don't know they're using HTTP/1.1. It's part of the plumbing. What's an ACME client? What's LE? What's v1?

This is probably happening for IOT devices across the globe just the same. A 2y expiration date is an order of magnitude too low for plumbing. Imagine if we suddenly decided to phase out HTTP/1.1 within two years.

We have to recognise that we are shoving HTTPS down people's throats. Pretty soon, HTTP will get big f-off warnings. OK: fair enough. However, if we're doing that, we should also provide a viable alternative, with the same reliability. Otherwise, HTTPS is a _massive_ step backwards for the decentralised web. LE is that alternative, but not if we start breaking backwards compatibility every 2 years.

<comment><USER7> Again, I'm not saying that the two year expiration date means "v1 stops working".

Rather, "after this point, no new domains may setup via v1", so any existing certificates and installations are grandfathered. Two years is sufficient for MIAB to update their software and distribute to users.

>LE is that alternative, but not if we start breaking backwards compatibility every 2 years.

Not what I'm saying either. They have a v2 now, we don't know if they need a v3. And they want to keep v1 running for a while.

But there will be a point where v1 will need to be switched off, similar to how modern browsers have switched off SSLv1 despite a lot of people still having servers running with that.

LE will, at some point, have to decide between keeping v1 running or moving away from old protocols to be able to evolve. And that cannot be infinitely pushed backwards.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> One of the wonderful aspects of this, that no-ones pointed out yet, is that these can used for INTERNAL domains, without you having to run your own internal CA.

i.e. lets say your internal network DNS domain is 'my-company-lan.com' \- all you have to do is ensure that 'my-company-lan.com' is also registered in public DNS[1], and then you can secure ALL your internal services using a free LE wildcard cert, that's automatically trusted by all platforms and browsers[2]. For some companies that's going to be a BIG cost and resources saving.

\--

[1] but not actually used for any public facing services.

[2] Mostly...

<comment><USER8> Going to reply to my own comment here.

It's at this point that I swear profusely at Microsoft yet again, for pushing the concept of '.local' domain suffixes a decade ago. As it's not a legal TLD, I can't get certs for any of my internal services without rolling my own internal CA, which only works automatically for Windows domain machines, and not for anything else.

<comment><USER9> The ".local" suffix was a terrible idea, to be sure. Active Directory domain rename in small environments is relatively painless.

<comment><USER8> Unless of course, you are running Exchange. In which case it's not supported :(

<comment><USER9> Unfortunately, yes. I've been lucky enough to be able to get domain renames done in Exchange 2003 environments (which is supported) or in non-Exchange environments. Migrating to a new domain because of a poorly-chosen name is a real pain. (I have one Customer who has a "." in their NetBIOS domain name. That creates some interesting kinds of hell-- completely breaks the NPS RADIUS server in Windows 2012.)

</comment></comment></comment></comment></comment><comment><USER10> For anyone wondering how to actually obtain a wildcard cert this way, here's the quick version:

1\. Use acme.sh: [https://github.com/Neilpang/acme.sh](https://github.com/Neilpang/acme.sh)

      acme.sh --issue -d *.example.com --dns

If your DNS provider has a supported api, you may be able to automatically publish the DNS records required using a slightly different command - <USER2> here: [https://github.com/Neilpang/acme.sh/tree/master/dnsapi](https://github.com/Neilpang/acme.sh/tree/master/dnsapi)

<comment><USER11> Thanks! This looks awesome. Can i automate it as well?

I have been toying a little with wildcard using certbot on my Ubuntu OpenVPN appliance, but was a bit unsuccessful at the moment.

Maybe i should just try and build a very tiny virtual sever that does nothing but spit out a wildcard domain certificate to some predefined destinations to have it used in anything that wants a certificate. Could be beneficial to a (large) infrastructure to have an always-ready certificate to use for free. Dunno if EV validation will uphold though.

<comment><USER12> For provider with DNS support, you can put it in a cron, and then create symlink or some copy step at the end of cron to copy private key and full chain to appropriate location of your web server.

I think acme.sh is the easiet to use in all of clients.

<comment><USER11> Thanks again. Everything works.

I've put my DNS to Cloudflare and after that the acme.sh was incredibly easy to implement thanks to their API implementations.

Also learned a valuble lesson: *.provider.com is not the same as provider.com :)

</comment></comment></comment></comment><comment><USER13> Don't forget to Donate:

[https://letsencrypt.org/donate](https://letsencrypt.org/donate)

Also the EFF:

[https://supporters.eff.org/donate](https://supporters.eff.org/donate)

<comment><USER14> My suggested amount: recurring donation of $19.84 per month.

</comment></comment><comment><USER15> The amount of money I've paid for this... I recon some of these providers are going under soon?

<comment><USER16> I'll happily pay money to get a cert that expires in 3 years instead of 90 days. Some of us don't feel like faffing about with cert renewal every quarter. (I know there are tools and clients that can "make it seamless" \- until the ACME endpoints are down or something).

<comment><USER17> I'm in the same boat. I haven't found a guide for an easy and flawless way to automate cert renewal with letsencrypt when you use multiple services over different servers. For my wildcard, I use the same cert for:

1\. Ubuntu VPS #1: a. dovecot ssl b. postfix ssl c. apache multiple virtual domains ssl d. pureftpd ssl

2\. Ubuntu VPS #2: a. apache multiple virtual domains ssl

3\. Microsoft Server a. IIS multiple virtual domains ssl

<comment><USER18> Why does it have to be the same cert on every host? Use a separate cert for each and automation will be much easier.

With Let's Encrypt, you don't need to minimize the number of certs just to save some money.

<comment><USER17> I'm just saying how I'm running things now. Totally open to better ways. Right now I pay $135 for a two year wildcard cert (very small business here). It takes 1 hour of my time to update the cert for all these applications. 1 hour of time and $135 every two years is not a lot. When I do a cursory look of how to reliably automate letsencrypt across all applications, there are people who have created scripts that help, but it does not give me reassurance that everything will run smoothly every 90 days. I am waiting for letsencrypt to get first-class support in dovecot, postfix, pureftpd, and IIS, so it can be set and forget, and I know long term support will be there.

</comment></comment></comment></comment></comment><comment><USER19> DNS providers and domain name registration companies are probably going to get pestered about API access for updating TXT DNS records now... :)

<comment><USER20> is it common for DNS hosts to provide delegated access at the granularity of individual records?

I don't want my webserver to have the ability to change my entire zonefile just so it can authorise certificates!

<comment><USER21> Not sure if it will work for your use case, but you can also CNAME the _acme- challenge record to a different domain (or a subdomain with a separate zonefile), dedicated only to authorizing certificates.

</comment></comment></comment><comment><USER22> Now here's to hoping that Heroku supports this soon. That will to mean I can a last migrate a number of apps that require wildcard domains to their platform.

<comment><USER23> I'm intrigued. What kind of app that you could host on heroku requires wildcard certificates? Bearing in mind that heroku can't really support wildcard subdomains for a single app. Each custom subdomain for an app needs to be added to the app. And then if you enable Automated Certificate Management for the app (which uses LetsEncrypt under the covers), they'll happily fetch a cert for each listed subdomain.

And Heroku already supports wildcard certs (that you need to provide yourself) if you use the SSL addon.

<comment><USER24> > _Bearing in mind that heroku can 't really support wildcard subdomains for a > single app._

Why not?

<comment><USER23> Well I suppose they could, but they'd have to be very careful of someone else spinning up an app and adding your domain to it.

</comment></comment></comment></comment><comment><USER25> This is great news! Let's Encrypt has helped me secure many of my own boxes without having to maintain my own CA, very happy to see them grow.

</comment><comment><USER26> Can anyone list any negatives of Let's Encrypt? I've been using it since the start and just can't find any practical downsides.

<comment><USER27> The only significant concern I have is that if LE were to essentially "take over" the CA industry, you know, due to being free, and awesome, we'd have a massive single point of failure for the entire Internet's security model.

My biggest peeve with the whole "HTTPS Everywhere" push is not the general notion of using encryption, but that the encryption is annoyingly coupled with the CA system, which is terrible for many reasons.

<comment><USER28> The encryption part is easy -- you don't need CAs for that -- but they're a necessary evil when it comes to verifying ownership. You need to delegate trust to _someone_ , otherwise using the internet becomes too cumbersome.

<comment><USER27> Automated SSL providers effectively mitigate the idea of "verifying ownership" or "delegating trust", because for example, someone can buy a domain like... googIe.com, get an SSL cert for it, and it's "valid". We're right back to the same level of security of you just checking that the browser bar points at the domain you actually intended to go to. (In this example, bear in mind, Google doesn't use an EV cert, so they'd be equally valid to a web browser. And a lot of EV certs I believe are getting distrusted soon as it is.)

CAs seem like a system that really doesn't work today, we've seen multiple times that many of these CAs aren't worth delegating trust to to begin with, and it causes an unnecessary cost and burden upon just... encrypting traffic.

<comment> vertex-four > We're right back to the same level of security of you just checking that the > browser bar points at the domain you actually intended to go to.

So you're sitting in a cafe, and you go to Facebook.com. Lo and behold, someone's installed a MITM proxy on the router, that presents its own encryption key instead of Facebook's, and your browser has no way to tell this because the CA system isn't a thing. They now have your password, can steal your session to spam your friends, whatever else. How do you prevent that?

Automated domain validated certificates are meant to ensure that when you go to Facebook.com, you're talking to Facebook.com and not a MITMing router on the way there. They're not meant to protect against phishing - they're meant to protect against the very real cases I've seen where my mobile ISP adds random JavaScript into the web pages I view, and sells information about me based on my use of the web.

<comment><USER29> Idea that's been floated before: TOFU plus a distributed network of people automatically sharing what cert fingerprints they encounter. Chances are high that you already hit Facebook on your $device, and if you all of a sudden retrieved a certificate that didn't match the one you had before, or that most other people online hadn't seen, halt and throw up the warnings.

Given the exploitability, laziness, general failure to follow best practices, not to mention misaligned incentives that we're seeing from major CA vendors, having centralized CAs seems like an ever-worsening solution.

<comment><USER30> Where do you store the trust from all those people to be able to query the statistics? That's just another central point of failure.

<comment><USER29> It's not as if distributed hash stores are new...

<comment><USER30> That didn't answer anything. How can you trust the result if anyone can write there. How can you trust the individual store that it doesn't manipulate its contents, etc.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> I do hope GitHub employs this for rolling out https for Pages sites using custom domains too.

<comment><USER32> Not sure if it would help in your situation but I've moved all of my github pages to netlify.com and they have a one button https feature for custom domains.

<comment><USER33> I did the same. Between Netlify and Zeit.co's Now, I don't see any reason to complain about HTTPS, not to mention the devOps issues that both these services solve.

SSL requires one click with Netlify, and it's on by default with Now.

<comment><USER32> Btw the only problem I have with Netlify is the close name conflict with netflix. Chrome's autocomplete is completely confused.

</comment></comment></comment></comment><comment><USER34> Great news, but interesting to see that they still recommend securing individual domain names. I imagine this is for security purposes?

<comment><USER35> Yeah, I think that if someone hacked your DNS provider, they could add _secure-payments.yourbusiness.com_ and start spamming people with "late payment! enter your credit card!" notices or something.

So I guess, make sure you trust your DNS provider if you're using wildcards. Or is there another exploit I'm missing?

<comment><USER36> Not sure how the availability of wildcard certs changes that scenario, if I can set the DNS record for secure-payments.yourbusiness.com then I can get a non-wildcard cert for it and get on with the spamming straight away

<comment><USER35> I think it's somewhat difficult to get a valid (CA-valid) certificate for a domain you don't own, though. At least, that's what the job of the CAs is: to verify that the certs they're issuing are for the actual owner of yourbusiness.com.

<comment><USER37> I thought that was the case, until CloudFlare issued a cert for a subdomain of mine without a single email round-trip or even notification.

Any DNS-based validation is contingent on full DNS control, and that does mean FULL. CNAME records are absolute, if I CNAME foo to xyz then I'm trusting xyz 100%. I won't get an email round-trip or CAA ping for the certificate unless I'm looking for it, because CNAME implies that all things that apply to xyz apply to anything pointed at it. So the CAA record for xyz applies, not the CAA record for foo - it's not even valid to have any other record types for the same name as a CNAME record, and CAA resolution stops if it gets a valid response versus walking up to the domain root.

To be clear: CloudFlare issued a perfectly valid certificate for a perfectly valid use case, it just bothers me that I couldn't tell it was issued until after-the-fact by seeing it in CT logs, and couldn't have prevented it from being issued by the mechanisms that seem to be built for that.

</comment></comment></comment></comment></comment><comment><USER38> Thank you letsencrypt team! Really appreciate all the hardwork to get this out.

</comment><comment><USER39> Hi, I made a video on how to implement Wildcard Certificate for your subdomains. I hope someone finds it useful :) [https://www.youtube.com/watch?v=zvg8IXAcUwo&feature=youtu.be](https://www.youtube.com/watch?v=zvg8IXAcUwo&feature=youtu.be)

</comment><comment><USER40> This whitepages unless you disable javascript or enable connections to discourse.org. How disappointing.

</comment><comment><USER41> On the face of it wildcard certs seem easy to implement - just match anything in place of the * - but clearly that's not the case as it took years to complete, anyone mind sharing some of the subtle challenges and complexities involved

<comment><USER36> Dynamic DNS providers is one -- I probably shouldn't be able to get a wildcard cert for any of these [1] domains, but permitting *.mysubdomain.hostname.com is probably OK

[1] [https://www.dtdns.com/dtsite/faq#hostdomains](https://www.dtdns.com/dtsite/faq#hostdomains)

<comment><USER42> LE requires setting DNS TXT records to get wildcard certs - do dynamic DNS providers ever let you do that? My assumption is they don't.

<comment><USER36> Yeah that's a fair assumption. So no wildcards for subdomains at dynamic dns providers -- probably not an important use-case anyhow.

<comment><USER42> Also a large majority of them will be on the public suffix list, which LE uses in their rate limiting checks.

[https://en.m.wikipedia.org/wiki/Public_Suffix_List](https://en.m.wikipedia.org/wiki/Public_Suffix_List)

</comment></comment></comment></comment></comment><comment> gator-io HTTPS vs HTTP usage: [https://netmarketshare.com/report.aspx?options=%7B%22filter%...](https://netmarketshare.com/report.aspx?options=%7B%22filter%22%3A%7B%22%24and%22%3A%5B%7B%22deviceType%22%3A%7B%22%24in%22%3A%5B%22Desktop%2Flaptop%22%5D%7D%7D%5D%7D%2C%22dateLabel%22%3A%22Trend%22%2C%22attributes%22%3A%22share%22%2C%22group%22%3A%22secure%22%2C%22sort%22%3A%7B%22share%22%3A-1%7D%2C%22id%22%3A%22https%22%2C%22dateInterval%22%3A%22Monthly%22%2C%22dateStart%22%3A%222017-03%22%2C%22dateEnd%22%3A%222018-02%22%2C%22segments%22%3A%22-1000%22%7D)

</comment><comment><USER43> I just wished there was a Windows client that just works with IIS. Every time I try, it just errors out and gives me headaches (certify, Let's Encrypt Simple Windows Client, etc.)

<comment><USER44> If you are using wildcard it doesn't need to be integrated with IIS. Use acmesharp which has a nice powershell interface (doesn't support wildcards yet). Then loading the certificate in the certificate store and assigning it to a website should be fairly easy in powershell.

<comment><USER43> Nah, I use a lot of SAN certificates; e.g. when a customer has 10 domains, and you want all of them to redirect to one, you have 1 site with just an SSL binding, and 1 site with all other domains and the non-SSL binding. That's a scenario that f's up a lot.

</comment></comment></comment><comment><USER45> Shameless plug, I created sewer[1], which is a letsencrypt client that you can use both as a (minimalistic) python library or as a command line application. And I just added ACME v2 support. Check it out,

1\. [https://github.com/komuw/sewer](https://github.com/komuw/sewer)

<comment><USER46> Thanks for this; I've been searching for something similar for a while now. I'll look forward to trying it!

</comment></comment><comment><USER47> I did not see it on the forum, but seeing that the wildcard feature requires DNS-01 challenge for getting the certificates, does it mean automatic renewal is impossible without DNS api ? (or is it possible to renew without the dns challenge ? )

<comment><USER48> This thread [0] suggests that you do.

0\. [https://www.reddit.com/r/programming/comments/84607r/lets_en...](https://www.reddit.com/r/programming/comments/84607r/lets_encrypt_releases_support_for_wildcard/dvn98d9/?st=jeq8o34j&sh=427b89e8)

<comment><AUTHOR> Yes, for an unattended renewal you'll need a way of programmatically creating TXT records. (Note that the validation follows CNAMEs, so the records you create don't have to be in your main DNS zone.)

</comment></comment></comment><comment><USER49> Can this be used for multi-level subdomains?

Like *.subdomain.example.org?

<comment><USER50> No, but that limitation is due to wildcard certificates specifications - <USER3> LE.

<comment><USER49> I'm mainly just trying to solve an issue where I've got end users who think there's a security problem because they've typed www.myorg.example.org instead of myorg.example.org and the wildcard DNS entry in Route53 picks it up...which directs the user to an Insecure error.

Trying to figure out how to get Route53 to stop the wildcard at the top level or get a wildcard cert that will go down the path.

</comment></comment></comment><comment><USER51> Does the DNS method require proving you control the IP space for the domain, or is a DNS TXT really the only thing you need to generate a certificate?

<comment><AUTHOR> Just a TXT record.

[https://tools.ietf.org/html/draft-ietf-acme- acme-03#section-...](https://tools.ietf.org/html/draft-ietf-acme- acme-03#section-7.4)

<comment><USER51> Wow. A lot of sites are going to get owned.

<comment><AUTHOR> We've been using TXT records to authenticate certificate requests since Let's Encrypt launched. That hasn't changed.

<comment><USER51> Without verifying who controls the IP space?

If you don't verify who controls the IP space, then if you can control the DNS, you can generate certs. Certs that appear valid to unsuspecting users.

Putting that kind of trust in DNS is pretty crazy considering how insecure most DNS setups are. Not to mention general attacks on DNS. There's even a potential chicken and egg problem, if you need DNS to secure your HTTPS, but you use HTTPS to manage your DNS.

What's really crazy too is it seems like this can't even be avoided. Even if I'm not using Let's Encrypt, if someone owns my DNS, they can use Let's Encrypt to get valid certs for my domain. That's insane.

What am I missing here?

<comment><USER52> > What am I missing here?

If I "own your DNS" wouldn't I just change them all to an IP space I control anyway? (If that was a requirement).

Unless I'm missing something, requiring "owning the IP space" seems to be an impossible requirement to fulfil. I'm on a virtual host in Azure/AWS/Linode I have no way of proving I own the IP (because I don't).

</comment></comment></comment></comment></comment></comment><comment><USER53> This is great, congrats, you are really doing a great service to the community.

</comment><comment><USER54> Excellent! Wildcard certificates are getting deployed tomorrow.

</comment><comment><USER55> Wonderful news ! Looking forward to using the Wildcard SSLs.

</comment><comment><USER56> > Except most big orgs now employ MitM tools like BlueCoat to sniff SSL > connections too.

This. A long thread mostly advocating HTTPS everywhere and only one mention of this. Would any of the knowledgeable HTTPS advocates here care to comment on it?</comment>


Laser Scans Unveil a Network of Ancient Cities in Cambodia - <AUTHOR> http://www.nytimes.com/2016/09/20/science/angkor-wat-cambodia-archeaology.html?pagewanted=all&_r=0 <comment><USER2> This is prosaically brilliant. Turns out that Lidar can be more culturally useful than just for speeding tickets.

Anyone who hasn't visited Cambodia (or SE Asia in general) should go. At least once in your life. It's cheap, the people are kind (do not insult the king of Thailand though) and the incredible diversity of people streaming in from India, China, and later France has left behind an amazing cultural chronicle. Cambodia will, for better or worse, forcibly remind you of both the heights (Angkor) and the depths (the Khmer Rouge) of humanity.

Note that the KR almost certainly would not have come to power and killed 1/3rd of the population if we hadn't bombed the shit out of eastern Cambodia during the Vietnam war. (Henry Kissinger received the Nobel peace prize for these antics) Almost exactly like Isis, except the KR didn't see the point of destroying their own heritage. So in spite of the odd bullet hole, Angkor and surrounding sites are as awesome as they were when Mouhot stumbled upon them in ~1855. (The Frenchman could not believe that "savages" built such incredible temples and attributed them to the Romans.)

Amazingly resilient people with a glorious legacy that continues to grow as we learn more about it.

<comment><USER3>
       KR almost certainly would
       not have come to power

Whatever one thinks of the Viet Nam war, and there are many valid criticisms of the conduct of the western armies and their leadership, it is worthwhile to bear in mind that the West fought there to prevent communist organisations like the KR to come to power.

The KR would certainly not have come to power if not

1\. The French communist party had radicalised Pol Pot.

2\. The Soviet and Yugoslav communist parties had further schooled Pol Pot in how to overthrow a regime.

3\. The Soviet, Chinese and North Vietnamese communist parties had supported the KR with weapons and other forms of logistics with the explicit aim of instituting a communist regime in Cambodia.

<comment><USER4> 4\. The near-century of French and American imperialism that preceded 1, 2, and 3.

There's direct causes, and there's indirect causes. Kissinger directly created the circumstances that let 1, 2, and 3 create the KR.

<comment><USER3> I disagree.

While it is true that the Vietnamese and Cambodians didn't want to be colonies, the KR were _vastly_ worse than being colonised.

KR were following the classic communist script that we have seen played out in many developing countries. The KR were created by communists, lead from Moscow and Beijing.

<comment><USER4> Hindsight is 20/20\. While it's true that the Confederacy didn't want to give up slavery, the civil war and reconstruction were vastly worse for slaveowners then giving it up peacefully would have been.

The classic communist script hasn't _always_ resulted in genocide. Much like how the classic imperialist script hasn't _always_ resulted in genocide.

Besides, Moscow hardly had a monopoly on sponsoring and/or training political death squads.

<comment><USER3> No hindsight. Communist takeover plans were very well-know and public for a long time.

        Moscow hardly had a monopoly

Nobody claims this.

The fact of the matter remains: the KR and Pol Pot were created following the standard communist script for "liberation movements" in the developing world (i.e. thinly veilded preparations for communist takeover). All the ideological training was provided by the Soviets and their allies, as were all the many weapons and other logistics. The US was in East Asia primarily to counter the communist threat, not to prop up French colonies.

All responsibility for the KR and their actions is with the communists leadership in Moscow (and Beijing and Paris and Belgrade and Hanoi).

</comment></comment></comment></comment></comment></comment><comment><USER5> This is very impressive finding and it highlights sophisticated planning and design done long time ago without any modern technology. Doing a Laser Scans not only help in creating a digital footprint but also digitize it for future generations in-case of any natural disaster.

</comment><comment><USER6> Does anyone have any information on the software used to process the LIDAR data?</comment>


After Cellebrite Breach, Hacking Team Lashes Out Against 'Vigilante Hackers' - <AUTHOR> http://motherboard.vice.com/read/after-cellebrite-breach-hacking-team-lashes-out-against-vigilante-hackers <comment><USER2> Vincenzetti is just displaying an inordinate amount of butthurt. His company does exactly what the "vigilante" hackers do. Hacking Team is just a company with an elite "corporate identity", and they do the deed for money. Phineas Fisher, and the Cellebrite hacker have an elite personal identity, and do it for the lulz. The difference is one of motivation. And anybody who hacks for authoritarian regimes, and maybe even for certain police departments, doesn't get to pass judgment on motivations in my view.</comment>