How anti-trust laws are used to stop independent contractors from organizing [pdf] - <AUTHOR> https://docs.house.gov/meetings/JU/JU05/20191029/110152/HHRG-116-JU05-Wstate-PaulS-20191029-SD002.pdf <comment><USER2> This is a really interesting topic. If you go to conventions for different trades, they usually make sure to emphasize that the convention is not a venue to discuss specific pricing, as that could be seen as collusion and anti- competitive. You wouldn't want a plumber's convention to be a place where they collude to fix prices!

With technology enabling more peer-to-peer connections, the game changes. If you're a productive plumber, why join a company and work for a salary when you can work directly for the consumer and enjoy higher margins (and higher risk)? However, as time goes on, more plumbers will make the same decision and enter the market. This results in a more efficient economy: more people can get plumbing at lower prices, and more people can work as plumbers.

But what if some business owners cost structures (due to mismanagement, poor productivity) do not result in good wages? (eg, XYZ Plumbing struggles to stay in business while ABC is doing just fine). Or what if the market forces end up in a clearing price that's too low? In today's economy, it's considered normal for some businesses to shut down if they cannot make money (know of a restaurant that has closed due to COVID?). But do we as a society want individuals taking on that much risk? If not, how can we insure against that risk?

<comment><USER3> One solution could be to target 100% employment and have the risk state subsidised (Through a guaranteed government wage). If the government is forced to spend money to employ people (The military could be argued to be a weak form of this), irrespective of need, I'm sure someone would figure out a solution to the government's labor surplus. Pretty easy to implement too — just conscription - with the ability to opt in and out as you choose other jobs instead or leave those jobs.

Overall, this means individuals are free to attempt different employment at market rates. That could even be below the guaranteed government wage, just there'll be no subsidies that if individual can't make the economics work out.

Hard to argue that the 1.2% employment rate in 1944 wasn't helping drive the economy forward.

<comment><USER4> And what would this army of people be doing?

I have an image in my head of all my neighbors working at the same company. WTF would we be doing?

I'm a software engineer, my wife a reporter, my next door neighbor a nurse, the guy across the hall plays video games all day. His girlfriend is a cleaning lady.

This doesn't include the sex offender down the street, the guys who shoot guns in the middle of the night, the drug addicted and mentally ill who hang out near the bus station, or any other "hard cases."

So what would we be doing?

<comment><USER5> A vast quantity of paid labor is great for infrastructure projects. This is what pulled the US out of the depression, and is the reason we have so many gorgeous post offices and public buildings everywhere. (Particularly on the post office front, this included stone workers, but also artists and architects and engineers.)

(Expanding on edit...) And really, infrastructure is about building the solid foundation on which the nation runs. Fix the digital infrastructure at all levels of government. Put out wild fires, and provide other emergency relief. You're already paying people; that's generally the expensive part...

<comment><USER4> Infrastructure work requires specialized training... that I don't have. And most people don't have.

We could certainly build a construction corps. But I don't think many people in my neighborhood could be part of it.

Modern construction is far more technical than in the 1930s. Failure isn't tolerated. Environmental impact statements are needed.

It's insulting to the highly trained construction workers to say the average person could be conscripted into doing their job.

<comment><USER3> Re-institute the Manpower Board then, the government's management of large amounts of manpower means they have a vested interest in their training. Look to the military, kids turn into marines, fighter pilots, engineers.

<comment><USER4> Only 30% of young adults meet the requirements for military service.

Most previous mass mobilizations focused on young men.

I still can't imagine what sort of work my neighbors and I would be doing.

Not building roads, that's for sure. Lots of bad backs.

</comment></comment></comment></comment></comment></comment></comment><comment> daniel-s I will confess to not making it to the end of the introduction, but this is a general comment about anti-trust and monopoly laws.

They're made up and arbitrary. The best definition I have seen is that someone is a monopoly if they haven't made enough campaign contributions and weild enough political influence to appease government bureaucrats from shaking them down. The exception is for a monopoly created by the government itself by legislation/regulation giving someone special privileges or banning competitors.

I challenge a reply to this comment for a definition of monopoly that rational+reasonable people could use to unambiguously differentiate between business that are and are not a monopoly (asside from the one I gave above).

I like Walter Block's joke on monopolies. He starts with 3 prisoners in a gulag who are chatting amongst themselves about how they got there. First guy, "I was always late to work. I was accused of depriving the Soviet people of my labour, so was sent to the gulag." The second guy, "gosh, I was always early. They accused me of being selfish and ambitious: trying to brown-nose and get ahead of my fellow workers, so I got sent here too." The last guy, "I was always precisely on time. They said I must be a spy and accused me of having a western wristwatch."

The same joke applies to monopolies. Three businessmen are all accused of being monopolists and are sent to prison. First guy, "I was charging more than my peers. They accused me of price gauging." Second guy, "I was charging less than everybody else, they accused me of undercutting the competition." Last guy, "I charged exactly the same as my competitors: I got charged with collusion and participation in a cartel."

<comment><USER6> We unambiguously differentiate by setting a threshold.

Does your water heater produce hot water? We can decide this unambiguously if you provide your required temperature and the actual temperature you are getting.

Despite the lack of a universal definition of "hot", we can unambiguously determine if your water is hot or not.

For your water heater, you probably set the threshold based on how much you enjoy your shower, how well your dishes get clean, and so on. For a monopoly, we can set the threshold at the point where there is an unacceptable amount of market control.

Measurement of market control is more difficult than measurement of water temperature, but that is no excuse to give up. We measure beauty, intelligence, bad driving, poverty, odor, and misery.

<comment> daniel-s You have provided no definition. "Unacceptable amount of market control" defines nothing at all. In fact, it only supports what I said. "Unacceptable" will be what the bureaucrat/politician has decided he wants to go after.

Perhaps you want to try again?

<comment><USER6> Define "pain", so that we know if opiates are appropriate. (or we give them to everybody who asks?)

Define "reckless driving", so we know who the police should stop and who should be charged with that crime. (or we just give up on that concept?)

Define "nuisance odor", so we can fine or arrest people who make entire neighborhoods unlivable. (or we let a condo smell like a huge industrial pig farm?)

Define "mentally disabled", so that we can pursue rape charges (due to inability to consent) or appoint a financial caretaker. (or we just let the profoundly unintelligent get abused?)

Life and law are full of fuzzy judgement. Pretending otherwise is a terrible idea.

</comment></comment></comment></comment><comment><USER7> Wow, this is wild. A great example of how regulation can be a double-edged sword. Anti-trust law prevents market participants from colluding to increase their influence - which is exactly what a labor union does. Lawmakers patched the issue by exempting labor unions, but they didn't cover independent contractors.

The latest attempt to patch the issue is to force reclassification of many independent contractors into employees. What unforeseen effects might this have? Does AB 5 have enough special cases to avoid making things even worse?

<comment><USER8> Why should we protect cartels?

<comment><USER9> If a union is a cartel because its members bargain collectively, so is a corporation. If you want to keep corporations because of the organizational efficiencies that maximize productivity and welfare, then why not unions?

And let's not get into a semantic debate--the rules for forming corporations are designed to make it efficient for investors to organize; likewise the rules for forming unions are designed to make it efficient for laborers to organize. So if you argue that laborers should instead form a corporation if they want to organize, I'd rhetorically ask why not make investors use unions as their vehicle.

<comment><USER10> Unions are expensive and the reason they hold power is because they strike. And when they strike they threaten violence against "scabs", or someone management hires to do the job despite union threats.

Unions are simply labor using violence to achieve their aims, which is soaking the payer to enrich themselves. Nothing more and nothing less.

<comment><USER11> You clearly need to read up on a few books on the history of labor kid. Embarrassing comment.

<comment><USER10> Why would management subject themselves to a union? It's because the law makes them once their labor organizes. And if they try to fire their unionized labor they get into a world of pain.

</comment></comment></comment></comment></comment></comment><comment><USER12> That is quite the size of an entire book and a timely submission for a weekend skim for those interested.

I did skip to the conclusion, typical ambiguous wrap-up, to say the least.

</comment><comment><AUTHOR> I don't think that this shows that anti-trust laws are bad. But I do think that this partly explains why Uber and Lyft drivers don't "just organize"\--it's because they don't receive the protections (limited as they are) that ordinary employees would when they organize.

</comment><comment><USER13> That's a fascinating read. I'd never thought of that implication of antitrust law.

Owner-operator truckers are in the worst position, as that paper points out.</comment>


Why Flash died - <AUTHOR> https://medium.com/@virg1l/parallel-universes-25366dc2a10b <comment><USER2> That is just bull, Flash would have died even if Adobe would have continued investing, just like Java and Silverlight. Proprietary plugin based extensions are dead.

</comment><comment><USER3> Flash died because we all wanted it to. Thankfully, it was a mostly quick transition. It was a rough transition in Apple-land due to Apple's well- meaning intentions, but that is just the way Apple does everything.

</comment><comment><USER4> Flash died of a lot of things. It was already mortally wounded when Apple hastened its demise. I don't think that had much to do with the bottom line at Adobe, either - almost everything Flash did got moved into the browser, so it became difficult to justify the security risks and the headaches that came with it on non-Windows platforms.

<comment><USER5> I'm not so sure. Remember that browsers were all over the place at the time. Web Devs were actually building what we would now consider standard HTML in Flash because they didn't have to worry about browser incompatibility.

I was working for a commercial software house around this time, and we were seriously considering delivering major products in Flash because it solved a huge number of problems. Silverlight was MS's response to this push. Jobs killed it not because it was bad, but because Flash was fast becoming the platform for the web.

I'm curious about the secret "thing that killed Flash". Anyone know?

<comment><USER6> >Jobs killed it not because it was bad, but because Flash was fast becoming the platform for the web.

It had already become the platform for the web. I read somewhere that Adobe outsourced all their development sometime around 2005. By the time they needed to pivot and make it lean, they didn't have the knowledge anymore. I don't know how true this is though.

It was also a memory hog and wouldn't run well on a first generation iPad. Jobs used H.264 for video and it ran much better than Flash.</comment></comment></comment>


Show HN: Claudia.js – deploy Node.js microservices to AWS more easily - <AUTHOR> https://github.com/claudiajs/claudia <comment><USER2> Nice! I had the same pain point and worked something up a few weekends ago. [1] I may look into integrating some of my ideas into Claudia.js, although "I like CoffeeScript" may not be in line with where the author is headed.

Most of my efforts went into integrating Amazon's Key Management Service into the local development and S3 deployment process. (One of the first Lambda functions I wanted needed to talk with GitHub, Slack and some other APIs, so encryption of access tokens seemed a given.) I'd be curious if the author has run into this situation or already had thoughts about how to approach this.

[1] [https://github.com/twobyfourio/cheese- grater](https://github.com/twobyfourio/cheese-grater)

<comment><USER3> So for Shepherd ([https://github.com/bustlelabs/shepherd](https://github.com/bustlelabs/shepherd)) we copy in an env.js file on deployment to lambda that has all the env variables. Stage Variables are good, but there is a gotcha. If you are using them to establish connections (external service, DB, etc) you only get access to them inside the function body. Might not be the biggest issue for some people but I like to have everything loaded and connections established when the lambda function is loaded by the AWS parent process rather than on actual function execution.

</comment></comment><comment><USER4> So this is like Zappa[1] for Node.js apps? Cool!

[1] [https://github.com/Miserlou/Zappa](https://github.com/Miserlou/Zappa)

</comment><comment><USER5> This is really handy! Although what I really need is a service that, given a URI to a GIT repo, will clone the repo, `npm install --production`, browserify (and maybe uglify) the main file specified in the package.json, and return the output.

At the very least I wish AWS would update the version of Node.js that Lambda uses and maybe provide the "request" NPM package by default (yes, I'd like my HTTP requests to follow redirects automatically thank you).

<comment><USER6> That first part can be done in about 5 lines in a shell script

</comment></comment><comment><USER3> I'm working on something similar: [https://github.com/bustlelabs/shepherd](https://github.com/bustlelabs/shepherd)

It aims to be simpler than Serverless, but still maintain great integration with API Gateway.

Lots of cool project in the space right now! Check em all out. I'll be sure to add yours to Shepherd's "Other Project" section.

</comment><comment><USER7> Check out the Serverless Framework if you are looking to build entire applications on lambda - [http://www.serverless.com](http://www.serverless.com)

</comment><comment><USER8> Check out Micro as well: [https://github.com/zeithq/micro](https://github.com/zeithq/micro).

It's also oriented around single-purpose (single-function) microservices, but pure HTTP.

<comment><USER9> Only tangentially related, as this is about using AWS Lambda.

</comment></comment><comment><USER10> Apex from @TJ is similar [https://github.com/apex/apex](https://github.com/apex/apex)

<comment><USER9> Without me having to dig into code, what is this about shim to run Golang on Lambda?

<comment><USER11> You can run a node script that runs a golang executable. You just have to pack the go exe into the zip bundle.</comment></comment></comment>


Authentication Cheat Sheet - <AUTHOR> https://www.owasp.org/index.php/Authentication_Cheat_Sheet <comment><USER2> "Applications should enforce password complexity rules to discourage easy to guess passwords." \- ARGH!

To clarify, to avoid downvotes for a non-'productive' comment, I firmly disagree since this will probably result in me having to pick a password that's harder to remember than I otherwise would. It might also might it more awkward to type quickly, making shoulder-surfing easier.

(Note that this is probably not i18n-friendly, either)

<comment><USER3> At my company this typically results in users printing or writing the password down.

I wonder if the guys who create these heuristics/recommendations ever had contact with humans. I believe that their research is thorough in their area of expertise (info sec), however, it sounds like they are only considering data _per se_ , ignoring human behavior variables. There's little value in enforcing hard-to-break passwords while also encouraging users to write them down.

What I believe: Info sec researchers should team up with HCI people.

<comment><USER4> There's not much wrong with writing passwords down. Printing thema is less desirable.

It's a hundred times better to have a difficult password on a post-it on a monitor than it is to have an easily guessable password. Who do you suspect is going to hack you? Ask that question honestly and you'll know how best to thwart them.

<comment><USER3> I understand your point, and I agree that the biggest threats aren't physically nearby. In that scenario ("remote" attacks), of course, there are bigger problems than written/printed passwords.

However, at the enterprise level, physically visible passwords are a big problem. Imagine a less-than-happy worker, about to leave the company, having the opportunity to get coworkers passwords. In such scenario, less strict rules (let's say, rules that didn't make people writing the passwords down) would have been beneficial.

And there's another point: the "perception" about IT security rules. If they ask too much of people (think "non-IT people"), they might create a image of overzealousness/"overcomplication". I wonder if this doesn't make people less compliant, with security rules, on the long term.

</comment></comment></comment></comment><comment><USER5> "An application should respond with a generic error message regardless of whether the user ID or password was incorrect."

I really don't like this advice (although I see why they put it in there).

I often use different email addresses for different services so that I can determine who sells on email addresses (depending on how much I trust them), and quite often I can't remember which email address I signed up with (was that mojang@...com or minecraft@...com).

At least if I see "user not recognised", I know to try a different email address.

<comment><USER6> So just keep trying addresses until you get a reset link sent to you. It's really unacceptable for any service to leak its user list in the way you suggest.

EDIT: x1j7xJuzX in the sibling subthread has it right for email addresses. It's true that separate usernames would be difficult to handle in a user- friendly manner without leaking, but with a valid email address a separate username is probably unnecessary. It doesn't help the user interact with the site. If users interact with each other, they can just choose non-unique display names. To prevent impersonation, just use display name plus some other invariant account property to generate a hash that is displayed alongside the display name.

<comment><USER2> How do you avoid 'leaking the user list' if you enforce unique usernames?

<comment><USER7> If you use email as username, you can make the sign up give the same "check your email to confirm your account" message for a new account and an existing account. This works well for new users and those who have already signed up but perhaps forgot, and leaks no information to someone who doesn't have access to that email account.

I'm not sure how to do this just for usernames, but usernames are less sensitive than emails anyway.

</comment></comment></comment></comment><comment><USER8> _" Maximum password length should not be set too low, as it will prevent users from creating passphrases. Typical maximum length is 128 characters."_

Why would you ever have a maximum password length at all? bcrypt or (god forbid) your secure hashing algorithm of choice doesn't care about input length, and has a fixed output length to stick in a database. Why on earth would you limit the password length beyond anything so insanely large (1024, etc) to not even matter?

<comment><USER9> Hashing passwords takes a lot of CPU resources. Django limited their password lengths to a maximum 4,096 characters because of this: [https://www.djangoproject.com/weblog/2013/sep/15/security/](https://www.djangoproject.com/weblog/2013/sep/15/security/)

<comment><USER10> The Django developers are wrong to blame PBKDF2 for this slowness. It takes just 1 second with an unoptimized Python PBKDF2 to hash a 1MB password, and probably 0.1 second or less with a native implementation. If they claim it takes 1 full minute, they must be doing something seriously wrong, like using a crappy parsing or serialization mechanism to pass a 1MB string around higher-level modules.

      $ time python -c 'import pbkdf2; print pbkdf2.crypt("a"*1000000,"XXXXXXXX")'
      $p5k2$$XXXXXXXX$hmAHZehesTpLs.pM3G4mKlHZI6/FMj.Y

      real	0m1.233s
      user	0m1.221s
      sys	0m0.012s

<comment><USER11> By default that uses 400 iterations, the current recommended is 10,000. Try it again with 10,000.

<comment><USER10> Indeed: 28 seconds with 10,000 iterations. I assumed Django was iterating 400 times. I was wrong. Thanks for correcting.

</comment></comment></comment></comment></comment><comment><USER12> Every time you introduce a password constraint, you've reduced the potential password complexity. I absolutely hate arbitrary password requirements. "not more than 2 identical characters in a row"? WTF? Stop with this nonsense.

<comment><USER13> _" not more than 2 identical characters in a row"? WTF? Stop with this nonsense._

This is OT, but there's an interesting snippet in "The Secret Life of Bletchley Park" [1] about decoding Enigma messages used by the Italian Navy in the Med.

One of the female operators had a set of messages from one Italian operator who sent a message once a week on a regular basis. They had determined that the first letter was an 'L'. She looked at the keyboard, saw that 'L' was neatly placed under the right hand and guessed that he was sending a test message consisting of nothing but 'L's tapped out in quick succession. Voila! She hit the jackpot.

From this insight, all dial wirings and movements of the Italian machines could be quickly deduced.

So, repetitive plain text _can be_ a security issue.

[1] [http://www.amazon.com/The-Secret-Life-Bletchley- Park/dp/1845...](http://www.amazon.com/The-Secret-Life-Bletchley- Park/dp/1845136330)

<comment><USER14> That's a vulnerability for cyphers and has no application to modern password systems. If a password were all Ls up to the minimum then certainly that would be a bad idea, but having two Ls in a row because your password happens to contain or be a derivative of a word that has two Ls has no bearing on how secure the password is.

        sha256(LLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLLL+mysalt) = 57c70b4fddd06c94c9a7b41d9884591bb1d487fb78df723b11bc4892e879f46e
        sha256(LRpSdU$EnD1ZrJJ2QyVHPycN*DZtrHm&YdH%%28f4ih+mysalt) = 29cd0708db0fb7350e17349012a6e728b357ef733e85f401fc757e6565ef5e80

Neither of those hashes would give an attacker the slightest bit of insight into the user's password even if the attacker suspected the first letter of each were an L.

<comment><USER15> > having two Ls in a row ... has no bearing on how secure the password is.

At least some password cracking programs are built to anticipate human tendencies, which I would guess includes repeating characters. If I were designing a password cracker, I would target human-created passwords and not random passwords. For example, I would have the program guess 123456 before it guesses R%Vg9~\

<comment><USER14> The other complexity rules rule that out, though.

If I have a password 10 characters long with at least one uppercase, one lowercase, 1 digit, and 1 special character then having one of those repeated won't make it any less secure. Rigidly enforcing that rule doesn't make sense, it's saying that "R%Vg9~\LL" is _less_ secure than "R%Vg9~\".

</comment></comment></comment></comment></comment><comment><USER16> A big one I've seen is more related to the TLS cheat sheet [1] they link to on that page.

Many sites will send session tokens over http because they don't set the "secure" cookie flag. It's a simple thing to do, and prevents a malicious ARP poison or DNS attack from potentially hijacking an account.

You'd be surprised how many sites are vulnerable to such attacks. Reddit, parts of Ebay, several university websites, and many other sites still are vulnerable to session hijacking.

I think people writing web libraries need to start building "sane defaults" concerning security. All cookies should be secure by default, and only those who know what they are doing should turn them off. It's not that much extra overhead, and the potential benefits outweigh the increased processing and bandwidth.

1: [https://www.owasp.org/index.php/Transport_Layer_Protection_C...](https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet#Rule_- _Use_.22Secure.22_Cookie_Flag)

<comment><USER11> Great point. Setting "SECURE" and the poorly named "HTTP" are key to cookie security.

One issue we ran into was: So our site runs behind a load balancer. We receive HTTPS connections into the load balancer but the internal connection between the load balancer and the actual websites was HTTP only, so when we tried to set SECURE on the cookies, the application framework we were using trying to be "helpful" unset the SECURE flag because it detected that the connect from its perspective was not secure (even though from the browser's perspective it was).

Keep in mind that the connection between load balancer and web-servers was never on the internet, in fact it never left a virtual machine farm (a single room essentially). So it is justifiable doing HTTP internally and HTTPS externally (and also makes certificate management easier).

We finally had to hack away a bit on the framework to get it to set secure regardless of the connection type.

</comment></comment><comment><USER17> > not more than 2 identical characters in a row (e.g., 111 not allowed)

Why? If my password is _id8FK38f@ &&#d_ is it inherently less secure if _111_ appears in the middle of it somewhere?

<comment><USER18> Next revision:

> no prime numbers, no more than 2 even or odd numbers in a row (e.g., 644 not > allowed), no sequence of 2 or more characters may repeat more than 2 times > (e.g. aabaa not allowed), no ascending or descending sequences longer than 2 > characters in a row (e.g. 123 or cba not allowed)

<comment><USER17> These are just rules for the sake of having rules. It's downright silly and honestly it makes OWASP look like a joke to have something this ridiculous on their domain.

<comment><USER18> That was actually sarcasm (reductio ad absurdum), not an actual quote.

I think I've seen password restrictions similar in spirit to those, though.

<comment><USER17> I honestly couldn't tell. I think that in itself says something...

</comment></comment></comment></comment></comment><comment><USER19> Some of the suggestions are bad. Why they are enforcing English characters? Like a-z? For example in Github I write щ and then it wants me to write a lowercase letter. WTF? It is lowercase! And more secure than an English letter!

</comment><comment><USER20> Do people REALLY brute force passwords? Do people REALLY brute force all lowercase, all latin combinations up to 20 characters before trying symbols, uppercase and numbers?

I am very skeptical that the '3/4 complexity rules' approach is making systems meaningfully more secure. I've had all kinds of passwords, but I've never lost them to brute force. Every time it was because someone got inside a company and made off with the database.

If complexity rules don't add anything, they should be discarded in the name of usability.

<comment><USER11> > Do people REALLY brute force passwords?

Yes. Source: I have, multiple times.

> Do people REALLY brute force all lowercase, all latin combinations up to 20 > characters before trying symbols, uppercase and numbers?

Remotely? No. Locally? Yes.

If I have some hashes, I am going to be doing every combination of characters at least up to 8 digits. If they're using something bad like 3DES or MD5 then I can go up to 20 digits and check everything.

Remotely you're typically using a common password dictionary which is just a few thousands passwords people often use. If you had a botnet you might be able to do every combination (I don't).

> I am very skeptical that the '3/4 complexity rules' approach is making > systems meaningfully more secure.

Nor am I. I am more an XKCD-sentence password fan myself...

I really like entropy calculators. They're much more useful than broad generic requirements that actually reduce the set of potential passwords.

The entropy calculators that give people "prods" (so there are no requirements, just a traffic light system) are absolutely wonderful.

> I've never lost them to brute force. Every time it was because someone got > inside a company and made off with the database

Which still requires brute forcing assuming the passwords are stored correctly. If it is something modern like PBKDF2 with a decent number of iterations (e.g. 10K rounds) it can be a nightmare even if your password is "just" 8 digits.

> If complexity rules don't add anything, they should be discarded in the name > of usability.

Agreed. They aren't even based on any research, someone in the 1980s just thought they "sounded" secure. Nobody has spent any time actually researching this, we just repeat the same tired advice from thirty years ago because "common sense" tells us it is a good idea.

</comment></comment><comment><USER21> Just a hypothetical, but what if an application started encouraging users to enter a "login sentence" instead of a password. i.e.: "Please enter a sentence that you'll be asked to remember each time you login." Obviously, the standard constraints of length and complexity (albeit slightly altered) can be enforced.

It's much easier for me to remember "Please close the window, I'm cold." then it is for me to remember "XSDJd94*(lo03X.._".

The "horse battery staple" XKCD comes to mind.

<comment><USER22> That could be an interesting idea, but I'm wondering if the user wouldn't expect an unobfuscated input box to type in his sentence. Or if he would expect : "Please close the window, I'm cold." to be the same as "Please close the window, I'm cold" (no end period here)

<comment><USER23> If you ate all the whitespace and punctuation and uppercase'd it as part of your password input routine, it wouldn't be all that much worse than existing shorter passwords yet make life a lot easier for valid users.

Another interesting strategy, not discussed so far, is everyone in almost all lives and professions has some pool of weird technical names that can be concatenated together for a password. I'm partial to "unpopular yet cool integrated circuit ID codes of the 80s". I thought I invented that idea and was introduced to an old programmer using concatenated library calls from multiple languages (so his passwords were concatenations like a java soundex algo library call followed by some obscure fortran matrix manipulation) My mom knows the long legal names of some obscure real estate cases / judgments / citations / forms.

</comment></comment></comment><comment><USER24> _The correct response does not indicate if the user ID or password is the incorrect parameter and hence inferring a valid user ID._

ARGH. This is a usability nightmare - moreso when the recovery system implements the same rule.

"Okay, I had an account on this website, which email address was it again?"

 _try logging in a few times_

"Hm.. I must have forgotten the password. Off to reset!"

 _go through the recovery process_

 _recovery page indicates an email will be sent_

 _email never comes_

"Wait, so are they being 'really secure', or is email just broken right now?"

 _wait a couple hours_

 _forget about the site_

<comment><USER25> The trick here is it not go to the reset page but to the signup page. Almost always, there is a message that indicates that the email id is already taken.

(which is why _I_ think that indicating specifically, that the userid was incorrect or the password was, is better UX.)

</comment></comment><comment><USER26>
      The application may return a different HTTP Error code depending on the authentication attempt response. It may respond with a 200 for a positive result and a *403* for a negative result.

I would say a _401 - Unauthorized_ with proper _WWW-Authenticate_ header.

403 means forbidden, which apply to when you try to access a resource without permission / authorization

Also, in their _Password Storage Cheat Sheet_ [[https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet)], they seems to recommend :

      Select:
        PBKDF2 [*4] when FIPS certification or enterprise support on many platforms is required;
        scrypt [*5] where resisting any/all hardware accelerated attacks is necessary but support isn't.
        bcrypt where PBKDF2 or scrypt support is not available.

AFAIK, things are not so binary :

* [https://news.ycombinator.com/item?id=3724560](https://news.ycombinator.com/item?id=3724560)

* [http://security.stackexchange.com/questions/4781/do-any-secu...](http://security.stackexchange.com/questions/4781/do-any-security-experts-recommend-bcrypt-for-password-storage/6415#6415)

* [http://security.stackexchange.com/questions/26245/is-bcrypt-...](http://security.stackexchange.com/questions/26245/is-bcrypt-better-than-scrypt/26253#26253)

<comment><USER18> There are different interpretations of what 401 should be used for. The spec only handles WWW-Authenticate authentication, which is pretty limited and not universally used (Bearer auth is occasionally used for APIs but Basic auth is pretty rare -- especially in end-user-facing parts of the web). The problem is likely that when the status codes were defined nobody thought people would ever need to build their own login forms.

I agree that it is more useful to use 401 to indicate that some form of authentication is required or has failed, and 403 to indicate that you are authenticated but not allowed to access something (which is what the spec emphasizes).

IOW, 403 should be "Unauthorized", 401 should be "Unauthenticated". Sadly the spec mixes those two meanings in various places.

<comment><USER26> I usually do set WWW-Authenticate to None or WebForm (to prevent browsers to pop-up basic auth dialog).

And I agree with ambiguous spec on those concerns.

</comment></comment></comment><comment><USER27> Simplicity should be a primary goal in the methods used to protect systems. Just because the methods to protect are easy, doesn't mean its easy to crack. For instance, a decent size password and lockout and you're set as far as brute force attacks. They are not going to guess a 10 letter password in 5 tries. After x tries, make them reset. Two factor auth for _really_ important stuff, isn't that pretty much it.

I believe we're seeing more successful attacks from the use of security techniques that are unnecessarily complex and not completely understood (or partially implemented) by most engineers - than cause passwords aren't long enough.

</comment><comment><USER28> Password complexity rules are stupid. The only thing that matters is the total entropy. "Entropy too low" is the only error a user should receive when coming up with a password.

Those complexity rules are the result of an entire industry blindly following the best practices of an old unix DES crypt function. It's dumb and it should stop.

[http://security.stackexchange.com/questions/33470/what- techn...](http://security.stackexchange.com/questions/33470/what-technical- reasons-are-there-to-have-low-maximum-password-lengths)

<comment><USER29> Going a step further, I don't even understand why we need any kinds of un- skippable errors because of this.

If I wanted a single number, say, '1' as my password, why shouldn't I be able to use it? It is my account and my responsibility, why does everyone feel the need to enforce something on others.

A simple warning would suffice.

<comment><USER30> A compromised account affects more than just the account owner. In many scenarios it's possible to escalate privileges and take over an entire service - your password might be all that stands between a malicious user and _everyone 's_ accounts.

<comment><USER29> I can see how this may be a problem for invite-only systems, but a place where anyone can create an account? Plz...

In a scenario like GitHub's organization (where one user has privileges over many shared resources), for example, its owner still carries the responsibility of safety of all its resources.

If it's possible to escalate privileges, then that's the place that needs fixing.

</comment></comment></comment></comment><comment><USER31> He forgot an important modern rule on authentication: don't do it.

If you can get another system to do it for you; persona, OpenID, Github, Google, Facebook, or twitter it's more secure for the end user. They have features such as two factor authentication, fraud detection, manage password resets for you, and the end user is more likely already have an account.

Many developers don't agree with this on a moral level, as you are giving power to third party. However developers are developers, and if you do it yourself you're bound to do at least one thing wrong.

<comment><USER32> Might be a sample of one - but I dont use any services which requires me to provide a google / github / twitter account. I have very little trust in what I am authorizing the service to do on my behalf. Perhaps this wariness has come from my experiences with linkedin where I have been negatively surprised on more than one occasion.

</comment></comment><comment><USER33> Isn't 2FA the best approach? I'm just asking.

A problem here where I work is that every application must have a different password and it must change every 90 days. Consequently everyone has a spreadsheet with his passwords written down because nobody could possibly remember them all.

It seems to me that with 2FA, one simple password is adequate. Two independent devices need to be compromised and brute force is ineffective since the turn around time is at least several seconds between tries.

<comment><USER34> One simple password is never adequate as that then trains the user to continue doing that across other sites - regardless of their use of 2FA.

I've found the best solution for me is to use a password manage (Personally, I use LastPass) and enable MFA/2FA across everything that allows it.

</comment></comment><comment><USER35> This doesn't touch on commercial authentication managers and how horribly they can be implemented. There's no authorization cheat sheet either.

They also make assumptions like "When multi-factor is implemented and active, account lockout may no longer be necessary." Sure, until someone finds a simple hole in one of the factors and the rest become trivially brute-forced, sniffed, phished, etc. The chain is only as strong as the weakest link.

</comment><comment><USER36> I dont really like this page. Its a good effort.. but. (no ands!).

\- Most things are just a flyby, such as "hey look heres a paragraph that tells your what MFA is". but doesnt tell you how to use it.

\- Password rules are outdated "use caps, 10 char, numbers, etc!". The horse staple blabla has been the new standard for yearS now... and is way better.. generating the password for the user is often not a bad idea

\- no mention of upcoming techs like FIDO/U2F

</comment><comment><USER37> This is not a accusing comment, but more of a request for more information:

"Passphrases shorter than 20 characters are usually considered weak if they only consist of lower case Latin characters."

This goes against the concept of diceware generated passwords of 4-6 short words doesn't it? Where in this equation am I getting it wrong? I've been approaching passwords like this for a while now.

</comment><comment><USER38> "An application should respond with a generic error message regardless of whether the user ID or password was incorrect. It should also give no indication to the status of an existing account."

If so.. then how to respond on user registration page when someone tries to open a new account with username / email address of an existing account?

<comment><USER39>
        cat registrationError.php

        <?php echo "we don't want your kind here. go away." ?>

</comment></comment><comment><USER40> and if you use email addresses as user names, verify they actually own the email address. Apple doesn't do this, and I'm amazed at how many people sign up for iTunes with email addresses I control.

</comment><comment><USER41> OTP passwords dont fight client side malware lol.

</comment><comment><USER42> Some of this is good advice, but there's a BIG point on the 'Password Storage Cheatsheet' that's linked and referenced by the above article, that I don't think is solid. [https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet...](https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet#Leverage_Keyed_functions)

Specifically, it suggests storing passwords using: `return [salt] + HMAC- SHA-256([key], [salt] + [credential]);`

It goes on to note that the key must be protected as private, strongly random, and stored outside the credential store, while the salt (can we please call it a nonce?) can be safely stored against credentials.

I'm still not comfortable with this construction. Stick with their earlier advice and use scrypt, bcrypt, or PBKDF2. That's my order of preference too, which differs from theirs somewhat, but that's a minor quibble; all three are reasonable.

The problem with their construction is that HMAC-SHA-256() is designed to be fast, and so attackers have the opportunity to make a lot of guesses quickly. The secrecy of the key helps over a straight SH256(...), but not a lot for the following reasons:

1 - It assumes an attacker who compromises the credential store won't also have the key.

2 - It assumes an attacker is unable to recover the key.

1) is a valid assumption for certain classes of attack. If your key is stored in an environment variable or something, while credentials are stored in a database, an attacker who compromises your database via a SQL injection won't have the key. But the problem is that an attacker who compromises the application may. If I have full remote code execution on the server (and you have a bad day then, passwords aside) I'll have the key. Or maybe an attacker has an arbitrary file read (not quite as bad a day), and you store your key in a flat file on disk. Or an attacker can cause your application to generate a stack trace (disclosing runtime details) and view the key...

You get the idea - there's lots of potential ways to get that key regardless how you store it, and everything hinges on that. Once they have the key, they can mount dictionary or brute force attacks against credentials just as they would against `SHA256([salt]+[credential])`

2) is a valid assumption only if the attacker doesn't know a single password's plaintext value and the key is sufficiently long and random. If I know the password to my own account (and I likely do) or any other account (let's say one user on the site uses a password that was recovered in another breach) this scheme fails.

Suppose my salt is "SALTYSALT" (okay, so my PRNG sucks; also a detail to be wary of) and my password is ye olde "PASSWORD" (yah, this sucks too.. but it's my crappy password. Maybe I added it just to observe the resulting HMAC value?) Now I can just try calculating `HMAC-SHA-256("A", "SALYTSALT" \+ "PASSWORD")` If that doesn't match, try `HMAC-SHA-256("B", "SALYTSALT" \+ "PASSWORD") and so on. The one thing I don't really know that would help is the length of the key. If it's long enough (We'd want at least 256 bits), and strongly random, I may have a difficult time. It it's short (And they make no recommendation on it's length, just that you "Generate the key using cryptographically-strong pseudo-random data"), I'm going to crack the key, and then I'm back to attacking all the other credentials.

I _MIGHT_ be convinced of this being reasonable if it can be ensured that all the HMAC calculations are done in something like an HSA or TPM which generates a large key internally and doesn't expose it, even to the application. But that's probably not the scenario we're talking about here. Even then, you've got nothing to lose by using an adaptive algorithm rather than the HMAC construct. For anything else, it's far safer (and easier really!) to use scrypt, bcrypt, or PBKDF2. So just do that.

<comment><USER43> _Some of this is good advice, but there 's a BIG point on the 'Password Storage Cheatsheet' that's linked and referenced by the above article, that I don't think is solid._

I read they recommend to use the both (adaptive hashing and "local parameterization"). As even if you utilize separate device (HSM for example) for encrypting the passwords (I'd encrypt instead HMAC), you should indeed not give up on adaptive hashing.

Here's some good commentary on this by Solar Designer (user solardiz on Reddit): [http://www.reddit.com/r/netsec/comments/26d52c/yescrypt_pass...](http://www.reddit.com/r/netsec/comments/26d52c/yescrypt_password_hashing_scalable_beyond_bcrypt/chqajgu)

<comment><USER42> "I read they recommend to use the both (adaptive hashing and "local parameterization")."

I read their text as recommending A or B, based on the intro where they state "Two approaches facilitate this, each imperfectly."

"As even if you utilize separate device (HSM for example) for encrypting the passwords (I'd encrypt instead HMAC), you should indeed not give up on adaptive hashing."

Right, this is the sort of thing that led me to hedge by saying I _MIGHT_ be convinced if an HMAC were involved; it still gives me pause, for sure.</comment></comment></comment>


Xi Jinping decides to abolish presidential term limits - <AUTHOR> https://www.economist.com/news/china/21737543-unhappiness-china-palpable-xi-jinping-decides-abolish-presidential-term-limits <comment><USER2> > The party hierarchy outranks the state one. In other countries, the > ministers of finance and foreign affairs (government jobs) are usually the > most important ones after the president or prime minister. In China, they > are not even in the top 25. Neither man is a member of the Politburo, let > alone its inner sanctum, the Politburo Standing Committee. Formally, the > People's Liberation Army is controlled by the party, not the government.

It was interesting to read. Some countries have an official "balance of powers" defined in the Constitution. But even authoritarian or dictatorial regimes have an informal balance of powers. In the old Soviet Union they pretty much had the Politburo, the army and KGB. They kind of kept each other in check in strange way.

Wonder where the business interests fit in the China's balance of powers. Do large companies bribe the government officials or go through the party to get things done and how do they interact in general.

<comment><USER3> > Do large companies bribe the government officials or go through the party to > get things done and how do they interact in general.

For about ~15 years before Xi fully consolidated power, that's how things routinely worked. It was run almost entirely on a bribery to get things done approach, in the business sphere.

Xi has moved the system/party on to new goals, with the business realm no longer having the same high order position that it previously did. I wouldn't want to be Jack Ma or Pony Ma in the environment that's being setup now. Alibaba and Tencent will eventually be too large for Xi's liking, if that's not already the case.

Australia's former PM, Kevin Rudd, has an excellent write-up on all of this (he has a particularly strong background regarding China):

[https://www.bloomberg.com/view/articles/2018-03-03/emperor-x...](https://www.bloomberg.com/view/articles/2018-03-03/emperor- xi-s-china-is-done-biding-its-time)

<comment><USER4>
      > Xi has moved the system/party

Because Xi has circumvented several of the most important limitations (term limits, seniority) on party and state leadership, there is no _system_ anymore. AFAIU, since Mao died, ultimate power was vested in the Politburo Standing Committee (PSC). Cycling out of leadership posts after two terms was simultaneously both the concrete recognition and reflection of where ultimate power was truly vested.

The bribery was an artifact of how power was shared in the PSC, and how the members jockeyed to maintain a balance of power. At a high level it wasn't corruption, per se, but the system through which the PSC members could exert influence when they weren't seated as the President, Chairman of the Central Military Commission, etc. It effectively operated like the checks & balances of Western institutions. If a PSC member opposed a policy preferred by the President, those backchannels to the party base and to industry was how they could push back, and ensured the posted leaders always had to acquiesce, to some degree, to the PSC members.

In as much as there was corruption, well that's the price you pay for not having a transparent system of governance with an independent civil service and independent judiciary without concentrating too much power into the hands of a (hopefully) benevolent dictator.

The problem is that all the senior leaders from the Maoist era are gone. The norms of the PSC were instituted _intentionally_ to avoid the reemergence of Maoist extremism. This generation doesn't appreciate the critical importance of the power-sharing norms within the PSC. They think they can have their cake and eat it too: preserve the one party Communist system and provide streamlined, efficient governance, without instituting democratic, rule-of-law reforms. They apparently don't appreciate the fact that once the PSC is effectively dominated by a single individual, then the one party system is _de_ _facto_ extinguished--the _party_ becomes subservient to a single individual.

More importantly, like many people they don't appreciate the fact that whether in democracy or single-party rule (which has a sort of internal democracy), some amount of organizational inefficiency is the price you _must_ pay to keep power from centralizing. Maximum organizational efficiency can only be achieved in a dictatorship because that's the only way, theoretically, to maximally minimize transaction costs. But over the long-term history has shown that optimizing for short-term efficiency is a really bad idea and it tends to result in very inefficient long-term outcomes.

</comment></comment></comment><comment><USER5> One of the few things that China's governmental system had going for them was term limits for their head of state. This is a very unfortunate development for the world.

<comment><USER6> It was just a term limit for the chairman of the party. The party never had a term limit set.

<comment><USER7> Right, but the term limit became defacto when the presidency was merged with the general secretary position. Xi could technically remain general secretary without remaining president, but practically that is impossible at this point, so the constitution had to be changed.

</comment></comment></comment><comment><USER8> I'm reading a very good book called "China Dream: Great Power Thinking and Strategic Power Posture in the Post-American Era"

I haven't finished it so I'll save you all from a premature review, but from what I have read so far I believe we need a more serious national conversation on China and the role that technology companies play in enabling dictatorships.

<comment><USER9> I also think in light of recent events I think we'd benefit from people educating themselves on the actual state of free trade with respect to China, China is far more protectionist than the US, but if we try to do something about it, it's considered to be starting a trade war.

<comment><USER10> When it comes to trade what matters is whether or not you meet your treaty obligations. It's a rules based process, where you agree the rules and have some arbitration process, e.g. through the WTO.

On that basis, what matters is whether China is following the rules it, and everyone else, agreed to. If you think some one is cheating you arbitrate. We made a deal.

Trump is intent on blatantly breaking the rules the US has agreed to, and breaking the deals it committed to. That is important because companies invest billions of dollars based on the rules countries agree on trade. Arbitrarily change the rules with no warning and those billions of dollars of investment can become worthless and the jobs associated with them lost in Canada, the EU and countries all over the world aside from China.

<comment><USER3> > what matters is whether China is following the rules it, and everyone else, > agreed to

That's incorrect. China is failing, to an extraordinary degree, to comply with what it said that it would do in being allowed into the WTO. Namely, opening up their economy in terms of full and equal foreign access. At every step, they've refused to go forward with that. As it turns out, most likely, they were lying and buying time. Their goal is clearly to get large enough to not have to ever comply. They've been very obviously following Deng Xiaoping stated policy - 24 character strategy - of hiding their strength and biding their time.

North Korea used the same strategy to acquire its nuclear weapons. Lie, pretend you're going to do a thing, with no intention of doing the thing, buy time, get the nukes, then you no longer have to comply and or you've massively increased your bargaining position.

<comment><USER9> It's amazing how clear this is, yet so few people can see it, it makes me wonder if there would be less confusion if we didn't have two different cultures involved.

Of course, Western corporations and their executives who are profiting handsomely from it have good reason to "not notice" what's happening and continue to talk their book, but the wilful ignorance of genuinely well- meaning liberals is more complex.

I always wonder if Chinese leadership sometimes leans back and marvels at how easy it is to win when the uninformed citizens of your adversaries are in an ideological war with each other.

<comment><USER11> This is just how the state operates. It will never be transparent about just how threatening the Chinese are and vise versa. Ignorance is bliss within the world of global power dynamics. If you ever meet someone who works/has worked for intelligence agencies, ask them about China. Whether they will share anything verbal or not, their true feelings have already flushed across their face.

<comment><USER9> If that's true then how would you explain their obsession with the "Russian Hackers" boogeyman, while remaining completely mum on the absolutely massive economic and political threat China has become, which anyone could have seen coming well over a decade ago?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> For those who say it's OK to be a president for life because he's a competent person: he's 64 years old. Brain deteriorates rapidly with age. The most reasonable person today can suddenly start rounding up Chinese who post memes on WeChat a year from now simply because of a normal biological process. That's where you need a system in place that strips them off power very quickly. History has had plenty Mad Kings.

<comment><USER13> The biggest problem is the precedent it sets. Once Julius Cesar made himself "first citizen" and took control over the senate, absolutely NONE of his successors relinquished power back to the Senate. ...and some of them were disastrous leaders.

</comment></comment><comment><USER14> Some other disturbing signs from China: increasing military budget [https://www.hongkongfp.com/2018/03/06/china-splash- us175-bil...](https://www.hongkongfp.com/2018/03/06/china-splash- us175-billion-military/), kidnapping relatives of the reporters in other countries that exposed the uigher concentration camps [http://m.dw.com/en/chinese-authorities-detain-relatives- of-r...](http://m.dw.com/en/chinese-authorities-detain-relatives-of-radio- free-asias-uighur-reporters/a-42803793), China literally banned words and letter n in social media [https://mashable.com/2018/02/28/china-bans-n-xi- jinping-term...](https://mashable.com/2018/02/28/china-bans-n-xi-jinping-term- limits/), China propping up dictator in Maldives and angering India [https://www.google.com/amp/s/mobile.nytimes.com/2018/02/14/w...](https://www.google.com/amp/s/mobile.nytimes.com/2018/02/14/world/asia/maldives- china-india.amp.html), China threatens to invade democratic Taiwan over us ties [https://www.google.com/amp/amp.abc.net.au/article/9503126](https://www.google.com/amp/amp.abc.net.au/article/9503126)

<comment><USER15> Is it disturbing from a US POV, or generally speaking? Because if I recall correctly, the US military spending has gone up significantly as well, also it's projected to rise even further in the future.

On a related note, could someone explain to me how Russia manages to stay a threat with a military budget that's about 6% of the US budget? Or does it only seem to be that smaller because their soldiers are payed less?

<comment><USER16> "Because if I recall correctly, the US military spending has gone up significantly as well, also it's projected to rise even further in the future."

US military expenditures are also very disturbing.

<comment><USER17> The US defense expenditure as a percent of GDP has gone down as a long term trend.

[https://goo.gl/images/sQPFFy](https://goo.gl/images/sQPFFy)

</comment></comment></comment></comment><comment><USER18> I must've missed the part when China became a democracy. While I hold the same fear as China continues to aggressively pursue the Orwellian path, I seldom to see model governments that makes China second think its authoritarian decision. After all, I can't envision other governments wanting to become US—-when excluding its resources. I hope we become better so we can emerge as the role model that we once were.

<comment><USER19> > I hope we become better so we can emerge as the role model that we once > were.

USA is still a role model on many areas: cultural, economic, military, etc. It was never a moral role model, although that didn't deter the government of boasting about it anyway.

<comment><USER20> Economic role model? Are you even serious?

US debt on 6th of March 2000 was 5.7 trillions. [0] Today it is 20.8 trillions.

And what USA has to show for the mere 15 trillions of debt?

Affordable healthcare? Free education? Absence of homeless population? Shiny new infrastructure? Thousands of kilometers of speed-rails connecting major cities?

Role model. You guys are delusional. Let me tell you something like non- american. The whole world looks at you with sheer amusement.

[0] [https://www.treasurydirect.gov/NP/debt/current](https://www.treasurydirect.gov/NP/debt/current)

PS: The only economic achievement I can list is that US elites have managed to alienate with their policies half of the country, so that half decided to give country a try with some real estate tycoon who enjoys to bang pornstars in his free time. Quite an achievement indeed. 15 trillions well spent.

<comment><USER19> And to think this article was written in 2000: "Clinton Forecasts Debt-Free Nation" [http://abcnews.go.com/US/story?id=94572](http://abcnews.go.com/US/story?id=94572)

And in 2012: "The Untold Story Of How Clinton's Budget Destroyed The American Economy" [http://www.businessinsider.com/how-bill-clintons-balanced- bu...](http://www.businessinsider.com/how-bill-clintons-balanced-budget- destroyed-the-economy-2012-9)

<comment><USER20> first article was written in 2000. it talks about projections (!) of 2001 budget.

<comment><USER19> Thanks, messed the years. Corrected.

</comment></comment></comment></comment></comment></comment><comment><USER21> I have a feeling 10 years from now Trump will be funny blip on the radar of how crazy the '10s were while Asia will be quite meaningfully transformed. I wish this was getting as much attention as BREAKING NEWS: Trump/staffer did something dumb. The (soon plausibly) richest and most populous country in the world will soon have a dictator. That's a bit scary.

<comment><USER22> It's part of the same larger pattern. The entire world seems to be moving toward totalitarianism to varying degrees. I have yet to encounter a really good explanation of why this trend is occurring across so many nations and cultures.

<comment><USER23> The explanation is the rise of populism following a bad economic episode. What you are seeing now has been seen in the 20's and 30's. If some good social policies had been implemented and the gains well distributed in the prior decades of growth this wouldn't be happening. But humans won't learn until forced to.

<comment><USER22> That's surely valid to some extent but I don't think it goes back far enough. I've seen this trend firmly in place since 9/11 or shortly thereafter and across virtually every segment of society.

</comment></comment></comment></comment><comment><USER24> Strange as it is, centrally planned economies are kicking the West's arse right now. We're busy electing far right faux populists (like Italy yesterday) and giving money to the rich.

<comment><USER3> Not even remotely close. Let's examine the countries in question anyway.

Liberal economies: US, Canada, UK, Ireland, Sweden, Finland, Germany, France, Spain, Japan, Italy, Denmark, Netherlands, Belgium, Australia, Portugal, Switzerland, Israel, South Korea, Hong Kong, Singapore, New Zealand, Iceland, Taiwan, Austria

Planned or otherwise heavily state controlled: China, North Korea, Cuba, Russia, Saudi Arabia, Iran, Venezuela, Zimbabwe, Algeria, Sudan, Angola, Turkmenistan, Ukraine, Afghanistan, Vietnam, Egypt, Burma, Cambodia, Pakistan, Belarus, Uzbekistan, Laos, Sierra Leone, Liberia

Who doesn't love self-explanatory lists?

And speaking of giving money to the rich. China has the highest real inequality of any nation that has ever existed in world history. They have half a billion people living on less than $10 per day, and a quarter of a billion people living on less than $3 per day, while they have over 600 billionaires, including _100 billionaires_ in their parliament:

[https://www.cnbc.com/2017/03/02/chinas-parliament-has- about-...](https://www.cnbc.com/2017/03/02/chinas-parliament-has- about-100-billionaires-according-to-data-from-the-hurun-report.html)

</comment></comment><comment><USER25> The Economist has a very biased reporting slant on anything China related. I try to take everything from them with a grain of salt.

<comment><USER26> The economist is completely and openly biased with all their reporting; that's why their pieces are both valuable and only part of the picture. To just scratch the surface:

 _> Our public agenda is liberal in the classical sense. We have supported free trade ever since our foundation in 1843 when we opposed Britain's corn laws, which sought to keep the price of grain high by limiting imports. We have continued to advocate bold policies in favour of individual freedoms, such as same-sex marriage and legalisation of drugs, regardless of whether they are politically popular, in the belief that the force of argument will eventually prevail._

[https://www.economist.com/about-the-economist#editorial- phil...](https://www.economist.com/about-the-economist#editorial-philosophy)

</comment></comment><comment><USER27> I had no idea North Korea was a model government for China

<comment><USER28> It has been my suspicion that Singapore has been a model for China over the last three or four decades, perhaps since the end of the Viet Nam war.

</comment></comment><comment><USER29> I would rather more terms with Jinping than Trump.

<comment><USER30> There's not even a term of comparison between the two. If nothing else, Trump is an evil and stupid, Jinping is evil and smart.

<comment><USER31> And the US presidency isn't nearly as powerful as what will certainly become a Chinese autocracy.

</comment></comment></comment><comment><USER32> I thought it was kind of odd when Trump joked that maybe the US should experiment with getting rid of term limits.

The joke he made was clearly to enrage us leftists, but it also reeked of a man who doesn't fully grasp this new situation, which is actually scary.

It was odd because China is an extremely advanced country and Xi Xinping made an extremely undemocratic, dictatorial move by abolishing term limits.

So now we have the makings of a dictator leading the largest country on Earth, commanding an extremely technologically-advanced military.

The cynic in me makes me think I don't understand Trump's joke because maybe he knows something I don't. The paranoid in me wonders, if Trump really is so misinformed.

<comment><USER33> Outside of the west, democracy is generally held in contempt. This can be dated at least as far back as Plato. Trump isn't misinformed, he believes that democracy is contemptible. And whether he is wrong is arguable.

<comment><USER34> If democracy is"contemptible" by the kinds of people that run oppressive, autocratic (soon dictatorial) Orwellian surveillance states that disappear people at the drop of a hat, I'll gladly keep my "contemptible" method of governance please.

At least we can (and do) peacefully and easily vote out our leaders for someone we'd rather have.

<comment><USER33> Let's dissect this misplaced moral superiority by comparison.

Trump's USA imprisons more people per capita than any other nation. And a disproportionately large number of those people are black men. For five decades, it has increasingly walked back checks and balances on the executive branch. NSA, on behalf of USG, has demonstrated the most complete surveillance of telecommunications on the planet. The Homan Square facility was used by CPD to disappear six thousand people. This is on a tiny scale compared to the work of the Chinese state apparatus, and it was eventually shut down. But it persisted for a decade.

The USA isn't better than China by very much. Arguably, it is worse. In any case, it is a far bigger hypocrite.</comment></comment></comment></comment>


Built an Awesome Photo Filter App Using React and CSS - <AUTHOR> https://github.com/cyan33/css-filter <comment><AUTHOR> I learned the CSS filter property a couple days ago and I was thinking why not create an online web app which is easy to adjust the filters and could let people download the filtered pictures, just like the instagram app. We've seen a lot alternatives, but they seem hard to use for me personally. So I tried hard to make this app intuitive and really easy to use. Try it out here [https://cyan33.github.io/css-filter/](https://cyan33.github.io/css-filter/)</comment>


News apps are making a comeback. More young Americans are paying for news. - <AUTHOR> http://www.niemanlab.org/2017/06/news-apps-are-making-a-comeback-more-young-americans-are-paying-for-news-2017-is-weird/ <comment><USER2> Not a news app but dead tree subscriptions to quality newspapers (WSJ, NYT) are seriously under-rated in my opinion. They don't interrupt you, try to get you to like or share, and it's extremely easy to skim while at the same time learn things you wouldn't get from click click clicking on articles from the website. Curation is worth it.</comment>


I moved my sites from Google Kubernetes Engine to Netlify and saved $1000 / year - <AUTHOR> https://labs.iamhamy.xyz/posts/i-moved-to-netlify-from-gke-and-saved-60-per-month/ <comment><USER2> This post was amusing to me for so many reasons. The author did this for his personal project, cheers to him for his passion to try out new technology.

This is roughly similar to what happens in technology teams all across the business units.

Manager 1: We are streamlining all our product offerings to a Kubernetes container cluster. Why you ask? We want to modernize our stack and we want to attract best talent.

Manager 1 and the team collects the rewards

...... few months later

Manager 2: We reduced the cost of operations by x% by simplifying operations. Aka rolling back to something other than Kubernates.

Manager 2 Collects the rewards

Every time, there is a detailed intelligent write up about what we are going to do and what we did and how awesome it was.

Believe it or not, internet has a way of influencing the really smart people with branding and advertising driving them to a form of resume driven development.

Kubernetes to developers is like what Axe body spray is to teenagers.

Just use Axe Deodorant and women will be all over you.

<comment><USER3> The frustrating is that these virulent things often define the standard, instead of a well-thought-through solution. E.g. JavaScript.

</comment></comment><comment><USER4> The title of this article is frustrating, it comes across like an ad for Netlify. The author moved to Google Cloud and Kubernetes because he wanted to attain hands-on experience on those platforms, not because he seriously thought it was the right technical choice for his 25 visitors a day static blogs.

So he spent $1k to learn GCP and K8s. That seems like money well spent.

<comment><USER5> I guess he could have spend the money in training and would be better off.

<comment><USER6> There is no replacement for hands-on experience.

</comment></comment></comment><comment><USER7> $1,000/yr is definitely excessive. You can have managed Kubernetes for ~ $100/yr from Google or (recently) Digital Ocean using smaller instance types.

The point about maintenance is a good one if you're running purely static sites. K8s has a steep learning curve, though FWIW I think its probably easier than systemd and standard unix administration + puppet/chef/ansible/etc.

<comment> Spartan-S63 For sure. $1000/yr is excessive. For a third the cost, you can have a three node, small cluster on DO that you can experiment with. I did it prior and will probably do it again in the future when I have something worth hosting out on the web.

I agree with your second point, too. If you don't view K8s as something you need to know _everything_ about, it's a powerful tool that simplifies things that you'd need multiple tools for. I never really learned provisioning tools like Puppet/Chef/Ansible and Systemd, so k8s was a fresh experience for me. I like it, though, because I really like containers over VMs as the unit that's running my code.

<comment><USER8> GKE is cheaper than DO if you don't have huge cpu needs, I just checked it recently. DO minimum is $15/mo for kubernetes, on Google you can get to around $7 with a "micro" VM.

That is, if you really want managed kubernetes. Otherwise you can get a $5 VM on DO.

</comment></comment></comment><comment><USER9> I'm saving 2000 USD per year myself here is how I did it: I bought a truck loaded with 1000 KG of stuff I never use to drive to work and the gas was very expensive, but now I have switched to a smaller car without any load and save 2000 USD on gas every year.

</comment><comment><USER10> It would be interesting to see a comparison to App Engine, which seems like a better fit than Kubernetes for low-traffic sites.

<comment><USER11> Yeah, App Engine would have cost $0 since that traffic would fit in the free tier.

Cloud Run would be the slightly more general and newer way to do this too, and the free tire there is 2 million req/month. I _think_ he could have migrated containers directly from GKE.

<comment><AUTHOR> Oh wow, I'd never heard of Cloud Run before. Just popped some numbers in that I think are correct and it did come within the free tier range.

See GCP calculator: [https://cloud.google.com/products/calculator/#id=36a5f437-98...](https://cloud.google.com/products/calculator/#id=36a5f437-98f9-4837-a937-287ae4250ebf)

</comment></comment></comment><comment><USER12> Based on the write up it seems that the author could benefit from the fully managed version of Cloud Run on GCP ([https://cloud.run](https://cloud.run)). No cluster to manage would help with maintenance pains and per request billing model could potentially lower the overall costs given the scale to 0 capability.

<comment><USER13> I was going to mention this as well. Any time a user has an underutilized K8S cluster if only 3 nodes I immediately wonder if the auto-scaling (to zero) docker-running features of Cloud Run are what they're really looking for.

</comment></comment><comment><USER14> github actions to deploy a hugo static site on github pages = free

</comment><comment><USER15> Anyone have any recommendations for a managed Compute/Postgres stack that's less than 100/month? I was trying Heroku but frustrated by the single port per container and lack of static ips.

<comment><USER16> What do you need a static IP for? (Also, fwiw, we have add on providers that do give you static IPs)

<comment><USER15> I wanted to point my root domain (hosted by Google) to the Heroku app DNS target. I was able to solve this by using Cloudflare instead, with flattening.

</comment></comment></comment><comment><USER17> You could probably save as much or more going to an AWS Serverless stack (S3 and Cloudfront CDN for the front end, lambda on the backend. Shoot me an email if you like.)</comment>


Building a Hacker News clone in Django - Part 2  - <AUTHOR> http://arunrocks.com/building-a-hacker-news-clone-in-django-part-2/ <comment><USER2> As a big fan of Ruby who's always wanted to learn Python, this looks really neat! Any tips for getting started with Python with Ruby experience?

<comment><USER3> Just pick a simple project idea, and have a go.

I'd recommend Django because the community support is massive, and the documentation is great. Actually the Django tutorial is a great place to start [1].

Pro tip: virtualenv will save you a lot of hassle.

[1] <https://docs.djangoproject.com/en/dev/intro/tutorial01/>

</comment></comment><comment><USER4> Is it going to replicate the invalid link errors?</comment>


A young person's guide to quitting your day job - <AUTHOR> http://arbor.posterous.com/i-quit-my-high-paying-job-what-now <comment><USER2> First: this is hardly a "guide" to quitting your day job. The only advice OP gives on actually quitting your day job is:

"Find a good partner!".

\---

Does there exist freelance agents? Like somebody that helps you track down freelance contracts?

(I may be mincing words here)

If there isn't, will some of you bizdev people pretty please make something like this? I'm a hacker, I've been coding for a long time, and I fit exactly the descriptions that this person laid out in part 1, but I would have absolutely no idea how to find work even if it came banging down my door.

<comment><USER3> In my experience, most boutique development shops and agencies would love to put about 80% of their work through employees, and 20% through trusted contractors. Typically you need to be a product engineer--web, ios, etc. Expect to get paid about half of what you would for contracting work you source yourself. To get this work, go to conferences and be friendly with people in this group.

If you can't meet these people, build some open source thing they want (when I did this five years ago it was imagemagick integration for RoR). They'll contact you and pay you to customize it.

I have friends who've used <https://grouptalent.com/main/talent/>. They had a pretty good experience.

Good luck!

<comment><USER4> > Expect to get paid about half of what you would for contracting work you > source yourself.

Being in a position that hires said contractors, I have to say this is false. Rates are competitive; we're not the one's setting them, the market is. Recruiter's commission may play a factor where it's involved, but it certainly doesn't halve the rate.

I'd also say "good luck" to acquiring contracts in your area of expertise directly from the companies that are buying them. They're looking for complete packages and the effort involved in acquiring and maintaing those relationships is quite often beyond the abilities of a single person.

</comment></comment></comment><comment><USER5> Quitting your job is the easy part. Legitimately replacing it is the hard part.

There are some nice thoughts here but I'd like to know what the plan is to survive. Its certainly possible to make it but I feel like this is glorifying a situation that most people once on the other side of the fence are going to be under stress and realize things are not necessarily so rosy. You have savings - great step. You have some things your working on - great step. Now how do you start making just enough money before your runway ends and you have to either go back to a job or start eating into your own time to do consulting (which is basically employment from my perspective).

Ill admit Im a relatively risk averse person but Id say the best plan is the 1 step plan where the time you are spending on your own business becomes more profitable than going to work - easier said than done but thats my 2 cents.

<comment><AUTHOR> I'm on the other side of the fence now. Yes, it's much harder, and much more stressful, but it's on my terms.

There's a lot more to this story, but I've decided to draw this out over a couple posts.

Funny you mention being risk averse. I've talked about this with my cofounder, and we don't see doing this as being risky. We see taking jobs as being risky, because we feel like we are losing out on doing something we like more and wasting our lives.

</comment></comment><comment><USER6> Having quit my day job back in 2000 to go into business for myself, I think I can give you a quick summary on the process to use:

Step 1: ensure you have at least 12 months of living expenses in cash. If you don't, then sell everything and move in with your parents or friends so that your expenses go down a LOT. If you don't want to do this, you might ask yourself how bad you want to create your own business.

Step 2. Spend all day talking to potential customers. Skip online research. Go talk to people. If you don't have something to sell (yet), tell them you are building it and you'd like to show them screenshots. You will suck at this conversation at first, but you will get better.

Step 3. Sell, sell, and sell some more. If you have a product, sell to customers. If you don't, sell to investors. Either way, you have to persuade somebody to give you their money.

Step 4. Pat yourself on the back because you just did something that most people only talk about.

Step 5. Network your ass off and only hang around other entrepreneurs who will support you. JOBers will most likely only knock you down because they envy what you have done (and they dont' have the stones to do).

Trent Dyrsmid

</comment><comment><USER7> This was awesome. Thank you for writing this. I'm saving money to have a year's cash to live on while fleshing out my idea(s) and heading down the runway of making my way on my own. I'll be making the transition ("falling out of the bottom of the world" I lovingly call it) on June 1st.

My favorite line was this one: "...life isn't a competition to see how upper middle class you can get." This is so true. It blows my mind how much people internalize these milestones of success and how little questioning goes into them. It seems that basically the whole culture's on autopilot, and I guess the point of a culture is basically to build a structure for most people to sail through on auto-pilot but I am really starting to see a life of questioned assumptions as the only life not lived in slavery.

<comment><USER8> "...life isn't a competition to see how upper middle class you can get."

That's been on my mind a lot for the last few years. While I'd like to put my (future) kids in a good starting point, there's more to life than rolling around in cash.

<comment><USER9> Not until you have enough that you're not clawing just to stay afloat. Until that point, stress and paranoia about job security are a pretty big deal.

<comment><USER8> I've been broke before. Not to toot my own horn, but I know what it's like.

There's a long way between "barely not broke" and "upper middle class". I am not particularly interested in struggling my whole life on the way up to wealth, but I am also not interested in living broke and trying to keep myself and my family fed.

</comment></comment></comment></comment><comment><USER10> Between working at a huge company with rigid structure and payscales (what the author seems to be describing) and being a founder, there is a spectrum of jobs, with different risk/responsibility tradeoffs. When companies go public, it's not just the 2-3 founders that make out well.

<comment><AUTHOR> I totally agree with you, which is why I tried to list out a bunch of things I noticed. There are lots of different approaches when your job starts to sour, but for me, it wasn't just about finding a new job.

By the way, I was actually describing an extremely successful 20-25 person company.

<comment><USER11> I worked for 2.5 years at a startup that failed. The technical work that I did was excellent, but it didn't do much for my career in the end. In fact, in my job after that, I was treated as a junior developer even though I was substantially ahead of the level, in terms of capability, at which I was placed. In retrospect, I should have jumped back into the mainstream a year before. As you get older and better, junior-level positions become non- options, but you may not get the "right" experience for senior ones.

Working for yourself can work out very well, or it can leave you re-applying for your old job, 3 years older and 10 years smarter, and you know as well as I do that being 10 years smarter just makes institutionalized life harder.

You can stay corporate and not lose your edge entirely. Obviously, it'd be better to work for yourself and not have to serve 2 masters, but few people have the resources for that. To do it, you have to learn how to be insubordinate enough to keep your creativity, without getting fired. That's not actually hard, if you stay out of the politics. Old Me would react to a pernicious inefficiency by speaking up and loudly, unwittingly walking into a political minefield. ("This is damaging my productivity, you idiots!") New Me says, "This is mildly annoying and reducing my productivity, but that gives me time for Coursera."

<comment><USER12> Wow this really resonates with me. But one may also accept that institutionalized corporate life is not for him and move on, even if that means less money and less stability throughout his life.

To quote the asian guy from _Tokyo Drift_ "Life is simple - you make choices and never look back"

<comment><USER11> I would advise taking acting classes. No, I'm not trolling. It can teach social skills and also make corporate life a lot more bearable. Public speaking is good, too.

Sometimes you have to _act_ subordinate, while keeping your poise. Play the character, do the role well, but never actually _be_ subordinate. Always keep your own career goals (knowledge, contacts, credibility) in mind and protect them, because corporate incoherence will assault your goals from all sides. It's rare that anyone will look out for you, and usually managers can't (that's called "playing favorites") so you have to do that for yourself. Your real boss is someone you can't get away from but who can't fire you: it's you.

<comment><USER13> This is very good advice. One tangent on this is the High/Low status games we did during the few acting classes I took in high school.

It truly helps you read some situations as one does act differently when a high or low status is assigned to you, it is striking how it affects behaviour, both in the game and when applied to real life.

</comment></comment></comment></comment></comment></comment><comment><USER14> Can someone please point me to "A married-with-family person's guide to quitting your day job"?

<comment><USER15> I did that a year ago. My last day at work was 2 weeks after my son was born. You can read about it here: <http://nathanbarry.com/i-quit-my-job/>

What made it possible was that I spent an entire year before hand designing and developing apps on the side. I got to the point where I was averaging at least $2,500 a month from the App Store, which was half of what I made at my design job.

I knew with that as a base I could make up the difference with consulting.

The other really important thing I did was save a lot of money. I took all the profits from an entire year of selling apps, plus my regular savings, and had just over $30,000 in savings.

Those two things gave me the confidence to leave, even with a newborn baby.

Now, 1 year later, I've written two books (one comes out next week), released more apps, and make more money than I did at the day job. All while having more flexibility.

If you want to talk further, my email address is in my profile.

Good luck!

<comment><AUTHOR> Surprisingly similar to my situation when I quit (except I didn't have a baby, and I'm not American). So nice to hear things turned out.

</comment></comment></comment><comment><USER16> You offer some really good advice, and I'm in a REALLY similar boat / life.

I wrote up something like this about 1.5 years ago. I started my company on the side, while still working a similar (top-tier consulting) gig. I hedged my bets a bit more by running the shop while I still had a full-time [salary] and built out my dev team as full-timers first. As of 1.5 months ago, 3 more of us are full-time and in beautiful San Francisco trying to grow the collective into something real. 7 full time, and 10+ in the collective.

The problem with both of our writings to the world about doing this, is that it's not actionable. It's motivational and awesome, but there's not much of an action item. If you can't do it in a single pomodoro, most people won't do it :)

We're both young, without a family tie-down, and ironically both Russian-born? men.

@OP: Team up for a blog post next week so that we can put together some actionable steps towards giving up the life of a cog and working for yourself on actually building something awesome?

vlad (at) DarwinApps.com if you're interested.

</comment><comment><USER17> Can't stress the "start small" part. I.e. not a marketplace or a social network to start with. (If you learn a new language, would your first project be a StarCraft2 clone or hello world?)

</comment><comment><USER18> I stopped reading when you gave an example of moving somewhere better. Google is not inherently better than Yahoo. Both companies have very interesting projects going on. What makes one company better than another is the chance to work on projects that YOU find interesting.

<comment><USER11> He said that most people would perceive Google as a step up, and he's right, but his point is that the incessant climbing is pretty stupid, and I agree.

Adam Smith called early industrial Britain "a nation of shopkeepers". Corporate America (and VC-istan is just as bad) is "a nation of _social climbers_."

<comment><USER19> > Corporate America (and VC-istan is just as bad) is "a nation of social > climbers."

But (from what I see at least) it's still better than a lot of other countries. At least in the larger areas you can earn a decent wage, with a decent amount of seniority, while still being in a technical role.

This just doesn't happen here in Spain - after 7 or 8 years you've hit the ceiling, you're an architect or analyst or whatever you want to call it, but to get further (earn more, have more responsibility in your company...) you need to move into non-technical management.

</comment></comment></comment><comment><USER20> That was seriously some awesome motivation. I've only been out working for a few months after graduation but I can already related to almost everything on his list.

Thank you for sharing!

<comment><USER21> As can I. I think I have some natural aversion to having a boss.

</comment></comment><comment><USER22> Depending on the interest rate of your educational loans, it can be better to keep them around. Save your money in the bank and budget for loan payments.

Sometimes it is useful to have that extra cushion in the bank instead of saving a small percentage in interest.

<comment><USER23> Most federal loans these days are at 6.8%, and max out at around $5,000/year for undergrads (which is only half the cost of tuition at a state uni here). Private loans tend to lean more towards 8-12%. Also, good luck even qualifying for the latter if you don't have a rich parent with collateral to cosign for you.

It's a good thought, but I think it's much less useful today than it was in the era of 2-3% interest student loans. My teachers always use amazingly low interest rates in math problems and then get all shocked when I mention how much even the government charges these days.

</comment></comment><comment><USER24> As someone on a work visa, how did you quit your job exactly? What's the grace period before you need to find someone else to sponsor your visa? (I'm assuming your startup can't afford to do so, but I may be wrong)

<comment><AUTHOR> Well, I thought about it for a while, and realized it wasn't worth it waiting N years to get a green card. I filed a petition to go from H1B status to B2 tourist and asked for 3 months to stay in the country to finish up my affairs. After that I left.

As a Canadian, I may enter the US for up to 6 months at a time without requiring a visa, but am I not allowed to work. So when I do visit, I make sure to only visit friends and I make sure not to do any work. I am currently in Toronto, but next month will be taking a vacation to the USA.

<comment><USER25> _As a Canadian, I may enter the US for up to 6 months at a time without requiring a visa, but am I not allowed to work. So when I do visit, I make sure to only visit friends and I make sure not to do any work._

I wonder what is considered "work" and how could it be tracked. Whenever I travel abroad, I bring my laptop, and I always end up answering a few emails and writing code (which is what I do when I go to the office here in the US). If you have a company registered in Canada and you come to the US for 6 months, who is to stop you from sitting at a computer and typing away, as long as no money changes hands in the US?

<comment><USER26> Well, by the same token there isn't much stopping a Canadian from coming into the US and working as a fry chef. Laws are for honest people, and people who attract attention.

<comment><USER25> That's different, as the restaurant is a US business employing a foreign national without a visa. In my example, the business was outside the US, and no money changed hands here.

<comment><USER26> Ah, I took your hypothetical as a proposal for an enforcement loophole, not a legal loophole.

</comment></comment></comment></comment></comment></comment><comment><USER27> sounds a bit like my own story (though you're a bit farther along!)

</comment><comment><USER28> I'm at step 1-5

<comment><USER29> Me too.

To the author: thanks for writing this blog post. It's always interesting to hear someone's perspective on the topic. I've been mulling over this for a while...

<comment><AUTHOR> Not a problem. Looking back, I admit it was nice to be able to get "instant" credibility, but if you know you are going to eventually pull the trigger, the sooner the better.

<comment><USER30> How much of your decision was influenced by the constraints of the H1B worker visa and the disillusionment with the whole green card process?

<comment><AUTHOR> If I were American and didn't need an H1B, It would have happened a year earlier.</comment></comment></comment></comment></comment>


2nd Annual Aaron Swartz Memorial Hackathon starts tonight at Internet Archive - <AUTHOR> http://blog.archive.org/2013/11/05/please-come-aaron-swartz-reception-at-the-internet-archive-fri-nov-8th-in-sf/

<comment><AUTHOR> Also, there are many other locations participating if you're not in SF:

[https://www.noisebridge.net/wiki/Worldwide_Aaron_Swartz_Memo...](https://www.noisebridge.net/wiki/Worldwide_Aaron_Swartz_Memorial_Hackathon_Series#Locations)

</comment><comment><USER2> More information at [http://aaronswartzhackathon.org/](http://aaronswartzhackathon.org/)

</comment><comment><USER3> Is this the correct donation link?

[http://www.givewell.org/about/donate?ASW](http://www.givewell.org/about/donate?ASW)

Or should donations be sent to the IA?

[https://archive.org/donate/index.php](https://archive.org/donate/index.php)

</comment><comment><USER4> How is it the 2nd annual?

<comment><USER5> It's once a year and this is the second one.

<comment> k-mcgrady I think the confusion is the fact that he died in January this year (so it's actually the second one within 11 months).

<comment><USER6> That makes it factually wrong not confusing.

</comment></comment></comment></comment><comment><USER7> Also, if you aren't near one of the locations you can always drop into irc://freenode.net/aaronsw which was set up for previous hackathons.</comment>