Playing with ZFS encryption on Linux - <AUTHOR> https://www.rolando.cl/blog/2017/06/13/playing-with-zfs-encryption/ <comment><USER2> A little more details on the crypto aspects: [https://blog.heckel.xyz/2017/01/08/zfs-encryption-openzfs- zf...](https://blog.heckel.xyz/2017/01/08/zfs-encryption-openzfs-zfs-on- linux/) (This is my post. I hope it's okay to post this here.)

<comment><USER3> Have the design decisions been reviewed by a cryptographer yet? According to the presentation on youtube, it had not.

<comment><USER4> We are having trouble finding a volunteer.

<comment><USER3> Would the Core Infrastructure Initiative be willing to sponsor a cryptographer to review it?

Getting this right would make it a lot easier to have faith in encrypted backups. Right now, you have to trust that each network backup product like bacula is doing it right.

I just randomly picked bacula and then looked up what they are doing. They're using OpenSSL with AES-CBC. I don't think anyone would recommend that.

As a start, it would be nice if Datto could document the design decisions. For instance, AES-CCM is a bit of a strange default and it's not explained anywhere. I see Solaris chose AES-128-CCM and maybe that influenced why OpenZFS is using AES-256-CCM. I haven't found a cryptographer in favor of CCM over GCM. For instance, Matthew Green doesn't appear to like it over GCM.

[https://blog.cryptographyengineering.com/2012/05/19/how- to-c...](https://blog.cryptographyengineering.com/2012/05/19/how-to-choose- authenticated-encryption/)

According to Crypto++'s benchmark, AES-GCM is 2,448 MB/s and AES-CCM is 710 MB/s. Does that match your experience with OpenZFS?

[https://www.cryptopp.com/benchmarks.html](https://www.cryptopp.com/benchmarks.html)

Given that GCM IV reuse is catastrophic and one of the main use cases for this is backups to potentially untrusted sources, I'm curious if AES-GCM-SIV would be a more conservative choice.

[https://www.imperialviolet.org/2017/05/14/aesgcmsiv.html](https://www.imperialviolet.org/2017/05/14/aesgcmsiv.html)

<comment><USER5> I'm Tom Caputi, author of the ZFS encryption patch and I can answer of few of your questions.

First of all, the choice of AES-CCM. I have had a few people ask me why we didn't chose something like ChaCha20 as a block cipher instead of AES. This is largely because AES is by far the most scrutinized block cipher around. It's use is currently so widely accepted that modern Intel CPUs have built-in AES instructions to improve performance. While its true to say that ChaCha20 (or other block ciphers) might theoretically be faster or that they ARE faster on some architectures like 32-bit cell phone CPUs, this is not currently the case with the vast majority of ZFS deployments.

As far as the choice for CCM as a default goes, this one was a little bit harder. Originally this decision was made to match the Oracle implementation as much as possible (a design decision which has since been dropped). Later, when we re-evaluated the descision, we found a paper ([http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comment...](http://csrc.nist.gov/groups/ST/toolkit/BCM/documents/comments/CWC- GCM/gcm-update.pdf)) indicating there might be weaknesses with the authentication mechanism, although the paper only mentioned cases with truncated authentication tags. So in the interest of being as conservative as possible, we chose the option which looked the most secure. We did not look into AES-GCM-SIV since it is very new (it looks like it actually came out this year) and so I would not by any means consider it a "conservative" choice.

As far as performance goes, we have not yet (as far as I'm aware anyway) seen a case where read or write speed wasn't bottlenecked by the disk speed. The benchmarks you posted are (as far as I can tell) single threaded and ZFS processes each block asynchronously.

The biggest thing here is that AES-256-CCM is only the default. It is easy for users to pick GCM for the time being and for developers to add newer, better encryption algorithms and change the default as time goes on. I wouldn't be surprised i we had changed the default by the time that the patch ends up in a tagged release.

</comment></comment></comment></comment></comment><comment><USER6> I almost cannot wait for this. Native file system encryption will be so good, because it removes the ugly/inelegant layer of indirection with Geli or LUKS, and it allows stuff like encrypted ZFS send and receive. It allows you to switch on and off encryption dynamically. That will allow you to use services like rsync.net without having to place as much trust their internal security practices.

It's great they're taking their time, but I've been looking forward to a stable release since its announcement almost a year ago :)

<comment><USER7> Uncertain that it enables encrypted send and receive. It very likely decrypts to get it into the send format, and then is reencrypted on the receive side. Those are separate file systems so it's not certain that they share, or even should share, the same encryption key.

Update: Ahh well it helps to whole article before posting. Both encrypted and decrypted send/receive are possible. But this also suggests multiple keys per pool, a key per file system I guess?

<comment><USER5> Yes, there are per filesystem / zvol keys and the raw encrypted data is sent over the wire along with the encrypted keys.

</comment></comment></comment><comment><USER8> Can I zfs send encrypted incremental snapshots to a remote server and have them merged without ever having the remote server decrypt anything? That would be awesome to backup to an untrusted remote computer.

<comment><USER2> Yes.

<comment><USER9> Without having read anything of the implementation.. That is little short of astounding.

</comment></comment></comment><comment><USER10> 64 bytes seems like an arbitrarily short limit for passphrases; it's going to be hashed at some point anyway (preferably with a decent KDF designed for the purpose) and 64 bytes is nowhere near long enough for natural English language text to be used to derive 32 bytes of entropy (estimates of English language text are ~1.5bits of entropy per character).

<comment><USER11> At the risk of invoking Cunningham's Law, _nobody_ uses passphrases anywhere near 64 bytes that he / she has to memorize. And if you're using a password manager, just use the raw or hex key option.

32 bytes => 64 hex digits, which is probably not a coincidence. :-)

<comment><USER12> Password yes, passphprase it's quite possible.

<comment><USER12> Eh, Materialistic doesn't allow me to edit my comment. I mean you're right about passwords, but a passphrases (e.g. a sentences) are easy to remember, more secure and can often be longer than 64 bytes.

</comment></comment></comment></comment><comment><USER13> Will this work the same way on FreeBSD/FreeNAS when this eventually lands?

OT: one of the sed lines is hard to read

       sed -i 's/github.com\/zfsonlinux\/zfs.git/github.com\/tcaputi\/zfs.git/' PKGBUILD

the OP might leverage that you can use other quoting characters, like

       sed -i 's,github.com/zfsonlinux/zfs.git,github.com/tcaputi/zfs.git,' PKGBUILD

<comment><USER14> FreeNAS has supported zfs encryption for a long while, unless I misunderstand you. Unless its not actually zfs encryption but something else?

<comment><USER15> Free(BSD|NAS) so far create a "normal" ZFS on top of an encrypted block device, produced via the cryptographic GEOM provider geli ( [https://www.freebsd.org/cgi/man.cgi?geli(8)](https://www.freebsd.org/cgi/man.cgi?geli\(8\)) )

This instead is ZFS doing the actual encryption on a normal block device.

</comment></comment></comment><comment><USER16> Does anyone know a good guide for getting set up with ZFS (particularly on Linux/Ubuntu)? The Ubuntu wiki basically just say "apt install zfs" and then links to a page that appears to be a brain dump of all the possible commands. Something with more coherence explanation of the relevant concepts would be really helpful.

<comment><USER17> I have documented the steps I had to take here [https://janweitz.de/article/creating-a-zfs-zroot- raid-10-on-...](https://janweitz.de/article/creating-a-zfs-zroot-raid-10-on- ubuntu-16.04/)

Be aware:

Uefi did not work for me in VirtualBox with ZFS.

Booting with UEFI, ZFS and RAIDz works, but I did not figure out how to install the UEFI grub-boot on all RAIDz drives.

Therefore, if the one and only drive with the boot partition fails, I have to rely on an USB-stick as a backup-plan for the bootloader.

Probably if I could start over I would try to skip UEFI and use legacy booting and installing Grub in the MBR of each drive (if that is possible).

For encryption we are using Luks right now, since it encrypts block devices and ZFS uses these block devices to form its raid.

Luks needs to decrypt ALL raid devices inside the Grub boot prompt in order for ZFS to start its raidz.

To make this happen, we had to modify:

/usr/share/initramfs-tools/hooks/cryptroot and remove an early return in a for-loop in get_fs_devices() , since otherwise only the first device was decrypted.

Make sure /etc/lvm/lvm.conf contains use_lvmetad = 0

Make sure /etc/default/grub contains GRUB_ENABLE_CRYPTODISK=y GRUB_CMDLINE_LINUX_DEFAULT="text"

So, yeah, I am looking forward for zfs-native encryption on Linux to make booting "safer/easier".

<comment><USER18> Maybe I had a better luck, for me, UEFI boot with ZFS in Virtualbox did work. I've used CentOS though.

Multiple UEFI boot partition are possible, but just like you note in your article, they have to be outside the ZFS pool. All of them. Then you set order for each one using efibootmgr. For each, you will get a separate entry in UEFI boot manager.

It is not necessary to install grub2 after rebooting into ZFS root. It is perfectly fine to run grub2-install in chroot from your temporary installation.

</comment></comment></comment><comment><USER19> I'm not really familiar with the development process between ZFS on Linux and ZFS on BSD, do these pull requests usually get merged upstream for use on BSD, Solaris, etc?

<comment><USER20> Together FreeBSD, ZoL and the Illumos groups work on OpenZFS.

Oracle closed off Solaris. The decendent of Open Solaris is Illumos. Oracle ZFS and OpenZFS are not hte same thing.

OpenZFS repo is the upstream, though it is closely tracks the Illumos version.

From there the projects pull on OpenZFS to create their implementations. New features are developed independently by the projects with rules that a new feature must be enabled in a downstream distro for X period of time before it can be upstreamed into OpenZFS.

<comment><USER4> Let's not forget Mac OS X and OSv, although the amount of work being done that and shared is not as large as it is with the other 3 platforms.

</comment></comment></comment><comment><USER21> I've been really looking forward to OpenZFS encryption support. ZFS on LUKS leaves a lot to be desired, and I've only just recently begun trying to shift all my PCs and devices to be fully encrypted by default.

</comment><comment><USER22> nice post, I think you forgot to fill in the Introduction though

<comment><AUTHOR> thanks! I think I stupidly lost that paragraph in a merge. I'll remove it for now and add it later. Thanks again!

</comment></comment><comment><USER23> I wish ZFS were in tree :-)</comment>


US spied on Japan government, companies: WikiLeaks - <AUTHOR> http://news.yahoo.com/us-spied-japan-government-companies-wikileaks-082720026.html <comment><USER2> If we want to live in a free society, we must do something about these heinous acts which imprison us all. Millions of people have, over the course of history, lost their lives precisely because men in power were allowed to abuse that power and cast their nets into the winds, to reap profit from the loss of the nation, their sovereign. If we want to continue to consider ourselves free, enlightened people, we must always work hard to uncover the secrets being laid as traps by those who would enslave us all. It is absolutely disgusting that the average American citizen is letting its government get away with crimes against humanity, and I look forward to the day when more American secrets are spilled on the altar of public opinion.

<comment><USER3> I am an American citizen. What would you like me to do about it?

<comment><USER2> Everything you possibly can.

<comment><USER3> Could you be a little more specific?

<comment><USER2> Renounce your citizenship and leave the country? Vote? Get active in public advocacy campaigns to inform people that their country is being used by criminals? I honestly do not know but one thing is for sure - we can't just give up and let this happen.

<comment><USER3> I don't see how leaving the country would help. I do vote, but my choices are either the crazy guy, the other crazy guy, or somebody who can't possibly win. Public advocacy campaigns? Maybe, but people by and large know what's going on and _like_ it.

<comment><USER4> stop. paying. taxes.

<comment><USER3> No. I'm not going to go to jail over this. Part of the social contract is that you pay taxes even when they help to pay for things you disagree with.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> That proves, that Mitsubishi is a terrorist organization.

<comment><USER6> This was probably downvoted for sarcasm, but it brings to light the scary power governments have in naming entities they don't like..

<comment><USER7> Mitsubishi under terrorism investigation for possible intentional deployment of dangerous airbags. The US DOJ and NSA are investigating whether or not these "faulty airbags" had a remote detonation device that could be used to target diplomats. [1] __Literally __the first google result with "Mitsubishi recall danger". Imagine how powerful the XKeyScore or PRISM is when they type "John HackerNews Author 3" "bomb". Congratulations, you're under investigation too!

[1] [http://www.9and10news.com/story/27525884/subaru- mitsubishi-e...](http://www.9and10news.com/story/27525884/subaru-mitsubishi- expand-recalled-vehicles-with-dangerous-airbags)

</comment></comment></comment><comment><USER8> [https://wikileaks.org/nsa-japan/](https://wikileaks.org/nsa-japan/)

</comment><comment><USER9> The NSA even spies on domestic targets, and shares unredacted intercepts with the Five Eyes and Israel ;)

</comment><comment><USER10> Obviously Japan should retaliate against the US.

</comment><comment><USER11> That's bad, but it might have good consequences. Governments around the world might start to better protect their information and communications, thus providing better protection against both NSA, spies and other malicious entities.

</comment><comment><USER12> This is legitimate as they do the same to us. They're one of the most capable countries doing espionage against U.S. military and industry. They've stolen plenty of I.P.. At one point, NSA intercepted a communication from Mitsubishi that contained President's Daily Brief. We have to spy on countries like this to even out the negotiations or else they become quite one-sided without us knowing why.

<comment><USER13> By this argument, basically every other country in the world should spy as much as possible on the US, since _our_ surveillance is so ubiquitous. Do you agree?

<comment><USER12> Yes, I agree they should play by the same rules as us or pull even more stuff. A NSA proponent worded situation nicely: "most countries make espionage against _them_ illegal while making espionage for them legal and even funded in form of intelligence agencies." That's the game. Better play it or competition wins.

</comment></comment></comment><comment><USER14> In other news, Japan spied on US government. Film at 11.

<comment><USER15> May seem like that now, but you were once labeled a 'crazy conspiracy theorist' for even suggesting that governments have secret spying agencies.

<comment><USER16> What? I think the fact that the NSA was spying on foreign nation's governments is pretty much in their mission statement

<comment><USER15> Until Snowden claims were dismissed as false and crazy.</comment></comment></comment></comment>


Stop tinkering with your toolbox - <AUTHOR> http://rodrigohaenggi.com/posts/stop-tinkering-with-your-toolbox/

<comment><USER2> I had Feyyaz post this on my behalf, since my HN Karma is far below average.

</comment><comment><USER3> This is really helpful. I like this guy's tips.</comment>


Show HN: Bubbly – animated backgrounds in 662 bytes - <AUTHOR> https://github.com/tipsy/bubbly-bg <comment><USER2> One other small filesize hack for pretty background images is to use primitive ([https://github.com/fogleman/primitive](https://github.com/fogleman/primitive)) to make stylized SVGs. I use it for [https://goodfeels.net](https://goodfeels.net) for the hero header image.

<comment><USER3> Wow they are great! Anyone know of similar things?

</comment></comment><comment><USER4> This is really neat!

While I'm not personally big on backgrounds I think this would be perfect as a substitute for those large hero images/videos that tend to require FAR more than .6kb to load. I'm pretty sure I'll wind up playing with this at some point and seeing how I can leverage it for random things.

</comment><comment><USER5> Great work.

I'd love to see some more configuration (different shapes, lines connecting shaped, etc) but I'm sure those would add to the size.

One thing I noticed is on Chrome on my Macbook Pro resizing the window gets slow when this is running. Usually when I see that it is because the onResize handler is too heavy. But I noticed you don't have an onResize.

<comment><USER6> I could always modularize it if people are interested. It resizes using VH/VW, so that shouldn't be an issue. Retina display?

<comment><USER5> Yes, retina. It may very well be that resizing is just the only action that makes the performance obvious.

</comment></comment></comment><comment><USER7> Credit to you for being able to do this, and it's neat as a code golf kinda project. But I don't understand the general obsession with small code size. What I really care about is how well it performs - what kind of hardware does it work on? What's the effect on the processors?

Code size is a signal, but the difference between loading a 1K and 10K file is invisible from an end user's perspective, so I want to know about all these other factors, which are more visible.

<comment><USER6> Normally I have most my users in Asia (Myanmar/Malaysia) with just a few pageloads per session, so bytecount actually matters. I could inline this in an HTML page without feeling guilty.

<comment><USER7> So you're concerned about their ridiculously slow (or capped) internet connections, but not about the impact on their CPUs or batteries, or visually how it performs?

<comment><USER6> I'm concerned with both, but the devices aren't nearly as bad as the internet speeds are. I tried to make a very simple draw cycle, did you find something that was very inefficient in the code?

<comment><USER7> Not in the code, but it took a couple of seconds to render on an iPhone 6S and knocked quite a bit of the battery. If there were a 5K library that didn't do that, I'd prefer the trade off of better performance for a larger file. Optimisations all have diminishing returns.

<comment><USER6> Aha. The example doesn't have viewport set, so it renders at full resolution. I can update the example later.

</comment></comment></comment></comment></comment></comment><comment><USER8> Frankly, this is probably one of the so many useless projects that are around, yet credits to you for having done it in less than 1KB

<comment><AUTHOR> Thanks, I think. I know animated backgrounds are not essential, but sometimes you want some movement for a landing page/cv page/etc. My goal was a to create a very simple library that was easy to plug in, and wouldn't use too much data.

<comment><USER9> Looks like a neat project. Maybe you could host a demo using github pages? Then folks could see it in action.

[https://pages.github.com/](https://pages.github.com/)

<comment><USER6> There's a link to a live demo in the readme: [https://tipsy.github.io/bubbly- bg/](https://tipsy.github.io/bubbly-bg/)

</comment></comment></comment></comment><comment><USER10> It's pretty heavy on CPU.

</comment><comment><USER11> In Chrome on macOS 10.13 it uses quite a bit of CPU (almost 2 out of 4 cores maxed). Still cool, but while it's low in file-size cost, it is quite high in CPU cost, even on a modern i5 machine.

<comment><USER6> If this is the example, keep in mind that it has 4 instances of bubbly running.

</comment></comment><comment><USER12> No animation in Nightly? I just see a slideshow of different colored bubbles. All beautifully rendered though.

Edit: the bubbles are moving, but veeeeery slowly.

<comment><USER6> 4k monitor?

<comment><USER12> No, puny 1600x900.

<comment><USER6> That's not supposed to happen then. Browser/OS ? CPU usage? If you're using the live demo, it might be lag due to running 4 instances of bubbly. How does this run? [https://codepen.io/tipsy-/full/yzPaKK/](https://codepen.io/tipsy-/full/yzPaKK/)

<comment><USER12> Firefox Nightly 58, Windows 10, CPU usage 50-70%

> How does this run? > [https://codepen.io/tipsy-/full/yzPaKK/](https://codepen.io/tipsy-/full/yzPaKK/)

This is much better but still slower than what shows in the gif on your github readme. CPU usage 50-60%.

Maybe I should just try in Chrome ;)

Edit: vastly better performance in chrome. I guess Firefox isn't there just yet.

</comment></comment></comment></comment></comment><comment> slipstream- Doesn't seem to be working in Edge.

Line 33: Object doesn't support property or method 'forEach'

<comment><USER6> That's just the demo code (for cycling through 4 different canvases), the library itself works fine in Edge.

<comment> slipstream- Ah, OK.</comment></comment></comment>


Show HN: Website to Get Job Referrals in 5 Minutes - <AUTHOR> https://companyreferrals.com/ <comment><USER2> How are you validating my credentials as an applicant?

The whole reason behind referrals is cheaper, easier, trustworthy validation and prescreening. As an employee when I refer someone it's because I have a good understanding of their person, character and ability. This platform has none of these, in my opinion. I don't know the person and my vouching for their ability is based on their claims rather than what I actually know about them.

<comment><AUTHOR> >How are you validating my credentials as an applicant?

Applicants submit their resume, LinkedIn, and answers to why they'd be a good fit for a certain company + a mini biography about themselves.

> As an employee when I refer someone it's because I have a good understanding > of their person, character and ability.

Many, if not most, referrals are people that don't know each other very well and either connected through LinkedIn, had a quick phone call, or had a quick coffee chat. We think that these same subjects can be covered in a few questions online.

<comment><USER2> Is this what referrals are these days? Somehow i doubt it, for any solid company at least. Are you referring to startups, because it damn ain't sure not the status quo here. [Former big 4, now quant fund]

I have never and will never refer a person that I do not know. A referral is partially me putting my own reputation on the line</comment></comment></comment>


Show HN: A directory of restaurants with links to buy gift cards to support them - <AUTHOR> http://givelocal.co <comment><USER3> My real worry is that if the restaurant goes under (or sometimes, even changes ownership), your gift card is worthless.

Dunno if a chargeback would go through, since you technically received what you paid for.

<comment><USER4> Yeah, these gift cards are essentially free loans given to borrowers with extremely poor credit. I'm still going to do it, but I'm considering it to be a donation to my local restaurant scene.

<comment><USER5> it sucks - but i think a better option is to use a charity to do this rather than give 'em cash. You lose taxes twice - once from your own end, and once from the restaurant's end.

<comment><USER4> I don't think you can "donate" to a for-profit private business without paying taxes...

<comment><USER5> no, i meant donate to a charity, whose sole purpose is to help those businesses in need. You don't donate directly to the business (which is the tax hit).

<comment><USER6> Are charities allowed to give assets to for profit corporations?

<comment><USER7> Whawhawhat? How about to the workers those for-profits are currently not supporting?

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I like the thought of this idea, but it won't work. If the business spends the money from the cards now then it will be on the hook for the meals later. It is basically just an interest-free loan to the business that will have to be paid back. The party that is really being bailed out here is the landlord.

A better approach would be to let the restaurant go under and have some way to pledge that you will support the new restaurant that opens when things return to normal.

<comment><USER9> We're better off having the government backstop this--pay the rent, pay unemployment to the employees, and have society pay at the end of the day. The tricky part is getting money where it's needed. The Fed is doing what it can, but that's basically keeping banks open.

<comment><USER10> This. It's way too complicated to let society sort this thing out by themselves. For one, because only the "visible" companies like restaurants will benefit, and e.g. companies in the supply chain will be easily forgotten.

</comment></comment></comment><comment><USER11> I built something like this 15 years ago, it is still up but I have not touched it in years ( Canada: [https://foodpages.ca/?giftcards=1](https://foodpages.ca/?giftcards=1) / USA: [https://dinehere.us/?giftcards=1](https://dinehere.us/?giftcards=1) )

In my aforementioned experience trying to entice restaurants to sell eGift cards online is a waste of time.

Good luck though.

</comment><comment><USER12> Why just restaurants? This should be expanded to support barber shops, nail salons and massage business. I'm sure I'm forgetting a few other business that could benefit.

<comment><USER13> I usually pay my barber in cash. If I wanted to send her a payment in lieu of my next appointment, what would be the most sensible way to do that?

I could mail her a check I suppose.

ACH transfer? (I assume I would have to ask her for her bank account info which might be a little awkward.)

Venmo? (I've tried to avoid it thus far.)

<comment><USER14> Sincere question - how widespread is actual check usage in the US nowadays? As in, would "mail her a check" be a colloquialism for an Apple Pay transfer or similar, or would it mean just what it says - write out a check, mail it, wait for her to cash it?

(Question comes from Norway, a small country with only a handful of banks which very early collaborated to get electronic payment options available - <USER2> the extent that debet card terminals are everywhere, even kids have cards - and I think the last time I saw a check was in 1992 or so, at which point my reaction was "wow, do these still exist?")

<comment><USER15> Checks are still an everyday thing in the USA and Canada for rent, grocery stores and more-expensive services.

Checks are generally not used for small amounts, and where the Not Sufficient Fee (NSF) fees would be a problem. So usually not for restaurants, barbers, etc.

Banks until recently issued free "basic design" checks, but it looks like my national-level bank stopped doing that last year.

The advantages of checks over eletronic payments is that you don't need an always online network, and you can mail or give checks in advance of the payment date.

</comment></comment></comment></comment><comment><USER16> Thanks for putting this together. I'd recommend adding some indicator that the results load async. I thought you had zero restaurants in Austin and left the page after a second because there was no loading indicator. In fact, until I got to Pittsburgh, I thought it was a site with no listings asking for my email (because Pittsburgh loads way faster).

(Adding an index to your database for city or however the queries are formed would probably also help).

</comment><comment><USER17> There is also [https://rallyforrestaurants.com/](https://rallyforrestaurants.com/)

Great to see people coming up with creative ways to support the restaurant community. These efforts should be critical to keep the business running and take out and delivery will keep back of house employees working. I'm still really concerned about front of house employees. What can be done for servers, bartenders, hosts?

</comment><comment><USER18> "Don't see your city? Hit Add Location above and your city will be added when you add it's first restaurant"

I could be blind but I cannot see "Add Location"

<comment><USER19> It's actually "Add a Restaurant" in the top right.

</comment></comment><comment><USER20> cool project. Good extension of the pledge show hn the other day

I'd love for a feature "within 25 miles of {zipcode} so I can find some around me. (I'm in the suburbs where local doesn't mean the same city)

Clicked "view all cities" Not down to type in the name of every city around me

<comment><USER21> You can type the name of the city you're searching for on this page - [https://givelocal.co/search](https://givelocal.co/search)

Great feedback though! This is definitely something we pulled together quickly over the last few days.

<comment><USER22> That search page seems to use infinite scroll for its results. That makes searching _within_ the results using the browser's Find function impossible.

</comment></comment></comment><comment><USER23> In the UK there's [https://saveyourindiehighstreet.uk](https://saveyourindiehighstreet.uk)

</comment><comment><USER24> Can't we have this site serving straight HTML with links? Why we should always have JS involved for even most simple tasks?

<comment><USER25> I've asked someone who likes using tons of JavaScript before and the response I received was along the lines of "It saves developer time."

I don't get that one because in my experience, writing straight HTML is simpler than writing JavaScript. The real problem seems to be that many people today seem to have learned frontend web development through fancy JavaScript frameworks and don't know any other way. Since learning the simpler way to do it is more work, they don't bother. That's just my impression, however, and I don't have any hard data. Another possibility is that people want to learn the latest sexy technology and React/Angular/whatever people use these days is that.

<comment><USER24> We probably need good tutorials about how to create a nice looking HTML pages. Pure HTML, maybe with CSS. I'd prefer page to be self-contained - a document, not an app. This way some accessibility problems could be avoided too.

At least we may have static page generators which execute JS once on server side - for pages which don't really need interactivity (documents, not apps). There are a lot of them.

<comment><USER25> There are many resources available today on how to create a nice looking HTML/CSS page. Looks like Mozilla has a complete guide:

[https://developer.mozilla.org/en- US/docs/Learn](https://developer.mozilla.org/en-US/docs/Learn)

This goes into JavaScript later as well but it seems to be the way I'd consider proper: only using JavaScript for things that can only be done in JavaScript.

</comment></comment></comment></comment><comment><USER26> Can someone clarify this for me? I thought that businesses generally were not able to book gift card revenue until after the gift card was redeemed. If that is the case, then I don't see how this really helps them. It's not like they can use that money to pay bills.

<comment><USER27> You think booking revenue at a later date restricts them from spending the cash they receive now? It helps them because they receive cash that can be physically spent for whatever they need. FASB guidelines just prevents them from matching those expenses to revenue from a tax perspective. If I receive $250,000 in gift card sales in 2020 but all $250,000 get redeemed in 2021, then your revenue in 2020 should not reflect this $250k, but instead be reflected in 2021. All else equal, in the event the restaurant owner took the convenient and simple path of recognizing the expenses in 2020, it would just mean their tax bill in 2021 would be much higher because their net revenue (sales - COGs) would be high as a result of the $250k in revenue being realized.

Source: I used to own a restaurant.

<comment><USER26> > You think booking revenue at a later date restricts them from spending the > cash they receive now?

I did not know what to think, as I have never dealt with this before. Thank you for explaining it.

</comment></comment></comment><comment><USER28> I'm working with a group on a version of this now that allows customers to request a gift card from any local business in the US. I could use some help a pm and a full stack dev with ecomm / payments experience. Ping me if interested. firstname.lastname@example.com

</comment><comment><USER29> Isn't this what commercial paper is for? Surely we shouldn't take the stimulus and send it aloft under the guise of charity? I'd rather just give that money to a small business owner than forestall the inevitable.

</comment><comment><USER30> In my experience, 90% of locally-owned restaurants have gift cards. So what's the point of a website that attempts to list 90% of restaurants? Why not just use Google Maps?

<comment><USER16> Sometimes it's nice to have a list view. Google maps only provides geolocated results in a small list so you'd have to move around the city quite a bit to find the whole list.

It can be useful to be remembered of places you like but haven't been in a while as well.

</comment></comment><comment><USER31> I think people should stop spending considering the u certainity in the markets and economy.

This is not the time for feel-good charity and small scale philanthropy

</comment><comment><USER32> We have this in Romania too: [https://cadou.ialoc.ro/](https://cadou.ialoc.ro/) :)

</comment><comment><USER33> Please donate your discretionary income to food banks and other charities, not business owners.

<comment><USER34> Actually, small business owners absolutely do need money right now. You want them to have the money, too, if you want to have an economy to return to after the pandemic subsides.

</comment></comment><comment><USER35> Great to see a Bubble-built app! Nocode lets you do things over the course of one day

</comment><comment><USER36> a better one for SF: [https://saveourfaves.org/](https://saveourfaves.org/)

</comment><comment><USER20> "Operation timed out -- app too busy"

Hug of death?</comment>


Thank You and Goodbye, the CyanogenMod Team - <AUTHOR> https://plus.google.com/+CyanogenMod/posts/RYBfQ9rTjEH <comment><USER2> Part of the problem is the confusing naming. I'm an Android fan and I can't tell the difference between CyanogenMod, Cyanogen OS, Cyanogen Inc and Cyngn. Terrible way to run a business and project when it's too hard to separate out what they each do by a unique name.

<comment><USER3> The conflation was deliberate. They wanted to trade on the good name of the original open project.

<comment><USER4> It was nothing sinister. Cyanogen himself, Steve Kondik, was the CEO of the new company. They were 100% open about it.

<comment><USER5> Once you've made a for profit enterprise, it's fundamentally deceptive to trade on the good will of things like volunteering, charity, add open source, because the incentive structure and relationship has changed. Someone selling me a OS for profit should be trusted far less than someone who does it for free and/or as a labor of love or duty.

There's a buying power that a consumer has that a user of something provided for free doesn't, but there is also a hell of a lot more reason to cheat, lie to, defraud a consumer than a user. There's an adversarial aspect to the relationship now.

</comment></comment></comment></comment><comment><USER6> I'm a user of CM for many years. I don't know any person's name in CM team, but I wish everyone who's behind the curtain have a good future and thanks for all your contribution.

</comment><comment><USER7> I have read this and another post from CM team. I somehow missed what the main catalyst was for shutting down. Is there a succinct explanation? What happened?

<comment><USER8> Hard to make money selling a free OS to replace an OS the customer doesn't pay for already?

<comment><USER9> Android is "free" to the consumer, but the payment is that if you want all of the Google apps (which are no longer part of the open source stuff) and the consumer uses the Google apps (likely), all of the search revenue goes to Google.

<comment><USER4> > Android is "free" to the consumer, but the payment is that if you want all > of the Google apps (which are no longer part of the open source stuff) and > the consumer uses the Google apps (likely), all of the search revenue goes > to Google.

The payment is your private information.

<comment><USER9> That too, although unpersonalized search ads are worth a lot more money than your private information.

</comment></comment></comment></comment></comment><comment><USER10> Another tech project bites dust due to clueless managerial types trying to propel their ego...

<comment><USER11> I saw an early interview where an early founder was saying they were going to put google out of business. Wasnt a good sign.

<comment><USER12> Yeah, get in line behind Steve Ballmer.

</comment></comment></comment><comment><USER13> The successors need a new name. I suggest "Public Phone". The trademark is available.

<comment><USER14> They have one. It's called LineageOS.

<comment><USER13> Blah. Sounds like another Linux distro.

<comment><USER15> I think the boring name is a good sign - Operating systems should be boring. Flashy marketing leads to the sort of drama that killed cyanogen.

<comment><USER16> The word lineage is boring? It seems to be haughty, lofty, arrogant, and so on.

<comment><USER17> Where does lineage mean that? I've never seen that definition.

<comment><USER18> "Lineage" can have a connotation of people talking about the great things their ancestors have done and attempting to somewhat attach themselves to those deeds, as well as an opportunity to look down on people of "lesser breeding".

Obviously it has positive connotations as well, but the negative ones are definitely there.

<comment><USER19> >>"Lineage" can have a connotation of people talking about the great things their ancestors have done and attempting to somewhat attach themselves to those deeds, as well as an opportunity to look down on people of "lesser breeding".

Yeah, I guess I would have failed that Rorschach test.</comment></comment></comment></comment></comment></comment></comment></comment>


HN: I was fired today, is this even legal? - <AUTHOR> Hi,
I've been unemployed for a while and recently got an $8 an hour job through Kelly services. The name of the company is called Juno Pacific in Santa Cruz. I did excellent work, got along with everyone and had nothing but praise from my immediate supervisor. She jokingly said 'good job ,you deserve a raise' and other such comments regularly. When I was quizzed at the little testing stations I worked at I did fine. It was easy rote work.
We had a meeting yesterday where the upper management ( who I had never met ) called in all the workers in my shift and told us about the productivity incentive program.
The productivity incentive program is this: If you give the company any ideas that make them more money you are rewarded with a pizza party and you get to spin a cardboard cut out wheel that has 'big prizes' like a $25 amazon gift certificate. The grand prize of the cardboard cut out wheel is an ipad.
The manager mentioned one example of a single employee that thought up an idea that saved them $5000 a month. Presumably this person was rewarded with a pizza party and got to spin the cardboard cut out wheel and claim their prize.
The manager said that he would like to see each employee come up with at least 3 ideas.
I raised my hand and said that "if anyone here can make the company an additional $5000 a month you should treat them as a consultant and simply write them a check for $1000". I also said that the incentive program as is is a bit "maddening" and silly. I also mentioned that I've seen this kind of thing before at companies while implying that its simply not fair. After the meeting was over a few other employees expressed gratitude because its what they were thinking as well.
Today I was fired without notice. The person that was given the responsibility to notify me didn't give any reason except that my 'outburst was inexcusable' and that the decision came from upper management. <comment><USER2> I know it sucks because you probably need that $8/hour right at this point but in the grand scheme, the "pizza party" and "wheel of fish" is about the most humiliating ridiculousness I've heard in quite some time. Life is too damn short.

Just reading the small amount you've written about the situation, I can tell you that you simply _write English_ at a greater than $8/hour level. Probably much greater.

I'm continually shocked at how aggressively companies court mediocrity and failure. They probably think they are extremely progressive even for listening to employees in the first place, double plus points for giving token rewards. Unless, of course, that the employee input happens to be about how ridiculous and juvenile the whole exercise is.

<comment><USER3> I personally think people should appreciate any reward, even if it is just a pizza party. Why do people think they should get a cut of the savings? If you work for the company, you should want to see it succeed for the sake of your own future with the company. If a company has a policy in place for 10% cut of the savings, sure that's great. But don't be greedy and expect more.

<comment><USER4> They think that because it's not part of their job, so they should be paid extra for it. I don't think that OP's $8/hour job's reponsibilities include increasing productivity on a company-wide scale. Management is asking the employees to do something that's not part of their job and for which they are not paid.

<comment><USER3> Doesn't sound like they made it part of his job, just a perk. Participating isn't a requirement. And if an employee was embarrassed by the pizza party and still wanted to submit an idea, I'm sure they could say "I don't want any pizza party, but what if we did this....."

</comment></comment></comment></comment><comment><USER5> It's completely legal, and probably a reasonably good life lesson for you in how communicate in the workplace.

I don't disagree with what you said necessarily, but if you think about it from the manager's perspective you basically shoved their nose [edit: and even worse, publicly] in an effort to make employees feel their opinion was valued and a small incentive program for it (the budget for which may not be under their control).

Realistically, you were an $8/hr temp. You were extremely replaceable, and you made yourself a net negative in someone's mind.

I sincerely hope you find new and meaningful employment in very short order.

</comment><comment><USER6> Yes, it's reasonable: you should not waste your life in a place with silly pizza parties. Aim for something better.

Edit: BTW, he links to his resume in his profile if anyone wants to do a good deed: [http://helpknow.com/resume.pdf](http://helpknow.com/resume.pdf)

<comment><AUTHOR> I am but in the meantime I need to have food and shelter. I have some freelance work that can sustain me but I really wanted a reliable paycheck. I actually didn't mind the work and the company made a good product. I think the problem is that in the mind of the manager I attempted to plant in the head of the other employees ( many of which English is a second language and its hard to find work and they want to keep it) that you shouldn't just give away what is in your head for some one else to benefit. Its bad enough that they pay these people nothing but trying to scrape whats in their heads in exchange for remedial trinkets is really just seriously gross. If I was still in my 20's I would have just thought the whole thing was racist but I've been around enough to know that its really just corporate culture.

<comment><USER7> Lesson learned: Next time just give them dumb ideas and don't stand out.

<comment><USER8> I oppose this: human dignity MUST be defended at all cost.

<comment><USER7> The poster was talking about an $8/hr temp job. He's already made a decision to trade dignity for necessity.

Defending dignity at 'all costs' makes it sound like you've never had to make a hard decision in your life. This is a case where the right move is to keep your head down, do the bare minimum, work on your portfolio on the side and bolt for a better job as soon as you can.

<comment><USER9> If everyone does that instead of speaking up, the situation for the people at the bottom never improves. If enough workers reject their poor conditions, the situation might gradually get better.

You can choose to put your own interests first by sticking around and not saying anything or those of your fellow workers by taking a stand. It's a question of values.

<comment><USER10> The keyword is "might". In the meantime, OP is out of a job and I just Hope he has some savings to fall back on because I doubt that temp agency will be looking to take him back.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> If you were a temporary worker through Kelly Services you probably won't have much recourse. I temped in my twenties and I don't think there's much you can do. You are a Kelly employee, not an employee of the host company, and as such your work assignment with Juno Pacific was ended so you head back to Kelly for a new assignment. IANAL.

<comment><USER12> Just to reinforce what Noddingham said: if you were a temp working for Kelly, you didn't get "fired": Juno Pacific called up your staffing manager at Kelly Services and told them that they didn't need your services anymore. Yes, that's a lot like getting fired, but if you were a temp, you were never an employee of Juno Pacific.

</comment></comment><comment><USER13> IANAL, but unfortunately there is probably not much you can do in this case. Many states are right to work states meaning that the employer can terminate your employment without reason as long as it is not discriminatory based on age, sex, race, etc... I am also going to assume that this was a temp position that was fulfilled through Kelly services in which case the employer has even more leeway presumably in their contract with Kelly. There is probably a clause in there somewhere that says that since it is a "temp" fulfillment they can terminate their relationship with you at any time without cause.

<comment><USER14> 1\. That is not what right-to-work laws are for, nor is what you described any definition of right-to-work.

2\. CA is an at-will employment state. You can be terminated for cause, no cause or just cause.

<comment> brown9-2 I think the parent poster meant "At-will" rather than right-to-work.

<comment><USER13> Yep, sorry mixup on my part.

</comment></comment></comment></comment><comment><USER15> [https://en.wikipedia.org/wiki/At- will_employment](https://en.wikipedia.org/wiki/At-will_employment)

</comment><comment><USER16> Well this is a life lesson learned: don't mess with upper management. What they are doing is exploiting their workforce (I mean c'mon a guy saves them $5000/mo and he gets a $50 pizza party?) and the only thing you can do is privately share your discontent behind their backs. Most companies are not open to disruption especially by petty labor.

<comment><USER17> Before you get a management position, if someone around you challenges your ideas or critiques things you do, you deal with it. After you get a management position, you fire them.

</comment></comment><comment><USER18> I have some honest questions.

Do you have any sort of social disorder? On the spectrum, etc?

How would you assess your cost versus value at the company? How much extra money (in savings or profits) do you think you generated for the company?

What did you imagine to the be the best outcome, and what did you imagine to be the worst outcome?

Obviously, you didn't think you would get fired over such behavior... why do you think you were unable to see this as a possible repercussion?

Why did you decide to do this in public, rather than private?

Do you often have issues filtering your thoughts before speaking?

Did you realize that your behavior might create a disincentive for other employees to contribute ideas to the company?

\----

I am just very curious when situations like this occur, what the internal thinking is... because from an outside perspective, it seems like you getting fired was the obvious (nearly the only) possible outcome.

</comment><comment><USER19> You made them feel stupid, so they made you feel unemployed. Do not criticize management openly in front of others, this was your mistake. I've also made this mistake, I was right, I was also ended up unemployed. You were right about everything you said, but it's probably small consolation. It may even have been illegal to fire you, however how likely is it that somebody who makes $8 an hour can afford a lawyer to right that wrong? You can go to some kind of labour dept lawyer and make a case for wrongful dismissal, but the bureaucracy behind such organizations is slow, by the time they act (if they ever do) you will be long past caring.

<comment><USER20> As others have pointed out, it's unlikely the company did anything illegal. That aside, I have been in the same situation as you and the OP, and it's far more important to learn the obvious lesson here than to waste time trying to find recourse.

</comment></comment><comment><USER21> You should reconsider what you were trying to accomplish with your remarks. If your intention was to change the policy, it may have been better to offer your criticism after the public event, in a less confrontational manner. No one likes to be shown up. Consider making suggestions that allow the other people to save face. While it might feel good in the moment to complain in public and humiliate your boss, the end result will often be counter-productive to your goals. This happens at all levels of management. You got to learn it when the stakes are relatively low. Good luck!

</comment><comment><USER22> Put a way to contact you in your HN profile and on your other profiles (GH, SO).

While it sucks to be short on money, it really seems like you dodged a bullet and you're better off not working there. From what I can tell from your writing and your online presence, you are far above making $8/hr.

<comment><USER23> Thats what really gets me about this, either this is truly a fucked up situation or something isn't getting through - if you're in the valley and you can write a jquery selector/do a few frontend customizations, you can put your resume on dice and have 10 phone calls the first week. I don't really know what to say, I have no degree but have just a few contacts and taking a job at a company like that for less than I'd get at an in-n-out seems way out of line.

Suggestion to OP: post your resume on a few sites and get recruiters calling if you haven't. Maybe put your teaching job on the bottom and emphasize coding ability. There's no reason you shouldn't be getting a few interviews very quickly unless you only speak in Klingon irl.

</comment></comment><comment><USER24> Yep, I see no discrimination based on sex or race, which we know is illegal for sure. They can simply fire you if they want to, otherwise. I wouldn't be too beaten up about it though.. Doesn't look like the best place to work.

</comment><comment><USER25> You can contact the Department of Labor ([http://www.labor.ca.gov/](http://www.labor.ca.gov/)), but I seriously doubt what they did has any legal consequence.

I don't know about CA specifically, but Departments of Labor usually LOVE aggressively defending employees' rights. Something I don't see much on HN, but I saw a LOT when I worked in HR.

<comment><USER26> > Departments of Labor usually LOVE aggressively defending employees' rights

In my experience this is only true if it is easily proven that you were fired because of blatant racism or sexism. If it isn't either of those two reasons or it is harder to prove, nothing will happen.

To the OP, yes it seems perfectly legal, you can be fired at any time for any reason that isn't one of a handful of protected reasons (sex, religion, race etc.). You can be fired for wearing blue that day if they so feel like it. It's just not usually so petty because it can be a little bit of a cost replacing a person.

</comment></comment><comment><USER27> Dude you have more rep than I do at Stackoverflow. Where are you located in the world that you are unable to find a web development job?

<comment><USER28> Yeah, that is a blatant imbalance.

Why, OP, are you not working as a developer?

Honest question, not trying to be negative or anything.

<comment><AUTHOR> I have been trying for years. I fail at everything. The thing is this, just knowing how to program and do DOM manipulation isn't good enough. You need to have a stack/framework or 5 that you know like clockwork and as intuitively as a language. I thought by now I would know enough but its really going to be another year of learning node/express/mongoose/mongo/jade/programming patterns/web apis/authentication and god knows what else before the 'big' $20hr checks come rolling in. Seriously , if you don't have enough 'intuitive' understanding of a stack coming into it then you're dead before you've entered the door. Learning a stack is like learning a new language. I have written in PHP but trying to learn CakePHP or any of the other PHP frameworks is a large time investment. I tried Rails and plopped. I've now finally settled on node with express but learning mongoose, ajax w/mongoose and jade in conjunction with api's and storing dom id's and whatever else takes time as building muscle memory is the only route to employment. When I was younger I use to play with drum machines and electronic music equipment a lot and knew certain pieces of it like the back of my hand. The only way I see myself making any real money is to learn a stack literally as well as I knew that music equipment when I was a kid. That means striving to know every granular piece of it....and that takes time.

<comment><USER23> You don't. You need to set reasonable expectations and approach a coding job as a "new" task instead of one you perceive you've failed at - you probably know more than many intermediate developers but it sounds like your ability to ship code is the biggest problem. Being a programmer doesn't mean knowing the entire stack and each and every piece of it, its about being able to pick out whats important to the task at hand.

I've run into a frequent roadblock in that I always want to know all the elements of what I'm getting into. I'm finding that in MOST cases its not important at all, until you're architecting a new system. Leave that to senior level folks for now, just find a place you can fix or work on UI elements or clear bugs - theres no need to be so stressed about a programming job, just reach for a branch that you can grasp firmly.

</comment></comment></comment></comment><comment><USER29> It's a shame, but something I've learned in the last few years working for a bigger company with layers and layers of management is that they genuinely are not interested in your ideas or input.

Some middle-manager somewhere in the chain came up with the "spin the wheel" idea - and no matter how stupid you think it is, they have a vested interest in it working out, so they look good to their boss. As soon as you point out how stupid it is, you're undermining them, and that's something no middle- manger will tolerate.

It's a shame, but the best thing you can do is keep your mouth shut.

(Yes, I'm looking for a new job)

</comment><comment><USER30> I'm really sorry to hear about what happened. I wish you the best of luck in finding a new job. The pizza party idea sounds demeaning and silly.

Now is not the time for advice on communication, but I can't help but comment on this, sorry. Take this with a grain of salt because I wasn't in the room. Should the manager be able to handle your questions better? Yes. But, consider this rhetorical question, was your aim to embarrass the manager or improve the situation? Even though you were presented with something ridiculous, from the manager's perspective, you embarrassed him in front of his reports. Criticizing someone (or an extension of them such as their work) in a group setting can be very destructive. In a situation like that, I recommend talking to the manager one-on-one afterwards. That gives the manager the opportunity to do something that fixes this and to be a good manager that listens to his employees and comes up with incentives that might actually work. If the manager doesn't want that outcome, don't waste your time there. Your manager might be childish and unprofessional. He might just lack the empathy required to understand your perspective without it being explained to him. If he is the former, and you don't want to get fired, you have to act in a way that is acceptable to someone childish and unprofessional. I think a good manager would handle your points and questions and give you some kind of response whether it be 1) I'll look into fixing this or 2) sorry, I can't fix this. They say good managers are hard to find.

</comment><comment><USER31> Employment in the US is "at will", which means you can be fired without just cause (except for prohibitions for race, religion, gender, age, disability, national origin). It may seem terrible, but it's good to remember that "at will" works the other way too, so if your situation sucks you shouldn't feel legally obliged to stay.

[edit] Also, I'm sorry that you got fired like this, it sounds maddening and inhumane. Best of luck to you in finding something better.

</comment><comment><USER32> In general, it is important to provide negative feedback on a management initiatives in private, except when it is very specifically solicited in a public forum (or you _really_ know all the people involved well enough to know that its acceptable _to them_ ), and, whether privately or publicly, doing it in a respectful way that focuses on the benefit (particularly, _to the company_ ) of doing things in the way you think is better and/or (really, equivalently) the costs (again, to the company) of doing things the "wrong" way (actually, that's largely true of negative feedback _in general_ , not just up the chain.)

Of course, there is a difference if you have grievances that have reached a certain point -- see, well, the whole of the labor movement -- but at that point you have better already organized with others and be prepared for an extended and escalating series of negative consequences before you reach your objective, and a not-good-enough new incentive program isn't usually the kind of thing where that is called for.

The consequences in this case were, perhaps, extreme (though not surprising, _especially_ in the contract of an assignment through a staffing agency rather than regular employment), but that there would be negative blowback is not at all unexpected.

The good thing is that losing a temporary assignment like this tends to have a _lot_ impact on employability, even in the short term, than being fired. That's not to say it doesn't _suck_ \-- I've been there, more than once -- but its probably a "learn from it and move on" situation more than anything else.

</comment><comment><USER33> California is an at-will state. You can generally be fired at any time for almost any reason:

[http://www.business.ca.gov/StartaBusiness/AdministeringEmplo...](http://www.business.ca.gov/StartaBusiness/AdministeringEmployees/EqualEmploymentOpportunityLaws/AtWillEmployment.aspx)

I'm no lawyer, but them not liking how you act in a meeting is probably one of the reasons.

As an aside: yes, you're right, that's horseshit. The purpose of behavior like this is to establish dominance. "Fair" is irrelevant; even "well run" is secondary to keeping the caste system in place. If you're interested in the nature and history of this, you might see if your library has the book Confronting Managerialism: [http://www.amazon.com/Confronting-Managerialism- Business-Eco...](http://www.amazon.com/Confronting-Managerialism-Business- Economic-Controversies/dp/178032071X)

</comment><comment><USER34> Hi William,

I'm sorry to hear about your situation. One thing I've learned in life is that people will ask all kinds of unreasonable things of you. There's no need to get upset with them. A simple "No, I can't do that" is a perfectly acceptable answer.

While your point was valid, I suspect it was the way you said it that lead to you getting fired. You said you mentioned it was "maddening and silly." There's no need to get mad. You can't control what other people will say. You can only control your reaction to it. If you had just suggested that the program might be more efficient if employees shared in the monetary savings and left it at that, I would guess that there would have been some discussion and maybe something positive would have come out of it. Instead, you insulted people who had probably put a lot of thought into this program so of course they felt humiliated and used their power to get revenge.

Yes, I know it's petty but many people are like that.

I was presented with something similar at work once. I won't go into the details but basically the company was hoping we would use our free time to create something that they would basically take ownership of. When the manager got done explaining it and asked me what I thought, I just said "I'll think about it" but I knew I would never do it.

It was never brought up again.

The same thing probably would have happened with this program. In a week, all the managers would have forgotten about it and moved on to one of their other hair-brained ideas.

I know you're in a difficult situation right now. I don't know your area but you could probably get an $8/hr job just walking down the street. I hope this turns into a blessing in disguise for you. It's a good lesson to learn. Better to be fired from an $8/hr job for this than an $80/hr job.

</comment><comment><USER35> You're in an at-will state, so unless you were fired due to a legally protected thing. (race, religion, sex, etc) You have no recourse. So it's legal.

It really sucks, and I'm personally sorry to hear that you had to work in such a crappy place and deal with such a demeaning and ridiculous situation.

</comment><comment><USER36> I'm not sure what you can do legally, IANAL, etc. But do you really want to? Getting embroiled in a legal mess probably isn't worth it, in any case.

I believe you did learn a valuable lesson in how to operate within a company, though. You will be faced scenarios like this many times in your career. It constitutes part of the politics of the workplace. Like most people, I went through a similar learning process. When you're younger, you tend to let your passions dictate more of your overt actions. As you get older, you see how the game is played and learn how to choose your battles. I know it sounds a bit cynical, and it probably is, but being around to fight another day (assuming that you believe that you're someone who can have a positive impact) makes it worth it.

</comment><comment><USER37> FWIW, to the extent you spoke out in protest of unfair working conditions, it possibly could have been a violation of federal labor laws.

[http://www.nlrb.gov/rights-we-protect/protected-concerted- ac...](http://www.nlrb.gov/rights-we-protect/protected-concerted-activity)

Yes, most employees have labor rights, even if they're not in a union. Check out:

[http://www.nlrb.gov/resources/faq/nlrb](http://www.nlrb.gov/resources/faq/nlrb)

Who knows if it could help, but you might want to contact the NLRB.

[http://www.nlrb.gov/what-we-do/investigate-charges](http://www.nlrb.gov/what- we-do/investigate-charges)

Mostly, though, I wish you luck finding a decent job. That company sounds awful.

</comment><comment><AUTHOR> I went into Kelly services today to fill out my final time sheet and the rep said the manager told him 'someone who looked like me' was spotted on the property yesterday.

I was home all day and haven't set foot anywhere near there since the day the assignment was terminated. I am inferring the manager intentionally made that up to further tarnish the perception of me in the minds of the reps at Kelly. Maybe I'm just paranoid , but it sure seems like that. Anyway, if he did do that it seems to have worked by my perception of the Kelly reps response when he was speaking with me.

I don't even know why I'm typing this other than to point it out in Robert Greene fashion for all those uninitiated.

</comment><comment><USER38> Is it even legal? Yes.

It sounds like you went on a short rant that makes the management look bad in front of everyone: this was a mistake.

Next time if you have an issue with the program like this bring it up privately with your manager or save your feedback until it is solicited.

<comment><AUTHOR> He asked for feedback before I raised my hand. But the reality is that you're right and I should just learn to shut up unless I'm completely confident that the other person won't feel uncomfortable when I open my mouth. I spend most of my time pretty quiet as-is. :)

</comment></comment><comment><USER39> Probably not anything you can do. Find a new job.

It will be interesting to see whether the people rallying to Eich's free speech rights despite his homophobia will be similarly impassioned about rallying to yours despite your rejection of serfdom.

</comment><comment><USER40> I wonder what would have happened had you reserved your comments for a private conversation with someone in upper management. That is how things are done professionally.

I agree with everything you said to them, but had I been in their position, I might not have fired you, but I would have given you a serious sit-down.

Management may be clueless, but when, from their perspective, they are trying to incentivize their employees, you don't publicly humiliate them in a manner that is sure to cause friction with the very employees they are trying to incentivize.

</comment><comment><USER41> Sounds like you're a smart person. If you're looking for good pay and a stable job try to find a government contractor. I have a good friend that started answering phones doing basic Tier 0 tech support, mostly just resetting passwords. This was at ~$15/hr. YMMV but at this contractor, they quickly realized that she was overqualified and paid for her to get certifications and bumped her into a much more technical role.

</comment><comment><USER42> Never criticize company policy other than in a 1:1 with your direct supervisor. If you have specific HR complaints, it should go through official channels.

It isn't public politics; you have no right to demonstrate or be heard (unless you are unionizing,) and it will never advance your career.

If you want to impact change, curry favor and build coalitions. Don't make any move or objection until the outcome you desire will be seen by everyone as inevitable.

</comment><comment><USER43> Learn from it. I wouldn't second guess management unless you ARE management. You got what you deserved. The program may have been idiotic, but thumbing your nose at management in front of other staff is a surefire way to get the boot. Are your really surprised?

</comment><comment><USER44> It may not feel like it right now, but it seems to me that you should be happy to be out of there. Don't accept that kind of ridiculous belittling humiliation.

I don't know if it's legal (in the US it probably is), but I hope and expect you will find something better.

</comment><comment><USER45> So save the company $60k / year and get the _possibility_ of an iPad? I think I would keep my ideas to myself and start looking for another job if I was an employee (I realize the OP was not an employee and my reply is slightly off topic).

</comment><comment><USER46> It's their playground, their rules. Move on, find a place that is a better fit.

</comment><comment><USER47> Call the CEO at Cretex, the parent company. Ask them why they fire employees that come up with ideas (the point of the incentive program, after all, was to offer ideas). You have nothing to lose at this point.

</comment><comment><USER48> Not sure about your whole story but working for 8 bucks per hr, at least from your resume seems way below your pay grade. There may of course be a good reason for that but otherwise I'd say aim higher.

</comment><comment><USER49> "The manager mentioned one example of a single employee that thought up an idea that saved them $5000 a month."

His idea was that the company should fire someone who makes $60k a year and redistribute the workload.

</comment><comment><USER50> Firstly, firing you for making this statement is crazy.

But one problem with giving employees a cut of the profit from their ideas is that everyone becomes incentivized to try to come up with home run ideas vs. doing necessary but non-revenue generating projects and tasks. [1]

The pizza party and cardboard wheel is kinda ridiculous--like something from The Office--but that's the (sad) norm at a ton of places. Most of us are extremely luck to be at the other end of the spectrum in tech/startups.

[1]: Great article on this topic by Joel Spolsky: [http://www.inc.com/magazine/20090101/how-hard-could-it-be- th...](http://www.inc.com/magazine/20090101/how-hard-could-it-be-thanks-or-no- thanks.html)

</comment><comment><USER51> TL;DR- Apply for unemployment, collect your monies while you search for employment. Do it ASAP most states require you to apply the first day you are out of work. They also expect your to be looking that day.

IANAL, but I think you may be eligible for Unemployment insurance. Here in MD. It's at-will emploement. You can be fired for any reason. But you'd be eligible for Unemployment. The burden is on the employer to prove that you were grossly insubordinate. Which it doesn't seem like you were. Also, companies are expected to try an resolve issue like this without going as far as to fire someone.

</comment><comment><USER52> Don't work anywhere that you're treated like a child. That "incentive program" is infuriating.

</comment><comment><USER53> For a moment I though I add clicked on my Slashdot bookmark ...

</comment><comment><USER54> Lesson, when needing cash for basic living expenses..keep head down and mouth shut..

Yeah it sounds unfair..tough its way things are.. work the system not have system work YOU!

</comment><comment><USER55> consult an attorney on legality. Only an attorney is allowed to give legal advice.

<comment><USER41> Don't bother. As long as California is an at-will employment state (I'm pretty sure it is) they can fire you for no reason at all.

<comment><USER32> More importantly, one of the main reason that services like Kelly are used is that _Kelly_ is the employer, not the company that is contracting for services from Kelly, and Kelly didn't fire you -- a company that was contracting with them exercised an option under their contract with Kelly to stop receiving services from Kelly. As a result, Kelly doesn't have any work for you until they get another request that you fit.

<comment><USER56> This seems like it would be pretty thin in the face of genuine wrongful termination.

<comment><USER32> Its pretty hard to have "genuine wrongful termination" without actual termination. Especially if the staffing agency quickly finds you other work, even if the other company motivation was "wrongful", you're going to have a hard time establishing compensable harms stemming from it.

If the staffing agency knew of the wrongful reason, and because of it (or because of the other company's decision to end your assignment with knowledge of it) they then declined to assign you other work, you might have a case for wrongful termination case against them (by way of constructive dismissal), but there would seem to be a number of things you'd have to prove there that you wouldn't in a direct employment wrongful termination case.

<comment><USER56> _' Its pretty hard to have "genuine wrongful termination" without actual termination.'_

IANAL, but my understanding is that judges pretty quickly look past what things are labelled. If the temp was able to quickly roll into another gig (or the temp agency otherwise kept paying them), that's one thing. But I'd still be very surprised if legal cleared "We don't have need for your services any longer because you're black. We're contacting your temp agency for a white replacement."

</comment></comment></comment></comment></comment></comment><comment><USER57> What's the name of the company? What's the name of the manager that got you fired?

</comment><comment><USER58> Here endeth the lesson.

</comment><comment><USER59> IANAL, but here's my read.

There's little you can do, and it sounds like it was a shitty job. Anything you'd recover in a lawsuit (and winning one against them is a long-shot) is going to be based on the income lost from that job, and wouldn't be worth it. If you were a salaried employee, you might be able to push for a severance (maybe a month?) on account of the circumstances your departure making them look bad, giving them an incentive to settle. As a temporary hourly worker, I don't think you have that credibility, and I think they can fire you pretty much at will: your services aren't needed. A termination suit would be unlikely to win you anything, and the reputation effect would cancel out what you're likely to win.

If Juno Pacific harmed your reputation at Kelly Services, you might have a claim of tortious interference. But, unless otherwise specified, JP has the right to cut your hours to zero, which means terminating you.

It's going to be a he-said/she-said battle, but the truth is this: you made the executives look cheap and stupid (because they are) and they canned you as a "troublemaker". It's a tough call what is legal in dealing with "troublemakers". Attempting to unionize (which is not really what you tried to do) is protected and not fireable. Making executives look bad (which you did) is "insubordination" and fireable. Where's the line between "a troublemaker" and "insubordination"? Judgment call, very subjective. Is it right, what happened to you? No, but that's how the system works right now.

Corporate survival protip: rabblerousing is rarely worth it. I know, from experience. If you don't care enough to start a union (and that's a ton of work) then you should just do your job and keep those sorts of opinions to yourself. Shitty companies are like Wrongness on the Internet. If you fight them all, you'll never get anything else done.

TL;DR: they probably didn't break the law, you almost certainly won't get anything even if they did, and your best course of action is just to get another (better) job.</comment>


Show HN: Csvsh – A tool for querying your CSV files using SQL - <AUTHOR> https://github.com/raymank26/csvsh <comment><AUTHOR> The project is a result of my previous research of open source tools which allow me to query for rows over CSV file as simple as over database.

There were a few tools and libraries around but most of them convert data to SQLite database as a first step which is not the best option when you have hundreds or more MB of data.

As a result I implemented the tool by processing SQL-like input using ANTLR and applying computed AST to the input CSV file. It worked quite fast for medium sized files.

After my initial approach I added support for DB indexes (based on B-Tree implementation in LMDB project) which highly increased query speed for CSVs files which size is more than 1 GB.</comment>


The Math Behind the Rolling Shutter Phenomenon - <AUTHOR> http://petapixel.com/2014/10/13/math-behind-rolling-shutter-phenomenon/

<comment><USER2> I'm still not sure if this is "republished with the author authorization" or simply plain blogspam. The original article is linked at the bottom: [http://jasmcole.com/2014/10/12/rolling- shutters/](http://jasmcole.com/2014/10/12/rolling-shutters/) and it w previously discussed here: [https://news.ycombinator.com/item?id=8446932](https://news.ycombinator.com/item?id=8446932) (705 points, 5 days ago, 41 comments)

<comment><AUTHOR> good point, missed that. it's a pretty popular and respected photography blog so I would give them the benefit of the doubt.</comment></comment>


37signals Live debuting tomorrow at 3pm CDT - <AUTHOR> http://www.37signals.com/svn/posts/1178-37signals-live-debuting-tomorrow-at-3pm-cst <comment><USER2> Advice-as-a-Service, lets see how much they start charging if the beta goes well.. ;)

</comment><comment><USER3> i really enjoy listening to the 37signals point of view on things, so this should really make for an interesting experiment...hopefully things go very smoothly, and best of luck to their team!

</comment><comment><USER4> It'll be interesting to see who ends up on the show. Will DHH be there?

</comment><comment> cypress-hill holy shit lets not pump up their titanic egos any more</comment>


David Cohen: You Have Acquisition Interest, Now What? - <AUTHOR> http://www.davidgcohen.com/2010/06/18/you-have-acquisition-interest-now-what/

<comment><USER2> Very often, acquirers will ask to have an "exclusive partnership" with you instead of outright acquiring you.

SAY NO.

Take just want you to take all the risks. If the partnership doesn't work out, you're pretty much out of business because you gave up everything else for that exclusivity.

</comment><comment><USER3> There's nothing about contacting other potential acquirers. That would seem like a good idea, but I have no experience in this area. What's the wisdom there?

</comment><comment><USER4> Leaves out the most important thing - Keep building/act like its not going to happen. You get more leverage.

<comment><USER5> I don't think he did leave that out actually. In step 5, he says, "Explain that you're very busy working with customers and improving your product, and that you can't afford to distract the company without having at least a ballpark understanding of the offer."

Did he have to spell it out further? Not to me

</comment></comment><comment><USER6> 10.5) Ask for an insurance. If they end up not buying after your agreement, they should pay you x% if the acquisition price.

<comment><USER7> Interesting. Is such a request typical?

<comment><USER6> I am not sure, but I read it somewhere. I think it would be common for large size acquisition as the company being approached my loose value if the deal dies.</comment></comment></comment>


32-Core CPUs From Intel and AMD - <AUTHOR>

With the gigahertz race largely abandoned, both AMD and Intel are trying to pack more cores onto a die in order to continue to improve processing power and aid with multitasking operations. Miniaturizing chips further will be key to fitting these cores and other components into a limited space. Intel will roll out 32-nanometer processors (down from today's 45nm chips) in 2009.
Intel has been very good about sticking to its road map. A six-core CPU based on the Itanium design should be out imminently, when Intel then shifts focus to a brand-new architecture called Nehalem, to be marketed as Core i7. Core i7 will feature up to eight cores, with eight-core systems available in 2009 or 2010. (And an eight-core AMD project called Montreal is reportedly on tap for 2009.)
After that, the timeline gets fuzzy. Intel reportedly canceled a 32-core project called Keifer, slated for 2010, possibly because of its complexity (the company won't confirm this, though). That many cores requires a new way of dealing with memory; apparently you can't have 32 brains pulling out of one central pool of RAM. But we still expect cores to proliferate when the kinks are ironed out: 16 cores by 2011 or 2012 is plausible (when transistors are predicted to drop again in size to 22nm), with 32 cores by 2013 or 2014 easily within reach. Intel says "hundreds" of cores may come even farther down the line. <comment><USER2> This is copied from a 2008 Entrepreneur magazine article: <http://www.entrepreneur.com/article/198920></comment>


An Update on Spline Licensing - <AUTHOR> https://raphlinus.github.io/curves/2019/05/10/spline-licensing-update.html <comment><USER2> This is wonderful news. Spiro splines are very cool, but I never considered them a real option for any projects I was working on because of the licensing issue. Hobby splines were the patent unencumbered next best choice as far as I could tell, but Spiro semantics always seemed incrementally preferable.

Raph's thesis on splines is a fun read: [https://www.levien.com/phd/thesis.pdf](https://www.levien.com/phd/thesis.pdf)

And the original paper on Hobby splines: [https://link.springer.com/content/pdf/10.1007%2FBF02187690.p...](https://link.springer.com/content/pdf/10.1007%2FBF02187690.pdf)

<comment><USER3> Can you comment on the advantages of this implementation comparing to the one used in Inkscape or other popular software?

<comment><USER4> I'll be giving at talk at Libre Graphics Meeting in a couple weeks on _exactly_ this topic. I'll make the slides available as well. Hopefully they'll make the front page of Hacker News also, as that seems to be a thing these days for my work :)

<comment><USER3> Cool, looking forward to the talk.

My first job as a software developer was writing AutoCAD extensions (in "AutoLisp" so you can guess how old I am).

Even if I don't work in the field anymore the topic is still fascinating for me.

</comment></comment></comment></comment><comment><USER5> THIS IS WONDERFUL!!!

And needs to be applauded loudly.

I've heavily criticized GNU family licenses, and HN has been full of companies who have moved from more Open licenses (MIT, Apache 2, BSD, ZLIB, etc.) to more restrictive licenses (GPL, AGPL) and "open core" crippleware has become trendy lately by failing companies trying to exploit their communities to survive.

To see a move from GPL to Apache2/MIT is fantastic!

Let's hope that this starts a trend. :)

Great work!

<comment><USER4> Thanks for the kind words.

</comment></comment><comment><USER6> >I am passing all patents into the public domain. I'd like to say a few words about why.

Honest question: How does that work? Is it enough for the author to say that they are in the public domain now?

<comment><USER7> He pushed [https://github.com/raphlinus/spiro/blob/master/LICENSE- MIT](https://github.com/raphlinus/spiro/blob/master/LICENSE-MIT) which should definitely be enough. :)

<comment><USER8> if they are truly in the public domain, one doesn't need to respect any licensing?

<comment><USER9> For the patents yes, but the code is still copyrighted, so the new Apache/MIT licenses apply. They're quite permissive though so I can't imagine many uses that would run afoul of them.

</comment></comment></comment></comment><comment><USER10> Great news!

I'm certainly no artist, but on occasion I do need to create graphics. I absolutely loathe using Bezier-Splines, but the Spiro-Splines in Inkscape are a joy to use.

That said, Inkscape isn't necessarily the nicest or most popular tool, so I hope many more artists (and non-artists!) will get to use them in the future.</comment>


Identity/Persona Shutdown Guidelines for Reliers - <AUTHOR> https://wiki.mozilla.org/Identity/Persona_Shutdown_Guidelines_for_Reliers <comment><USER2> Shameless plug: Portier is a FOSS project to replace Persona, [https://portier.github.io/](https://portier.github.io/). We also just had our time on the HN frontpage, [https://news.ycombinator.com/item?id=12837669](https://news.ycombinator.com/item?id=12837669). Lots of questions were answered there, but feel free to ask here as well if anything is unclear.

<comment><USER3> This is pretty cool, I might try it one day if I build a site that needs login.

But this is a lot different than Persona, right? Portier is passwordless login via email (with special handling for Gmail), whereas Persona is another of those "Log in via" buttons (simply speaking)?

<comment><USER4> No. They work pretty much the same, except Portier is stateless, and Personal needed you to create an account before use, which was unnecessary. Persona also had special handling for Gmail. Portier will probably add more "special handling" cases in the near future.

<comment><USER5> Persona only required you to create an account if your email provider didn't support it (or your custom domain doesn't delegate it) or they didn't have special handling for your email provider. There was a bunch of confusion about this early on because a lot of potential early adopters were generally geeks like us who have our own email domains and didn't automatically fall into the special handling (which Persona supported Gmail and Yahoo, which remain the two largest email domains).

<comment><USER6> Technically, you _always_ created an account when you used Persona. Sometimes with a password, sometimes without. Sometimes old passwords would come back to haunt you if your domain added and then removed support for BrowserID. Sometimes you would accidentally set up two accounts, because you added a new address to the Persona UI in the wrong order. Sometimes addresses would mysteriously bounce between Persona accounts, because we updated the address/account association on each use. Sometimes you needed a password and sometimes you didn't for the same address, because we supported un- decentralizing Persona on a per-website basis.

...the account story in Persona was way more complicated than it should have been, mainly stemming from the notion that per-login email confirmation loops were too onerous to be viable, and from the idea that users wouldn't succeed with Persona unless it remembered and displayed all of their email addresses in a consistent, persisted account chooser.

</comment></comment></comment></comment></comment><comment><USER7> If you're a fan of the idea behind Persona, it looks like there's a spiritual successor from some Mozilla veterans called Portier, which can be self-hosted (and is written in Rust, if that's your thing :P ). Recent announcement and HN discussion here: [https://news.ycombinator.com/item?id=12837669](https://news.ycombinator.com/item?id=12837669)

<comment><USER8> The main thing I was keen about was browser integration, which only the browser vendors could provide.

<comment><USER9> Couldn't it be done as a Firefox extension?

<comment><USER10> Yes, but adoption would a tiny fraction of mainline support/promotion could accomplish.

<comment><USER9> Late reply, but:

I think this is one of a few areas where a browser or extension developer can create something that will force every other browser vendor to adapt, sooner or later.

Last time I feel that happened was with tabs, so IMO this should is a high- value target even if nobody seems to be interested ATM.

</comment></comment></comment></comment></comment><comment><USER11> Previous discussion of the original announcement (Jan 2016): [https://news.ycombinator.com/item?id=10884893](https://news.ycombinator.com/item?id=10884893)

A decentralized way to authenticate users securely and privately would be an exceptional addition to the open internet.

Unfortunately in this case the financial incentive and favors those building "information silos" where the purpose is information collection for profit.

I wonder if SMTP would ever see the light of the day with the current mindset as opposed to a "Facebook Messenger"-like multitude of services, much like what happened with the IM fragmentation.

</comment><comment><USER12> "Why is persona.org being shut down? Our metrics show that usage of persona.org is low, and has not grown over the last two years.

Hosting a service at the level of security and availability required for an authentication system is no small undertaking, and Mozilla can no longer justify dedicating limited resources to this project. We will do everything we can to shut it down in a graceful and responsible manner."

I find this a bit confusing because citing low usage and lack of growth is something I'd expect to hear from a for-profit corporation, not a well funded non-profit. Have they shared information on how expensive it is to maintain Persona? I'm also unaware of any pledge drives to get funding for it.

<comment><USER13> I found it confusing that they expected growth over the last 2 years when in 2014 they functionally announced they were going to abandon it, transitioning it to "community ownership"

This is a self fulling prophecy

<comment><USER14> They have the right to set their level of involvement or investment, and it is only polite to peg that level of involvement to whether any significant number of people are using the thing. It doesn't mean they were obligated to try to actively market persona while also planning to shut it down, that would make even less sense.

</comment></comment></comment><comment><USER8> Such a shame. Persona was a hugely exciting project. It always disappointed me that Mozilla never fully implemented the vision of Persona integration in the browser, and it puzzles me that Mozilla seem surprised that Persona didn't get much adoption.

I still think there's potential for improving user authentication in a way that's usable, privacy conscious and fast, without a costly shim service like persona.org. Maybe Firefox could finally implement the Persona API in the browser for sites to use?

</comment><comment><USER3> I tried Persona back then when it was new, and found it pretty confusing (as a user). Still, it feels like a lost opportunity that it is shutting down.

Can someone tell, in a nutshell, what the difference was between OpenID/OAuth (I mean whatever the heck it is that allows me to "log in using my Google/Facebook/GitHub account". I always mix up those two.)?

Is it just that you use your e.g. Gmail or other third party email address, but then the authentication is not done by your email account provider, but by Mozilla?

<comment><USER8>
      ╔════════════════════════════════════════╦═══════════════════════════════════════════╦══════════════════════════════════════════╦════════════════════════════╗
      ║                                        ║ Persona with browser and email server     ║ persona.org shim                         ║ OpenID                     ║
      ║                                        ║ integration                               ║                                          ║                            ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ User identifier                        ║ email address                             ║ email address                            ║ URI                        ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Auth provider                          ║ Email server                              ║ persona.org                              ║ OpenID server              ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Passwordless                           ║ Just one password for your email server   ║ One for the shim, and one for your email ║ One for your OpenID server ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Provider sees where you log in         ║ No                                        ║ No                                       ║ Yes                        ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Provider must stay online at all times ║ No, auth tokens are cached                ║ No, but persona.org must stay online     ║ Yes                        ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Requires Javascript                    ║ Yes                                       ║ Yes                                      ║ unknown                    ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Fallback available                     ║ Yes, just use the email                   ║ Yes, just use the email                  ║ None                       ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Ability to contact user                ║ Yes, just use the email                   ║ Yes, just use the email                  ║ None                       ║
      ╠════════════════════════════════════════╬═══════════════════════════════════════════╬══════════════════════════════════════════╬════════════════════════════╣
      ║ Implemented                            ║ In no desktop browsers or email providers ║ Yes                                      ║ Yes                        ║
      ╚════════════════════════════════════════╩═══════════════════════════════════════════╩══════════════════════════════════════════╩════════════════════════════╝

<comment><USER15> that's a great chart, but a few corrections about OpenID:

Provider must stay online at all times: the OpenID provider needs to be online when you login to the consumer site, after that, you have a session with that site and the provider doesn't need to be online.

Requires Javascript: there's a fallback in OpenID.

Ability to contact owner: there are extensions to propagate attributes like email addresses that are commonly supported.

<comment><USER16> I think the key point is that _by design_ , OpenID Connect doesn't necessitate that the identity provider reveals the users email address to the service provider. The identity provider can choose to include that in the token (or the UserInfo endpoint) or they can hide it behind another OAuth scope and explicit permission.

Whereas by design, Persona does mean the service provider has access to your email address. For consumer applications, this is probably fine, but it's a very different assumption than most access and authorization use.

</comment></comment></comment></comment><comment><USER17> Persona was a great service. Such a shame.

</comment><comment><USER18> >> Identity/Persona Shutdown Guidelines for Reliers

I can't parse this headline. It sounds like a weird psychological problem of some sort ;-)

<comment><USER19> Yeah, this one [https://news.ycombinator.com/item?id=12862355](https://news.ycombinator.com/item?id=12862355) is weird too. I think it's "((Identity/Persona Shutdown) Guide) for Reliers", i.e., a guide to the shutdown of Identity/Persona for people who rely on Identity/Persona.

</comment></comment><comment><USER20> posted in wrong thread!

<comment><USER6> I think you mean to be in this thread: [https://news.ycombinator.com/item?id=12861815](https://news.ycombinator.com/item?id=12861815)

<comment><USER20> oops you are right!

</comment></comment></comment><comment><USER21> The fact that they keep throwing money at useless stuff like that new design for their logo, while at the same time they refuse to keep useful services online, is a clear sign of the downfall of the Mozilla Foundation.

<comment><USER22> > refuse to keep useful services online

The project failed to gain widespread adoption. An org that runs marginally valuable side projects indefinitely is an org that is going to face a downfall.

Like you, I'd love to see a better authn mechanism, but Persona wasn't going to be it. So, this frees their resources to focus on what is going to continue making Mozilla relevant. Certainly a declining user base on Persona wasn't going to be it.

<comment><USER8> My opinion is that Persona was still untested, we will never know whether Persona was going to be it or not because they never launched the browser integration.</comment></comment></comment>


Show HN: connect.so/cial - Show all your social activity in one place - <AUTHOR> http://www.connect.so/cial

<comment><USER2> It looks like you get your own Pinterest-like board aggregating your social accounts? Interesting idea, I like the layout.

When you are ready to launch it would be nice to have a public demo account, linked from the front page, that shows an example of a populated board. The screenshot gives you an idea of the layout, but a full demo would encourage more signups I think.

Are you sure about that URL? Using a TLD and path component pretty much guarantees no-one will remember your URL. connectsocial.me perhaps?

<comment><AUTHOR> Thank you for your feedback mryan.

Its very hard to find a perfect url for the service, I thought about using another url but for example connectsocial.me/mryan is more difficult to remember that connect.so/mryan.

When a user signs up gets a custom url starting with connect.so/, ex: connect.so/barackobama connect.so/aplusk or connect.so/kimdotcom we try to use the shorter url with the word connect and we think connect.so its perfect for the service but we will register some TLDs with connectsocial</comment></comment>