Show HN: Micro CRM, a CRM for People Who Hate CRMs - <AUTHOR>
 Hello Community! My name is Charles-Eugene Loubao, I am a software developer who recently turned into an Indie Maker and I am sharing my new product with you today.
Micro CRM is a Customer Relationship Managment web app built to be easy to use and intuitive. Most CRMs can be complicated to use and come with an expensive price tag. Micro CRM is built to fill that need for a much simpler and cheaper contact managment platform that offers compeling features without being overwhelming.
What can I do with it ?
- Keep all your contacts in one place - Timestamped notes can be used to keep track of events associated with your contacts, or as a call log.
By getting the Premium Plan you also can also:
- Import your existing contacts from Excel CSV files - Organize easily with tags - Create email reminders to help you remember follow-ups
What's next ?
Micro CRM is in it's early days and I am planning on adding the following features:
- Search - Sorting and Filtering - Custom fields - Contact attachments (files, links, images, etc) - Team Collaboration - Possible Integrations (email, calendar, Slack, etc)
How much does it cost ?
Micro CRM is free to use for manual entry and simple contact managment. The premium plan is $5/month and for a limited time I am offering a free 30 days trial with no credit card required when you create your account.
Head to https://microcrm.cc and create your free account today! <comment><USER2> Great effort, and I applaud your efforts to try and come up with a solution in this very crowded space.

For me, simplicity in a CRM is not the factor that will make me pull out my wallet. After all, your current feature set I can already do using AirTable or even a Google Sheet.

The killer features I need, that will make me pay actual $ for would be:

* Ability to have multiple team members in my company share and update my list of contacts

* Ability to add contacts from other sources (e.g. directly from my Inbox, by cc'ing any correspondence to a special CRM address, or by photographing a business card).

* Ability to group contacts by company or conference etc. so I can contact them at once.

Basically, anything that eliminates data entry, and takes the pain out of manually creating a name, address, phone, email etc. Good luck with the build out of your feature set.

<comment><AUTHOR> Thank you for your helpful insight. You listed most of the things I am getting ready to build.

Stay tuned!

<comment><USER3> Would you have any interest in pulling in CDRs & text message logs to give a broader overview of interactions with clients? If so, I'd be interested in helping write bindings for the open source PBX we use...

<comment><USER4> Could you please provide more info on how you'd do this? I have built a CRM for internal use that does this with maxo.com.au . Is the open source PBX just astrix?

</comment></comment></comment></comment><comment><USER5> I know you didn't ask for suggestions, but here's mine: the one thing I care about a CRM doing really well is pipeline / funnel management, i.e, the ability to define a set of stages that a contact goes through to close a deal or reach some other desired result and track contacts as they move through the pipeline(s).

For example: unqualified lead -> qualified lead -> responded to email -> discussion with sales rep -> made purchase

Being able to organize my contacts in this way and quickly see which contacts are at which stages and easily move them between stages (ideally with an API endpoint) is a super powerful way to drive day to day workflow (and automations like follow up emails, assuming there's an API endpoint for querying).

<comment><USER6> A simple CRM, by just supporting labels, lets you implement pretty easily any scheme like you have described.

Hierarchical labels (like gmail) are IMO the gold standard that every bit of software should implement on every type of object.

<comment><USER7> Flexibility of labelling is definitely the way to go with pipeline management. Different organizations have very different ideas about sales processes (and even what constitutes a sale/deal/partnership) and a CRM aiming for simplicity should simply let users define (and reuse) their own.

</comment></comment></comment><comment><USER8> I really admire your efforts and optimism around the product. I started something similar 2y ago - not general like yours but a vertical CRM for a specific segment. My value proposition was to create something really simple, clean and start adding relevant features by compiling from my user's feedback. I end up building a lot of more features than I expected (pipelines, tasks, workflow, email integrations, custom fields, filters, permissions, api, webhooks, reports etc). No matter how your product is, once you position your company as a CRM, the users will always compare you with others 9000 existing similar softwares. If you are planning to integrate google mail and/or calendar, be prepared to spend 15k to 90k for the third party company security assessment. I wish you very luck and I hope you can create something meaningful in this space.

<comment><USER9> I was getting started on a calendar integration product targeted towards businesses and I just looked up the security assessment rules after reading your comment. Having to fork up tens of thousands just to allow the product to be usable completely kills the possibility.

That's really disappointing. I suppose it's better to find out now rather than later.

</comment></comment><comment> mr-karan Just curious, have you taken a look at [https://github.com/frappe/frappe](https://github.com/frappe/frappe)

<comment><USER10> AFAIK Frappe is the framework on which the CRM is build. The actual product is ERPNEXT ([https://erpnext.com/](https://erpnext.com/))

</comment></comment><comment><USER11> How does it compare to Monica[1]?

[1]: [https://news.ycombinator.com/item?id=14497295](https://news.ycombinator.com/item?id=14497295)

<comment><AUTHOR> Hey, thank you for checking out Micro CRM.

At first glance Monica is a great open source CRM with a lot of good features. The main difference with Micro CRM is that I am trying to implement integrations such as email and calendar and build an API for third party integration without users having to deploy their own CRMs

The other difference is that being a closed source product, paying customers will have a person to talk to directly in case of a problem.

Lastly I am proud of my product and will also say it is better haha!

<comment><USER12> > The other difference is that being a closed source product, paying customers > will have a person to talk to directly in case of a problem.

To be clear, "closed source" is unrelated to "has a support plan". You can buy support for FOSS projects, and good luck getting Google on the phone even if you pay them.

</comment></comment></comment><comment><USER13> What is a CRM, and what problems does this solve instead of being simple/cheap? (not all of us work in the same industries with different acronyms)

<comment><USER14> 'CRM' stands for Customer Relationship Management, and in a sentence is usually short for 'a CRM app'. CRMs are what folks use to keep track of their relationship with a given client. E.g. when you call your bank, the person at the other end knows your info, what happened last call, etc. That's because of the CRM.

Lots of solo-entrepreneurs struggle with CRMs, because the existing solutions are geared for large corporations or specialty verticals (e.g. healthcare, banking). Formerly, singletons used solutions like Access and FileMaker, but these are obviously deprecated in 2019 for all the usual reasons, some of which are good.

OP has created a general-purpose CRM fit for solopreneurs. I'd throw down right away for this if I wasn't worried about what happens to my data if this offering disappears, which is the Usual Problem with SaaS and one not really addressed by this product (nor is it reasonable to expect it to be.)

<comment><AUTHOR> Thank you for your proper explanation of a CRM. I understand about your concern with your data but I can assure you, I am building this SaaS product for people like you and it is here to stay.

I am also planning on building an exporting feature , not because this product will disappear one day (which will not happen) but because I want you (the user) to be able to access your data whenever you need.

I am more than happy to hear any concerns you might have

<comment><USER15> Who takes over if you unexpectedly die or fall into a coma? That's the hardest question I can give you, I don't like thinking about it either .. but before I trust a huge business decision with a new SaaS these need to be asked. Do you have a team, a cofounder?

<comment><AUTHOR> Valid concern. Who wants to use a product and see it be discontinued. As of right Micro CRM is a bootstrapped product and I do not have a co-founder. However as a Solo entrepreneur I am dedicated fill gaps in markets like this one.

The ideal future for me would be having a small team to work on these projects with me but as of right now it is a one man show.

</comment></comment></comment></comment></comment><comment><USER16> I'm not even going to look at something on a .cc domain name. Get a .com or anything but ,cc. The .cc is notorious for spam.

<comment><USER17> Does an obscure TLD really stop you from checking out a site? This is a bit worrying, as it's increasingly expensive to get a ".com" that matches your product...

<comment><USER18> Agreed. It's some weird gatekeeping to care about the TLD.

There is nothing special about com that solves spam.

<comment><USER16> Google has mass purged .CC from the search engine in the past. In handling a small biz mail server, I auto blocked everything .CC. It's just a bad neighborhood from my experience. YMMV.

<comment><USER19> I don't mean to be a dick but that's exactly the kind of discrimination that drives the centralization of email. Please reevaluate this policy.

</comment></comment></comment></comment></comment><comment><USER20> Might there be a future version which can be embedded in a larger web site or app? In other words, being able to drop in contact management features within a mobile app or React/Vue site?

<comment><AUTHOR> I am planning on building an API to make integrations with other systems easier. That feature however would be available in the Enterprise Plan ($100/month, unlimited users) which I plan to introduce once the API for third party integration is implemented.

A mobile app is also on the works

<comment><USER21> "$100/month, unlimited users"

Just a not that, to me at least, that kind of pricing seems a bit unrealistic - a lot of CRM products charge that per user per month and do very well.

NB I'm not implying that you can't serve that demand - just that to anyone familiar with existing CRM products that seems bizarrely inexpensive.

<comment><AUTHOR> I am trying to build a different kind of CRM. Something easy to use and affordable.

</comment></comment></comment></comment><comment><USER22> Charles, I really appreciate your effort here. But, boy! you choose the wrong name for the CRM. Search engine will be filled with Microsoft Dynamics results.

<comment><USER23> Counter argument

DDG: [https://duckduckgo.com/?q=Micro+CRM&t=ffcm&atb=v117-1&ia=web](https://duckduckgo.com/?q=Micro+CRM&t=ffcm&atb=v117-1&ia=web)

G: [https://www.google.com/search?hl=en&q=Micro%20CRM](https://www.google.com/search?hl=en&q=Micro%20CRM)

</comment></comment><comment><USER24> What if a user was planning on importing contacts and using tags so they sign up for the premium account. Then they decide to drop down to the free tier. Are the tags still there that they can see but just unable to add more tags? Do the tags disappear? Or once you have a paid account you can't just drop back down to free?

I always wonder how other app developers handle this kind of thing.

<comment><AUTHOR> Hey! Right now if a user wants to switch back to free plan, the tags are still there. They just can't access them. Same thing for the import feature. The contacts stay but they are unable to import more contacts.

</comment></comment><comment><USER25> Good for you @charly1811 - keep going!

I suggest adding a silent layer of data aggregation like Clearbit, it will feel like magic to people by removing the pain of manual data entry.

* used to work @clearbit

<comment><AUTHOR> Thanks for the idea !

</comment></comment><comment><USER26> I like that this is actually for "customer relationships" and not sales-funnel software, where once a sale is made, the system is no longer updated.

<comment><AUTHOR> Thank you. MICRO CRM is a relationship management app. The only thing from a funnel software that I plan on Implementing is a pipeline which I believe can be useful.

</comment></comment><comment><AUTHOR> Any suggestions is welcome !! I am trying to build a CRM for small businesses and freelancers so I want to know what you guys need !

<comment><USER27> I'm a veterinarian. I've been looking for a product that I can auto forward our emails to and log calls to without any friction. I want to be able to make notes and assign tasks. It would be nice if it would integrate with my practice management software.

<comment><AUTHOR> Hi! Thank you for checking out Micro CRM. An email integration is on the pipeline of features to implement. What software do you use at your practice?

<comment><USER27> Go ahead and e-mail me and we can chat about it. I've got some ideas for you.

</comment></comment></comment></comment><comment><USER28> What's your plan on promoting it? I feel like this space is overheated and it's impossible to stand out

<comment><AUTHOR> You are right, the CRM space is really crowded. I am not trying to build the next Salesforce or next giant in the CRM space. I believe the reason why small businesses and freelancers struggle so much is because most CRMs out there do not ask them WHAT THEY NEED. My plan for Micro CRM is to build a simple product that will grow with my customers overtime.

Right now my main strategy is to manually promote to places like HN, IndieHackers, ProductHunt (Official ProductHunt launch is Monday Nov 4) and listen to what you guys have to say and what you guys need

<comment><USER29> > I believe the reason why small businesses and freelancers struggle so much > is because most CRMs out there do not ask them WHAT THEY NEED.

I work for a smallish CRM company targeting the SMB space. Not to be defensive, but making a general purpose CRM is _hard_. It's not that we're not asking, but there are as many different answers as there are customers out there. Some want contact management, some want task management, some want pipeline management, some want productivity and collaboration tools, all ending up shopping in the same bucket of "CRM". The list of potential features to add is endless, as is the scope creep and complexity creep of your software as your feature interactions multiply.

Though I suppose, the silver lining for you is that if you are operating as a bootstrapped business rather than growing under duress from investors, you can choose your battles (and customers) more judiciously. Best of luck out there.

<comment><AUTHOR> Thank you! See you on the CRM battlefield ;)

</comment></comment></comment></comment><comment><USER30> Great work. At first glance, I appreciate the clean design and simple features.

I've used Hubspot free plan 3 years and it works great. Not complicated and has all the features I expect a CRM to have.

</comment><comment><USER31> Tip: use "real" fake data instead of lorem ipsum in the examples.

<comment><AUTHOR> Thank you for your feedback.

</comment></comment><comment><USER32> Why not just use the free hubspot plan, and you get pipelines with that as well as email integration etc.

<comment><AUTHOR> Hey! Micro CRM is not trying to compete with CRMs like HubSpot. Such CRM seem to be target for marketing team. Micro CRM is a general purpose contact management with a fixed set of features .

</comment></comment><comment><USER33> The best, free, and totally underappreciated CRM is Bitrix24.com IMHO. There's just nothing else free on the market that combines client and project management like Bitrix24. Check out [https://bitrix24.com](https://bitrix24.com) or [https://bitrix24.eu](https://bitrix24.eu)

<comment><USER34> Do you work for Bitrix? Because this reads like an ad.

<comment><USER33> Yes, I did help Bitrix24 launch back in 2012. Didn't mean the comment to come across as an ad. I am 100% sincere in my believe that as a CRM and PM Bitrix24 got many things very right. Plus, free is free.

</comment></comment></comment><comment><USER35> Can you export data with either plan?

<comment><AUTHOR> I did not implement export yet but I will probably have it in the premium plan

It is in the pipeline of immediate features

</comment></comment><comment><USER36> Good job, I'm curious why Vuejs ?

<comment><AUTHOR> Vue.js is my go to for frontend development. It is easier than react in my opinion and allows me to architecture my app however I want</comment></comment>


Never Write For-Loops Again (Python) - <AUTHOR> https://dev.to/dawranliou/never-write-for-loops-again <comment><USER2> It's an interesting article, but the title should really state that it's about Python and Python's idiomatic alternative to for loops.

<comment><AUTHOR> I changed the title.</comment></comment>


New Vulnerabilities All Come Preinstalled on Android Phones - <AUTHOR> https://www.wired.com/story/146-bugs-preinstalled-android-phones/ <comment><USER2> Just skip the bloat. Link to the actual post: [https://www.kryptowire.com/android- firmware-2019/](https://www.kryptowire.com/android-firmware-2019/)

Google and Huawei are not on the list. And Samsung's vulnerabilities are only exploitable by system apps.

<comment><USER3> I'll add that Nokia is also not on the list. Most (all?) of their new phones run Android One.

</comment></comment><comment><USER4> I hate fearmongering articles like this, which basically advocate the authoritarian user-oppressing position that's sadly so common these days:

 _"We believe that if you are a vendor you should not trust anybody else to have the same level of permissions as you within the system,"_

The fine print here is that these are effectively _local privilege escalation_ vulnerabilities, which is far less worrying than anything remotely exploitable.

The age-old advice of not installing applications you don't trust still applies.

<comment><USER5> > The age-old advice of not installing applications you don't trust still > applies.

That's the one thing that seems to be a legitimate point in this article -- Android phones tend to come with bloatware from manufacturers and carriers, so you don't have the option not to install these applications you shouldn't trust.

<comment><USER6> And very often you can't uninstall them.

</comment></comment></comment><comment><USER7> Just opened the samsung ones. They all seem to be "app by manufacturer can use permissions of another app installed by manufactuer" Android 8. And even then only things like turning wifi on/off. if that's as bad as it gets now I'd say its more like things have come a very long way.

<comment><USER8> So it's yet another case of media writing misleading articles to drive an agenda? The amount of such content these days is getting pretty catastrophic.

<comment><USER9> I don't know that I care if anyone can see the issue today or not. Specifically in this example, one app should not be able to influence the behavior of another app outside of normal channels just because the phone mfg made the app.

Backdoors, exploits, and all manner of existing CVEs exist because of mfg shortcuts, and we should be learning lessons even if the threat model isn't immediately apparent.

<comment><USER7> Except - Android 8. We are already on Android 10.

I'd see an issue if these potential vulnerabilities hadn't apparently already been fixed, but since it looks like they have. Meh, clickbait.

</comment></comment></comment></comment><comment><USER10> I get it when a "security" firm does a FUD article, it is in their interest to sell antiviruses and whatnot, but disappointed to see that this article is coming from wired.

</comment><comment><USER11> News flash: All devices ever released have always came preinstalled with yet- to-be-discovered vulnerabilities.

</comment><comment><USER12> Is there any rhyme or reason to which devices they choose to scan? I see Samsung asus Sony, what about Google or lg?</comment>


Dear Tech, You Suck at Delight - <AUTHOR> https://medium.com/@sara_ann_marie/dear-tech-you-suck-at-delight-86382d101575#.8ih0zkapy <comment><USER2> I just asked Siri "I don't know what to do with my dirty socks"

It responded with "OK. It's no big deal that you don't know"

I'm guessing that the system is seeing if there is something that is an option that it can provide "open app, call something.. etc" if not then just reassuring in this case, that there is nothing wrong (or that the system cannot provide an answer)

The author brought up an important point which is the system needs to be able to handle these outliers (ei: imma shoot myself --> suicide hotline) But only the engineers can tell us how many of these requests are pulled into the system, and how to direct the alerts off. It would be super helpful to be able to tell CHP hey theres a object in the highway on 280N next to Saratoga Ave right from Siri//Google voice. But there needs to be underlying infrastructure for that from both ends.

</comment><comment><USER3> I find this controversy pretty weird. I can't decide how to feel about it or what I think users and companies should do. Here are some of my thoughts.

1\. People never used Siri to report an emergency before Siri existed. Is there something dangerous about dialing a number or using a dedicated emergency app? Should people have the expectation to rely on something so unpredictable (voice-controlled UI) when the technology just isn't there yet?

2\. Is Siri's inability to understand sexual assault a consequence of Puritanism, which also kept (keeps?) nudity out of the App Store? Is it just that sexual assault is something related to sex, and therefore in a category that US corporations often stay away from? (For those outside the US, having any kind of sexual content in your product can lead to backlash in the large, conservative swathes of the country.)

3\. Can problems like this be solved with plugins, like the ones Google is working on? Should it be the user's duty to find those plugins, or should there be a wizard that takes the user through filling in the blocks of functionality that the manufacturer doesn't (or won't) fill?

<comment><USER4> The main problem here is one that's slightly harder to notice.

Siri getting it wrong is to be expected. It's just software. And especially with voice recognition failure should be expected. However there's a glaring absence in those screenshots:

Other than "try again differently", there is no step into feedback loop of _any_ kind presented, whatsoever.

There should be an option to let Apple know that Siri got something horrifically wrong. But no such thing exists. And the reason is quite simply that Apple does not care (enough) to spend the money of building even the tiniest bit of customer interaction chain for that.

</comment></comment><comment><USER5> I recently bought an iPhone, after a five year hiatus. A few months ago at 5:30 a.m., while driving through though the Bay Area, I asked Siri "What city am I in?"

Siri replied, "Calling Ian", and proceeded to call my contact.

I haven't used Siri since.

</comment><comment><USER6> I don't understand why anyone would ask Siri these questions (/statements) in the first place. Surely you just call the police. And if for some reason the police are not an acceptable option for you, what on earth would cause Siri to be your second port of call?

<comment><USER7> Well if you're a hack journalist looking for a big name brand to attach your name to, asking these questions makes perfect sense.</comment></comment>


Mail-Order CRISPR Kits Allow Anyone to Hack DNA - <AUTHOR> https://www.scientificamerican.com/article/mail-order-crispr-kits-allow-absolutely-anyone-to-hack-dna/ <comment><USER2> "Hack" DNA. This kit is nice if you want some hands on molecular biology experience but really boring as far as what you'll do; mix some liquid in tubes and then watch ecoli grow on a plate.

CRISPR is really overhyped, there are a lot of problems with it still. No one will be hacking human embryos in their garage anytime soon.

<comment><USER3> Not with THAT attitude!

</comment></comment><comment><USER4> This could be really useful. In fact my brother could use some extra fingers. I guess I would just have to ladle some of this on his salad and wait for the digits to erupt?

</comment><comment><USER5> My 10y0 daughter wants to get this.

She is busy dreaming up genetic experiments, mostly inserting features of one organism in another, and has a theory that there will be a future movement like the Amish that will have rules as to what technology they will use, and which they will forbid. Of course she thinks CRISPR will be one of the things allowed.

</comment><comment><USER6> How long until people are making bathtub crystal meth with GM yeast?

<comment><USER7> While a talented lab might be able to make yeast produce ephedrine (since Ephedra sp. do that naturally - no idea how complex that is, though, I am not biochemist), I don't think there are any organisms that synthesize methamphetamine directly...

<comment><USER8> Nothing about this idea is unrealistic.

[http://blogs.discovermagazine.com/d-brief/2015/09/15/modifie...](http://blogs.discovermagazine.com/d-brief/2015/09/15/modified- yeast-marijuana/)</comment></comment></comment>


Google+ Topical circles? - <AUTHOR> http://www.gravity7.com/blog/media/2011/08/google-topical-circles.html We have circles for people. Would it make sense to have circles for topics? <comment><USER3> One thing that I currently use Circles for that is related to the original article is book mark managing. If I see something I'm interested in and want to read later (mostly programming stuff) I'll post it to a Circle that has no followers. Pulling the meta info and providing a thumbnail is really handy. And if I think a link would be of particular interest to one of my friends I can easily share it.

<comment><AUTHOR> I would never have thought of that! Now, if you could grab your content circle and drag that into an audience circle... But as convenient as that would for sharing, I suppose it would create a lot of noise!

</comment></comment><comment><USER4> Introducing a feature like this would dilute Google+. As it stands, Google+ is a social network; it's primarily intended as an online place to connect to people you know in real life. This feature would make it more of a broad "discussion center", where you talk about topics with people you don't know. That's a pretty fundamental paradigm shift.

In fact, the only similarity between Google+ and this feature is that both involve groups of people. That's about it. I don't think implementing this would improve Google+ at all; it may be a good idea for another site, and the groups thing _may_ be a good way to go about it, but not Google+.

<comment><AUTHOR> Whether topical circles would enhance or dilute G+ is a matter of opinion of course. You might be right -- I tend to enjoy deep dives more than most.

But I see no reason, either in functional integrity or in social practices, that topical circles would diminish G+. Those not interested would simply not use them -- this is true of FB groups and lists.

It is incredibly difficult to achieve the network density and connectedness required to make a social network stick. Attention is in short supply -- witness Ning's failure to become the social network of interest groups. Perhaps it's not feasible for vertical and niche networks to match the success of the generic social nets. For this reason strikes me as in the ballpark to enable sustained topical conversations where the audience already exists, and where shared topical interests could augment individual profiles and deepen engagement.

</comment></comment><comment><USER5> It would really be great to have "shared circles". It would re-cast the "groups" concept in a social manner. I believe this is the next logical step... only question is when Google+ will be ready for it, and how well implemented it is.

I think the Circles concept that Google is pushing is very powerful and easy to visualize.

<comment><AUTHOR> They're working on it and purchased Fridge to help get there -- as far as I understand.

</comment></comment><comment><USER6> I had a similar concept pop in my noggin after reading this post on G+ from matt cutts: [https://plus.google.com/109412257237874861202/posts/NEif81aW...](https://plus.google.com/109412257237874861202/posts/NEif81aW2FA?hl=en)

Where he's trying to gauge audience interest (good) so that he can adjust his publishing style (I think this is bad).

They should apply the "sparks" concept to the circles -- and do some automagic filtering to the type of content I'd like to see from a particular publisher/user.

</comment><comment><USER7> Sounds like he wants to have something like Google groups in G+. I don't see why this is a bad idea. In fact i'd also like to see by topic recommended follow list made by people.

<comment><USER3> Agreed, but then it starts to sound like you're just participating in a really unstructured forum. I like the thought of public Circles but they really have to nail the implementation.

<comment><AUTHOR> But I wonder if unstructured forum isn't precisely the model for sustained conversations best suited to feed/stream interaction?

My sense is that time-based content consumption (streams) beg for solutions that allow activity to preserve and sustain the good stuff. This is essentially how FB updates work. But in FB there's no navigation back to active posts. Which is where I think G+ could provide a real solution.

<comment><USER8> "Objet petit a"

...in technology it is data loss. History and timeline.

Lack of archiving and activity indicators is haunting every time I post. Will I be able to go back? Some sites are vulnerably unsearchable, deleterious, bankrupt, block, unfree or datalock: same problem. My voice gets lost.

\+ could - <USER2>

Maybe set a +example.

<comment><AUTHOR> Not often you see a Lacanian reference in this industry. It's more than data loss -- or rather, data is as often the product of interaction and a form of communication as it is just data. So preserving interestingness and relevance by sustaining attention, which is easily accomplished by _action_ (not data), is I think possible. Features simply have to be designed to privilege communication over raw information.

</comment></comment></comment></comment></comment><comment><USER9> Screw topical circles: I'd pay cash to use Google's knowledge of people to guide follows. For example, I'd like to be able to follow a bunch of people who talk about mathematics; presumably, Google could pick these people out based on what they've said in posts.

Not interests. Not communities. What the people actually say (as estimated by an algorithm somewhere, naturally).

<comment><AUTHOR> Right. And I think the right features will help to produce the conversations in which people will more likely say the things that the algorithms need ;-)

</comment></comment><comment><USER10> The number 1 feature of G+ I'd like is federation. Something like that would be immensely cool (and for Google, still very profitable) if it would work like email. If I could log in to the network with any vendor I like. Or run my own box that talks to the rest of them.

</comment><comment><USER11> A good point: today only the Sparks in Google+ bring some light to what can be possible: for me the key enabling social network development through topic related information exchange.</comment>


Google and Facebook Team Up to Modernize Old-School Databases - <AUTHOR> http://www.wired.com/wiredenterprise/2014/03/webscalesql/

<comment><USER2> So relational databases are old school, and column stores are all the hip trendy thing, despite throwing away a ton of features?

<comment><USER3> Well, there are three types of databases: Relational, Columnar, and finally massively distributed. They throw away different feature sets in order to handle a certain subset better.

The primary reason Relational databases are so friggin' strong is that they have a solid foundation and maturity. Most new "NoSQL" stuff is immature crap which should never be used in production for any kind of persistent data. But they are being used as such, and I do note that matures the products over time.

<comment><USER2> Tell me about it. I have been hauled into a project, where we are reimplementing a relational database using NoSQL. No idea why, other than the fact that they want to use NoSQL.

</comment></comment></comment><comment><USER4> What is the rationale of putting this work into Mysql? With its sloppy execution and the dark clouds of Oracle hanging over it? Why not Postgres, or even MariaDB instead?

<comment><USER5> Because they are locked in to Mysql and can't easily switch to something better.

<comment><USER6> I'd really like to see the evidence for that. Postres > MySQL, and MySQL doesn't have that many lock-in features last time I looked.

Any Google/FB/Twitter employees here than can elaborate?

<comment><USER7> (I am a manager of the Data-Perf team at FB which deals with lots of different DB technologies)

MySQL (specifically InnoDB) is extremely efficient as a storage backend compared to PostgreSQL.

There are a few features that make InnoDB better in many cases:

1\. Change buffering for IO bound workloads: If you are IO bound, then InnoDB change buffering is a huge, huge win. It basically is able to reduce IO required for secondary index maintenance by a huge amount.

[http://dev.mysql.com/doc/innodb/1.1/en/innodb-performance- ch...](http://dev.mysql.com/doc/innodb/1.1/en/innodb-performance- change_buffering.html)

2\. InnoDB compression: When you are space constrained (say using flash storage), then being able to compress your data is a big win. In our case, it reduces space by around 40% which translates directly to 40% less servers required. While you could do something like run PG on ZFS with compression, for an OLTP workload, you want the compression in the DB so that it can do a lot of work to minimize the compressing and decompressing of data.

[https://dev.mysql.com/doc/refman/5.6/en/innodb- compression-i...](https://dev.mysql.com/doc/refman/5.6/en/innodb-compression- internals.html)

3\. Clustered index: The InnoDB PK is a clustered index. This makes a lot of query patterns (such as range scans of the PK) very cheap. Combined with covering indexes (which PG now has too!), you can really minimize the IO required by properly tuned queries.

There are a variety of smaller things as well, such as InnoDB doing logical writes to the redo log vs. PG doing full page writes, so on very high write systems, the REDO log bytes written will be dramatically less. Also MySQL replication has traditionally been more flexible than PG, but PG has made some great strides recently, so I don't know if I would maintain that position still.

<comment><USER8> Your smaller points don't make much sense to me... PG doesn't have a REDO log, that's just not the way it's architected. If you mean WAL, a patch went out in 9.4 to prevent updates to a page from rewriting more than necessary, so they're not doing full-page writes each time. Clustered index also makes inserts slower--it's again not a straight win for MySQL (and what query patterns other than range scans of the PK does it make cheaper?). Finally, while obviously it's not the same as InnoDB compression, TOAST does a rather good job in practice, and Postgres's indexes are quite efficiently compressed (especially with new changes in 9.4). I can't speak to (1), but it's not at all clear to me that any of these advantages put MySQL ahead in the long term, and certainly not for all workloads.

<comment><USER7> Right, PG calls the REDO log the WAL (for most purposes they are the same thing). I did not know that 9.4 can do partial page writes to the WAL now. Guess I will have more reading to do, thanks for pointing it out! A nice blog post by a colleague recently showing how large writes to redo logs matter is (not about PG, but why it is significant in the context of size of entries):

[http://smalldatum.blogspot.com/2014/03/redo-logs-in- mongodb-...](http://smalldatum.blogspot.com/2014/03/redo-logs-in-mongodb-and- innodb.html)

As far as when clustering a table is useful, see the CLUSTER command in PG. It is roughly the same places you would want to do it, except it is automatically maintained. You do need to realize what is going on to minimize impact on inserts, but in a lot of cases, data in inserted in generally ascending order so it mostly 'free'. This does make GUIDs really bad for PKs in InnoDB.

Clustered indexes are like covering indexes (which PG got recently). You don't quite realize how useful they are until you get access to it ;)

InnoDB compression for us is primarily for non-lob objects, so TOAST is quite a bit different than the cross-row compression that we get. We will normally do compression of large objects outside of the DB whenever possible.

I'm not saying that InnoDB is _always_ better than PG, but in _a lot_ of cases that I have tested it with, it is indeed better. PG has come a long way recently, including options such as covering indexes to close the gap.

</comment></comment></comment></comment></comment></comment><comment><USER9> I don't think "Webscale" is the right word; they should have used "Worldscale". The web part is irrelevant here.

<comment><USER10> Every time I see the word "Webscale" I think of this animation:

[http://www.youtube.com/watch?v=b2F-DItXtZs](http://www.youtube.com/watch?v=b2F-DItXtZs)

<comment><USER11> The name was SPECIFICALLY picked to refer to that animation, it's an inside joke kind of thing.

</comment></comment></comment><comment><USER12> Previous discussion in HN at least here: [https://news.ycombinator.com/item?id=7480843](https://news.ycombinator.com/item?id=7480843)

Project page: [http://webscalesql.org/](http://webscalesql.org/)

</comment><comment><USER13> Currently under what circumstances will we see performance increases, and by how much?

</comment><comment><USER14> Well not just Google / Facebook but Linkedin and Twitter are also in the team.</comment>


They're Made Out of Meat - <AUTHOR> https://www.mit.edu/people/dpolicar/writing/prose/text/thinkingMeat.html <comment><USER2> Background:

[https://en.wikipedia.org/wiki/They%27re_Made_Out_of_Meat](https://en.wikipedia.org/wiki/They%27re_Made_Out_of_Meat)</comment>


Google Play is tracking you – and that's just the tip of a very large iceberg - <AUTHOR> http://www.extremetech.com/mobile/235594-yes-google-play-is-tracking-you-and-thats-just-the-tip-of-a-very-large-iceberg <comment><USER2> Is it just me or are we slowly sliding into a world with no privacy at all? Is someone's urge to improve their service a good enough reason to give up your privacy?

<comment><USER3> Turn off location services. I don't think many people actually need to walk around with GPS active.

<comment><USER2> I know but there are millions of people who don't even care about that and have no idea that they can be tracked with GPS for advertisement purposes. And, of course, no one is talking about privacy (referring to the mainstream media).

<comment><USER3> The more you know.

Like most sheep, they're marching to slaughter and don't care. I have friends who have plain, old dumb cells that can't even text. But they are reaching retirement age and it doesn't matter for them. Persons who take an interest in their environment and safety will find out and take measures to safeguard their privacy, but the others, like sheep, will blithely ignore everything and continue to broadcast every facet of their lives to anyone who will listen. There's no hope for them.

I can't even be bothered explaining it to them any longer.

</comment></comment></comment></comment><comment><USER3> All the more reason to use a custom ROM.

Unless Google Play Services can somehow turn on GPS without it registering as a battery usage item, I doubt they are successful in tracking me.

<comment><USER4> Yeah, I totally agree with you on that one. But don't think they aren't working on other tracking methods, a lot of us never turn on the GPS option and that ain't good for their business.

<comment><USER3> That is their prerogative, though, and I don't begrudge them the opportunity to try. But short of setting up in-store cell systems that cut out those of the individual carriers, I don't see how they'll manage it.

I never use in-store wifi and only turn on data if _I_ need data. I'm always amazed by people who complain about battery life, yet wander around with wifi,data, and bluetooth running 24/7\. :-)</comment></comment></comment>


Big Problems Facing Science - <AUTHOR> http://www.vox.com/2016/7/14/12016710/science-challeges-research-funding-peer-review-process <comment><USER2> "Scientists often learn more from studies that fail. But failed studies can mean career death. So instead, they're incentivized to generate positive results they can publish."

Not in the "hard" sciences: my background is physics, and there are lots of papers on "failed studies", which serve to constrain the domain of applicability of some theory or other. Or, better yet, indicate new science to be found.

The authors note the bias in the survey: "Our survey was not a scientific poll. For one, the respondents disproportionately hailed from the biomedical and social sciences and English-speaking communities."

<comment><USER3> As a physicist, I'm not happy with the trend of new research fields calling themselves science (mainly for benefiting from the hard-earned respect physics [or natural philosophy, as it was called] has gained throughout centuries, which is the real problem [rather than etymology]), and recently introduced concepts to gain some legitimacy, for justification, such as "hard science", "natural science", etc.

[https://en.wikipedia.org/wiki/Hard_and_soft_science#Criticis...](https://en.wikipedia.org/wiki/Hard_and_soft_science#Criticism)

Now the word "science" somehow means "legitimate and respectable research". What's worse, it's not the reality of these fields but a distortion of reality through verbal association, and the word "science" is slowly being dragged into mud due to non-reproducible or downright wrong published results thanks to many such fields of "science".

I should also add that mere "data fitting and data extrapolation" with no basic theory of fundamental understanding isn't science either.

If you're curious about the details, Feynman has defined the issue very well at some point

[http://calteches.library.caltech.edu/51/2/CargoCult.pdf](http://calteches.library.caltech.edu/51/2/CargoCult.pdf)

<comment><USER4> I disagree. I'm glad that science is becoming less associated with the "hard" sciences and is being used more broadly. After all, science is much more than simply the sciences that strictly use the scientific method. The "soft" sciences like psychology are sciences even though their methods are sometimes not easily reproducible. But we shouldn't be resigning outreslves simply because the "soft" science methods are more difficult than the "hard" sciences.

<comment><USER5> That's the definition for science and doing resesrch. This line of reasoning brought us Theranos and [http://www.nature.com/news/over-half-of-psychology- studies-f...](http://www.nature.com/news/over-half-of-psychology-studies-fail- reproducibility-test-1.18248)

So no science as a field should remain well defined in scope and meaning, in the same way crafting shouldn't be blurred with engineering.

<comment><USER4> Right, so long as we can agree that science is not limited to the scientific method. Science should be well defined, but not limited to arbitrary confines.

<comment><USER3> Science _is_ well defined.

Oh, so when science is defined in the way Popper defines it, it is "arbitrary confines", but when it is defined in a way to legitimize cargo cult science, it is "well defined".

<comment><USER4> Arbitrary confines of science is when you limit science to the scientific method. Well-defined science is frankly an insult to science

<comment><USER3> > Science should be well defined, but not limited to arbitrary confines.

> Well-defined science is frankly an insult to science.

Spoken like a true pseudoscientist.

Yes, it should be an insult, right? How dare they can expect a scientist to use scientific method for all their results? I mean, it sounds totally crazy, insulting! And more importantly, how are we gonna publish papers or get grants then?

<comment><USER4> Strawmen for days!

Just answer me this: Do you believe that the science is purely limited to the scientific method?

Just riddle me that and I'll be content. Just keep in mind that you'll be outing yourself as scientifically illiterate.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Science just costs too much, and scientists have paid too much to be considered scientists. The Ph.Ds that I know just want jobs that pay the bills, that pay off their loans. They do research because it is what gives them grants and enables the climb of the hierarchcy, not because they're driven by it. The system has beat out their lust of curiosity and exploration.

The root problem is cost. We have to make science cheaper. We have to put it back in the hands of the curious and adventurous. Science should be possible by anyone - even teenagers. If science can't be done by the young, the poor, the autodidacts, what's the point?

Currently, everyone is on the 'teach everyone programming' kick. U.S. states are now starting to require that everyone learns programming. But, what about science? Let's create the 'github' of science - where anyone with a hypothesis can create a notebook, gather up like-minded people to collaborate, gather data, analyze it, 'fork' others' research into new areas. That's how we will make it cheaper and accessible.

<comment><USER7> No, that is not the problem. The science may be expensive but the main cost is seldomly the researcher him- or herself. Equipment is expensive and always will be, I mean we are speaking about cutting edge science not counting birds in the garden. When I am doing Assays in the lab, its it easily 5 bucks per sample. But then I have 30 to 50 samples. And one Assay is only a small step in a long procedure for a small scientific advance. Similar, when I am doing scientific computation, I often cannot work with the nice and cheap Nvidia 1080 GTX because I am doing science and need reproducibility. Accordingly, ECC is a must and we have to afford a Nvidia Tesla Cluster. Do you really think scientists are not curious or exploring, thats ridiculous. It is just that you cannot make an expedition without funding, and that is not about the money you make, its about the ship you need. (just my two cent as someone whos working on a dataset that is worth 3 or 4 times my yearly income and could easily be 3 or 4 (or 10) times larger)

<comment><USER8> Well put. Modern science is an incredibly high-tech business in so many fields. Whether it's an expedition to Antarctica, building a new radio telescope or even "just" buying an electron microscope - you're gonna have to pay, and you're gonna have to pay _a_ _lot_.

There are still a handful of areas where amateurs could in theory do proper research without spending a few million dollars on lab equipment - ecology for example. But then we get to the problem of necessary knowledge: it take a few years of hard study until you even know the right questions to ask, which ones have already been asked, and how to interpret the results that you get.

In short: there is no short cut to modern science.

</comment></comment></comment><comment><USER8> Yes, yes, yes - these are the things we ought to be talking about! In academia, in government, in society! Great to see these problems summarized here, usually one only sees an article on one of the seven.

It gives me hope that we _have_ started talking about these things - at least in academia (as numerous think-pieces in Nature et al. testify). We need to continue this discussion, make the public aware of it, and then start taking steps to solve it. No, science is not doomed, but boy do we still have a lot of work to do to get it to where it should be...

<comment><USER9> Yeah, what I came here to say. It's been interesting to watch over the past 5-10 years as these problems seemed to gain a voice. Hopefully we'll see several addressed in our lifetimes.

<comment><USER8> My favourite proposed solution for the paywall problem is to launch a platform akin to iTunes - one giant repository of academic articles available to anyone at a low cost. (Kind of like SciHub, except the people who deserve to get some money for their work actually do.)

</comment></comment></comment><comment><USER10> I had hoped to read one of those occasional lists of the hard, outstanding problems scientists still need to solve, in biology, say, or physics. Instead, it's a list of meta "problems" like science funding, or poor study designs.

<comment><USER11> The only problem in science is funding. Everything else is an opportunity.

<comment><USER8> If we had unlimited funding, most of the other problems would indeed take care of themselves. The problem is the "unlimited" part...

<comment><USER11> The problem is not only the level of funding, but they way the funding is distributed. Science could live happily with the current expenditure if the way the funding was distributed was smarter.

</comment></comment></comment></comment><comment><USER12> I think that this trend of decreasing funding for science research will only continue unless some fundamental changes are made to the system.

For one, the government is becoming increasingly weak while corporations are becoming increasingly powerful.

Unlike the government, corporations in general (and their investment strategies) are focused on short term results - That's how executive pay/bonuses are structured - CEOs don't want to invest in something that will only bear fruit in 10 years so that some future CEO will get all the credit for it. Humans are terrible at allocating credit/praise because we like to pretend that the universe is simple and that all actions have simple, predictable effects without unexpected side-effects.

Science research cannot exist in a corporate environment. Science can only rely on government or philanthropy.

</comment><comment><AUTHOR> Daunting as this list seems, of these points and fixes are of course interrelated. Even small tweaking can bring big improvements. Take open science. Improvements to funding are needed to promote long-term projects, but in absence of those kinds of grants, open science is all the more important. Sharing partial results and details of studies that might not make it into publications leaves a baton for others to pick up and make the most of their limited funding time.

And speaking of open science, making research public as it's happening (not even results, just what you're studying) can help prevent redundant concurrent studies in multiple labs and facilitate collaboration, also making the most of the limited funding scientists have.

</comment><comment><USER13> This list is great! Reproducibility and verification of results is key!

Pachyderm (disclaimer: my company) is building infrastructure tools to help data scientists reproduce results by offering "Git for Data."

</comment><comment><USER14> Could the "citizen science" movement help with the paywall problem?

What about legislation requiring that any unclassified government funded science be available outside a paywall? Last I saw a figure for it, the combined budgets of all of the US military bands was ~$270 million a year. I bet a lot of science publication could be "nationalized" for that amount.

<comment><USER8> The EU has put a regulation in place that as of 2020, all published research that funded by it must be open access ([https://techcrunch.com/2016/05/27/eu- mandates-open-access-fo...](https://techcrunch.com/2016/05/27/eu-mandates- open-access-for-all-publicly-funded-research-by-2020/)).

</comment></comment><comment><USER15> 1\. Money. Economical issue.

2\. Poor design. Competence issue.

3\. Replication. Incentive issue.

4\. Peer review. Bad old analog system.

5\. Paywalls. Capitalism.

6\. Poor communication. Competence issue.

7\. Stress. Personal issue.

Nothing gets in the way of science except ourselves.

</comment><comment><USER16> It is an obvious propaganda piece for the benefit of those who profit on the fossil fuel industry.

Psychology and Climate change are in different categories. The crisis of reproducibility in _soft_ sciences has nothing to do with the overwhelming scientific consensus on the reality of global warming.

Many mentioned issues are real in hard science too but it just an example that you can lie with the truth. Perverse incentives, publication bias, imperfection of peer review, etc can't invalidate established results e.g., Newtonian physics continues to work in the domain it is applicable for.

It is infuriating that the planet (planetary habitability) is destroyed for the benefit of the very few.

<comment><USER8> I'm sorry but I really cannot see where you get this bizarre interpretation of the article from. Global warming isn't mentioned _anywhere_ in here! ("Climate change" gets exactly one mention, between two commas, and otherwise plays no role whatsoever.)

I think you really missed the point of the article. Of course the problems the author talks about don't invalidate already established results, the big deal is that they potentially prevent _new_ results from being soundly established (or discarded if necessary)!

<comment><USER16> Are you a global warming denier?

"Climate change" is "fossil fuel"-friendly alternative to avoid saying "Global warming" for what is happening. It is disingenuous to suggests that "Global warming" is unrelated to the article.

The article equates the certainty with which we know results in Psychology and Climate change (the terms are separated by commas as you've noticed). Psychology has a very flimsy foundation: even major results can be debunked (e.g., ego depletion). On the other hand there is no doubt that the climate change (global warming) is happening.

The article can be used as a tool by climate change deniers. They could say: "science have many major issues and therefore climate change is a figment of these communist eggheads imagination."

<comment><USER8> > Are you a global warming denier?

I did not say anything to that effect in my previous comment. In fact, your question is so mindbogglingly groundless I am not even going to bother answering it.

> The article can be used as a tool by climate change deniers. They could say: > "science have many major issues and therefore climate change is a figment of > these communist eggheads imagination."

Of course it can, and nothing is going to stop them. But does that mean we shouldn't be talking about the problems we _are_ facing in science? You aren't going to fix anything if you refuse to talk about it.

This article isn't about climate change any more than it is about climate change deniers. That's another discussion for another time. This article is about _our_ problems in the way _we_ do science. So stick to the point, please.</comment></comment></comment></comment>


Boxer Tattoos Startup Logos on Body for Money - <AUTHOR>

I am BillyTheBillboard an undefeated toughman fighter,kidney donor,and thats right Human Billboard I curretly have 9 permenent tattoo advertisements of differant websites. I am looking to advertise for some more! If you are interested let me know I will give your website a great deal my email adress is firstname.lastname@example.com or firstname.lastname@example.com <comment><USER2> coolest advertising, definitely a step up from the 'I wear your company shirt' girl

he's got pics at: <http://checkoutmyink.com/profile/billythebillboard>

<comment><USER3> i'd say at least 2 or 3 steps up

</comment></comment><comment><USER4> Wow. I can't imagine anyone getting a tattoo of Hostgator on their neck. That's just insane. Your body is the only thing you truly own in this world.</comment>


Russian polar researchers plan to reach Lake Vostok in this season - <AUTHOR> http://english.ruvr.ru/2010/12/24/37701431.html

<comment><USER2> They've been drilling since 1995. More background from a story earlier this year at [http://www.times.spb.ru/index.php?action_id=2&story_id=3...](http://www.times.spb.ru/index.php?action_id=2&story_id=30838)

</comment><comment><USER3> Perhaps it's a sign of the times, but when I read, "Experts assure that there will be no penetration of air from the atmosphere in the relict lake and there is no threat to its ecology," I feel like it's guaranteed that we'll find a way to do exactly that.

</comment><comment><USER4> I do hope their promises of not contaminating the ecology will hold up in those undoubtedly very harsh conditions. Would be a shame to waste all those years of drilling by introducing foreign 'samples' into the mix.

<comment><USER5> Along those lines, is there more detailed information available on this "new technology" that is supposed to prevent contamination? Wikipedia says that the Russian bore hole was filled with freon and aviation fuel to prevent freezing...

</comment></comment><comment><USER6> This is very exciting, and will probably produce some extremophile (bacterial?) lifeforms which have been hidden for ages, and probably live off volcanic heat and gases.

</comment><comment><USER5> Are the Russians getting too impatient for cryobot and hydrobot?

[http://www.nasaimages.org/luna/servlet/detail/NVA2~14~14~250...](http://www.nasaimages.org/luna/servlet/detail/NVA2~14~14~25039~124507:cryobot- hydrobot)</comment>


Ask HN: How to find certain breeds of open source contributor - <AUTHOR>

I maintain an open-source project that's almost entirely supported by people running Linux and OSX. But we've come to need some Windows folks to help port the SDK. How can we find them? <comment><USER2> You could try the MSDN forums: [http://social.msdn.microsoft.com/Forums/en- US/home](http://social.msdn.microsoft.com/Forums/en-US/home)</comment>


One Night in Paris - Air France Behaves Horribly To Passengers - <AUTHOR>

http://jayharishshah.blogspot.in/2013/10/one-night-in-paris.html <comment><USER2> This submission has a few comments: [https://news.ycombinator.com/item?id=6626108](https://news.ycombinator.com/item?id=6626108)

These submissions don't:

[https://news.ycombinator.com/item?id=6632587](https://news.ycombinator.com/item?id=6632587)

[https://news.ycombinator.com/item?id=6632326](https://news.ycombinator.com/item?id=6632326)

[https://news.ycombinator.com/item?id=6629177](https://news.ycombinator.com/item?id=6629177)

[https://news.ycombinator.com/item?id=6628933](https://news.ycombinator.com/item?id=6628933)

[https://news.ycombinator.com/item?id=6628068](https://news.ycombinator.com/item?id=6628068)

[https://news.ycombinator.com/item?id=6632584](https://news.ycombinator.com/item?id=6632584)</comment>


Remarkable images show how learning an instrument boosts brain power - <AUTHOR> http://www.dailymail.co.uk/sciencetech/article-3957092/Music-lessons-pay-Remarkable-images-learning-instrument-boosts-brain-power.html <comment><USER2> Why wouldn't they have a control group? While it would make intuitive sense that musical training changes the brain, brains also change a lot during childhood, even without musical training.

</comment><comment><USER3> I've been thinking about learning the piano so I wonder if these gains occur in adult brains.

<comment><AUTHOR> would be great to know which instruments yield the biggest gains</comment></comment>


Marriott CEO shares post-mortem on last year's hack - <AUTHOR> https://www.zdnet.com/article/marriott-ceo-shares-post-mortem-on-last-years-hack/ <comment><USER3> This is basically a PR piece on how careful they're being and how "seriously" they're treating it.

> Uncovering the full scope of the attack took significant forensic work, the > CEO said. However, despite the RAT's presence on the Starwood IT system, at > that point, there was no evidence that unauthorized parties had accessed > customer data located in Starwood's guest reservation database.

> By the next month, in October, the forensic firm also found Mimikatz [...]. > The tool was most likely used to help hackers acquire passwords for other > Starwood systems and help them move to other parts of the IT network.

> Yet again, investigators didn't find evidence that hackers had accessed > customer data.

> Yet again, there was still no evidence of hackers accessing customer data.

With infrastructure so compromised, and so few protective measures, the default assumption has to be some kind of customer data was accessed. Spin at its worst.

And while I haven't watched the hearing, you'd expect a post-mortem to include maybe how they gained access, and measures to fix it in future. Even if the CEO didn't elaborate, you'd expect a reporter to ask similar questions, and at least point out nothing was said.

<comment><USER4> I also like how there's no mention of revoking the admins' credentials after Guardium detected the anomaly. I would say it's obvious that they changed the password, but then I may be giving them too much credit.

</comment></comment><comment><USER5> > there was no evidence that unauthorized parties had accessed customer data > located in Starwood's guest reservation database.

This has to be one of the most disingenuous phrases one could possibly utter about an event like this. The fact that the attacker left no evidence (or that you failed to identify whatever evidence was left behind) in no way assures people that their data wasn't stolen. It's fallacious and it reeks of negligence and a complete disregard for accountability.

I'm never staying at a Marriott again if I can help it. It's not much, but it's better than nothing... Last year I hosted a corporate event at a Marriott in NY and we paid north of $15k.

<comment><USER6> Did you read the entire article? Once they had confirmed that customer data was stolen, they informed the authorities and the public.

I don't think any company would do that differently.

<comment><USER7> No he/she only wanted to boast about the $15k.

<comment><USER8> It's the same point the current highest comment made:

Even though the system was compromised, they assumed the best case instead of the worst case as would be expected with customer data.

The money seems to be a proof that their impact will be larger than just a person who stays at a hotel twice a year.

<comment><USER6> I don't think that's how to read it. They probably did not assume that at all. But they are not going to go public with any information until they have confirmation.

You're reading a postmortem and not necessary exactly what they were thinking at the time.

</comment></comment></comment></comment></comment><comment><USER9>
      "The Guardium alert was triggered by a query from an
      administrator's account to return the count of rows from a
      table in the database," Sorenson said.

      Such queries are considered dangerous because the software
      that runs on top of a database doesn't usually need to make
      them.

Really?

<comment><USER10> "Dangerous" is probably the wrong word - anomalous is a better one. Most software doesn't need to know, say, how many entries there are in the Users table. It generally is querying for a specific user, or a range of users with some particular property.

It sounds like they had some software watching for any out-of-the-ordinary queries, which they then manually verified with the apparent person who was executing them. When that person had no idea what they were talking about, that's when the red flags went up.

<comment><USER11> Your example with the user table is a little bit 'bad'. Because yes i like to see statistics as an admin on how many user acounts are there :P

<comment><USER12> So you routinely log in as an admin and run sql queries directly on a production DB? That seems quite a bit more "bad" than the example.

<comment><USER13> I do it several times per day. When you are maintaining a piece of garbage application, completely undersized, absurdly opened in term of filtering and extremely badly designed, it's the only way to manage this mess, not to mention the times when I have to fix the DB by hand, replaying, with some manual tweaks, queries normaly executed by the application.

And unfortunately, I don't think that's so uncommon.

<comment><USER14> I don't even think its bad practice.

I was the lone technical hire at a startup I was at a couple of years ago. We ran our app on top of postgres, and I used a native macos postgres client to keep an eye on our database (accessed via an SSH tunnel). The startup is very high-touch with clients - we built personal relationships with our clients.

Unsurprisingly our CEO loved looking at the numbers and the data. We could see conversion, and keep an eye on what our users were up to and how they were using our product. I was the sole engineer and I was only working 3 days a week. I didn't have time to build monitoring dashboards and all that; so instead I spent half an hour teaching our CEO the basics of how to do postgres read queries, and how to pull the results of a query out into CSV and into excel. That was probably the most productive half hour of my time at that startup - it was a huge enabler for him, allowing him to explore the data in arbitrary ways. I showed him how to sort, filter, select specific fields and join tables.

If I had instead built a specialised dashboard, it would have taken me away from our product. And I wouldn't have any idea what queries to display - <USER2> dashboard I made would have been worse for him than just querying the database directly. I'm still convinced that I made the right call.

(We did eventually build a dedicated admin panel, but months later - only when we actually needed it because some common tasks were too difficult through SQL alone).

<comment><USER12> Nothing you describe there requires write/admin access though.

I'm not religious about this. My team automates anything we have to do more than a couple of times, and from time to time we do have to manually alter something in a prod db. Do it often/long enough though and someone _will_ screw something up.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> > The Marriott CEO said again that investigative efforts have yet to uncover > evidence to suggest that hackers gained access to the encryption key used to > encrypt the payment card numbers, meaning that most of the compromised > payment card numbers are still useless to attackers.

So the clearly sophisticated hacker(s) had access to the network for _four years_ yet somehow forgot the private keys to decrypt the millions of records they went through all that effort to steal?

<comment><USER16> I think you are misunderstanding... They got dumps of a couple of databases, which they encrypted, downloaded, and presumably decrypted. Those dumps themselves contained a credit card number that was encrypted by Marriott with a key they don't think the attackers got.

That is my read of it anyway.

</comment></comment><comment><USER17> What I really want to know is why wasn't this discovered as part of the due diligence for the acquisition?

I thought it was normal to run a security audit of whatever systems a business uses prior to the acquisition?

</comment><comment><USER18> It had never occurred to me to define a bunch of select * statements in production that would trigger alerts. Brilliant.

</comment><comment><USER19> Long story short: he's not in prison.</comment>


Douleutaras.gr - <AUTHOR> https://www.douleutaras.gr/ <comment><AUTHOR> Has anybody in Greece tried this out?</comment>