Even when told not to, Windows 10 doesn't stop talking to Microsoft - <AUTHOR> http://arstechnica.co.uk/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/ <comment><USER2> > And finally, some traffic seems quite impenetrable. We configured our test > virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy > and a system-wide proxy) so that we could more easily monitor its traffic, > but Windows 10 seems to make requests to a content delivery network that > bypass the proxy.

Does this mean a Win10 machine setup to use something like Tor will leak the user's actual IP back to Microsoft? If you're VPN'd, is some traffic still leaking outside of the VPN?

From an engineering perspective, how is this happening? Does Microsoft have a second network interface hidden away using hardcoded settings for DNS, etc?

On a somewhat related note, if a Win10 app is cert pinning, is there a way to force it to use your cert so you can MITM it?

<comment><USER3> I've been on Windows 10 for a couple of days now.

VPN traffic doesn't leak if the default route is the VPN interface. I tried it and my firewall went silent apart from the tunnel.

I have absolutely no fucking idea what it is sending out though. It's always talking to something. I've turned everything off that is documented and use a local account and remove-appxpackage'd everything. Sorry but this release is a write off. My host/vm relation is being inverted to Ubuntu as a host this week rather than a guest.

If I don't know what it's doing, how can I trust it?

<comment><USER4> I've been trying to use a software firewall and here's what I've blocked so far...

[https://up1.ca/#JQqL3y0xqLZnxaOlYQ0s6A](https://up1.ca/#JQqL3y0xqLZnxaOlYQ0s6A)

And this is on a machine running Enterprise with privacy settings cranked, and most stuff disabled via group policy.

I'm trying to avoid blocking updates, but svchost is still out there talking to random microsoft servers. The worst part is that I can't differentiate between the servers used for tracking and the ones used for updates. I might have already blocked necessary stuff for updates.

At this point I'm really tempted to just wipe the machine and go back to 7, I've never felt so little trust in a machine I own. Even when I've run malware, at least I knew or could easily find out what was happening. This is just a big unknown to me. I'm seeing claims that it sends idle mic data even with Cortana disabled too, which is making me very paranoid even though the claims look sketchy at best.

<comment><USER5> Here's an image link to your image that actually fucking works: [http://i.imgur.com/i4ydV1a.png](http://i.imgur.com/i4ydV1a.png)

<comment><USER6> Thank you.

 _Javascript is required to view and upload files._

No, it is definitely not.

<comment><USER4> Up1 uses client-side crypto, so in this instance it is. No real point here though, but I use ShareX with it, and it's nice to be able to deliver screenshots and stuff like this privately.

<comment><USER6> What's the point of client-side crypto in a browser? Can't you be served backdoored JavaScript that no longer does proper encryption, and you'd be none the wiser?

<comment><USER7> The service provider isn't able to decode the info because the key is part of the URL that isn't sent to them. This decreases liability (and if nobody visits them, they can't be forced to decrypt it).

<comment><USER5> This protects you from nothing. It actually makes it LESS secure. Because you now have to enable JavaScript.

The service provider can still decode the info by MitM'ing.

If you are using Google Fiber, for example, your service provider can do whatever they want anyway – they control your browser, they are a CA and they are your ISP.

If not: As we've seen with CINNIC, MitM'ing is trivial because CAs give out root certificates far too often, far too easily

<comment><USER7> This is not to protect you, it's to protect the website.

>The service provider can still decode the info by MitM'ing.

Yes, but as I explicitly mentioned, only if you visit the website. If NSA goes to the website and demands the data, they can't do anything with it until I visit, whereas if it was decrypted, they could. This is a non-trivial difference.

>If you are using Google Fiber, for example, your service provider can do whatever they want anyway – they control your browser, they are a CA and they are your ISP.

Google is _not_ going to risk their entire reputation by abusing their CA. Notice how CNNIC was removed from trusted stores and basically lost their business. Mitm by compromising a CA is far from trivial. Also, certificate pinning can mitigate the CA risk almost completely.

<comment><USER5> As you've probably seen with MEGA, this does not protect the site at all.

Take Megaupload (not MEGA), they had unencrypted data, but complied fully with DMCA and operated fully legally.

Take MEGA, they have to comply with DMCA, too, even though everything is encrypted and they never can decrypt the data, either (MEGA does literally the same as up1.ca)

Additionally, Certificate pinning only works if I visited the site before the MitM started. And some carriers like T-Mobile just strip every Certificate Pinning header anyway, as they use proxies to compress data. (Chrome's Turbo mode does the same).

Essentially, the site uses JavaScript for showing images without providing any advantage to either the user or the site.

<comment><USER8> > Essentially, the site uses JavaScript for showing images without providing > any advantage to either the user or the site.

That is a very baseless and false conclusion.

<comment><USER4> Well, admittedly, in the context of a link on Hacker News, it's pretty true. The link containing the seed is trivial to obtain and could easily be reported to the providers who would have to take it down if deemed legally necessary.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Until recently Microsoft had taken a far more reasonable approach to privacy than say Google. Anyone remember the MS "gmail man" ads mocking the way Google inspects your email when MS doesn't? It seems that MS under Nadella has taken a decidedly Google-like turn away from privacy with Windows 10. MS seems as hell-bent as Google and Facebook to collect as much data about you as possible, even if it is for seemingly innocuous purposes.

<comment><USER10> An algorithm reading your email to look for words to server better ads is hardly spying imho. I rather see ads of things that interest me than ads for casinos. And I'm hardly a MS lover.

<comment><USER11> Unless, of course they are looking for the words "male", "escort", "date" in e-mails from a (most likely Republican) Senator, married with kids :-)

Joking aside, you realize what you just have said is naive? Any form of privacy invasion can be - and eventually will be - used for nefarious purposes.

</comment></comment></comment><comment><USER12> In all these discussions about Windows 10 phoning home, there are a couple of things that I haven't yet seen properly discussed.

1\. Do the different versions of Windows (Home/Pro/Enterprise/Education) behave differently? If so, how?

2\. Do the pro/enterprise versions behave differently when they're connected to a domain?

I'd imagine that the answer to at least one of these questions would be "yes." This kind of behaviour would be a deal-breaker in many enterprises.

<comment><USER3> We have an enterprise edition VM in test and it appears to react the same as Pro at least. Haven't tried home.

What is scary is the lack of GPOs to turn this stuff off which you'd expect in an enterprise product. Technically we can't apply policy to make this compliant with our data protection requirements.

Their funeral to be honest.

<comment><USER4> There's actually some GPOs to turn this stuff off. I'm running Enterprise on my desktop... the problem is that many of them don't work or only disable the UI, but still connect out to random Microsoft servers. How the hell does Microsoft think that's acceptable in an "Enterprise" product?

<comment><USER13> This was something I was wondering about. It seems like any company that has proprietary data to protect or privacy laws to comply with (most) don't even have a choice. I personally don't use Windows a lot, but even knowing that information was being sent out by default would be a deal breaker for me.

Can you give some examples of the stuff that does actually have switches?

<comment><USER4> > Can you give some examples of the stuff that does actually have switches?

Yeah, if you disable the Search thing in the start menu for example, it _does_ stop sending your queries to Bing. That switch does work. It just sends a bunch of tracking info instead.

On Enterprise, you can also disable telemetry which does appear to work.

</comment></comment></comment></comment></comment><comment><USER14> Given that it is proven that the NSA spied on European companies for economic reasons, this isn't a good idea. Now the NSA can just tap into Microsoft, either covertly or through court order, and spy on the whole world.

Details of economic spying -- may not be the best article but the easiest to find:

[http://www.hurriyetdailynews.com/nsa-spied-on-french- economy...](http://www.hurriyetdailynews.com/nsa-spied-on-french-economy- ministers-top-companies-reports-.aspx?pageID=238&nID=84733&NewsCatID=351)

<comment><USER15> Embrace, Extend, Eavesdrop.

</comment></comment><comment><USER16> Stupid question, but my Mom lives in a really rural area. Pays quite a bit for internet and is charged by the MB. Can we ask Microsoft to pay for their bandwidth usage?

Since upgrading to Windows 10 she's been hit with $200 in overages.

<comment><USER7> Did she set the connection as "metered"? I know some things stop then.

The $200 is likely from the automatic updates, which were pretty big. How much extra in MB was it?

<comment><USER17> It's likely from the automatic _sharing_ of automatic updates.

</comment></comment></comment><comment><USER18> This highlights what we really lost when consumer operating systems started replacing enterprise-grade operating systems. I would have never imagined this kind of things happening on something like Solaris or Irix, which were the base operating systems of many workstations. At some point when Linux became popular it suggested that the regular consumer would benefit from the robustness, focus, reliability of an entreprise grade OS. Not so..

That large companies accept this state of affair is extremely surprising.

That we accept that our electricity and communication bills are being diverted to serve the interest of an operating system's creator.. that sounds crazy. It's like letting the creator of your fridge eat your food and drive your car.

<comment><USER19> Would you let the creator of your fridge eat some of your food, if they gave you the fridge for free?

<comment><USER20> Maybe, from the stuff in the back that is way past its use-by date.

</comment></comment></comment><comment><USER21> I was downvoted and criticised a few days ago for defending Microsoft on Windows 10. I am starting to change my opinion after looking into the issue more. I watched a recent Richard Stallman talk on youtube and went through the process of making the tightest privacy settings I could on my iPad, Windows 10 laptop, and Android phone. (I left my Mac and Linux laptops as is since I just use those for development.)

I think that Microsoft looked at the Google Now user experience on Android phones and decided to emulate that type of AI assistent in Windows. Google collects all sorts of user context information and Microsoft decided to do the same.

This is a guess but the difference may be that (some) people are willing to have less privacy on their smartphones but care more about privacy on their computers.

<comment><USER22> > I think that Microsoft looked at the Google Now user experience on Android > phones and decided to emulate that type of AI assistent in Windows.

I don't mind that (Cortana).

I do mind that when Cortana and its supporting options are explicitly disabled, Win 10 apparently _still_ won't stop chattering back with HQ constantly. Not only for privacy reasons either; it seems (though I'm not certain of the relationship) to have a substantial, though intermittent rather than constant, impact on performance.

<comment><USER21> I agree.

</comment></comment></comment><comment><USER23> From the image of the captured data that is sent when telemetry is "off", a few bits are obviously Windows-style UTF-16. The GUID is obvious, and is that an assert error message? Very strange...

        prod
        e5ff4669-311a-0933-dee2-9444eee86460

        instrumentation.cpp
        Instrumentation::StartQosExperience
        (Utilities::HashMapContains(_qosUXScenarioDataById, scenerioId) == false)
        Assertfailed: (Utilities::HashMapContains(_qosUXScenarioDataById, scenerioId) == false):
        Instrumentation is active when we try

(it cuts off after "try")

</comment><comment><USER24> I have a really hard time understanding how "enterprises" are going to upgrade to Windows 10.

An operating system that is sending random internal data to random places on the internet seems to violate both a wide selection of national laws related to data privacy, and many corporate policies relating to trade secrets, privacy, internal operations and so on.

Microsoft must have thought of this. What's their plan for continuing to sell to these customers?

</comment><comment><USER25> _Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn 't connected to a Microsoft Account._

Well there you go. If you ever wondered whether this is happening only on the Microsoft Account(tm).

</comment><comment><USER26> It's hard to know without inspecting the exact data involved, but I feel like this is dangerously close to a HIPAA or HITECH breach, and I know of several hospitals who are strongly on the Microsoft bandwagon and are considering Windows 10.

The "send search data to an internet endpoint even if it's patently obvious that the search is for local resources" reeks strongly of Ubuntu's Amazon Shopping Lens. Did Mark Shuttleworth switch gears from Canonical to Microsoft when I wasn't looking?

<comment><USER22> > It's hard to know without inspecting the exact data involved, but I feel > like this is dangerously close to a HIPAA or HITECH breach

Perhaps pedantic, but that's redundant; HITECH doesn't define breaches separately from HIPAA, it establishes standards for when HIPAA data is "unsecured" and reporting requirements, etc., related to HIPAA breaches.

<comment><USER26> I'm aware; my point was that there are HITECH implications as well that would be very hard to address with Windows 10 if my suspicions are correct; it would be hard to meet the breach reporting and notification requirements when the operating system may very well be actively siphoning PII even when supposedly configured to do otherwise. The only safe option is to assume that any patient data that exists on a Windows 10 system is unsecured unless that system is entirely disconnected from any kind of network or until Windows 10 is significantly more transparent about what it's doing behind users' backs.

Of course, this is speculation right now, and perhaps my concerns are unfounded, but I can already imagine some old doctor typing "J. Random Hacker biopsy" into that Start Menu search field in the hopes of finding some document and inadvertently sending the fact that J. Random Hacker had a biopsy to Microsoft and potentially some advertising partners (depending on the nature of such transmissions).

</comment></comment></comment><comment><USER4> Hah, I mentioned this a few days ago. Glad to see someone picked it up and ran it.

[https://news.ycombinator.com/item?id=10037753](https://news.ycombinator.com/item?id=10037753)

</comment><comment><USER27> Wow. I use Linux and BSD on my own machines, but the rest of the family is on Windows 10. This sort of thing makes me seriously think about trying to get the wife and kids to consider switching :/

<comment><USER28> I had the Win10 preview on a spare laptop that I just use for Netflix and Pandora, and was planning on just upgrading it to full 10..... until all this came out. Wiped it and installed Xubuntu.

I did like Windows 10 though, but then they kinda ruined it

</comment></comment><comment><USER29> I am sticking with Windows 7 until I get out of college and after that I am ditching Windows forever.

<comment> rm_-rf_slash God forbid Microsoft give 7 the boot for support like they did XP. Windows 7 is standard for workstations at the college administration where I work, and suggestions to switch to 8 are met with laughter across the board. We have trouble enough with China trying to hack us literally thousands of times per day, and there is no reason to trust Windows 10 to be any more secure.

<comment><USER30> > We have trouble enough with China trying to hack us literally thousands of > times per day

you mean you did "tail -f /var/log/secure".

> God forbid Microsoft give 7 the boot for support like they did XP.

god forbid Microsoft try to deprecate OSs after nearly 13 years. note that in 2001, the newest Linux kernel available was in the 2.4 series, with many people still using 2.2.

<comment><USER31> _god forbid Microsoft try to deprecate OSs after nearly 13 years._

You seem to have invented a decade. Windows 8 RTM was just over 3 years ago.

Also, while I have some sympathy with both the idea that software isn't perfect and the idea that Microsoft need a viable business model, I don't think it's unreasonable to expect a product like Windows 7 to come with essential support for a significant period of time, perhaps based on the expected working lifetime of devices where the software is normally installed.

It's true that we don't know how to make perfect software yet, but it's also still the case that those security and bug fixes are only necessary because the product as originally provided was defective. If you're making as much money from a product as Microsoft do from Windows, and if defects in your product cause harm on the scale that bugs in Windows do, I think it's fair to expect you to make good your mistakes for a reasonable period as well.

It also seems to me that Microsoft could do very well from stating a reasonable period of guaranteed support with the purchase but then offering reasonably-priced ongoing support afterwards so it have a real revenue stream to fund long-term maintenance if it turns out that devices running Windows 7 are in use for a long time. This also conveniently removes the incentive to ship successive products that are seen to be worse than what people had before.

<comment><USER32> _> I don't think it's unreasonable to expect a product like Windows 7 to come with essential support for a significant period of time, perhaps based on the expected working lifetime of devices where the software is normally installed._

Under Microsoft's software lifecycle policy, operating systems are normally supported for 10 years. So, for example, we already know that support for Windows 7 ends in 2020, unless it's extended. [http://windows.microsoft.com/en- GB/windows/lifecycle](http://windows.microsoft.com/en-GB/windows/lifecycle)

The best LTS on Linux is 5 years, and used to be 3 years. The best lifecycle support on OS X is, oh well, pick a number. A small number.

If you bought Windows 7 in 2009 and took a free upgrade to Windows 10 then you're supported until 2025, if your hardware lasts that long. So you'd have got roughly 15 years' use of an operating system for roughly $40. It's obviously terrible value....

<comment><USER31> Just to be clear, I'm not arguing that Microsoft's current support periods are somehow bad. On the contrary, I think they have historically been by far the best in the industry, and that this has been a strong argument in favour of building serious software on Windows.

All I'm saying is that a significant period of support -- longer than the 3 years the posts I was replying to seemed to be suggesting -- is a reasonable expectation for this sort of commercial software, because the developers are supplying an imperfect product in the first place.

In contrast, if the new version of Windows with its compulsory updates removes that ability to keep what you actually bought working as well as it was when you bought it, that is not a good thing, any more than it is when Apple have dumped support for old versions of iOS or OS X well before the end of the useful lifetime of devices they ran on. The position that the software industry wants to keep changing things so everyone else should be forced to keep up whether or not it's actually in their interests is not something I can support.

<comment><USER32> _> The position that the software industry wants to keep changing things so everyone else should be forced to keep up whether or not it's actually in their interests is not something I can support._

Oddly enough, Microsoft already tried that. They ended up with people running 14-year-old code (which cost them money both short term and long term) and a major malware problem.

Check out conficker devastating businesses and costing people a fortune ... almost wholly because they didn't install the patch for it. And these idiots are running supposedly-competent businesses or government departments.

The business branches offer more control over taking updates, but this is a consumer operating system.

<comment><USER31> Again, this is conflating security patches with more general updates.

As a personal anecdote, the only serious malware that has ever hit any system I run, as far as I'm aware, was a zero day exploit. The system was fully patched when it was hit. In contrast, the amount of productive time I have spent over the past few years recovering from problems caused by non-security- related software updates that I didn't particularly want but couldn't avoid if I wanted to keep the security patches is probably measured in weeks by now.

I'm all for keeping systems secure, but when updates start to take priority over keeping systems useful, you have a problem. Most security patches are fairly low risk and have few if any unrelated side effects anyway, but that is certainly not the case with modern software updates more generally. Just look at the frustration of browser users with Mozilla constantly rearranging the UI or Google actively removing functionality from Chrome, or of course the number of users who never moved from Windows XP to Vista or from 7 to 8 because the changes weren't considered improvements.

In the brave new world of Windows 10, the average individual user will be stuck with all the updates, security or otherwise, whether they want them or not. There's really no excuse for that, even in a consumer-focussed OS. Install updates by default, so less technical users get what they probably want? Sure. Block even knowledgeable users from choosing whether to install specific updates? The only time that makes a difference is if Microsoft want to force an update that the user does not want.

<comment><USER32> _> Just look at the frustration of browser users with Mozilla constantly rearranging the UI or Google actively removing functionality from Chrome_

Welcome to the brave new world. (Apple removing functionality as well.)

Windows 10 is moving to a continuous update process that is exactly like Gmail, Facebook and all web apps, and for exactly the same reasons.

At least this avoids the "big bang" updates that left incompetent organizations running buggy, insecure 14-year-old code. (The buggy insecure new code actually does work a lot better ;-)

 _> Block even knowledgeable users from choosing whether to install specific updates?_

How many are of those exist? As far as I can see, the number is between very, very small and zero, and even the best know far less about updates than Microsoft (because Microsoft can see tens of millions of PCs, and it has the source code).

That very small number has a problem because Microsoft is trying to cater to a billion users who don't even pretend to such arcane knowledge.

Otherwise, there's a business branch where you can delay updates for a few months, and one where you can effectively delay them forever.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER33> In the post-Snowden era, USA tech corporations, like Microsoft, felt the downturn on trust from non-USA companies and citizens in their online offerings. With Microsoft betting more and more on their cloud services, I find it strange (or maybe it isn't strange, but let's be naive for a minute here) that Microsoft goes against this and actually gives people _more_ reasons to not trust them than less.

As if they're thinking we all don't give a shit. But if we all didn't, why the downturn in trust in USA tech corporations post-Snowden?

I can't help but think that this is either massively naive from their part (people/companies won't care, they will buy our stuff and services regardless) or very short-sighted (as it will hurt their cloud services offerings in the long run, the more they hammer down the trust from their own users in MS' wares.)

<comment><USER34> Or maybe when nobody trusts you anyway, that ship has sailed? :)

</comment></comment><comment><USER35> I'm not savvy enough to discern whether OSX os iOS does this. Does anyone know if iDevices also ping back to Apple?

<comment><USER36> Little snitch indicates OSX does, but I'm not savvy enough to discern in what capacity or the content

<comment><USER37> As I understand it, Little Snitch is a process-level network firewall that uses a kernel extension to monitor and report all outgoing traffic. I have used it for about a week on a Mac running OS X 10.11, and I'm seeing lots of undocumented traffic from apps and daemons signed by Apple. By undocumented, I mean that the built-in docs in Little Snitch can't explain what the sender is doing.

</comment></comment></comment><comment><USER38> Is Microsoft paying for that traffic?

<comment><USER39> In canada that's a big concern

<comment><USER40> Maybe in Ontario. It's uncapped out east.

<comment><USER39> I don't know about the rest-of-Canada.

I stayed in Ontario (Mississauga) last year for six mo. and I was on Rogers, capped at 80 Gb/month. My alternative was Bell. Same price. Same cap. Week- long activation date.

I was paying what I had been paying for in the US for unlimited data. There were uncapped plans available, but they're pricier. Considering the building was hooked up to fiber (at least Bell suggested it was), getting 80 Gb seemed a bit stingy.

The best way to illustrate how broken our system is to our American friends is to point out that, when I returned to the US, I was thankful to return to Comcast.

Which is like being thankful to getting reinfected with Ebola.

</comment></comment></comment></comment><comment><USER41> Funny, nowadays there seem to be more firewall rules needed for outbound traffic then inbound on Windows. In the old days we had a name for that - spyware.

<comment><USER42> The name today is "cloud" ;)

</comment></comment><comment><USER42> You agreed to the privacy terms, so you are at the mercy of whatsoever Microsoft implemented. Windows 10 even could totally ignore your settings.

 _I say this, not because I think that this is OK, but to reflect, that even the change of the settings do not save you from the harm, that was done from the privacy terms!_

 _Why downvoted? When you disagree, than give arguments, not gutless clicks!_

<comment><USER9> Very few people will read the privacy terms. Just because they have a document people clicked 'agree' below without reading doesn't mean that MS should not be held to account for what Windows 10 is leaking. For many users not using Windows isn't an option.

<comment><USER42> With such an argumentation, you could just trash any terms. As long as they are not against any law, they are valid, as long as they do not contain something that is totally unexpected (for example that you must pay Microsoft additional fees above the normal price).

 _I also think, that Microsoft should be held accountable -- but it starts with those terms!_

I think, many people just rushed into Windows 10, because it was free. But free, seldom means free in deed. A clever trick of Microsoft to trick people into this.

As long the privacy terms are not effectively changed _and_ the OS stops to send coded data to servers, this OS can not be trusted.

<comment><USER43> Terms and conditions as a requirement to use a product you've already purchased shouldn't ever count for anything. So I think you should trash any terms. And I'd hope in a civilized country if a company tries to use mandatory-accept 300 page terms and conditions to abuse their customers a judge would step in and say "no."

And this is absolutely unexpected. That's why there's a very popular post on ars technica and hacker news and reddit with tons of well-informed technical people surprised about it and pretty pissed off.

<comment><USER44> > in a civilized country if a company tries to use mandatory-accept 300 page > terms and conditions

If you don't like 300 pages of ToS then don't buy Windows. It's your free choice. Software should be protected speech. I don't like Windows 10, but then I also think that Microsoft should have the right to write Windows however they like as long as they don't factually lie in their privacy statement and other documents.

> to use a product you've already purchased

The person who sold you Windows should've informed you of the license.

<comment><USER43> > It's your free choice.

No, it isn't. Very few choices in a very capitalist society are actually free, they are free in the sense that choosing to comply or not with a gun to your head is "free". Which is why regulation is necessary. Burying anything significant in a ToS is in our society meaningless, because if it actually had teeth it would be fraud.

</comment></comment></comment></comment></comment></comment><comment><USER45> Windows 10 reminds me of a saying an old co-worker of mine used a lot, ___" Vendors lie... packets don't."_ __

</comment><comment><USER46> Of course this is true. Companies make money by spying on their customers. Did we really imagine that flipping the "Stop making money" preference was going to work?

<comment><USER47> well...yes. I fully expect when I opt out of something, anything, that it isn't still doing what I just thought I opted out of.

that's probably my fault for being so naive.

</comment></comment><comment><USER48> Maybe I'm just jaded, but does that really surprise anyone? Most "developments" at MS have been nothing but successive layers of lipstick-on-a- pig. No amount of lipstick can make the pig underneath go away.

<comment><USER31> It doesn't _surprise_ me. Moves in this direction were likely as soon as Nadella was chosen to be the new CEO and all but certain as soon as they announced the free upgrade push for Windows 10.

It does disappoint me, though. Microsoft was one of the few major players in IT that could realistically have offered an antidote to the always-online, spy-on-everything, everything-is-a-service, subscribe-not-buy, force-updates- you-don't-want madness of recent years. Instead, they seem to be throwing good money after bad in what I'm already expecting to be a repeat of Vista/8 level failure. They have about as much chance of actually out-Googling Google as Mozilla do with Firefox, yet like Mozilla they persist in trying and in doing so alienating the substantial user base who valued their products precisely because they weren't like that.

<comment> at-fates-hands >> Microsoft was one of the few major players in IT that could realistically have offered an antidote to the always-online, spy-on-everything, everything- is-a-service, subscribe-not-buy, force-updates-you-don't-want madness of recent years.

I felt the same way after they came out and said they really believe in protecting data and people's privacy. This is the exact _opposite_ of all the big talk over the past few years. Disappointing for sure.

I tried upgrading to Win 10 this past weekend and it was a disaster. My 3 year old video card wasn't supported (no dual monitors) and then after I reverted back to 7, it killed all my network adapters so I couldn't connect to the internet. I had to nuke my entire OS and start fresh. I'm not upgrading anytime soon.

Here's some of those articles:

[http://blogs.microsoft.com/blog/2013/12/04/protecting- custom...](http://blogs.microsoft.com/blog/2013/12/04/protecting-customer- data-from-government-snooping/)

[http://blogs.microsoft.com/on-the- issues/2014/07/01/advancin...](http://blogs.microsoft.com/on-the- issues/2014/07/01/advancing-our-encryption-and-transparency-efforts/)

[http://www.washingtonpost.com/business/technology/microsoft-...](http://www.washingtonpost.com/business/technology/microsoft- suspecting-nsa-spying-to-ramp-up-efforts-to-encrypt-its-internet- traffic/2013/11/26/44236b48-56a9-11e3-8304-caf30787c0a9_story.html)

<comment><USER22> > I felt the same way after they came out and said they really believe in > protecting data and people's privacy. This is the exact opposite of all the > big talk over the past few years. Disappointing for sure.

But, that's pretty much a well-established pattern (Microsoft has done it with lots of things before, but so has Apple and lots of other companies, its not particular to Microsoft) -- if someone realizes an opportunity you didn't, you attack them for it and try to get the market to see the product as unnecessary or even abusive, right up until you are ready to push something that exploits the same opportunity.

</comment></comment></comment></comment><comment><USER20> I got a refurbished HP Stream 11 for $120 (Groupon) and spent 3 hours upgrading to Windows 10. I then installed Chrome and LibreOffice. It works fine, but, with all these privacy invasions, I see no reason to use it. My Acer C720 Chromebook (upgraded to a 128GB SSD) with Crouton and Ubuntu 14.04 is much more useful to me.

<comment><USER49> This is totally off topic, but, if you don't mind sharing, what SSD did you get? I have the same Chromebook running Arch, but it has been idling since I got something else. I really want to upgrade it and start using it again.</comment></comment>


Ask HN: Do programmers generally lack of math skills? - <AUTHOR> Almost everyday I see and meet a lot of programmers (even good ones) that lack of math skills, but they've good career and perform well. How accurate is this hope you guys will answer here? <comment><USER2> You are correct, and this is unfortunate. "Any fool can write a loop," but sometimes it takes some basic math knowledge to realize that you don't need a loop. Or, for example, that you can iterate through a sequence of squares simply by growing the sum of the odd numbers (which, I think, could be a sensible interview question).

</comment><comment><USER3> I am a fairly decent programmer with a good career but I'm not all that great at math. Not for the lack of interest, although tbh my interest in math developed after completing my formal education.

As for other programmers I know and have worked with I believe most of the good ones also had a good grasp of mathematics but there were also few like me.

So from personal experience I won't draw any relationship between math skills and programming.

<comment><AUTHOR> Do you think if you'd have better math skills you'd be even better programmer?

</comment></comment><comment><USER4> I've never used math beyond basic arithmetic in nearly 30 years as a programmer. Went through three semesters of calculus, also linear algebra and statistics in college but have never used any of it professionally. Honestly at this point I could not do any of it without spending some substantial time on review.

</comment><comment><USER5> What would you define as a lack of math skills? Programming is math so every programmer use math, some well, most not so. Some use applied math in their day by day work, most of us don't. But I bet that compared to the overall society, programmers knowledge in math are far above average.</comment>


Randi Zuckerberg Runs in the Wrong Direction on Pseudonymity Online - <AUTHOR> https://www.eff.org/deeplinks/2011/08/randi-zuckerberg-runs-wrong-direction-pseudonymity <comment><USER3> In these sort of arguments I don't really understand why _civility in and of itself_ is valued. It only makes sense in a social situation that affords civility. For that you can make "giving up anonymity" _opt-in_ , rather than _opt-out_ (which is mostly what is being done a lot, from forums that force you to use FB accounts to tor users in various countries who have no easy way to opt-out of foregoing anonymity).

It is rather silly to quote civility when the alternative, the lack of anonymity, has terrible "real-world" consequences, as mentioned in the article.

 _the argument willfully ignores the many voices that are silenced in the name of shutting up trolls: activists living under authoritarian regimes, whistleblowers, victims of violence, abuse, and harassment, and anyone with an unpopular or dissenting point of view that can legitimately expect to be imprisoned, beat-up, or harassed for speaking out._

Can someone explain the rationale of placing civility ahead of the above consequences?

<comment><USER4> The argument is that online anonymity itself also creates real-world consequences, such as character assassinations, harassment, and downright internet crime.

If "Civility" means "being nice to each other", why shouldn't we value it, in and of itself?

<comment><USER5> >online anonymity itself also creates real-world consequences, such as character assassinations, harassment, and downright internet crime.

anonymity itself doesn't create crime or harassment. Like in the real life, it only makes it easier to perpetrate one. With this being said, why wouldn't we all wear GPS and RFID enabled collars at all times with our name, identification number and scan barcode being promptly visible on the collar?

Nice device, goes well with Guchi pants:

[http://www.extremtrac.com/e/products/personal%20tracking%20s...](http://www.extremtrac.com/e/products/personal%20tracking%20system/p18.html)

<comment><USER6> > why wouldn't we all wear GPS and RFID enabled collars at all times with our > name, identification number and scan barcode being promptly visible on the > collar

Like a smart phone?

<comment><USER7> A smart phone is not needed.

FBI can turn on a phone's microphone: <http://news.cnet.com/2100-1029_3-6140191.html>

A German politician got a telecom company to hand over phone location data: <http://blogs.dw-world.de/spectrum/?p=907>

Pretty animation of phone tracking: <http://www.zeit.de/datenschutz/malte- spitz-data-retention>

</comment></comment></comment></comment></comment><comment><USER8> I have released many pieces of software which could've brought a shitstorm down on me, legally and otherwise. I've decided in every case to do so under my real name, as I felt that I was in the right and if others disagreed, the downside for me was low (I have no house to lose, no family to support, etc). Others in the same exact position would've chosen to release these things under a pseudonym, as they had more on the line; this is a reasonable choice, and one that should be respected. In an environment where everything has to be tied to your name, you don't just crush malicious actions, you crush anything controversial. That's not alright.

</comment><comment><USER9> If you are not offended in five minutes after leaving your doorstep, then you dont live in a free country.

Facebook being the Identity provider of the net is a scary thought. As does anyone that big.

</comment><comment><USER5> >People behave a lot better when they have their real names down.

right from the KGB and Stasi manuals.

<comment><USER10> Yep. Replace the word "civility" with "harmony", and you have the official position of the Chinese government as well, almost word-for-word.

</comment></comment><comment><USER11> Relevant TED Talk:

Christopher "moot" Poole: The case for anonymity online

[http://www.ted.com/talks/christopher_m00t_poole_the_case_for...](http://www.ted.com/talks/christopher_m00t_poole_the_case_for_anonymity_online.html)

<comment><USER12> I enjoyed that. To be honest though, he does not make a very strong case for anonymity. That is not to say that there is not a strong case for anonymity, but anecdotes like "they saved a cat" and "they protested scientology" are not it. I think people have organized protests on Facebook before.

<comment><USER11> I agree, it wasn't very in-depth.

More relevant quotes from 'moot' here:

[http://venturebeat.com/2011/03/13/4chan-moot-christopher- poo...](http://venturebeat.com/2011/03/13/4chan-moot-christopher-poole-sxsw/)

</comment></comment></comment><comment><USER13> Who the fuck cares about Randi Zuckerberg. Without Mark would we give a shit what she says?

<comment><USER14> Her views are relevant because of her position (until yesterday) in Facebook, her surname is just a nice addition to attract more readers, not the reason for the story.

</comment></comment><comment><USER15> _I think anonymity on the Internet has to go away. People behave a lot better when they have their real names down. … I think people hide behind anonymity and they feel like they can say whatever they want behind closed doors._

That's nice that you feel that way. Why do I need to care, though? I _can_ say whatever I want behind closed doors.

</comment><comment><USER16> I was talking about something similar earlier today with a friend from high school. We were talking about how it was totally un-cool to disagree with the "consensus" about which girls were hot and which were not. We were imagining what it might have been like if we'd felt able to speak our minds.

I'm not a huge believer in the whole "social media toppled authoritarian regimes" stories that have been going around after Tunisia/Egypt but I do think that to the extent real anonymity is possible it has the potential to help people living in places where dissent is both stigmatised and punished by allowing them to realise that others feel the same way.

This Steven Pinker talk <http://www.youtube.com/watch?v=3-son3EJTrU> (I think; I don't have Flash so can't check it's the right one) talks about why this type of communication is essential to free societies and why freedom of assembly is protected in all free societies.

On the same general topic researchers in public health give people some wiggle room on truth telling by introducing random noise into their responses in order to improve the aggregate quality of information you get from asking them questions about controversial topics (drug use, sexuality): <http://en.wikipedia.org/wiki/Randomized_response>

tl;dr: anything that helps people tell the truth rather than timidly conforming to social norms is a good thing

</comment><comment><USER17> Randi is right. Only scumbags like Ben Franklin are sleazy enough to use pseudonyms. <http://www.pbs.org/benfranklin/l3_wit_name.html>

</comment><comment><USER18> TL;DR Your right to privacy interferes with my revenue stream.

</comment><comment><USER19> In my past life I've worked on the Google Maps identity story when Google Hotpot launched (allowing you to set a maps nickname, while still having friends on Google Maps). I feel that identity on the web is a harder problem than most people realize.

My personal opinion is that you have to strike the right balance between

\+ establishing trust in the production of content (you want other people to trust what you post, build an identity). Producing anonymous/pseudonymous content is fine, but how can I, as a consumer of that content (reader of reviews) can make sure I can trust it?

\+ offerring users the protection they want from entities bothered by the content you produce. This can range from the extreme cases of freedom of speech, minorities, sensitive issues (medical, sexual orientation) to the more trivial examples of bad reviews for restaurants where the owners might track you down.

\+ incentivizing the production of high quality content and discussions (see the quality of YouTube comments for a case of user generated content gone wrong :-) ).

\+ making it easy for users to deal with this identity complexity. Understanding that even though you are logged in with your GMail account you are posting as a Nickname, understanding what others can or cannot infer about you.

It's a complicated problem full of tradeoffs any way you want to go. \+ Go with real-name all the time and you upset the people that are not comfortable exposing their real name. \+ Go with pseudonymity and you lose the benefits brought by having an identity on the web. \+ Go with a compromise and you have to deal with complicated user experience problems.

</comment><comment><AUTHOR> I would hate to see a tradition in political discourse older than the US be given up for advertising dollars. How would a modern version of the Federalist Papers work with no pseudonyms?

</comment><comment><USER20> Having the ability to speak anonymously allows for people to speak their true mind and show their true personality rather than hiding behind the fear of lash back.

<comment><USER21> One word. /b/.

<comment><USER22> I've met some of my best (online) buddies on /b/ or in /b/-related activities (though I don't go there anymore).

Yes, it's a raging shithole of trolls, mouth-frothing idiots and general retardation, but there're probably just as many decent people there. They're just not as vocal. This applies to many places, by the way, not just /b/.

Also, generally speaking, /b/ is the worst kind of example that you can probably think of. This makes for an interesting argument though: it can hardly get worse than /b/ - it's the absolute superlative of anonymity induced uncivility.

</comment></comment></comment><comment><USER23> Computer security is and will continue to be so imperfect that it will remain extremely difficult for anyone to mandate real identity use on the broader internet. All the anti-censorship tools would work just as well against western governments and websites as they do against the middle east and asia. Wifi is ubiquitous and very hard to manage. People's identities are trivial to steal and would be a cinch to use if no money was changing hands. Hacking the client, password reuse, selling dead accounts, proxies and vpns from locations that don't require name use, off shore hosting.

Sure, many people wouldn't bother and just adapt. But clearly groups like Anon, 4chan, most of irc, #antisec and numerous others would avoid it all and go elsewhere. It's often repeated that the kids will hang around until something new is cooler. I imagine AnonymouSabu could do a pretty good job of jump starting a new social network all by himself if he got banned from twitter. Even if you have nothing to hide you'd probably head there if your friends are there.

Second is how practical PKI with identity management is on a nation scale. To make a serious run at 100% real identity all the time you probably need to go full public/private key, smartcard+pin, IP packet tagging for egress outside the nation's great firewall and so on. With less than all that it'd simply be too easy to avoid.The problem is, PKI with identity management is a really hard problem to do well. One of the largest PKI deployments in the world is the DOD. They wrangled for years on deployment, already have strict security protocols and a managed environment. None the less they had to shut the entire system down not that long ago and revalidate every identity because they had so many bad cards in active use.

Sure, the government probably isn't the best at that, hence why the Obama ID plan looks to open standards and a federated group of ID providers - presumably firms like Google, Facebook, Bank of America, Verisign and Verizon. The problem is that many of these firms are ill equipped to manage something you depend on for all aspects of your life, day in day out. I've edited out a bunch of specific examples, but suffice to say few or none of them have all the pieces needed to manage such an important, hands on and support reliant business.

On paper it all seems achievable, but in practice it seems highly unlikely to me that you'll see universal required ID. Facebook would like to see it for any number of business reasons, but when it comes down to it it probably matters little what they think.

All that because somebody related to someone who figured out how to help college students hook up thinks people might be a bit nicer in blog comments? Yah right.

</comment><comment><USER24> A while back i decided to forego my pseudoname in order to look more professional.

This has led to many problems: for one, conflicts. It seems every other month people mistake me for someone else with the same name. Either that or yet another person "mistakenly" uses my gmail address to sign up for a web service.

My last name is also difficult for some people to pronounce. With a pseudoname, this was not an issue. Not to mention my pseudoname was pretty easy to remember... people even still use it!

Really as far as i know, my lack of a pseudoname has not made me appear any more professional than before, so i'm finding it hard to find a good reason why i should even use my real name on the internet. In fact pseudonymity is a great tool to segregate online identities in this age where people will write and store prejudicial information about you for extremely long periods of time (forever if it gets to archive.org).

</comment><comment><USER25> I wonder how this relates to exponential growth in "Persona Management Software". I heard for some companies having thousands of Facebook accounts under control. And apparently they are "real" and non-anonymous as it gets.

My question is: how are they going to distinguish puppets from real people?

<comment><USER26> > My question is: how are they going to distinguish puppets from real people?

As long as it benefits their bottom line, I'd say: never.

If you follow the money, it rarely fails... especially when we're talking about the amoral concepts that corporations are designed to be.

</comment></comment><comment><USER27> Facebook is (so far) arguably the most successful example of "permission marketing," a concept in which the marketer learns about the mark, in order to more effectively sell them some crap they don't need (and perhaps something they do need, just to be fair.)

Of course, anonymity is a powerful defense against this type of marketing, particularly when it isn't particularly "permissive" in the first place. Facebook's repeatedly sneaky approach to eliminating privacy is part and parcel of that effort.

So naturally, "permission marketers" think everyone should be identified as it helps them make more money. That's really what it's about: the bottom line.

<comment><USER28> I think the by far more massive example are the custom coupons at the grocery. People who complain about cookies or Facebook have no problem swiping their affinity card at the grocery. That affinity program knows more about them than Facebook does, and much more money is involved.

</comment></comment><comment><USER29> In real life people use their real names ... doesn't stop idiots being idiots.

</comment><comment><USER30> The 'Greater Internet Fuckwad Theory' is a hypothesis at best. One that has been refuted by empirical evidence of pro-social behavior under anonymity many times.

For all practical purposes, it's not even a well-formulated hypothesis, and most people (even journalists) never bother to look at any of the findings, it's just a popular meme.

</comment><comment><USER31> That quote makes me feel like she(he?) didn't really understand what they were saying. It looks almost identical to a word jumble. I know it was a free form panel, but jeez, you are the marketing director of Facebook, you should be a better communicator than that.

</comment><comment><USER13> Once you start letting people use pseudonyms, then what? Are we going to start letting dogs use pseudonyms too? Where does it stop?

</comment><comment><USER32> Yuck. This argument is consistently framed as a false dichotomy: either get rid of pseudonyms or keep them.

Why not both? Some places, like Google+, might be nom-de-plum-free. Some, like reddit, might not. Why make it one way or the other?

I can easily foresee an internet that has parts that are "real person only" and parts that are the wild west. For that matter, some parts, like banking access, might be even more locked down. I don't think we have to make some massive decision for all of it. Let it evolve and bifurcate as it needs to.

<comment><USER33> The problem occurs when one of these real name zones becomes a monopoly.

</comment></comment><comment><USER34> Authoritatively do not go there with Nym.

</comment><comment><USER35> nonsense. some of things that post comments or use Internet don't have real identity.

</comment><comment><USER36> The argument for political dissidents in nonfree countries is valid but old (in many cases the regimes will catch the dissidents regardless). The value of pseudo-identity is not just anonymity, but the ability to have multiple identities. We shouldn't be forced to use one identity for the various areas of the internet, just like the comments and actions i make on HN are totally unrelated to my facebook community or my twitter community. Single-identity is a vehicle for tracking people, and i can only think of evil reasons to track people across communities. Even in real life, we dont carry our real identities around, you don't tell your full name to the cashier in the supermarket or to people in the street. If you get into a fight, you don't start by exchanging phone numbers.

In fact, offline real identity is less dangerous: unless you kill their mother, people you don't interact with will forget you in a matter of months. The internet is permanent.

But why am i wasting my time, facebook people think like infants anyway.

<comment><USER37> Your comment re: multiple identities is exactly right. I don't understand why people seem so surprised to hear this sentiment coming from her, though - <USER2> is already on record on that topic:

"Having two identities for yourself is an example of a lack of integrity."

Facebook's policy from the top down seems to be that you are only ever entitled to one identity - period. If you were foolish enough to be born into an environment where expressing yourself solely through that one identity can get you in to trouble and/or killed, that's your own fault.

</comment></comment><comment><USER38> Coincidence?

"Randi Zuckerberg to leave Facebook..."

[http://news.cnet.com/8301-1023_3-20087785-93/randi- zuckerber...](http://news.cnet.com/8301-1023_3-20087785-93/randi-zuckerberg- to-leave-facebook-to-start-social-media-firm/)

I think someone likely said, "enough is enough" and forced her out.

</comment><comment><USER39> i think anonymous should take this as a challenge, and hunt down everything negative there is to know about her online.

I'm sure if they look hard enough they can dig up plenty of dirt on her.

But even if they do, it wont' be all of it, since noone is that stupid as to use their real name online. If she has even a single account online that uses a pseudonym or a username she is a hypocrite

<comment><USER40> Let's definitely harass people who express viewpoints we don't agree with.</comment></comment>


A serverless email server on AWS using S3 and SES - <AUTHOR> https://github.com/0x4447/0x4447_product_s3_email <comment><USER2> > This stack was created out of frustration due to the fact that to this day > there's no easy way to have a full email server without the overhead of > installing and configuring all servers needed to handle incoming and > outgoing messages.

Interesting approach, though I solved this frustration by the use of a Docker and kept "my data is mine" \+ "no vendor lock-in" \+ "I control all the gears" approach. (Though, it's not perfect since VPS is ran by "someone" else.. but that place where you run this stack can be easily changed at your convenience). Simple docker-compose.yml with 3 images and voila.

This AWS S3 SES setup looks far more complex than what I did using only 3 docker images: the postfix (for smtp), dovecot (for imap), opendkim (for email sigining & verification). It's really easy to fire-up a VPS with a single click nowadays.

If someone is interested in the images I am using:

\- [https://git.nixaid.com/arno/postfix](https://git.nixaid.com/arno/postfix)

\- [https://git.nixaid.com/arno/dovecot](https://git.nixaid.com/arno/dovecot)

\- [https://git.nixaid.com/arno/opendkim](https://git.nixaid.com/arno/opendkim)

Then you just feed the images with the right configs (main.cf, master.cf, .., dovecot.conf, opendkim.conf).

It's also possible to template the configs and make the variable-based configs. Make things scale friendly. I am also using Terraform to automate the server deployment/DNS record updates so it is easy to get from 0 to 100.

The only drawback is that you are the one to maintain the OS/SW upgrades, security, etc.. but that's something I really want to do by myself instead of relying on someone else :-)

<comment><USER3> Another drawback is that while yes, you can scale up fairly easily with terraform, your server can also fall over if you get a heavy burst of traffic, and you'll return errors until you're able to provision more machines. Depending on what you're doing, how fast you're growing, and how much tolerance your users have for downtime, that might be a pretty big deal.

<comment><USER4> You can set up autoscaling groups via terraform just fine, with a little bit of care taken to ensure that you trigger on the right metrics.

If anything mail is pretty much the easiest thing you can possibly pick to scale, because the inbound mail will be automatically retried. And haproxy in front of SMTP servers works just fine (really, any load balancer that can load balance raw TCP connections, but I've used haproxy to load balance thousands of messages a second).

For your user-facing side you need a bit more resiliency, but nothing stops you from using a service like SES to back a traditional setup for sending either. Reliably scaling outbound mail is the easy bit - the hard part is the reputation management that managed mail services provides, and no specific deployment mechanism will solve that.

<comment><USER3> Sure, but for heavy/bursty traffic, you can still have downtime while new VMs spin up. Retries might save you or they might make the problem worse, depending on the size and pattern of the burst and how your auto-scaling config interacts with the retry config of various hosts.

It may seem like a nitpick or something not worth worrying about, and for most that's probably the case. But for some businesses it could be a crucial difference. My point is simply that this is a legitimate benefit of serverless that wasn't mentioned above--I didn't think that would be a controversial point.

<comment><USER4> That is no different for serverless. You don't magically escape startup times - you need to carefully ensure that cold startup times are low enough, or that you maintain excess capacity to compensate.

The precise extent is different between different platforms depending on overheads, but that just means the point at which you need to trigger scaling is different.

You can find lots of descriptions of approaches people have taken to keep serverless instances running to avoid the cold start delays to work around this... For autoscaling groups you'd instead configure the alarm points used to trigger the scaling accordingly.

Serverless platforms tends to assume the startup will be fast enough to keep the connection open rather than return an error, but that is a load balancer config issue - you can set up retries and wait for other platforms too if it makes sense.

(Though for email this really does not matter - retries for all commonly used mail servers follow some form of exponential backoff up to many hours at least; retries works just fine in practice)

<comment><USER5> > That is no different for serverless. You don't magically escape startup > times - you need to carefully ensure that cold startup times are low enough, > or that you maintain excess capacity to compensate.

Serverless deployments are just another ladder step up the abstraction level, continuing the tradition that hardware doesn't matter. Similar to code compiled into assembly or a garbage collector managing memory. In the common cases, these cases are harmless (otherwise they wouldn't be popular), but they generally hide what's actually happening. Doing a garbage collection on a 200MB app is generally pretty snappy. But doing one on a 32GB server app can take seconds or minutes.

Abstractions like these are fine, as long as the limits of the abstraction are well understood. Sadly, that is rarely the case.

</comment></comment></comment></comment></comment></comment><comment><USER6> Just a friendly reminder, since I've worked with SES in the past: Don't forget about bounces when using SES [0].

From [0]:

> If your bounce rate is 5% or greater, we'll place your account under review.

To sum it up, try to keep track of bounced e-mails by using the SES notifications [1].

[0] [https://docs.aws.amazon.com/ses/latest/DeveloperGuide/e-faq....](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/e-faq.html#e-faq- bn)

[1] [https://docs.aws.amazon.com/ses/latest/DeveloperGuide/monito...](https://docs.aws.amazon.com/ses/latest/DeveloperGuide/monitor- sending-using-notifications.html)

<comment><USER7> We accidentally had ses credentials set up on our QA server and quickly got banned for sending too many email@example.com emails. Took quite some time to get it unbanned. Since then we switched to Mailgun for email delivery but ses is still useful for processing incoming email via Lambda

<comment><USER8> We are careful to use throwaway email addresses like _randomusername_ @mailinator.com on our dev and staging servers so they still get delivered, but we can just forget about them.

Really interested to learn about the SES simulator address though (posted as a reply on this thread) - don't know how we missed that, and it would have really helped with early testing when we were developing the email queueing system on our app.

<comment><USER9> We configure all our test addresses to firstname.lastname@example.com (or whatever the simulator address actually is) so we don't spam or get banned by inadvertance

</comment></comment></comment></comment><comment><USER10> I don't know anything about serverless --- to this day I fail to understand what this word is even supposed to mean. And the deployment diagram[1] sure looks complicated to me. I think I prefer old-school servers.

[1]: <[https://raw.githubusercontent.com/0x4447/0x4447-product-s3-e...](https://raw.githubusercontent.com/0x4447/0x4447-product-s3-email/assets/diagram.png>)

<comment><USER11> The benefits to using this approach over a traditional server are:

1\. Someone else maintains the software running these services, including OS upgrades, security upgrades and patches, uptime monitoring, etc.

2\. Since every logical component is an independent service, each scaling independently, any one single component is unlikely to become a bottle-neck while scaling. In traditional monolithic servers, you'll have to have contingency plans if you beat storage/network/CPU/RAM limits

3\. The closest thing to this is to break up a monolithic email server into microservices and deploy them as independently scalable containers, which is a considerable engineering effort.

Assuming this works as advertised, you can go from zero to a full blown email service for organizations with thousands of people (assuming the stated AWS limits are lifted), in record time

<comment><USER12> > 1\. Someone else maintains the software running these services, including OS > upgrades, security upgrades and patches, uptime monitoring, etc.

This is the standard marketing phrase echoed to promote serverless. By experience, I don't think is valid. Packages like unattended-upgrades automates all this stuff.

Also, not being able to verify what the software is doing is scary and looks like a 10 steps backwards to me.

> 2\. Since every logical component is an independent service, each scaling > independently, any one single component is unlikely to become a bottle-neck > while scaling. In traditional monolithic servers, you'll have to have > contingency plans if you beat storage/network/CPU/RAM limits

Except when it comes with a bottle-neck by default. Running mail servers requires rather little resource.

> 3\. The closest thing to this is to break up a monolithic email server into > microservices and deploy them as independently scalable containers, which is > a considerable engineering effort.

Why in earth? Have you seen the postfix architecture?

> Assuming this works as advertised, you can go from zero to a full blown > email service for organizations with thousands of people (assuming the > stated AWS limits are lifted), in record time.

I'm pretty sure one can have a up and running mail server while the "cloudformation" thingy will still be running :)

<comment><USER13> The long and short of it is that "serverless" is all done on a pay-per-use basis. So is running a VM to host an email server — let's say $5/month on the low end. With this setup you'd be paying pennies a month assuming normal personal usage. If you were running an email server for your Fortune 500 company, yeah this wouldn't make sense. But for personal usage? Assuming SES isn't on the shit list of Google et al this is fire-and-forget, and dirt cheap.

<comment><USER14> This use case and logic seems really weird to sell the serverless buzzword. My personal email has been somebody else's problem since the 90s and is done through the provider of my personal domain at no additional cost.

Setting up a serverless email server seems like something I'd have to bother with and maintain a few years down the line when the platform of choice inevitably changes something. Some use cases of serverless applications just shift maintenance efforts. Sure, I don't have to update OS packages. I still have to wonder if the service I'm using for my serverless stuff will be there (for startup vendors) in a few years or, more likely for vendors like AWS, change their terms, pricing or aspects of their API. I can pay a student intern to maintain a single VPS based $whatever, AWS consultants cost a multiple of that. If that's something you can and want to do yourself, sure, that's great - even for small use cases like this but then it becomes a philosophical toy problem more than a technical challenge.

</comment></comment></comment></comment></comment><comment><USER15> Thanks for putting this together and documenting it so well. I've had to build this solution twice now, and far less elegantly.

The S3 PUT charges caught me off guard the first time (receiving lots of marketing/spam email will cost $1/1000 emails). I ended up putting small emails up to 400 kB in dynamoDB and only using S3 for large emails and attachments, which could be a means of cost reduction in this solution as well.

<comment><USER16> Honest question: how did you arrive at 1$/1000 mails? When I look at S3 peicing it says 0.005$/1000 PUTs.

Are there a lot of requests made or am I missing something else?

</comment></comment><comment><USER17> I've been working on a small side project that involves processing incoming email. In particular, it's an app that needs to do something for each email it receives from (hopefully paying!) users.

I am not interested in storing user mail, so SES is just too costly, at least according to a quick worst-case calculation.

That leaves me with two options:

1\. Self-hosted Postfix

2\. Mail service like Mailgun

With (1), there is no need to worry about overages, but scaling the mail server might be challenging.

The advantage of (2) over SES is that you are only charged a flat fee for each email, regardless of size. Emails are then automatically deleted after some period of time. Scaling up and down is easy.

For now, I am using Mailgun, but I am writing the mail processing daemon in a way that will make it easy to transition to Postfix, if needed.

Also, I decided to write the mail processing backend in Rust, so I've been learning the language as I go!

<comment><USER12> > I've been working on a small side project that involves processing incoming > email. In particular, it's an app that needs to do something for each email > it receives from (hopefully paying!) users.

I wish you all the best! Mind if I ask for the link?

> With (1), there is no need to worry about overages, but scaling the mail > server might be challenging.

Honestly, quite the opposite.

1\. Duplicate your MX box.

2\. Duplicate your MX record.

That is it :)

> I am writing the mail processing daemon ... in Rust...

You might like to take a look in [https://github.com/mailman/mailman](https://github.com/mailman/mailman) for ideas/inspiration. It's a great tool for processing emails too, but cannot deny I'm now curious to see how one in rust will look like.

<comment><USER17> Thanks! No link yet, but there is a messy GH repo: [https://github.com/aksiksi/vaulty](https://github.com/aksiksi/vaulty)

Yes, I only learned about MX record priorities last night haha. With Postfix, the most straightforward way to run code on receiving an email seems to be through a pipe filter. Running multiple filter processes probably requires a beefy server.

Thanks for that link! I might just use a similar approach to allow users to configure how to receive emails (HTTP or stdin, etc.).

<comment><USER18> Then limit the number of filters... you can have postfix run a fixed number of smtpd processes, and each process handles only one message at a time.

When they're all full, your server will just stop handling messages, but SMTP will retry anyway, giving you plenty of time to scale up if the load is consistently too high

</comment></comment></comment></comment><comment><USER19> Seems like a crazy amount of architecture. Does AWS keep all this stuff organized in some way, or will my personal experiments in Lamba accidentally break this because it's all merged together?

Say I've installed this.

I now want to write my own lamba service to handle contact form POSTs or something. Then I decide to delete it, but I accidentally delete one of these crazy email things. What happens?

<comment><USER20> You can make "new" sub accounts from your main account. If you wanted to segregate it completely.

</comment></comment><comment><USER21> >his day there's no easy way to have a full email server without the overhead of installing and configuring all servers needed to handle incoming and outgoing messages.

[https://mailinabox.email/](https://mailinabox.email/)

</comment><comment><USER22> Now someone just needs to create a serverless (aka client side or browser only) Gmail like interface you can host on S3.

And the shackles will be broken...

<comment><USER2> [https://www.rainloop.net](https://www.rainloop.net) ?

Anyway, what is the point in moving from one Giant to another Giant? :-) Unless it saves the cost, I don't see the benefit of such hassle.

<comment><USER23> Most serverless offerings are somewhat compatible with a pitcher of greasing. It would be a doable exercise to duplicate this codebase for a few other platforms.

</comment></comment></comment><comment><USER24> I'm missing something - how are people reading this in an email client if it doesn't have IMAP support?

<comment><USER25> I think the bigger problem is that you can up their bill by spamming them

</comment></comment><comment><USER26> Please don't use '+' for special purposes in email addresses without making it changeable (I recommend '_' instead).

Yes, it is "nominally" accepted--in reality there are too many website that "validate" email addresses and barf on '+'.

</comment><comment><USER27> If you only need to read the emails from S3, take a look at this project [https://github.com/mewa/s3abird](https://github.com/mewa/s3abird)

</comment><comment><USER28> Yes this is legit! Got it to work on a throwaway domain under 30 minutes.

</comment><comment><USER29> You can get receive at any address on a domain forwarded to whatever email you want if you're registered with Monicker.

I imagine most other registrars offer the same thing.

</comment><comment><USER30> Note that SES only retries delivery for a fixed 840 minutes (not configurable), which is an annoyingly too short amount of time.

</comment><comment><USER31> Wow, this is cool! JSON structures resemble JMAP. I wonder what'd be the effort to add JMAP endpoint to this?

<comment><USER32> JMAP is a radically different beast. The similarities between this thing's JSON format for sending and JMAP's Email data type are superficial only: they're both JSON and are representing the same thing, so it should be no surprise that they look similar. But that's a quite tiny part of what JMAP is: JMAP is an object synchronisation protocol. (And this is why JMAP so much more complex than the typical REST API. And why I prefer it so much.)

I also think the JSON here is only for sending, not for receiving—I presume that you'll receive the MIME message, because otherwise you'd be throwing away all kinds of essential information.

All of this gets you basically nowhere along the path to JMAP, and achieving a JMAP endpoint would be a _lot_ of effort. This project doesn't look to be at all suitable as a base for such an endeavour. Things like sorting (e.g. newest first), querying (e.g. emails from so-and-so) and JMAP's state management (so the server can tell you "something changed" and you can ask the server to tell you what changed since _x_ , rather than needing to throw everything away and start again) don't work well within the design of this system—you need to store lots of extra details along the way, maintaining indexes and other such things.

For such an endeavour, I would instead recommend either wrapping an existing mail server in serverless voodoo (much of which I expect to be not too hard: you're essentially just replacing ingress and egress and not running it as a daemon; but there will be architecturally difficult parts like getting push channels working probably), or starting new mail server software from scratch designed to be able to work serverless.

(I work for Fastmail on our webmail. I have general knowledge of how mail servers work internally, but little specific knowledge; for example, I have no idea how amenable Cyrus, which we use and develop, would be to serverless packaging.)

<comment><USER31> Thank you for your detailed in depth response!

For the record it seems this seems to do some basic processing:

> The Inbox or Sent folder triggers another Lambda function that loads the raw > email, converts it to a .html and .txt file, and stores it alongside the > original message, while storing any attachments in the attachments.

This looks OK for me having clients do indexing and processing. From your description it seems JMAP choose a different tradeoffs and puts more services on the server side.

<comment><USER32> This project seems to be designed more for a process-and-delete workflow, whereas JMAP is designed as a general-purpose object synchronisation protocol on which you can build arbitrary email clients.

</comment></comment></comment></comment><comment><USER33> How does this compare to setting up something like sendy (sendy.co) on lightsail and connecting to SES?

</comment><comment><USER34> ... and I thought about a similar thing (Email server using Lambdas) just yesterday ... ^^

</comment><comment><USER35> What about email signing?

<comment><USER36> After surrendering all your data to a cloud provider?

<comment><USER4> Signing e-mail servers two different purposes:

Authenticating the actual sender vs. authenticating the server or service controlling the domain for reputation purposes.

If you trust Amazon enough to use their cloud services, there's little reason not to trust them for the latter. Doesn't mean trusting them with respect to the former.

Things like DKIM makes no assertion that the content was sent by the right person; just that whomever controls the domain has trusted the service in question to send e-mail on their behalf.

</comment></comment></comment><comment><USER37> Cool project! I'll make sure to test it someday.

Thanks for sharing!</comment>


Show HN: Sawtooth – Online audio workspace - <AUTHOR> https://www.sawtooth.io <comment><USER2> I find myself asking questions that could easily be answered with a demo or some sort of try before signup.

The idea of everything I click on going to the signup page really is a huge turn off and personally I consider it to be a poor user first experience.

You should add some sort of something that allows me to see what you are about before making me sign up. I don't even know what I get if I sign up.

Otherwise, I am sure you have done a great job.

<comment><AUTHOR> Thanks, you are right. I should add more content up front so that everyone can get a better idea how it works without having to sign up.

<comment><USER3> Even better - the home page should be the app itself. Only prompt people to register for an account when they've created something they might want to save.

<comment><USER4> This is what I was expecting.

</comment></comment></comment></comment><comment><USER5> As a frequent user of SoundCloud, Gobbler and plain old DropBox to share audio files among fans and colleagues in the industry, I am wondering what the advantage of Sawtooth could be?

I see that you have filters etc., but given that I would rather adjust EQ and effects on my tracks on my own DAW with virtually no latency, I don't know that I would actually do that on a web platform with all the vagaries of lag, dropped signals etc.?

Plus the fact that most audio people have their favourite 'go to' plugins for reverb, delay, chorus etc. as VST/AU plugins that they pull into their DAW - it seems that Sawtooth straddles that line between being a quick 'grab an audio recording snippet for sharing' and a full fledged web based DAW.

I am assuming a 'use case' for this would be to capture a song or riff idea while I was sitting in a hotel room between travelling etc., but to be honest, I have a lot of iPhone apps for doing that and posting directly to the sites I mentioned above. To make Sawtooth compelling, it would probably have to supply some rudimentary DAW like capabilities, such as perhaps a metronome, some sort of ability to do basic MIDI patterns with uploaded samples, and perhaps some rudimentary multi track ability - even 3 or 4 tracks would be great for doing basic song ideas to send to my band members.

<comment><AUTHOR> Gobbler looks great. Have you used the collaboration features and have they worked well for you?

One of the goals is to streamline the experience of navigating and listening to sets of files. If it's built correctly, then using Sawtooth should be a smoother experience than managing where your files live in your Dropbox folders, having it sync them, finding them on another computer, then listening with a separate media player or the player in your OS file navigator (thinking of Finder on MacOS).

This is not meant to replace any of your desktop DAWs. If anything, it could interoperate with them in certain cases, if people are interested in that. Maybe an API would be handy for others developing websites or apps that work with audio.

I'd like Sawtooth to keep simple audio work really simple. I suspect it's easy to overwhelm newcomers to the audio world with complicated UIs (which are necessary for advanced work).

Gobbler for example seems very geared towards musicians and music creation, which is great for many. But there are also lots of people working with audio for other reasons... field recordings, voice recordings (podcasts etc), signal analysis, etc. Maybe Sawtooth becomes more optimized for one of those other cases.

</comment></comment><comment><USER6> As an amateur producer, I'm wondering: what's the utility of something like this?

If I create a new set, I have the option to use the 'Synth'.

Let's be very honest here: if I want to make real music, I'm going to turn to a serious DAW + synth plugin. I personally use both Massive and Serum with Ableton. Anything you cook up in a webapp is going to fall seriously, _seriously_ short of what Serum can do.

Not to mention that a web tool just doesn't fit into the workflow. The synth is the heart of digital music production. If I'm making music in Ableton, I want my synth to be inside Ableton.

This might interest absolute amateurs, but amateurs won't pay for this, and by the time they are advanced enough to _want_ to pay, they would have discovered Ableton/Logic/FLStudio.

I don't mean any offense, but I find that online music tools like this are generally very poorly thought. They are a solution searching for a problem instead of the other way around.

A lot of people need simple tweaks to their photos or graphics. This is why online photo editing tools work even though they fall far short of Photoshop in capabilities.

But audio/music? This isn't something your average Joe needs for his Instagram profile or his Facebook business page. If someone is serious about music/audio editing, he will eventually want to use a professional tool.

Not to mention that Ableton Lite is quite decent for someone new to music production

<comment><AUTHOR> Sawtooth creator here...

Thanks for the feedback and I agree with a lot of what you said. You're right that this can't compete with pro audio software but it's also not my goal to compete with those tools.

I'm putting Sawtooth out there to evaluate if there is demand for this type of web app, and what groups may be the most interested. Whether anyone will pay for it... great question! I'm not worried about that just yet.

Web apps have a lot of limitations compared to native desktop apps when it comes to serious audio work. At the same time, I wonder how many people could use a reliable web app for super quick edits, to listen to some of their audio while on the go (not just at an audio workstation), or share tracks privately with bandmates or coworkers. We'll see.

<comment><USER7> Thanks for your project.

The sharing aspect is the interesting bit. Having a "github for sound samples", with the ability track forks and have commit history could be wonderful.

Implementing a professional DAW or synth takes a staggering amount of work. The toy synth might confuse users about the purpose of sawtooth. (Personally, I would remove it)

<comment><USER6> See: Splice.com. It works like GitHub and is already very popular with producers.

</comment></comment></comment></comment><comment><USER8> I think the marketing page could do with some demos. There are online DAWs already and most of them are pretty sad. If you showcase some real audio work accomplished with Sawtooth, it'll be more worth signing up to try.

I have DAW software already, I use Ardour and Pure Data on my computer, so I want to know that I can do something compelling with your tool before bothering to set up an account.

<comment><AUTHOR> I appreciate the feedback. A couple aspects of Sawtooth that might be compelling for you, as a supplement to what you're already using -

1\. Share sets of recordings privately with any collaborators. All protected by logins. This feature is basic right now (it's read-only if you are not the owner) but could be expanded.

2\. The convenience factor of accessing your most used audio clips or recordings from anywhere, on most any device. Maybe your final Ardour mixes you would upload to have easier access when you're not at your workstation, for example.

I know this isn't for everyone, and it's certainly not intended as a replacement for desktop pro audio software. Rather, it may be a complimentary tool for some for simple editing tasks, quickly streaming your recordings while on the go, or collaborating with others on shared sound files.

<comment><USER8> Seems cool, good job. I look forward to seeing more of your platform.

DAW plugins are usually pretty hard to write and maintain, but maybe it'd be cool to have a "send selected tracks to sawtooth and share" type flow.

</comment></comment></comment><comment><USER9> I've very long wanted something like this! Basically like a CyberChef ( [https://gchq.github.io/CyberChef/](https://gchq.github.io/CyberChef/) ) but for audio. I work in digital speech processing and often work with audio codecs and it would be very helpful to have an online tool which lets you apply multiple filters to some audio.

What I'm missing after trying out Sawtooth is the interactivity of CyberChef. Basically trying out a few filters, one after the other, showing the intermediate results for each, and some frequency analysis on it, and hearing the results. Can audio filters be applied in the browser for instant-feedback to hear the audio 'live' (like CyberChef auto-bake) like it can be with text?

And some conversions would be really great as well, like being able to apply various encodings: Treating the samples as a-law encoded and applying an a-law decoding pass on it.

<comment><AUTHOR> I was wondering if anyone would be interested in having some signal analysis available. It would be a logical step from what's there now.

At the moment all filtering is done in the backend. Hearing instant-feedback though seems to be a common request so I'll have to give it some thought.

Sawtooth does keep all versions around and available (to support undo) so improving the ability to quickly play the different versions of the same file would be the easiest addition.

Thanks for giving it a try.

</comment></comment><comment><USER10> Did you ever have a desktop app? In the early 2000's I used a program I thought was called Sawtooth, or maybe it was just SAW, 'saw' was in the name, but I can't for the life of me find it anywhere. You could draw a wave form with the mouse, name it, piano roll it, sequence it into a song and export as a wave and that was about it. I know that sounds like ever DAW on the planet but it didn't have any advanced features and I think drawing the wave form was unique to it at the time. If anyone knows what I'm talking about please let me know.

<comment><USER10> 2 days of really hard thinking I finally remembered. "SawCutter". Seems to be abandoned though. cuttermusic.com is something else now and the download.com link is, of course, completely shady. Hope I can find it on an old backup CD somewhere.

Edit: Looks like this might be the author who seems to have a pretty impressive resume: [http://www.larryzitnick.org/](http://www.larryzitnick.org/)

</comment></comment><comment><USER11> I do a bit of online video production (for social media marketing and for online courses) and I have to open up audacity every once in a while. I don't like the audacity user experience. Here's my feature request list

1) Make it easy to switch audio formats ([mp3|wav|au|etc]->[mp3|wav|au|etc])

2) One button to make it louder, one button to make it quieter

3) A good cut and paste interface with the ability to zoom in and out and see the spectrogram so one may be sure that one starts cutting at the audio part (if there is white noise)

4) Abilities to selectively remove deep or high voices and remove background noise

<comment><AUTHOR> Thanks for the list!

<comment><USER11> You're welcome. I know how challenging it can be to launch a new product and all you want is information from the market regarding where to go.

</comment></comment></comment><comment><USER12> Interesting. In "Works With Multiple Formats" section, it mentions 'AU' \- do you mean AIFF (AU is Apple's Audio Unit plugin format)? 'Chorus' is misspelled under "Filters".

What is bitrate/quality of transcoding, and how would you rate your DSP algorithms compared to those in pro DAWs/editors? Like, is that FreeVerb or something fancier, and what about pitchshift/timestretch quality and zero- delay filters? Audio folks are pretty picky about quality these days.

<comment><AUTHOR> In supported browsers I'm using the Opus codec which in general is quite good quality compared to MP3. It falls back to MP3 in browsers that don't support Opus... Safari and IE I think.

I believe it's using the default encoding settings for Opus and MP3 at the moment (using opusenc and... maybe lame for MP3 I forget). Certainly I'm looking to have great streaming quality so I should confirm that those defaults are reasonable.

I'm using various open source and custom tools for the processing. YMMV. In general they should be solid, but not as fancy as many of the latest VST plugins. This could all evolve depending on feedback and what people are interested in. One thing I considered as an addition is the ability to define custom filters on the webpage... either interpreted or compiled in the backend to edit your files. I think that would be a neat way to experiment with filters, but would have some limitations as well.

</comment></comment><comment><USER13> I like this idea - but why do you let people edit the .wav part of the extension? That was super counterintuitive to me could I have done .mp3 for example?

I'll leave any other feedback I have here unless you have an email I can send it to - I've been looking for a good web version of Hum (the mobile app) and this looks like it could be it + more!

<comment><AUTHOR> Hey there, thanks for trying it out. Was this after uploading a wav then clicking to edit its tags or file name? I'll see if I can improve that aspect. In general, Sawtooth transcodes uploads behind the scenes to create mp3 and opus encoded versions so that they can be streamed to your browser (not all browsers support playing wav directly). These versions are all stored next to each other. Editing the name string in the UI shouldn't be able to change file extensions in the backend.

I'd be happy to field any other questions here or equally you can reach me at curtis at sawtooth.io

</comment></comment><comment><USER14> Seems like a great start. I too would like to see ways to combine waveforms. And a bigger ask of being able to draw filters in real time while playing back to hear changes instead having to process them to find out what will happen as well as loop the same while editing. I realizing I'm asking for more DAW like features! :P

</comment><comment><USER15> Seems like a really cool project with potential. Would like to see the ability to preview on filters and synths, that seems like a big downside compared to the desktop DAWs.

Also not sure if there's a place to report bugs and provide feedback in the future?

<comment><AUTHOR> Thanks, please send any feedback to curtis at sawtooth.io

</comment></comment><comment><USER16> I was playing with it for a bit and came across a few issues, but can't seem to find a support or contact link. Where would you like such information sent?

<comment><AUTHOR> Please shoot me an email with your findings: curtis at sawtooth.io

Thank you!

</comment></comment><comment><USER17> It would be worthwhile to mention if multichannel audio is supported or if the application is limited to working with mono and stereo inputs.

<comment><AUTHOR> Good point. Multi-channel is supported. I'll make a note to add it to the feature list on the page.

</comment></comment><comment><AUTHOR> FYI - you can use Google login if you visit the Sign In page (instead of Sign Up). Need to make this more obvious.

</comment><comment><USER18> Click - sign up. ... No.

</comment><comment><USER19> Can It be used for direct streeming?</comment>


Leveraging Linux in a Lousy Economy - <AUTHOR> http://www.scribd.com/doc/16119251/Leveraging-Linux-in-a-Lousy-Economy-Theodore-Tso

<comment><USER2> Summary: A first-rate Linux hacker pitches to large entities interested in _customizing_ a linux solution for their (hardware) platform, also pushes IBM's high-performance realtime solutions for the enterprise.

<comment><USER3> Shorter summary: PowerPoint hell</comment></comment>


How Long Before You Purge? Apparently Never for the Gap - <AUTHOR> http://www.centernetworks.com/how-long-before-you-purge-apparently-never-for-the-gap

<comment><USER2> While purging the mailing list would decrease the number of spam complaints I wouldn't send out messages to past customers with the explicit message (and only message) of opting out because... suprise they WOULD opt-out. Instead email your list on a regular basis which in-turn would allow people plenty of opportunities to opt-out.

The Gap, at least they are not pitching Viagra or Cialis. There email shows a lack of saavy about the Internet it speaks more about who is running the company as being out-of-step with the exact market they are trying to attract.

</comment><comment><USER3> I don't understand. He criticizes them for sending a mail because it will cost them money? If he doesn't want to be on their list then he can use the can- spam mandated opt out option that the email offers.

Purge? Never if the customer doesn't want to be purged. I don't see the cost justification.

</comment><comment><USER4> Wow. The Gap thinks that its new offerings in other sectors will appeal to an old customer? Is he also astonished that The Gap has spruced up its product offering for the fall?</comment>


Zapier – Superpowers to get your work done - <AUTHOR> https://zapier.com/

<comment><USER2> Where does this stand in relation to IFTTT?

<comment><USER3> Zapier is IFTTT-on-ultra-steroids-that-cost-$$$. More channels, more actions, more flexibility, for sure, but if you want more than 5 actions firing 100 times a month, it's $15 a month and upwards.

I have 43 IFTTT actions which fire many times a month (easily north of 500). Zapier would be $49/month for me.

(I would like to give IFTTT money - even if all that unlocked was in/out webhook support.)

<comment><USER2> Great summary, thanks. I've had an eye on both services for a while and wondered how they differed.</comment></comment></comment>


Ask HN: How do you quantify happiness when looking for a job? - <AUTHOR>

I want to open by saying that, of course, it's not possible to quantify happiness. And when looking for a job, happiness a) means different things to different people, and b) is worth more to some than others vs. other factors of a job.
So I ask this question not expecting some magical formula. I'm just trying to gather from the HN community how different people weigh happiness as a factor amongst several other factors when comparing two or more job opportunities.
For example, I may be looking at two similar but different job opportunities. And of course, a third option is to just stay where I am (or a fourth, continue looking for other opportunities).
When comparing all of my options, I've quantified as much as possible the easy stuff: base pay, PTO, 401k match, stock options/bonuses, medical premiums, etc. And after doing this, I have a clear picture of how the options compare strictly looking at comp & benefits.
But let's say after getting to this overall compensation value, job A offers $25k less than job B, but job A seems to have a better overall culture and the work sounds more enjoyable vs. job B.
How would you (not how should I) decide whether the happiness you may get from job A offset the $25k you would lose? And if you decide $25k is too much of a cut, how would you decide the amount of loss that you would be willing to live with for the benefit of a certain level[1] of more happiness?
[1] And just to clarify, I'm not talking about extreme misery vs. extreme bliss. Maybe job B would still make you happy, just not quite as much as job A. <comment><USER2> I'd say watch this TED talk first on Motivation (if you haven't already): [http://www.ted.com/talks/dan_pink_on_motivation](http://www.ted.com/talks/dan_pink_on_motivation) Its 18 minutes but a very important 18 minutes to spend.

Once you watch this, get a better sense of what any company is like with respect to the concepts Dan mentions in the talk (ie Autonomy/Mastery/Purpose)

Ultimately, if their philosophy aligns with what Dan says, you're odds of being intrinsically motivated are much higher which by definition means you will be happier.

I can't think of a better framework to get a sense of how happy you might be in any job.

Hope that helps</comment>


Steven Novella on Low Carb Diets - <AUTHOR> http://www.theness.com/neurologicablog/?p=1354

<comment><USER2> I'm going to do some more indepth research when I get home. I've read plenty of articles by people with PhDs in areas that focused particularly on things like how exercise and diet affects the body.

From what I've read there is evidence to show that the old thought "a calorie is a calorie" is not true. Dr. Novella points to a study where "low-carb" was 20% of the caloric intake, and uses this study to validate that statement, however, most places I read about define low carb as much lower than this (generally about 20g which probably works out to about 7-8% or so).

I'm definitely not an authority on this but I know I've seen some info that seemed really well backed (by science) that shows that there is validity to the low carb diets for fat loss (there is a difference between weight loss and fat loss).</comment>