Demystifying Windows 8′s changes, additions, and features - <AUTHOR> http://www.extremetech.com/computing/96431-demystifying-windows-8-changes-additions-and-features

<comment><USER2> > Windows 8 will be the most secure Microsoft OS ever.

Ever. Never again will Microsoft create any software product as secure as Windows 8. It will be the pinnacle of human software engineering and it's all downhill from there.

Seriously though, 'ever' is such a strong word...

<comment><USER3> That's a common usage though, right? Apple's press release for the iPhone 3GS claimed it would make gaming "better than ever" and taking pictures "easier than ever." Sometimes, it's made explicit that we're talking about the past ("you've never seen anything better"), but even without making it explicit the meaning is clear.

[http://www.apple.com/pr/library/2009/06/08Apple-Announces- th...](http://www.apple.com/pr/library/2009/06/08Apple-Announces-the-New- iPhone-3GS-The-Fastest-Most-Powerful-iPhone-Yet.html)

<comment><USER2> They are actually using future with 'ever'. As far as I know, the future 'ever' is relating to all future events. In contrast, Apple is using the present tense or the past tense 'ever', which would relate to all past events.

I guess you could use the two versions interchangeably without confusing too many people. Then again, good writing probably wouldn't.

</comment></comment></comment><comment><USER4> The most fundamental flaw of this stupid idea is still trying to merge Desktop and Tablet features. It's what makes Unity suck beyond saving grace, it's what makes Lion the most colossal fail in the history of fails from Apple, and it's the same thing that will break Metro.

You don't put Tablet features on a Desktop OS. You don't put Desktop features on a Tablet OS. Either way is doomed to fail because they are completely different input paradigms and entirely opposed areas of usage (tablets being communication devices with multimedia functions, Desktop machines being where actual work gets done).

I see this entire thing as Microsoft's last desperate attempt to get into the Tablet market - where they've already lost to UNIX (Android and iOS) - and I doubt it's going to get any better. And since the Desktop market is going to shrink tremendously in the future in terms of multimedia usage for the everyman, eventually leaving only the power users on the Desktops, they've pretty doomed to eventually loose the shrinking Desktop market as well, as power usage is the territory of GNU/Linux, whether you like it or not.

But oh well, it's going to be funny to watch from the sidelines.

<comment><USER5> "… it's what makes Lion the most colossal fail in the history of fails from Apple …"

What? What?!

The only 1:1 ported tablet feature I know of is Launchpad (and it does suck, don't get me wrong) which is, however, completely optional and doesn't even get in the way.

Launchpad does not make Lion a colossal failure. That's impossible.

Other stuff might, but it has little to do with trying to bring tablet concepts to the desktop. Apple clearly hasn't attempted to do that, at least not 1:1.

Sure, Apple added fullscreen apps but those have been a staple of Windows forever, I don't think dragging tablets into this makes any sense whatsoever. And you might not like the new simplified Spaces and Exposé but they do not have any tablet equivalents. They are all desktop, all the time.

Auto saving, resume and Versions are obvious features for any operating system, the tablet/desktop distinction doesn't make any sense when looking at those features. Operating systems should support them, no matter the device. That's it.

So what's the problem? People have been complaining about bugs and some don't like Mission Control or the way fullscreen apps are implemented. I see little relation of those complaints to Apple trying to bring iOS to OS X. (I also want to note that Lion has received a large number of positive reviews. Your claims of it being a colossal failure are definitely a minority opinion.)

</comment></comment><comment><USER6> Has anyone come across any benchmarks as far as battery life or performance go yet? I know benchmark3d has been including the leaked versions in their game benchmarks.

<http://benchmark3d.com/benchmarks>

<comment><USER7> If I remember correctly, the Windows 7 pre-release license agreements included a clause forbidding you from benchmarking the operating system. Is there a similar clause in the Windows 8 ELUA?</comment></comment>


Does LinkedIn Promote Ageism? - <AUTHOR> LinkedIn requires start/end years for any experience and this becomes a way for people to identify a person's age. I have seen it used time and again where people look to see how old a person is, then pass simply on that alone--especially in the Tech industry.  There is an article on Slashdot today about how to retrain "old IT people." The problem is the same as race, why are they singled out? In many states age is a protected class, so why is it not getting the same level of treatment as things like race?  LinkedIn doesn't require you to list your race... Has anybody else observed this behavior?  Perhaps they could simply give the option as the # years spent at a given location, in lieu of start/end? <comment><USER2> I don't and will not put more than 10 years of experience on my resume no matter how old I get. My university study does not exist on my resume either. I am hoping this will help against discrimination.

<comment><USER3> Instead, look for jobs where more than 10 years of experience is an asset.

I've been a professional programmer for more than 30 years. I bring way more to the table than someone with 10 years of experience, and I expect to get paid for it. If you're not looking for what I have to offer, then I'm not looking to work for you.

I haven't been out of work at any point after 3 years of experience, so this attitude hasn't hurt me in terms of having work.

I'm in embedded systems, though - this approach might not work in, say, web programming.

</comment></comment><comment><USER4> I don't see the issue? Any resume you provide is going to have the dates of tenure (and probably a graduation date for that matter). Unless you're trying to argue that employers shouldn't be able to look at experience when hiring there's not much way around it. Even without ranges number of positons and the highest title reached can give you a relative age to some degree of accuracy.

I think tech's dirty secret is that there is ageism, but not against the old. You only need to look as far as the entry level jobs requiring 10 years exp to see that the system isn't really rigged in favor of young people.

<comment><USER5> > I think tech's dirty secret is that there is ageism, but not against the > old. You only need to look as far as the entry level jobs requiring 10 years > exp to see that the system isn't really rigged in favor of young people.

Yep. I'm starting out my career and have been denied entry level opportunities on the basis of not having enough experience (even though you'd think entry level = minimal experience required).

<comment><USER6> Which makes complete sense. If you don't have experience in a job, it makes sense an employer might not want to hire you. I got an entry level job out of college because I had years of internship experience.

</comment></comment></comment><comment><AUTHOR> I had somebody tell me they like to see if anybody had any gaps in their employment. But this is probably a false indicator either way and not worth the problem of encouraging Ageism bias.

<comment><USER7> I like talking about the 2 year gap in my resume.

I chose not to work because I had saved enough money to live inexpensively, sleep in, exercise, read books, and do whatever I wanted without having to answer to anyone.

Employers who are interested in this and "get it" are the ones I want to work for.

</comment></comment><comment><USER8> > I have seen it used time and again where people look to see how old a person > is, then pass simply on that alone--especially in the Tech industry.

Linkedin is simply a screening tool. And long before that, there were actual CVs on paper.

If you influence the hiring process, get curious about why people get screened-out. That's where you find the true hidden gems in talent.

</comment><comment><USER9> I dont see a long history as a negative - if you are being recruited for one role, then often a technology from your past may swing it for you as the organisation has a system using this technology that no one wants to touch. So recruiting you makes sense as you can give advice on that system</comment>


Texas plumber sues dealer after his pickup turns up in Syria - <AUTHOR> http://www.scribd.com/doc/293042163/Mark-1-Plumbing-Inc-v-Charlie-Thomas-Ford-Ltd <comment><USER2> This is absolutely amazing. Jaw dropping if it's not a clever case of photoshop!

Recently they had started to ask serious questions to Toyota as to why IS had so many brand new pickup trucks...

<comment><USER3> I was trying to guess if it was 'shopped or not. I can't imagine that someone in Syria would just "happen" to have this plumbers name and number nor did it seem likely that they just grabbed another picture of a truck with similar positioning.

It's much easier for me to believe that folks have discovered a way to arbitrage the difference in price between used cars in one market and their price in Syria effectively.</comment></comment>


Gnod News: Search Hacker News and Reddit Comments - <AUTHOR> http://news.gnod.com <comment><AUTHOR> I'm doing a social search engine. Won't be big and professional like Google. This has been brewing for a while, and is starting to get ready. I'd like any feedback on things people like/dislike in it :)

Are there any other social search engines that draw from multiple sources? I know there are services like mention.com, but I wanted something where you do not have to sign up and can just search right away.

<comment><USER2> Love how clean this is. Feature request: Quora mentions! At that point, I'd probably want to be able to sort by medium.

<comment><AUTHOR> I would add Quora if I had access to their data. They have no public API. Anybody from Quora listening?

</comment></comment></comment><comment><USER3> Neat! Now you just have to add voting.... :)

Sidebar: I did something similar many years ago. I was doing a hacker news book site (books hackers talk about). I wanted to include every time the book was talked about, but I didn't want to run code or update stuff. The entire site was static.

I found out you can determine the "buzz" for something just using Google Search and some code. Check out this page: [http://www.hn- books.com/Books/Slaughterhouse-Five.htm#the_bu...](http://www.hn- books.com/Books/Slaughterhouse-Five.htm#the_buzz)

This allowed me to write reviews, do interviews, and also present whatever folks were saying about a book -- without having to write server code or even maintain a server.

Love to see how this continues to develop. Lots of potential here.

</comment><comment><USER4> Nice. I'd like to use regexp in the search, or some other kind of advanced parameters. For example, I searched for "latex" and got no results from the document preparation system LaTeX.

<comment><AUTHOR> There is already a bit of advanced syntax. Any use of quotation marks will enable it. For example, is you search for...

        latex "donald knuth"

That will search for any comment that has latex anywhere in the text and donald and knuth next to each other.

So you could trigger the advanced syntax by putting latex in quotes and search for any commment that contains latex and text anywhere in the comment:

        "latex" text

</comment></comment><comment><USER5> Shameless plug (and relevant to the topic), I run the site [http://redditcommentsearch.com](http://redditcommentsearch.com) which allows searching through the comments of a particular user on reddit.

I created this site because I often needed to search through my own comment history, to find old debates that I want to revisit.

<comment><USER6> This is useful, thanks.

</comment></comment><comment><USER7> [https://karmalytics.co/](https://karmalytics.co/) is somewhat similar.

<comment><USER8> Yup except with keyword tracking.

Found this comment b/c I have an alert set up for "karmalytics"

</comment></comment><comment><USER9> It's "cogwheel", and your dong is backward -- very 4chan, that.

(I'd have something more substantive to say, only the "cogweels" seem to be grinding teeth off one another at the moment, so there's not much I can do.)

<comment><AUTHOR> Thanks, fixed the wheels. If you get the wheels message, just reload the page.

</comment></comment><comment><USER10> Looks good, and works good too! It would be nice to see if a particular item is from reddit or hackernews, and maybe what section or subreddit. And perhaps the number of other comments in that thread?

<comment><AUTHOR> I'm a bit hesitant to throw all that on the screen as it would clutter the interface. Maybe display it on mouseover?

<comment><USER11> I really appreciate the sentiment of this comment. It shows that whatever does end up making it to the screen should be pretty well thought out.</comment></comment></comment>


Zoom's Use of Facebook's SDK in iOS Client - <AUTHOR> https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/ <comment><USER2> So it sounds like Zoom was using the Facebook SDK, and now they're not.

I've been and iOS developer for a long time. I can tell you from experience that _everyone_ does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with.

Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. Or having no way to package open source software where you can actually see what's running. As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

Yeah maybe you can pass laws about it. But is that really a great solution? Who audits that? How do you determine what's legal and what's not? We should be pushing for a platform that makes it obvious what the software you're running is up to. The random pitchfork crusade against whatever company happens to catch a bad news cycle just isn't going to get us anywhere.

<comment><USER3> I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent.

Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private.

Blaming Apple? Why, when Zoom is on the Play Store as well?

[https://play.google.com/store/apps/details?id=us.zoom.videom...](https://play.google.com/store/apps/details?id=us.zoom.videomeetings&hl=en)

>As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is __expensive. __It 's quite literally one of the most intensive network activities you can partake in, rivaling torrenting.

It doesn't make sense economically to offer a video hosting platform without collecting income from it. Nor does it make sense to attempt a peer-to-peer solution knowing full well that one laggy peer wrecks the experience for everyone else.

It's a very hard problem.

<comment><USER4> > Blaming Apple? Why, when Zoom is on the Play Store as well?

Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they

A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade

B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. punishment by having text like "sends data to: facebook, google, hotjar" on an app's install page)

C. Apple doesn't do any software stuff to limit and track the trackers. Having a counter for # of total days a domain name was contacted would be an eye- opener for many, and being able to toggle a "block" on the domain would be a big step forward.

Facebook meets the standard for being included in apps (respects the user resetting the usage ID), but that standard isn't the standard privacy- conscious users want. Apple can do better, but whether it be industry pressure or monetary pressure [google paying to be the default search engine], they don't actually put privacy first.

0: [https://www.businessinsider.com/apples-ces-ad-las-vegas- misl...](https://www.businessinsider.com/apples-ces-ad-las-vegas- misleading-2019-1)

<comment><USER5> > the Facebook SDK was collecting device information unnecessary for us to > provide our services.

Sorry state of Apple App security and privacy - all your apps are swarms of data collection and privacy abuses.

Apple built this world - and Apple is to blame. Zoom is to blame too. And finally individual app developers should also alert everyone on what's truly happening in their apps.

<comment><USER6> While I have zero love for any given hyper capitalistic business like Apple, Android is not any better on the whole in this space, and in some ways measurably worse (especially when you take into account what devices actually hold the largest market share)

<comment><USER7> This is true, but Apple touts how much better they are about Privacy, and charges a premium for it. Google is more up front that they make little money on the initial sale, and are dependent on advertising to make money.

<comment><USER8> > Privacy is built in from the beginning. Our products and features include > innovative privacy technologies and techniques designed to minimize how much > of your data we — or anyone else — can access

[https://www.apple.com/privacy/features/](https://www.apple.com/privacy/features/)

Apple sells privacy, brags about privacy - yet Privacy is abused in from the beginning in the store apps.

<comment><USER9> And the lesson is - _you can 't buy privacy but you can sell it_.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data intentionally.

What justification does Facebook have for keeping automatic event collection turned on by default in their SDKs? Why can't they enable it only when the the user has explicitly opted in ([https://developers.facebook.com/docs/app- events/gdpr-complia...](https://developers.facebook.com/docs/app-events/gdpr- compliance/#disabling-automatic-event-collection))? They even say, "you need to ensure that your SDK implementation meets these [GDPR] consent requirements."

<comment><USER11> > I don't think these companies are sharing data with Facebook intentionally.

That would imply they are incompetent and negligent.

Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing?

> What justification

Their core business.

<comment><USER12> > _That would imply they are incompetent and negligent._

Not really.

Product Manager: I want to be able to support Facebook login for our app.

Developer: OK... [googles for how to do that] ... We can use the FB SDK for that.

PM: Cool, let's do that.

Dev: [implements it]

Nobody really does much more due diligence than that most of the time. I suppose you could argue that's negligent, but if that's the case, then pretty much every company that has an app with login functionality is probably in that boat.

<comment><USER13> > I suppose you could argue that's negligent, but if that's the case, then > pretty much every company that has an app with login functionality is > probably in that boat.

I think every company that does this is negligent. Audit your dependencies, people!

<comment><USER14> As nice as it would be, auditing everything you use is almost impossible, especially for smaller teams.

<comment><USER11> Is this really a compelling argument for the given case? A detailed audit does not seem necessary here:

This is not some surprising behaviour hidden in some random dependency.

This is the Facebook SDK, from Facebook, and _everybody_ knows what their business is.

<comment><USER9> > This is the Facebook SDK, from Facebook, and everybody knows what their > business is.

Ignorance is a bliss. Talk to some people that still use fb after their scandal and you'll get "who cares, everyone is tracking users and selling data anyway" as an answer.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity.

Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they were called out.

<comment><USER16> The Advertising Identifier is app-specific, and if Limit Ad Tracking is enabled, it is set to all zeros. So it's not accurate to say that it's "your deanonimized identity".

<comment><USER17> You are correct that users can disable it but incorrect to say it is app specific:

[https://developer.apple.com/documentation/adsupport/asidenti...](https://developer.apple.com/documentation/adsupport/asidentifiermanager/1614151-advertisingidentifier)

You are thinking of "identifierForVendor":

[https://developer.apple.com/documentation/uikit/uidevice/162...](https://developer.apple.com/documentation/uikit/uidevice/1620059-identifierforvendor)

</comment></comment></comment><comment><USER18> To use the Facebook SDK is a rocky mistake. It includes all kind of telemetry that is send to Facebook, whenever the user is connected to Facebook or not.

In the company I worked for, they read the code, you have access to it, and stripped that parts. It's not much work but its a pain.

The best approach is to use just the HTTP APIs and ignore the SDK. Your team will better understand how Facebook works, your app will be lighter and you are free from nasty surprises that a 3rd party may add to your app without your knowledge.

<comment><USER19> This is kind of exactly what they said it didn't do.

</comment></comment><comment><USER20> It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

<comment><USER21> It's the official SDK of one of the biggest companies. I can't fault them on not catching this. What Facebook does is ugly.

<comment><USER22> Yeah, this.

I really can't fault Zoom here. They used an existing tool provided by a company that is, allegedly, reputable.

Though, thinking about it more perhaps Zoom should get some more scrutiny here because this isn't the first time Facebook has said eff it to user privacy. Distrust of Facebook should be the default.

<comment><USER21> Actually Apple and Google should not allow this in their app store policy. An 3rd party SDK sending data if it's not needed should be a BIG no-no....I expect at least Apple to require this.

There are probably thousands of other apps that have the same problem.

<comment><USER23> Would be pretty hard to scan for, but I agree that there should be something at least outlined. Privacy policies clearly are aren't useful enough.

<comment> yjftsjthsd-h Hard in the general case, but I'll bet it's trivial to scan for the Facebook SDK, or any other blacklisted libraries, unless they're intentionally obfuscated.

</comment></comment></comment></comment></comment></comment><comment><USER24> Dear all, I am the CEO of Zoom. First, I sincerely apologize about this Facebook SDK issue. We learned a lesson, and we will do all we can to improve. I also wrote a blog.

[https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of- facebo...](https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk- in-ios-client/)

Please take care and be safe.

<comment><USER25> Hey, thank you for listening to security researchers and fixing a problem when you became aware. I know this is not so much a problem, but rather a business decision, but the product would be much more useable if it was possible to connect without the app without having to use some tricks. There have been many conferences that took much longer than expected to start because not everyone had Zoom

<comment><USER24> Dear Ponsin,

You are right on! To focus on our service stability and security are our top 2 priorities. We will work as hard as we can to keep improving. Thank you for your great support!

</comment></comment></comment><comment><USER26> And so zoom crumbled from the social pressure, while every other service and website is thinking "oof, they didn't realize that everybody does this to do advertising"

<comment><USER27> It's also possible they didn't listen to their app over the wire and see it doing this. What lesson could we teach about "why you should mitmproxy your app while it's in development?", so that people can start uncovering this in _other_ apps — including their own?

</comment></comment><comment><USER28> Considering how many apps are using Facebook's SDK, shouldn't this be something that FB should be addressing? After all, they are the ones making an SDK available to app developers to help with user-login. Shouldn't the presumption of trust rest on FB?

<comment><USER29> I can't see the big deal. We use the Facebook SDK specifically for the free analytics. It's just a default part of the SDK. It's not sending anything any other analytics package wouldn't

<comment> yjftsjthsd-h > It's not sending anything any other analytics package wouldn't

But the _where_ matters as much at the what; sending it to FB means that they add it to their profile of your users.

</comment></comment></comment><comment><USER30> It's not fair to be attacking zoom so much over this. They took prompt action as soon as they were aware.

<comment><USER31> As soon as they were aware of the thing they themselves did.

So they don't know what they're doing? Really? How does that defense go in criminal trials?

</comment></comment><comment><USER27> Zoom's blog post about the removal of Facebook login and SDK:

[https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of- facebo...](https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk- in-ios-client/)

</comment><comment><USER32> What if mobile platforms (iOS, Android... ) changed the security/privacy policy so that apps had to request the "network access" permission, either whitelisting domains they want to talk to, or askingfor wildcard access?

Most apps shouldn't need wildcard access, and the mobile device could include a warning when an app does this teaching users that they should be careful with the app.

This way at least when you installed Zoom for example, it would say something like:

"Zoom is requesting network access to:

\- zoom.us \- analytics.tracker.example.com \- facebook.com "

And then at everyone would know. It still doesn't solve the underlaying problem, but it would probably make companies more reluctant to add third party analytics and sdks.

<comment><USER13> Most apps are extremely chatty and prompts like these may not end up being useful.

<comment><USER33> It worked for location access on iOS, and that was just adding a flashing blue icon. Many apps stopped using the location all the time, and now there's a popup every few days telling you how often the app requested your location in the background.

</comment></comment></comment><comment><USER34> Headline should technically read:

"Zoom Removes Code That Sends Data to Facebook when you first open the app"

as per the article:

"Motherboard downloaded the update and verified that it does not send data to Facebook upon opening."

It's a bit naive to just assume that just because they don't send the data right away, that it's not getting sent at some point later on.

<comment><USER35> > we decided to remove the Facebook SDK in our iOS client and have > reconfigured the feature so that users will still be able to log in with > Facebook via their browser.

Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn't exist any more. Instead of being able to collect the data at all times, wouldn't FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more.

It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it's not like the root cause is fixed.

<comment><USER36> On recent versions of iOS, in-app browsers do not share data with the Safari browser. How effective would browser fingerprinting be? Everyone with the same device, same language/locale and same timezone should have the same browser fingerprint, I thought.

<comment><USER13> > On recent versions of iOS, in-app browsers do not share data with the Safari > browser.

Specifically, SFSafariViewController does not share cookies or other data with Safari anymore. Some bad actors got caught with their hands in the cookie jar, literally, and out that sharing went.

<comment><USER37> The do still share something. In response to this headline I installed the Zoom app and picked to login with Facebook. A browser popped up showing the facebook webpage and said "Login as Gregg Tavares?". Since I just installed app how did Facebook know it was me? The only possibility that comes to mind is that Safari was using cookies from some other app's embedded webview.

<comment><USER38> I believe the cookies passed into the webview are limited to a specific domain. So the app developer says "open a webview for Facebook.com" and the webview includes cookies only for the stated domain.

</comment></comment></comment></comment></comment></comment><comment><USER39> If Zoom "takes its users' privacy extremely seriously" and their "customers' privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes?

Someone's lying here.

<comment><USER40> This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent.

> releasing a program without even hooking it up to a network monitor for five > minutes

How many times have you seen _anyone_ do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at all costs, but it's hard to sell.

<comment><USER41> I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.

<comment><USER12> Yeah, that's the thing. I do very little web development, but I inevitably find myself in the Network tab of dev tools debugging something. I do around as little mobile (Android) development, and I'm not even really sure _how_ I'd watch network traffic coming from an Android app. (I'm sure it's possible, but I imagine it requires explicit setup, possibly with some third-party software and/or the assistance of a laptop.)

<comment><USER42> If you have a router running something like openwrt (or from a vendor that uses openwrt and lets you get a root shell on the router) you can just use tcpdump on the router with a filter to pick the host you want to monitor.

</comment></comment></comment></comment></comment><comment> awinter-py covid will shift the overton window on privacy

centralized location tracking in an infectious crisis (either mandatory or mass voluntary) will normalize to 'good'

sleazy third-party phone home from apps considered key to surviving under lockdown, apparently not ok now! good

the bad news is we'll normalize some bad practices, but the good news is we'll make pragmatic compromises using actual information -- with covid taking up moral panic cycles, privacy is a place we can be rational

also no business feels totally secure RN and people will do anything to win & keep business -- even zoom

</comment><comment><USER43> Wouldn't a meaningful win require a change to their privacy policy?

</comment><comment><USER44> That's great for iOS users, but it doesn't mention anything about the Android client. Nor do they discuss the tracking that the webapp still does even though they explicitly state they still allow FB login via browser. Isn't this more of a sorry for getting caught rather than an actual apology?

</comment><comment><USER45> They were made aware of the issue on the 25th... it seems like due diligence would have revealed the issue at the outset. It should be no secret that FB provides their authentication services with strings attached. At least they fixed it quickly.

</comment><comment><USER46> It seems that Facebook JS SDK also sends user behavior back to Facebook even when user doesn't click on the "Sign in with Facebook" button: [https://simplelogin.io/blog/do-not-use-facebook- sdk/](https://simplelogin.io/blog/do-not-use-facebook-sdk/)

On the Web, it's recommended to use a generic OAuth library instead of integrating Facebook JS SDK. On mobile, this is almost impossible though as Facebook doesn't implement the OAuth PKCE flow.

</comment><comment><USER47> For anyone interested in Facebook's SDK behaviour on Android, there's a good video[1] from 35C3 covering this topic, and a related HN discussion thread[2].

[1] - [https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_...](https://media.ccc.de/v/35c3-9941-how_facebook_tracks_you_on_android/)

[2] - [https://news.ycombinator.com/item?id=18788658](https://news.ycombinator.com/item?id=18788658)

</comment><comment><USER48> Thank you zoom.us for the best tool available right now with a fair and acceptable price model. A special thank you also for the great Linux support, that is absolutely unmatched from all other "solutions".

I am very sorry that so many bad publicity happens right now, but as far I know even bad publicity is good in the end.

<comment><USER49> well, you know, bad publicity because of bad practices.

</comment></comment><comment><USER50> I'd like this to be independently verified. There were a lot of comments on the other threads that "Of course Zoom was sending data to Facebook" because they're using Facebook's SDK. It made it seem like such data leaks were inevitable, when apparently they aren't.

<comment><USER51> From the article:

> Motherboard downloaded the update and verified that it does not send data to > Facebook upon opening.

Edit: Fixing mental hiccup, nothing to see here.

<comment><USER52> This is the new article from Motherboard. Motherboard = Vice

<comment><USER51> Now I feel dumb. I completely forgot that connection, and skipped over the blatant "Motherboard, Tech by Vice" in the title. It's been a long week...

Don't mind me, just fixing that mistake.

</comment></comment></comment></comment><comment><USER53> [https://www.theregister.co.uk/2020/03/27/doc_searls_zoom_pri...](https://www.theregister.co.uk/2020/03/27/doc_searls_zoom_privacy/)

</comment><comment><USER54> Great, now if they would stop having an activity monitor that checked every process running on your computer, or made their web interface work with Firefox we'd be all set...

</comment><comment><USER55> Just curious about the IP being sent to FB, isn't that PII? How can FB do this legally without the user agreeing to it first? Or did I miss something?

</comment><comment><USER56> Is the data sent back to Facebook sent in clear text ? What if they used https to send back the data ? Would the data content be detectable ?

</comment><comment><USER57> Evil privacy-invading shit is fucking _everywhere_. Why is it only news when Facebook is somehow involved?

</comment><comment><USER58> Zoom, you've handled this perfectly

<comment><USER59> /s

</comment></comment><comment><USER60> Is that list actually complete? It doesn't sound like _that_ much of a deal.

</comment><comment><USER61> Let me ask how many of those who now argue in Zoom's favor have bought shares or are invested in any other way, like having bought licenses directly or indirectly for their company?

</comment><comment><USER62> Tooo little, too late. Try creating a Mac App Store version first

</comment><comment><USER63> Just uses jitsi

</comment><comment><USER62> I really don't appreciate the downvoting mobs by certain companies.

</comment><comment><USER64> So did they just... remove Facebook login? Doesn't seem that likely. Maybe the FB SDK has some flags you can set.

<comment><USER65> > "We will be removing the Facebook SDK and reconfiguring the feature so that > users will still be able to login with Facebook via their browser. ..."

It sounds like this they're just no longer flat out using the Facebook SDK (which provides a slightly more "native" / "nicer" login flow for apps when used). They're going to do what most (at least, from personal experience) apps do and just show a webview with a redirect back into the app, which doesn't call out to Facebook at all.

EDIT: That is, it doesn't call out to Facebook at all until you start the login flow, which is just opening a browser view to the oauth2 flows..

</comment></comment><comment><USER66> That is ridiculous that a company as big as Zoom wouldn't know what an API they're using is doing with their customer's data. Is there not a legal/privacy team at Zoom that is in charge of reading all the fine prints and license agreements??

<comment><USER21> I guess you haven't worked at a big company yet.

For me this would be much stranger at a tiny company.

</comment></comment><comment><USER67> I noticed today that the mic was "muted" on zoom. I chimed in on the video call I was on and the window flashed a reminder that I was "muted".

So clearly the mic itself is not muted - the software is still listening.

Not sure how I felt about that given all the recent Zoom privacy revelations.

<comment><USER68> Yeah, my light's still on when I'm not sharing video and I hate it

<comment><USER69> Interesting. The LED on my 2019 MBP's camera goes off when I stop Zoom's video.

</comment></comment></comment><comment><USER70> >> we were made aware on Wednesday, March 25, 2020, that the Facebook SDK was collecting device information unnecessary

So Zoom is basically lying here

Come on, the developers who takes the responsibility to use the SDK were aware of it, ok maybe the CEO of Zoom or the market guy was not but the tech team is. They are not stupid.

You should have just apologise and assume your fault, that would be the courageous position, not denying it.

Tbh I am ok with Zoom sending my data to FB (I mean, in my case I've insta/messenger anyway) but not ok for Zoom taking everyone as naïve people with this lying statement.

<comment><USER53> This is what scares most security analysts is the fact that the product was developed and stores data in a place that has incredibly sketchy laws when it comes to intellectual property.

I can't see why Zoom can't come out with a statement regarding why they are collecting all of this sensitive data.

Big corporations might be sharing stuff unwittingly with people that they don't want to share it with.

[https://www.sec.gov/Archives/edgar/data/1585521/000119312519...](https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm)

Top of page 21 in their SEC filing:

"In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."

</comment></comment><comment><USER37> I'm happy the Zoom doesn't want to help Facebook spy on me. Unfortunately the chosen solution is still a privacy nightmare. Basically they let you login to Facebook via an in app browser. The problem is an app can spy on all activity of an in app browser. That means you have to trust that Zoom is not recording your facebook password as you type it in. We need a better system.

Also scary. I have never ever logged in to Facebook on my iPhone except via the Facebook app and it was the first time I've installed Zoom. When I went into the Zoom app and picked login via Facebook, somehow it knew who I was and asked if I wanted to login as me. How is this possible? Is iOS sharing cookies across apps? I feel like maybe I need to reset my phone. WTF

I also feel like the best solution for this case is to somehow login via the facebook app. I know that used to be an option but it seems facebook deprecated it. My argument would be (a) I don't have to worry Zoom (or any other app) is getting my Facebook credentials (b) If actually do want to login via Facebook it's almost guaranteed I have the app installed.

<comment><USER71> Not in iOS. If they are using with webview or safariviewcontroller they can not access the browser cookies or data or most of device information.

<comment><USER37> Not true AFAICT. Given Chrome on iOS uses a webview and overrides all networking and given Firefox can inject JavaScript it seems trivial to use both of those features to spy on any webview activity

</comment></comment></comment><comment><USER72> I love $ZM, it works when nothing else does, and it's responsive to user feedback and cares about user happiness. Most of the interactions I have today are through $ZM and my life would be cut off almost entirely if $ZM didn't exist. If I'm fortunate enough to run a company, I would love to have a business relationship with $ZM, and I'll remember all this.

No, I'm not a paid shill, just a really tired and stressed out guy who gets almost all of his social interaction through Zoom.

<comment><USER59> Whereby works great for social interaction.</comment></comment>


Show HN: Landing page for socializing weddings - <AUTHOR> http://funnup.co

<comment><USER2> Not sure if I am overlooking something, but so far there is relatively little information on the project.

What I could see the most potential in is in syndicating the different pictures and videos that different guests make with their own devices, and create some form of app based on that data. Like some form of picture book, but just as an app.

On the one hand, this seems not that easy to scale, but on the other you could get wedding planners to include your product into their portfolio of services. This should allow you to demand higher fees and direct commission based sales channel.

But maybe I am just misunderstanding the whole idea. Shouldn't write comments being slightly intoxicated :)

</comment><comment><USER3> So instead of doing things like drinking, dancing, and live actual human vocal conversations complete with eye to eye contact -- you'd rather have people playing with their smart phones during one of the most important moment in a couple people's lives?

Apparently you're not aware than most wedding receptions frown heavily on cell phone use.

<comment><USER4> Although stated in an assy way, billirvine does have a point -- I'd shoot the person who shows up to my wedding/reception and sits glued to their cell phone.

But there are other ways that people could achieve the goals stated in your video. Perhaps an iPad that sits on a table by the guest book, where an app is running that lets people record their thoughts and wishes on video, or leave a doodle/drawing, a photo, or pick up the tablet and walk it around.

One of the things I hate about weddings and receptions are the camera crews which get in the way of my enjoyment, sticking their camera in my face and forcing me to be spontaneous and well-wishing on command. I'd like a way to maybe take a moment, sit in a quiet spot, and congratulate the couple. And camera crews inevitably miss great moments where people are being spontaneous and emotional -- in my opinion there is definite value to being able to memorialize some of these.

<comment><USER3> > Although stated in an assay way

Apologies, my son is planning his wedding, the proximity to personal irritation as a result of guests having cell phones out at an expensive function paid for by the family is palpable.

</comment></comment></comment><comment><USER5> I really appreciate your comments. It's very hard to explain an idea in a few words, so, what we want is to keep the engagement of the guests by learning a bit more about the bride and broom via games or fun activities during the wedding party. An added value will be to get gather the guests experience sharing their photos and videos.

<comment><USER3> > An added value will be to get gather the guests > experience sharing their > photos and videos

Doesn't this have the very real potential of causing the guests who don't have smart phones to feel left-out. Especially the senior family members?

</comment></comment><comment><USER6> This strikes me as spammy.

<comment><AUTHOR> We are currently working on this project for Start Up Weekend gathering feedback.</comment></comment>


Sign Up Forms Must Die - <AUTHOR> http://www.alistapart.com/articles/signupforms/

<comment><USER2> I can't agree more! I can live with having to sign up, if it's a fast process, but I hate long forms that take a long time to fill in.

Like the article says, it's much better to gradually ask information when you need it. And only ask the information that you actually need to do your job.

</comment><comment><USER3> Mint.com is probably among the worst offenders.

</comment><comment><USER4> Login forms must die as well!</comment>


Study shows Facebook most active Wednesdays at 3pm ET - <AUTHOR> http://www.huffingtonpost.com/2010/10/28/facebook-users-most-active_n_775505.html

<comment><AUTHOR> I'm not sure I would agree with the implication that this is the best time to post something. From the viral launches I've run (most recently through youtube.com/laughpong), around 10am ET tends to work really well (don't have enough data to talk about days, but Wednesday sounds pretty reasonable).

The advantage here is that at 10am ET most people on the east coast are at work, not asleep or commuting. If you can get a decent enough spike there, about an hour later people from the Central time zone will be in that same position, and then an hour later people from Mountain time. Then by 10am Pacific time there's another spike from Pacific time and from people on the East Coast starting to take lunch.

The "lunchtime spike" rolls from east to west coast like your initial spike, and by the time it hits the West coast, your "after work" spike is about to start.

By timing it right, you can potentially catch and ride all three waves of people who are looking for things on the internet. Just like in surfing, if you can catch the wave just right you can ride it for a long, long time. An essentially whole-day spike is a lot better than a massive spike over a very short period of time.

<comment><USER2> Does a video on your splash page help market things virally?

I feel like there are few things more irritating than a video of a founder or an overly cutesy animation explaining a new product being launched. How wrong am I?

The exception to my hatred for video is the Land o' Lisp video, that thing made my month.

<comment><AUTHOR> I think it can be boiled down to this:

Is the video interesting?</comment></comment></comment>


Ansible Vagrant Examples - <AUTHOR> https://github.com/geerlingguy/ansible-vagrant-examples <comment><USER2> I've worked with Ansible, but not with Vagrant. I was under the impression that Vagrant solved the same problem as Ansible. So what's the advantage of a hybrid Vagrant / Ansible solution instead of all-Ansible or all-Vagrant?

<comment><USER3> They don't solve the same problem; Ansible (as you must know) is for configuration management and remote execution while Vagrant is a set of tools around VMs to help with development.

I use them together for almost every project I work on, Vagrant spins up the virtual machine and Ansible sets everything up on it (as well as taking care of provisioning servers when I'm ready to deploy).

Small plug for my personal open source project using these two technologies (and many others): [https://github.com/johnthedebs/basicproject](https://github.com/johnthedebs/basicproject)</comment></comment>


Portal is the most subversive game ever - <AUTHOR> http://www.gamesradar.com/gb/pc/game/news/article.jsp?articleId=20071207115329881080&releaseId=2006071916229527001&sectionId=1006&pageId=20071207115724980042 <comment><USER2> I'm surprised at some of the hasty comments here. Sure, the article is wrapped-up in obscure academic language, but the main points are valid.

Portal is not like any other FPS. (This is obviously true, if you know anything about Portal.) The main claim is that FPSs tend to be "masculine", in many ways, and that Portal is unlike FPSs in those ways.

1\. In FPSs you have a gun that's meant for killing. In Portal you have a gun that doesn't inherently kill (but can be very powerful if used cunningly).

2\. FPSs typically have military or monster themes. Not so Portal.

3\. In FPSs you typically play a male character. When the lead is a female character she's super-hot and sexy and is meant for teenage guys to drool over. (Think Lara Croft.) Not so Portal, with a not-particularly-sexy female character, and she's not even on screen enough to drool over much.

4\. In FPSs you typically shoot bullets. In Portal you shoot portals. (And here the author makes an admittedly lame joke: "Heehee the bullets are penises and the portals/holes are vaginas".)

5\. In FPSs, the enemy typically wants to kill you. In Portal, the AI wants to emotionally manipulate you.

6\. In FPSs, you kill the enemy. In Portal, you outsmart the AI.

7\. In FPSs, you typically kill monsters/Nazis/terrorists. In Portal, you disable these cute little turrets by kicking them and knocking them over.

8\. In FPSs, your sidekick is some guy who's your best buddy. In Portal it's an inanimate block.

What the author is trying to get across is that Portal is unlike any other FPS, which is indisputable. The author's take is that Portal takes the quintessential "masculine" videogame, the FPS, and makes it a little less "masculine". I don't think that's too controversial.

<comment><USER3> I assumed the article was a joke. Yea it sounds about right but it draws no meaningful conclusions. Anyway, if you look at something like Metroid Prime you can see most of the assumptions don't really hold up across the FPS spectrum.

PS: Be careful when using "tend to be X" because you often end up saying thinks that are logically equivalent to "blue cars are blue."

</comment></comment><comment><USER4> _"Rather than skintight latex or a chainmail bikini, she wears a plain orange jump suit that is eerily reminiscent of those worn by prisoners in Guantanamo Bay."_

Way to read too much into the game. Half-life features a hero called Gordon Freeman who wears an orange armor body suit thing. She is trying to escape the lab, and Freeman was trying to escape the lab as well.

 _"The unobtrusive presentation of the female protagonist doesn't force a male gender perspective on the player as is the norm in FPS games."_

What is the writer talking about?? In most other FPS games you can't tell if the character is a male or not either. All you can see is a gun and hands. How is that forcing the male gender perspective on the player?

 _"she comes to represent man's attempt to construct an idealized mother figure through the cold logic of science"_

Ok, I'm done reading that clap-trap. Science always gets the shit end of the stick when lay-people discuss it. It's either evil and responsible for very bad things, or it's cold and it ignores people, or it's unnatural.

<comment><USER5> Agreed.

I'm not down on the humanities - I double majoried in CS and History. I _love_ the humanities - art, literature, history: these things are important.

Women studies are not among the "real" humanities - this is a made up, politically correct, politically slanted body of "study" that, without justification, denies the importance of most of the useful arts and sciences, an simultaneously congratulates itself (and its practitioners) on being far more clever-than-though.

Witness the very first sentence of the review:

> Warning: The text you are about to read contains heady intellectual > discourse and is not recommended for anyone made queasy by the discussion of > feminist film theory or psychoanalytical signifiers.

Oh, yeah, that review was chock full of "heady" intellectual discourse all right!

In fact, it was filled with the four or five common tropes of feminist / culture studies "deconstruction". I could write this crap in my sleep. Throw around the word "symbol" and "signifier", the word "privelege" or "Other" (must be capitalized) or "hierarchy" (or better yet "hegemony"), and talk about how up "subverts" down, wet "subverts" dry, red "subverts" green, and drop in one or two entirely irrelevant political references to the conservative devil of the hour (in the 1980s, this meant Reagan, in the early 21st century, it meant Rumsfeld or Bush, now it means Cheney or Bush, etc.), mix in a half cup of cheap Freudianism, and away you go.

Utter, utter, lazy, useless garbage.

<comment><USER6> It's clearly a very forced analysis, and, like you said, just drips with cliched, volumeless argument. That being said, I'm pretty sure it was posted with some degree of self-referential humor.

The idea of analyzing Valve games critically _is_ pretty good, though. They're one of the few studios which makes games worth analyzing! I'd like to see articles like those.

<comment><USER7> I can make a forced analysis of System Shock 2. Starting also with the broken pseudo-maternal AI that guide you through the first half of the game before _spoiler_ spoiler _spoiler_.

Within my limited experience with talking to artists and poets, I don't think artists deliberately set out to include specific symbols inside a work. Too much left-brained stuff. Which I find funny as a deconstruction essay requires you to spell out exactly what it is you are talking about. Kills the mood.

Yet most artists that are any good at their craft easily tap into something that hits you in the gut. I think Portals is one of those games. I have not played it, but I bet it does mess around in your head in ways beyond just messing with your sense of space-time. I wasn't too hot on playing it, however, after reading the article, I want get a copy now.

</comment></comment></comment></comment><comment><USER8> This article is hilarious.

For those who don't plan on playing Portal:

First let me say that you should reconsider. The game will break your brain.

Second, you should listen to the final song. It's so rewarding. <http://youtube.com/watch?v=Y6ljFaKRTrI>

Sung by a passive aggressive AI who you kill in the end. The AI and a weighted companion (an inanimate cube) are the only other characters in the game.

<comment><USER9> Thanks for the link, that's the best "demo" for i game I've ever heard/seen.

<comment><USER8> If you really want to start "thinking with portal", search for the challenge maps

<http://youtube.com/watch?v=MHC7Ld1oXaU>

</comment></comment></comment><comment><USER10> Excellent observations, however I think it's particularly cumbersome to attempt to explain its novelty in terms of masculine and feminine. It confuses both the game itself and the meanings of the term "masculine" and "feminine."

</comment><comment><USER11> Dear author,

The Cake is a Lie.

Portal is revolutionary but not for it's gender roles. It's revolutionary for turning FPS into a puzzle game on crack. Go back and play with the developer commentary.

Look at me still talking when there's science to do...

:)

</comment><comment><USER12> If you've got better things to do (like working on your startup), but want a satisfying 'pick up put down' diversion, Portal's the best thing you could probably pick.

</comment><comment><USER13> Also fun, but 2D: Flash Portal.

<http://portal.wecreatestuff.com/></comment>


Ask HN: Why are all these Rust related posts showing up on HN? - <AUTHOR> <comment><USER2> Because many of care about programming, and programming languages, and find Rust to be an interesting language. And because Rust isn't yet in the "old fogey" language category - it's still new enough that there are interesting aspects of it to explore that (for most of us) haven't already been explored a dozen times.

</comment><comment><USER3> It's hot right now. They're in the "ramping up" phase of popularity. Mainstream vendors are starting to take it seriously.

</comment><comment><USER4> Good-natured brigading. People who have put time into Rust have made a career bet that will only pay off once they can get a job somewhere using it. Others aren't programmers, but like the "better" and "safer" story that goes along with Rust, which allows for the signal of virtue when they evangelize.

</comment><comment><USER5> Because it ticks all the boxes of performance and safety. The community, documentation and tooling are also great.

</comment><comment><USER6> Interesting - I noticed a similar thing and asked: [https://news.ycombinator.com/item?id=23060724](https://news.ycombinator.com/item?id=23060724)

Doesn't seem specific to Rust, I noticed a similar dynamic around other topics over time.</comment>


Toxic Workers [pdf] - <AUTHOR> http://www.hbs.edu/faculty/Publication%20Files/16-057_d45c0b4f-fa19-49de-8f1b-4b12fe054fea.pdf <comment><USER2> This is a very naive analysis. It defines toxicity as propensity to be fired, only looks at big corporations, and uses self-reports in interview tests (like paper tests) as the independent variable.

I suppose the reason this piece strikes this community as so silly is that the general philosophy of the startup is that a group of 5 or 10 people can best multi-million dollar corporations because corporations are so inefficient. To turn to such a company's firing decisions as the source of truth of worker quality feels profoundly backward.

<comment><USER3> I think it's also because people on this community have worked at corporations where toxic workers aren't the problem--it's toxic managers.

If they are going to do a study on the impact of toxic workers on the workplace, surely they should do one on managers.

<comment><USER4> Psychopaths rise to the top. Until the human race finds a way of dealing with this, it will continue.

<comment><USER5> you first need to make the link between toxic managers and psychopaths, rather than throw out this trope without a second thought.

<comment><USER6> Aspects of a toxic manager:

* Grandiose sense of self-worth

* Pathological lying

* Cunning/manipulative

* Callous/lack of empathy

* Failure to accept responsibility for own actions

* Appears to do a lot of things, but in reality does nothing for the organization

</comment></comment></comment></comment></comment><comment><USER7> As common in studies of personality, the researchers perform a bait-and-switch in defining key terms. To ensure mass appeal, like a skillful astrologist crafting this week's horoscope, they introduce the term "toxic worker" as an employee who is "harmful to an organization", leaving the authors plenty of room to maneuver.

Unfortunately for the authors, today's scientific paradigm requires at least the semblance of a statistical analysis. Finding a numeric measurement for an aspect of human consciousness, such as "toxicity" (or how much of a jerk you are), can be quite difficult. For the empirical portion of the paper, the authors choose to define a "toxic worker" as one who has been fired for "an egregious violation of company policy" such as "sexual harassment, workplace violence, falsifying documents, fraud, and general workplace misconduct". In their data, 1 in 20 employees was eventually deemed "toxic".

While I'm sure most people can identify a jerk at the office, they might also tell the authors, "You keep using that word [toxic]. I do not think it means what you think it means."

<comment><USER8> Oddly enough, when I hear "toxic," it's usually associated with someone who manages to _avoid_ getting fired for misconduct.

</comment></comment><comment><USER9> The definition surprised me. I mean the actual definition, as it is used later, not the one presented in the beginning. First they say someone who does more bad than good is a toxic worker, but then they have some quite strange attributes to that, like someone being fired for toxicity (which often means he's annoying to the boss, not that he's toxic), or someone who steals office supplies (I don't know anybody who would even complain about that, as long as it's not in exceptional ammounts).

And finally they conclude you should always try to cut losers instead of fighting for winners. There is no game (in the sense of game theory, not child's play) in which "always" really makes you better than average. Sometimes everybody knows that someone is toxic but you can't cut him lose, because he is in a very specific position (e.g., the brother of your most important customer). Another time having that one super-star will put you forward by a dimension, not just a few bucks. "Instead of always do A better always do B"? No, both is wrong. Don't "always".

<comment><USER10> In terms of stealing office supplies, it boils down to intent. There's a big difference between taking pens home as part of work and not bothering to bring them back -vs- thinking "my kids need more pens for school" and then going out of your way to take them home. The former is mostly absentmindedness and isn't really stealing; the latter is an ethical failure and is stealing.

<comment><USER11> Just finished watching this video, it's closely related to what you're talking about, even mentions stealing stationary:

[https://vimeo.com/49462153](https://vimeo.com/49462153)

<comment><USER9> Interesting. Thanks! I watched quite a lot from that guy and always felt I learned something.

<comment><USER11> You're welcome ericb. Yeah, I think they're interesting as well. Like the art style too.

</comment></comment></comment></comment></comment><comment><USER12> This is one of those papers where the title sounds vaguely legitimate, but the underlying analysis is only tangentially related to the topic. Also, consider

 _" less attention has been paid to the question of how to manage those workers on the opposite side of the spectrum: those who are harmful to organizational performance."_

Which is complete rubbish--GE placed a huge focus on doing performance reviews and culling the "bottom 10%". A practcice which started a trend (called forced ranking) that grew to include many of the fortune 500, in cluding perhaps famously Microsoft.

Its either a bafflingly careless omission or a cynical gesture to pretend this topic is somehow "under the radar" in business school or corporate HR departments.

<comment><USER13> The GE-style ranking is looking at something else, people with poor productivity. This is looking at people who are productive in their jobs by the usual metrics you'd use, but are a liability for the company, due to a propensity to cut corners, break laws, embezzle, etc.

</comment></comment><comment><USER14> I read this study via the article [http://qz.com/563683/turns-out-toxic- coworkers-are-more-expe...](http://qz.com/563683/turns-out-toxic-coworkers- are-more-expensive-than-superstar-hires/) which pointed out the net savings between hiring a superstar vs firing a toxic employee, and I was more shocked that the numbers were so low for superstars. That a Top 1% person in their field can only deliver $ 5303 worth of extra value to their company over their whole period of employment? I mean I'm no superstar, but that seemed pitifully low just from my own experience of the right action at the right time by the right person being able to secure deals worth a lot for the company.

As per the paper:

"To generate a straightforward comparison of the value of each of these focuses, we quantify the value of a star performer by identifying the cost savings from her increased output level. That is, a superstar is a worker that adds so much value that without her a firm would have to hire additional workers (or pay for additional hours from existing workers) to achieve the same level of output as when they have that single superstar worker."

"We calculate the percent in increased performance for each of these performance levels and multiply it by the average worker salary, based on company records."

"For comparison, we report in the "Avoid a Toxic Worker" column the induced turnover cost of a toxic worker, based on company figures. Induced turnover cost captures the expense of replacing additional workers lost in response to the presence of a toxic worker on a team."

"Top 1% Superstar: $ 5,303 Avoid a toxic worker: $ 12,489"

"The data were obtained from a company that builds and deploys job-testing software to large employers. Many of these companies are business-process outsourcers (BPOs) that themselves provide a variety of business services (e.g., customer care, outbound sales, etc.) to their clients. The employees included in the dataset are all engaged in frontline service positions and paid on an hourly basis."

So these stats are coming from call center staff and telemarketing where there's a lot more priority on people following the script/process than showing flashes of brilliance. But all of that gets lost when it gets breathlessly repeated in the abstract or in articles referencing it.

<comment><USER15> i was immediately thinking the same thing: was john carmack's genius practically negligible for id software? how about fabrice bellard's worth (for telekom paris)? could have ten other average ("non-toxic") programmers achieved what they did?

</comment></comment><comment><USER16> HBS always writes about obvious things. This is known to anybody with more than 20 years of experience: toxic workers ("jerks") exists and they are mainly super stars. And they will raise in ranks (they will become managers, directors, etc.). But not necessary by growing the business.

And "toxicity" spreads. Spreads fast.

<comment><USER4> Earlier in my ex-companies life, they had a real low threshold for terminating someone who was toxic. As the other CEO's took over, company lost its customers, and became more financially stressed, the tolerance for wrongdoing increased until it was basically as the chart in the article stated with offences having to be pretty severe (bullying, sexual harrassment) to cause termination. It was almost like the company needed the toxic people to keep the lights on.

</comment></comment><comment><USER17> Three questions:

1\. Why are workers toxic? Is it something you're born with, or something that you have when you are hired? Is it unchanging, black and white, true or false—or can it change over time or be impacted by the environment?

2\. Given the answer to the above, what types of things influence workers' toxicity? Are you able to improve any of those things?

3\. Given that the time and focus of any team is limited, and assuming most of the improvements from question 2 actually impact everyone in the company positively, do you truly believe that handling toxic people is the best use of time for a human management team?

Fire when you need to, and ensure you fix mistakes quickly and with intelligence, but do not focus efforts on the bottom tier. Work to improve the environment that makes people "go toxic." Ignoring that environmental effect is the type of behavior that makes toxic _companies,_ which is the far greater problem, and should be the far greater concern.

We all know toxicity exists, and we've worked with people who, on the surface, don't belong anywhere near the company. But often the medium that breeds toxicity—the politics, fear, competition, in-fighting and more—is more important to tackle than the individuals themselves. There's a reason companies foster and hire people who tend toward toxic behavior; and there's a reason they act the way they do.

As W. Edwards Deming said: "Give the work force a chance to work with pride, and the 3 per cent that apparently don't care will erode itself by peer pressure."

</comment><comment><USER18> Is this a joke? I don't believe HBS would allow its logo to be placed on such obvious trolling.

<comment><USER19> Not sure if serious. I have no idea if this will engender downvotes for myself, but personally, I've always found HBS to do almost NOTHING BUT lend its name to pseudoscience twaddle and call it "business" or "management". Rest assured, in corporate life whenever you get some bullshit speaker spruiking some bullshit idea, a HBS paper is always eerily near.

Frankly I'm shocked they have the cachet they do...humans and their authority/prestige structures continue to fascinated me.

<comment><USER18> In my B-school program we did read lots of HBS cases and most of those were about objective things like "could the company have adopted a different marketing strategy" not "how can the company legitimize its political machinations in a totalitarian labor system" So I was giving them the benefit.

<comment><USER7> > "how can the company legitimize its political machinations in a totalitarian > labor system"

That's an excellent TL;DR.

</comment></comment></comment></comment><comment><USER20> Is there any proof to the value of questions relating abstracts like the following:

1\. I like to ask about other people's well-being

OR

2\. I let the past stay in the past

Choosing Statement 1 would give subjects a greater other-regarding score, whereas choosing Statement 2 predicts a subject to be self-regarding

</comment><comment><USER21> Very interesting, currently there is this post and " We all don't know what we are doing (cyberomin.github.io)" next to each other on the front page.

The whole idea that good leaders wing it and do their best, but that they can and should detect and weed out toxic workers and end their career with absolute certainty (because being declared toxic will be very hard to recover from) is a really interesting cognitive dissonance. Allow margin for error to good role model, but bad role model are intrinsically bad and unredeemable. I'm sensing straw man, posturing and feel good speech all the way down.

</comment><comment><USER22> This looks like nonsense, especially the hilarious costs/benefits calculated to the nearest dollar.

And yes, of course toxic management is more likely to be a problem, even though it remains curiously unstudied by the HBS.

Even so, I think the takeaway - don't hire self-aggrandising control freaks, no matter how talented they seem to be - is probably sound at every level.

Except possibly the CEO. (Was Steve Jobs toxic? Bill Gates? Haven't most toxic CEOs been disastrous for their companies?)

</comment><comment><USER23> What struck me is the fine line between superstars and toxic workers. More or less, they look much alike. The main difference seems to be how they're perceived by coworkers and management. And how that affects their attitude toward the organization. I would have liked to see more about the impact of management style on forking superstars and toxic workers.

<comment><USER4> I've always viewed superstars who are toxic as flawed. Superstars without toxic traits are rare. As the article states, you are most likely better off without the flawed superstars, the problem is, how do you come up with a consistent and effective way of getting rid of them?

<comment><USER17> A far better question is, how do you create an environment that helps flawed people improve?

Most people have flaws. It's 'consistent and effective ways for getting rid of them' that drives them crazy in the first place. One of many things that creates a negative feedback loop that drives a toxic culture, which breeds more "toxic workers."

<comment><USER4> 1\. I believe that termination for toxic behaviour is the only way to adjust the behaviour of these types of people. There's the PIP, but these individuals would quit if they were put on a PIP. These individuals aren't dumb, they will have F.U. money, and some of them would be financially independent.

2\. In electronics, that would be a positive feedback loop as it is reinforcing the behaviour. A negative feedback loop would reduce the undesired behaviour.

<comment><USER17> In behavior as well -- you are correct.</comment></comment></comment></comment></comment>


The Earth Belongs to the Living - <AUTHOR> https://nplusonemag.com/online-only/online-only/the-earth-belongs-to-the-living/ <comment><USER2> There are plenty of moral arguments both for and against an estate tax, but I think the economic consequences are more important. If you ask economists about the desirability of estate taxes, they say, "We don't know."[1] Maybe it will hurt economic growth. Maybe it won't. But if the tax is 100%, one thing is guaranteed: Lots of people will evade it. After all, what punishment can the government exact upon a soon-to-be-deceased parent?

That may not sound like a big problem, but remember what happened during alcohol prohibition. Criminal organizations made boatloads of cash from the illicit behavior of otherwise law-abiding citizens. Crime skyrocketed. Respect for the law plummeted. We see the same thing today (though on a much smaller scale) with many drug laws. There are a lot of risks that accompany the criminalization of normal behavior.

1\. Economics of estate taxation: a brief review of theory and evidence: [http://www.nber.org/papers/w15741.pdf](http://www.nber.org/papers/w15741.pdf)</comment>


Ask HN: Technical roles without technical interviews? - <AUTHOR> Well, I'm done with technical interviews (as a candidate). So far in this job search I've gone through the full interview process at close to 15 companies, and have done over 40 technical rounds in that time.<p>I just can't handle the stress, anxiety, and rejection any more. Is there a job out there that can take advantage of over a decade's worth of software engineering experience but that doesn't have a technical interview portion? <comment><USER2> Honestly, I think it's a sign of the times. We might be at the peak here. I have recently interviewed at a couple of "AI" labs at banks and some MLE positions at insurance companies and one startup, and they are all requiring leetcode. Most of them have asked dynamic programming questions and expected working solutions in 20 mins. IMO it's a sign of higher supply than demand. I think it's about to get much much worse with many companies moving to remote work, meaning we are competing with folks in countries like India (no offence meant here, it's just a product of the education system) who are much hungrier and will literally do every possible Leetcode problem out there.

I think we are about to experience a tech bubble bursting type of situation (especially given the over inflated valuations + ridiculous stock prices of FAANG), meaning much less jobs, much higher competition and a whole world of pain, which will result in many folks leaving this profession (especially those with little experience and with no real formal education).

Now with the emergence of things like GPT-3 expect further automation of annoying software dev tasks and a lot of front end roles transforming or going away entirely. I think future devs will need more ML exposure and experience as that will become a standard part of the job soon enough, and we might enter an era of growth after the bust with much more ML integration into products and new companies forming around that.

In 5 years, the world of software dev will be a different place.

In the meantime, take a vacation, relax your brain, understand that most of us are getting rejected and it has little to do with our skill, and get back to leetcoding if you want those high paying cushy jobs. Use the smaller companies who insist of pretending they are FAANG as practice, and aim for FAANG my friend.

That's the best advice I can give because I feel the same pain and that's what I'm doing.

<comment><AUTHOR> Thanks for the comment. I pretty much feel the same way as you, especially the bit about a higher supply than demand and the expectation that it will only get worse.

I appreciate the advice of relaxing for a bit. Although I wouldn't want to wish this on anyone, it is a bit relieving to hear that others are experience something similar. Best of luck to you

<comment><USER3> Yes I'll second this. I've been through interviews recently and, given the current climate, it's pretty gruelling compared to this time last year.

Most of them had 3 stages and a technical task that was expected to be your best work ever.

You're not alone in feeling this way so just stick at it until the right role comes along. Read, study and improve in the meantime while you prepare for each interview. You'll come out the other end a stronger engineer.

<comment><USER4> I'll say that I've dipped my toes recently as well, and sense it might be a real buyers market.

I also could just suck. Like all things, the answer is probably some combination.

</comment></comment></comment></comment><comment><USER5> I have a mitigated opinion about technical interviews. I know several companies hiring mostly in the employees' network, so technical interview is not really necessary. Good references are far better than any whiteboard test.

On the other end, by hiring only in your network, the result is often companies lacking diversity. If you only work with people you know, you'll probably work with people from the same schools, same social class, same experiences, etc. as you. At least technical interviews are more objective and give a chance to people with diverse backgrounds.

We can probably find a proper mix between network and technical interviews. In my opinion the technical interviews should be here to select candidates as a prior step to any other interview. So they should be quite easy. (I'm always surprised by the proportion on candidates to fail in very easy technical tests.) The true candidate evaluation should be done according to soft skills: ability to communicate, curiosity, desire to learn and help people, etc.

<comment><AUTHOR> Makes sense to me, thanks for the perspective.

</comment></comment><comment><USER6> This must be an American thing. In Europe it's pretty rare to find tech companies that do whiteboard questions and/or leetcode. The usual standard is one meeting with HR and the head of engineering (and/or a senior engineer) that ask you: tell me about yourself, what do you think about OOP, distributed systems, how to scale servers, Solid principles and some common patterns. If any, they invite you to an on-site meeting with the team to see if the team likes you... and that's all.

I'm not talking about FAANG (because, honesty, 99.9% of us don't work/will never work for a FAANG. And this includes HN folks as well. So it's pretty useless to take FAANG as examples of anything).

<comment><USER7> How many interviews have you done like this? I am in Europe and my graduate interviews were similar to this but I assumed more experienced interviews would be more leetcode style..

</comment></comment><comment><USER8> I can't speak to the quality, but I've seen this "no whiteboard" job posting website mentioned before: [https://nowhiteboards.io/](https://nowhiteboards.io/). That being said, it seems like many of them (at least on the front page) still require pair programming and/or a take home assignment.

<comment><USER9> I can verify that at least some of those companies listed there have whiteboarded/leetcoded me.

</comment></comment><comment><USER10> I also feel it is frustrating. I have some good experience, lead a team of seniors and implement very complex software solutions in a big company.

Still, when I send a CV, I receive a leetcode challenge that I have no desire to study for and that doesn't represent my skillset or what I will be working with.

Is frankly very upsetting. That is before even talking with a human being.

</comment><comment><USER11> > I've been interviewing non-stop for a few months. For a few months prior to > interviewing I watched computer science lectures online, read CTCI, and had > a premium Leetcode subscription with a good amount of practice.

> I haven't done mock interviews with a friend, but I did pay for a few mock > technical interviews.

Chances are that, given such extensive preparation, it's not really the technical part that is the problem, if you haven't been able to get an offer after going through a full process at 15 companies. Of course, it might be a severe case of bad luck, but I'd bet that your anxiety and stress are somehow leaking through. Did you self-reflect on that, and if yes, what are your thoughts?

</comment><comment><USER12> The easy answer you might not like: interview at small places that don't have a lot of existing technical experience and don't pay very well. I've had 3 jobs now at small agencies (3-4 devs) that paid under $100k and none of them required any sort of technical interview. One looked at a project I had on Github and asked me to talk about it for a bit. Another just hired me without any real proof of my ability, just what I said I could do. Another just asked general interview questions. If you're fine building CRUD apps all day every day for sometimes pretty dumb projects with often dumb technology choices and no opportunity for upward advancement, it's a fine job.

</comment><comment><USER13> Well, there are three ways you can do this, at least from what I've seen/heard.

1\. Become enough of an expert/authority in your field that you're hired on the work you've done in the past. If you're a superstar that invented a game changing JavaScript framework or open source project used by millions, people aren't gonna throw you into a technical interview before hiring you.

2\. Find companies your friends/acquaintances work for and get the job through your connections rather than a formal interview process.

3\. Apply for jobs at smaller or less technically focused companies where interviews are a bit more traditional (and often come down to a quick chat over a coffee or something).

<comment><USER10> 1\. Become enough of an expert/authority in your field that you're hired on the work you've done in the past. If you're a superstar that invented a game changing JavaScript framework or open source project used by millions, people aren't gonna throw you into a technical interview before hiring you.

That depends. There's the case of the person who wrote brew being asked technical questions to work at Apple.

In smaller fields, maybe. In FAANG I believe you would still go through the pipeline.

On (2) likewise for a FAANG

</comment></comment><comment><USER14> Hey I think you might be referencing to no white boarding. The easiest way to do this is to show your technical ability which might give the interviewer the confidence that you are the right one and leverage your network because that always helps.

You can show your abilities by building side projects,communicating the communities,writing blogs or even contributing to the open source communities

<comment><AUTHOR> Thanks for the comment. Those are some good areas where I can show my expertise.

</comment></comment><comment><USER15> Are you saying you went through the leetcode/hackerrank daily preparation routine for a couple of months, but you are still getting nervous during interviews? If so, why do you think that is? Are you comfortable solving those programming puzzles outside of the interviews? Have you timed yourself? Have you done mock interviews with a friend?

<comment><AUTHOR> I've been interviewing non-stop for a few months. For a few months prior to interviewing I watched computer science lectures online, read CTCI, and had a premium Leetcode subscription with a good amount of practice.

I haven't done mock interviews with a friend, but I did pay for a few mock technical interviews.

I much prefer technical assessments that are related to the day-to day. In either case, I'm much more comfortable working alone than I am with someone watching in an interview. I've only ever worked alone and in these interviews I have a hard time concentrating.

I'm not someone who can talk out loud and code at the same time. When I'm coming up with a solution I think about a potential solution, recognize why it won't work, and then go on to the next idea. I feel like this happens rapidly in my head, but if I were to "talk out loud" I would just be constantly saying why things won't work and it would take so much longer to get to the final idea.

It's kind of like how if you were to loop through 100K items in the console. If you don't output anything to the screen it's really quick, but when you start printing the number it takes longer to run.

But really, I just feel like leetcode style interviews don't touch the surface of my working experience and capabilities at all, and only focus on a very narrow thing.

I realize this is where the industry is right now, so I'm looking for roles that aren't a "programmer" but still benefit from my programming experience.

<comment><USER15> _I just feel like leetcode style interviews don 't touch the surface of my working experience and capabilities_

When you play a game, and encounter a particularly difficult level, do you also feel like you don't have the skills needed to pass this level and therefore you should just give up? Treat the interview process as a game. Everyone plays the same game, and some people are better at it than others, but it's just that, a game. Try to have fun with it. After all, you became a programmer because you enjoy solving technical puzzles, right? Maybe having to solve a puzzle with a timer, and with someone watching you is making you uncomfortable, but it still involves doing what you love and what you're good at. If you can't change the world, change your attitude.

By dismissing companies hidden behind this interview practice you eliminate the majority of good SE jobs. You potentially trade a bad interview experience for a bad job. Is this a good trade?

</comment></comment></comment><comment><USER16> What sorts of companies are you applying to? And where? I consider myself to be about average in technical skill and I don't have much trouble passing interviews at good companies in the US South. I know I wouldn't be able to make it in the Bay Area so I don't apply to jobs there.

<comment><AUTHOR> All of the positions have been remote (US), and I suppose a lot of them are headquartered in SF or NY. The companies I tend to apply are pre-ipo startups.

I have been rejected by FAANG, but I'm not surprised. I knew those were long- shots, I guess I'm surprised that in reality the others were long-shots too.

I kind of have a feeling that everyone who has hired me in the past feels they made the right decision, but also everyone who hasn't extended an offer feels the same way.

<comment><USER16> SF and NY are already competitive enough but remote positions make it 10x worse. If you're really insistent on remote work for a startup try to focus on Nashville, Charlotte, and Atlanta.

<comment><AUTHOR> Thanks for the tip

</comment></comment></comment></comment><comment><USER17> Go for a midlevel dev position at a non-tech company. Manh of them will not require leetcode. You will probably need a pay cut though.</comment>


BitTorrent starts streaming DJ sets to test live P2P - <AUTHOR> http://gigaom.com/video/bittorrent-studios-dj-sets/?utm_source=dlvr.it&utm_medium=twitter

<comment><USER2> Interesting. I heard that spotify uses some P2P technology, but since it's got such a huge database and people are listening to different things, then I guess they just leverage the users to basically send files to each other. In this case everyone is receiving the same stream live, so I guess it requires quite complex messaging management.

I'm imagining that clients check the tracker to find other clients, select a pool of peers, and then divides up a sequential list of stream blocks, requesting one from each. Still, this would depend on connecting to peers that are not too many hops away from the source, so some kind of tiering must be managed as well.

</comment><comment><USER3> I look forward to seeing more technical information on the streaming P2P protocol. Seems like it would require significant changes to the basic torrent protocol to get the next bits needed without a huge buffer and time lag.

<comment><USER4> I noticed that my BT client (µTorrent) already has a 'STREAM' button on downloading torrents.

<comment><USER3> That would violate the bittorrent protocol, which explicitly says that clients must not bias their choices of chunks. And consider that if all clients did so, the peer-to-peer mechanism would stop working for the later chunks.

<comment><USER5> [http://torrentfreak.com/bittorrent-p2p-live- streaming-110119...](http://torrentfreak.com/bittorrent-p2p-live- streaming-110119/) has a longer story (from earlier this year).

I hesitate to say it has more details though...

</comment></comment></comment></comment><comment><USER6> BitTorrent Inc has been around forever. Is this a new product or new marketing?

<comment><USER7> A new product. They've developed a reasonably low latency P2P streaming protocol for delivering live events.

<comment><USER6> I thought they had something similar a few years ago that they were licensing.</comment></comment></comment>


Xz, gzip, lz4, bzip2 cost/benefit log/log graph - <AUTHOR> https://docs.google.com/spreadsheets/d/1l1roiLsTrWwKhU8Vj6XF-w5J1GlrszZ1CxMgfZ1-XDo/edit?pli=1#gid=1124023795

<comment><AUTHOR> lz4 is ridiculous, and xz -0 is in a world of it's own. Different corpora will behave differently of course, but the overall shape will likely remain similar.</comment>


Byte-Monkey: Fault injection for the JVM - <AUTHOR> http://probablyfine.co.uk/2016/05/30/announcing-byte-monkey/ <comment><USER2> On the GitHub page it lists these modes:

        Fault: Throw exceptions from methods that declare those exceptions
        Latency: Introduce latency on method-calls
        Nullify: Replace the first non-primitive argument to the method with null

The first two seem useful. The last maybe less useful depending on how you design your project. For example, I commonly disallow null to be passed as a method parameter for internal methods. External APIs will null-check, but all internal logic expects to never be passed null. Still might be useful since you can restrict the scope of it's instrumentation on a package level.

<comment><AUTHOR> Author here - the project did originally just have fault and latency modes, and the last one came out of discussions with a colleague about other failures that might be interesting.

I'm looking for more failure modes to add, so if you can think of any more send them my way!

<comment><USER3> \- Extend the time code spends in a synchronized block

\- Throw OutOfMemoryException randomly

<comment><AUTHOR> Pausing within a synchronized block to exaggerate slowdown sounds really interesting - and would provide a great opportunity to learn about how locking works "under the hood" :)

</comment></comment></comment></comment><comment><USER4> This looks super useful for making things super reliable e.g., your core service kind of thing. Also if you are writing sort of critical high perf libraries/utility like a resource pool, cache, transaction manager .. the latency & fault looks specially good.

Nullify looks more interesting as a general code reliability check tool specially with the @NotNull thing another commenter mentioned.

</comment><comment><USER5> Haven't tried Byte-Monkey, but have experimented with Byteman [http://byteman.jboss.org/](http://byteman.jboss.org/) which I find to be quite handy in debugging the tricky to reproduce issues

</comment><comment><USER6> I've done a bit of monkey patching for the JVM and I know it's quite the pain in the ass.

Kudos to you op for making this work. Great job! I might give this a try some time soon.</comment>


HyperStealth, Designing camoflage using customized graphics program - <AUTHOR> http://hyperstealth.com/

<comment><AUTHOR> The link to the companies homepage. HyperStealth was featured in wired.com article here: [http://www.wired.com/design/2012/06/how-hyperstealths- algori...](http://www.wired.com/design/2012/06/how-hyperstealths-algorithms- build-better-camo/)

While you can dispute the purpose, the approach is remarkable.</comment>


An Interview with David Moon and Daniel Weinreb - <AUTHOR> http://blogs.azulsystems.com/cliff/2008/11/a-brief-conversation-with-david-moon.html

<comment><USER2> As Click discusses in his Google tech talk (<http://www.youtube.com/watch?v=5uljtqyBLxI>) Intel could implement a hardware read-barrier and radically change the GC performance picture for commodity systems.

<comment><AUTHOR> There are many things CPU designers _could_ do to improve high-level language performance. (See: <http://www.loper-os.org/?p=46>) However, they will do none of them. The "we shall build C/C++ machines forever" dogma continues to rule with an iron fist.

There "is no market" for high-level-language-friendly silicon, because there is no software for it, because there is no market...

<comment><USER2> Actually, there has always been vigorous interaction between OS and chip designers. See VM evolution, performance counters, matrix/vector operations.

I think read-barrier support, as a proven technique (see the same video for transactional memory as a functional bust) is on the cusp of acceptance.</comment></comment></comment>