Goldman Sachs says it won't do an IPO without at least one "diverse" director - <AUTHOR> https://techcrunch.com/2020/01/23/goldman-says-it-wont-take-companies-public-without-at-least-one-diverse-director-heres-what-it-should-have-said/ <comment><USER2> I dont understand why we cant look at the person and their merits/experience vs their sex and color of their skin.

Different perspective is good, but sex or skin color should never be a deciding factor.

</comment><comment><USER3> Key quote: "Starting on July 1st in the U.S. and Europe, we're not going to take a company public unless there's at least one diverse board candidate, with a focus on women," [CEO] Solomon said...

So apparently a white woman would be better than a black man? That's a lot of cringe for one sentence.

</comment><comment><USER4> This topic got some momentum on here

[https://news.ycombinator.com/item?id=22137232](https://news.ycombinator.com/item?id=22137232)</comment>


To reach Mars, SpaceX is trying to buy up a tiny Texas community - <AUTHOR> https://www.latimes.com/business/story/2019-10-01/spacex-mars-boca-chica-texas-buy-out <comment><USER2> I wonder how many greedy holdouts will emerge? Faced with greedy holdouts Musk may say fuckit and move on rather than be held up at gunpoint - as it were.</comment>


J002E3 - <AUTHOR> http://en.wikipedia.org/wiki/J002E3 <comment><USER2> > One explanation could have been that it was a 30-meter-wide piece of rock, > but University of Arizona astronomers found that the object's > electromagnetic spectrum was consistent with white titanium dioxide paint, > the same paint used by NASA for the Saturn V rockets.

I know this is a really old thing but the idea that we can determine composition of the surface of an object from so far away simply by looking at the light it reflects is absolutely incredible to me. Very science fiction. :)

<comment><USER3> This is a pretty fundamental part of astronomy. Just look at what you can do with Fraunhofer lines ([http://en.wikipedia.org/wiki/Fraunhofer_lines](http://en.wikipedia.org/wiki/Fraunhofer_lines)). They are an almost steganographic signature written into the elements.

And more generally spectroscopy: [http://en.wikipedia.org/wiki/Spectroscopy](http://en.wikipedia.org/wiki/Spectroscopy)

<comment><USER4> Just to reinforce jgc's point: this object was not "far away" by spectroscopy standards. You can use the same technique for looking at the most distant stars and galaxies in the sky.

When people talk about Hubble (the guy, not the telescope) detecting the expansion of the universe by looking at redshift from distant galaxies, what he was actually looking at were spectral signatures. He saw all the patterns he expected to see from burning stars, but the lines were smeared out. Because he knew the patterns always form a consistent picture of the atomic structure, and he understood the doppler effect, he was able to estimate the distances of those objects quite accurately. Amazing stuff.

<comment><USER5> Not quite. From the doppler-shifted spectrosocopy lines, we can figure out what speed everything is moving relative to us, but that by itself doesn't tell us anything other than their speed.

Noting that _all_ the doppler shifts of other galaxies are red-shifts tells us that all the galaxies are moving away from us, but it still doesn't tell us whether speed correlates to distance in any way.

Figuring out the distance of galaxies is a different matter entirely, and is done with standard candles[0].

It's from the standard candles that we can measure distance, and only once we know the distance that way can we make a correlation between speed and distance, from which we see that the further away a galaxy is, the faster it is receding.

Only once we have found that there is a speed/distance curve can we estimate the distance to an object based on its doppler shift. We can't get it from the doppler shift alone.

[0] [http://en.wikipedia.org/wiki/Cosmic_distance_ladder#Standard...](http://en.wikipedia.org/wiki/Cosmic_distance_ladder#Standard_candles)

</comment></comment></comment></comment><comment><USER6> Oh, for _fuck 's_ sake, mods. There was a useful, informative, uncontroversial title here, and you've turned it into something meaningless. You've actually made it _more_ clickbaity. Stop doing this, for the love of all that is good.

</comment><comment><USER7> Original title:

        J002E3 - piece of Apollo 12 returned
                 to Earth orbit after 31 years

That was much, _much_ more useful and informative.

</comment><comment><USER8> For those interested, NASA's Jet Propulsion Lab runs a telnet server that provides information about objects like this via its HORIZONS system.

To avoid an onslaught of HN traffic to the telnet server, I will just say to go to ssd.jpl.nasa.gov, and click through to find it. Once you're telnetted in, enter J002E3.

</comment><comment><USER9> My Kerbals will be honored to know that even NASA loses track of used stages. :)

</comment><comment><USER10> Apollo 12 was struck by lightening shortly after launch. I wondered initially if this was the reason for the "extra long burn of the ullage motors".

But according to the Apollo 12 wikipedia page: "a small error in the state vector in the Saturn's guidance system caused the S-IVB to fly past the Moon at too high an altitude to achieve Earth escape velocity".

[http://en.wikipedia.org/wiki/Apollo_12](http://en.wikipedia.org/wiki/Apollo_12)

</comment><comment><USER11> > ...the object's electromagnetic spectrum was consistent with white titanium > dioxide paint...

Isn't this just a fancy way of saying that it was white?

<comment><USER12> No. It means it, spectroscopically, looked _specifically_ like titanium dioxide paint, and not just any arbitrary white material. Its spectral lines were consistent with titanium dioxide.

[http://en.wikipedia.org/wiki/Spectral_line](http://en.wikipedia.org/wiki/Spectral_line)

</comment></comment><comment><USER13> The see-also links below this article are pretty interesting too.

</comment><comment><USER14> Now this is a much clearer title!

<comment><USER7> Sarcasm?

</comment></comment><comment><USER15> Godspeed, J002E3. Next time you come back around, we'll bring you home.</comment>


Flock, Private Contact and Calendar Cloud Sync for Android - <AUTHOR> https://whispersystems.org/blog/flock/ <comment><USER2> Anyone remember the social web browser, Flock? I wonder if there is a minimum time before these names can be re-used.

</comment><comment><USER3> Is there any way of getting this to work with Syncthing or BitTorrent Sync so I don't have to use a 3rd party server at all?

</comment><comment><USER4> FYI, for those who absolutely do not trust the cloud, a similar tool based on sync with Thunderbird is Birdiesync ([http://birdiesync.com](http://birdiesync.com)).

</comment><comment><USER5> Great stuff. This is important work to get everything end-to-end encrypted. Any updates on how the integrated messaging up is coming along, and whether we're still getting a desktop app/extension soon, too?

I'd love for nothing else than to give up using Hangouts, but I use it a lot to talk to people from my computer to their phones, and right now apps like Whatsapp or TextSecure are no go for that. Hopefully there will be a solution for it soon.

<comment><USER6> WhisperSystems are working on a web based TextSecure [https://github.com/WhisperSystems/TextSecure- Browser](https://github.com/WhisperSystems/TextSecure-Browser)

</comment></comment><comment><USER7> Will Flock sync calendars and contacts from multiple accounts, e.g., my personal Google account (gmail.com) and my business account (privatedomainIown.tld)?

If yes, I will sign up right away.

Next question: What about sync with CRMs, e.g., SugarCRM or 1CRM (or others, that's cool too)? I need two-way contact and calendar sync between my CRM and my Android device, I would pay you more than $5/year for it.

<comment><USER8> I'm trying it out for 30 days. So far this is what I've found. I'm syncing out of google into flock. My plan is to at some point delete all my contacts and calendars out of google. But we'll see. Yes it does allow syncing multiple accounts. And multiple calendars from the same account as well. Groups are not supported (yet as of v0.51) but hopefully this will change in the future.

Not sure about the answer for your other question.

</comment></comment><comment><USER9> Somewhat off-topic but when can we expect a release of TextSecure for iOS?

<comment><USER10> They are working on it [1]. Behind schedule so they're anxious as well.

[1] [https://twitter.com/jmathai/status/491294401579077634](https://twitter.com/jmathai/status/491294401579077634)

</comment></comment><comment><USER11> Can I host a Flock server and charge money for it myself? Many people may not like having to sync their data to servers in the USA, even if the data is encrypted.

<comment><USER12> The Android Flock client works with any standards compliant WebDAV/CardDAV/CalDAV server. There is nothing stopping anyone from running a server of their own, at which point you can do anything you want with the server including charge for its use.

</comment></comment><comment><USER13> Can someone explain me the difference between google sync services vs Flock? In either case, the data leaves the device.

<comment><USER14> With Google Sync, the servers have access to your plaintext data. This means that Google Inc, the engineers at Google with access to the servers, any attackers that compromise Google's sync servers, or any governments that compel Google to provide them access to the servers, all have access to everything (photos, contacts, calendar entries, documents, etc.) that you sync.

With Flock, the data is encrypted with a key that only the user knows before being transmitted to the server. This means that nobody with access to the Flock servers can see your data.

</comment></comment><comment><USER15> 1\. Do I disable Google Sync services (gmail, cal, and contacts) and replace it with Flock? 2\. Is my contact list and cal events empty until I enter a password to unlock them?

<comment><USER14> 1\. You can replace your Google sync account with Flock if you choose. You can import data from a Google account into your Flock account without destroying or altering the data in your Google account.

2\. The Flock encryption is used for transmitting data to/from the server. On the device, we let the Android permission system take over from there, so you don't have to enter a password in order to see your contact or calendar items. Your workflow remains the same as before.

<comment><USER16> I will definitely pay for this, if it works well. Contacts and calendar sync are very important to me, and nothing else does it as well as Google, right now (as far as I know).

Feature request: Please support contact checkpoints. Some app accidentally deleted all my contacts once, and the only thing that saved me was Google's "restore contacts as they were X time ago" feature.

</comment></comment></comment><comment><USER17> I love that there are creative artistic people out there that care about privacy and owning your own data. There are tons of great apps out there that basically do this like CalDAV/CardDAV sync [1][2], but they aren't beautiful like this one.

I like beautiful design, especially on my phone but I like owning my data even more. This is truely a great product.

Edit: I see this is encrypted as well. I really need to dive into this! Cool beans!

[1][https://play.google.com/store/apps/details?id=org.dmfs.cardd...](https://play.google.com/store/apps/details?id=org.dmfs.carddav.sync) [2][https://play.google.com/store/apps/details?id=org.dmfs.calda...](https://play.google.com/store/apps/details?id=org.dmfs.caldav.lib)

<comment><USER18> Not sure if the Twitter acquisition has any part in this, but worth pointing out: [https://whispersystems.org/blog/welcome/](https://whispersystems.org/blog/welcome/)

EDIT: Having said that, MAN I love these folks. I wish they got along better with the F-Droid community[1], but hopefully that will eventually get sorted out :)

[1]: [https://github.com/WhisperSystems/TextSecure/issues/281](https://github.com/WhisperSystems/TextSecure/issues/281)

</comment></comment><comment><USER19> I've had mixed success with CalDAV connectors for Android and a self-hosted server. The apps that I bought didn't support self-made certificates very well, or not at all (certificate pinning would be ideal).

The best way was to create a new CA certificate and use that to sign the server cert. But after installing the new CA cert on Android, I got a non- removable notification that my calls and data might be monitored. I did this on the train to a "hacker" congress, imagine how surprised I was about the warning...

Can anybody recommend a CalDAV/CardDAV server? What does the hosted Flock service use?

<comment><USER20> That warning is really irritating, and I get the security concern but the fact that there is no way to silence, minimize, or otherwise hide that notification _in any way_ bothers me.

I don't understand why there is no way of telling it "yes, thank you, _I_ put it there, shut up already, even for a short while!".

<comment><USER21> I read somewhere that it's a known bug that is being addressed. I'd like a fix too. My company wifi requires a cert installed and now the warning pops up on a regular basis.

</comment></comment></comment><comment><USER22> I'm trying it out now. Took 5min+ to sync my 180 calendar events and is taking forever (it seems right now) to sync my 1000+ contacts. I will try out for 30 day free trial, but I will only be paying the $5 yearly subscription if they allow distribution on the F-Droid repository since I prefer to not have Google Play on my phone. Open Whisper Systems has been frustratingly adamant about not wanting to distribute TextSecure on F-Droid as it doesn't do auto updates because they want to fix all bugs quickly (although current versions do notify when updates to apps are ready). Until then will be sticking with ownCloud.

<comment><USER23> The F-Droid thing will certainly will not happen.

Moxie, one of the core developers of the WhispherCore products, had a pretty argumentative debate on their forum and his own Github issues regarding their repackging of his software TextSecure. It was subsequently removed, due to his indirect request (he went so far as to say he did not approve, but did not directly instruct them to do so). Despite their workflow and licensing, he believed it to be a step backwards in security as he takes issue with phone rooting and other things (if I recall correctly).

Long story short, it is a safe guess you will not see any WhisperCore products on F-Droid anytime soon. Moxie et al. say compile and patch yourself, or use the Play Store (for the faint of heart).

One reference here:

[https://github.com/WhisperSystems/TextSecure/issues/281#issu...](https://github.com/WhisperSystems/TextSecure/issues/281#issuecomment-21762482)

UPDATE: Maybe I missed something entirely as you mentioned your obvious knowledge of the F-Droid spat. Will leave it here for others though. Clumsy reading on my part, sorry.

<comment><USER22> Yup. I'm one of those that has to recompile text secure whenever there is an update. I'm hoping once F-Droid implements auto reinstall of updated apps, then moxie will permit builds on F-Droid.

Point of correctness: F-Droid does not require root privileges to install, just that user allows "untrusted" sources in android settings. Most F-Droid apps don't require root privileges. Google play on the other hand is full of malware.

<comment><USER23> I know that to be the case, I was cribbing something I read from Moxie on the F-Droid Forum where he presented his view of Cyanogen, which was pretty inaccurate.</comment></comment></comment></comment>


Why Third Parties Don't Ever Succeed - <AUTHOR> http://www.theatlantic.com/politics/print/2012/03/the-inevitable-quadrennial-third-party-shooting-star/255107/

<comment><USER2> The article doesn't even describe the electoral reality: our first-past-the- post (also knows as plurality) voting system [1] mathematically suppresses any but 2 parties.

Condorcet laid this out in 1893 [2], and Arrow [3] improved on it. Wikipedia has a bunch of information on this.

One can easily only come to the assumption that, like the electoral college, the voting system in the USA has been designed (or co-opted) to prevent actual democratic representation. Of course discussion of such is "conspiracy theory".

[1] <http://en.wikipedia.org/wiki/First-past-the-post_voting> [2] <http://en.wikipedia.org/wiki/Voting_paradox> [3] <http://en.wikipedia.org/wiki/Arrow%27s_impossibility_theorem>

</comment><comment><USER3> There is a nice series of YouTube videos on this topic on the C.G.P. Grey Explains channel.

One specifically illustrates why the first-past-the-post system inevitably becomes a two-party system: <http://youtu.be/s7tWHJfhiyo>

You can then click through to other videos on topics such as alternative voting systems, gerrymandering, and the electoral college.

</comment><comment><USER4> > America has not seen a long-lasting national third-party movement in its > history, and it won't be seeing one now.

I don't agree. True, it's been a long time. The Democratic and Republican parties have dominated U.S. politics for over 150 years. But the country is older than that. Before the mid-1850s the Whigs were a major force; the Republican Party started as a "third party". So, earlier, did the Whigs, eventually displacing the Federalists.

It is true, however, that the U.S. has never seen three major parties being powerful at the same time. When a new party has become powerful, an old one has always faded away, leaving just two.

<comment><USER5> The Republican Party did start as a third party, and it might be useful to look at how they succeeded:

[http://thinkprogress.org/yglesias/2011/08/06/289913/gop- as-t...](http://thinkprogress.org/yglesias/2011/08/06/289913/gop-as-the- exception-that-proves-the-rule/)

They managed to convince a lot of incumbent politicians to jump ship and join the Republican Party.</comment></comment>


Cryptography Dispatches: Hello World, and OpenPGP Is Broken - <AUTHOR> https://buttondown.email/cryptography-dispatches/archive/cryptography-dispatches-hello-world-and-openpgp/ <comment><USER2> Can we stop saying that pgp is busted and just talk about how the keyservers are the problem with how people decides to exchange keys ?

I don't use key servers. So when I get an encrypted message from my friend I have no issues.

Allowing a third party such as a key server to play some role in veifiing the authenticity of a key is basically broken from tht start, and has nothing to do with pgp it's self.

<comment><USER3> Isn't keybase.io trying to solve this?

<comment><USER4> They decided to bolt on sending cryptocurrency to people they haven't KYC/AML'd instead.

</comment></comment></comment><comment><USER5> > At least at some points we need proper transactional behaviour and Sqlite > implements that by talking a temporary copy of the database - not an option > for large keyrings.

I don't understand how GPG maintainers think they can implement something better (function and performance-wise) than a proper database engine. Also I don't think GPG will ever need to handle keyring lager than 140TB [1].

[1]: [https://www.sqlite.org/whentouse.html](https://www.sqlite.org/whentouse.html)

<comment><USER6> I'm pretty sure SQLite doesn't implement transactions that way anyway. That's a pretty bad misunderstanding of how it works. I suppose it's easy to think you can do better than SQLite if you think SQLite is really bad.

<comment><USER7> SQLite never implemented transactions that way, neither in undo nor WAL mode.

Someone might have misunderstood how undo logging / rollback journals work. Only pages to be changed are recorded in the rollback journal, not the entire database.

</comment></comment></comment><comment><USER8> Very nice article, I'll definitely subscribe!

> For example, it was never clear to me whether signing a key meant that I'd > verified the person's identity, or that I then trusted them to verify other > people's identities.

Signing means you verified identity. Trust to verify (also called ownertrust) is controlled by a different setting and you can trust someone to verify other keys fully or marginally (or not at all if you know someone is controlling given key but does not verify others well). See this excellent post for details: [https://www.linux.com/learn/pgp-web-trust-core-concepts- behi...](https://www.linux.com/learn/pgp-web-trust-core-concepts-behind- trusted-communication)

<comment><USER9> I think he understands that in general. The problem is that, in practice, the "web of trust" depends on significant numbers of users trusting _other_ users to verify _still other_ users on their behalf, which is in practice something most people are (or should be) loath to do.

<comment><USER10> I think we need to rely on this at some point, though. If my friend Alice introduces her friend Bob to me, that's my only way of determining that when Alice is talking about Bob, it's _this_ Bob and not a different Bob.

I actually don't think there is a problem with the concept of a web of trust per se. It's a fact of life. I think that the software doesn't help you use it appropriately. Even if Alice says that a person is Bob, I should not be fooled into thinking that it _really_ is Bob, or that Bob is trustworthy. All it says is that when Alice talks about "Bob", she means this person who we're calling "Bob". If "Bob" then introduces me to "Cathy", we shouldn't be fooled into thinking that it really is Cathy. However, it's still very useful to know that Cathy is Bob's friend who is Alice's friend. If Alice tells me to talk to Bob's friend Cathy, I can be totally comfortable talking to the "Cathy" that Bob introduced me to.

Just to make a more concrete example, imagine that you have a problem with your software. You contact the company that supplies it and somehow determine that the person you are contacting is really operating on behalf of the company. They refer you to second line support. It would be incredibly useful to know that the second line support person you are talking to is, in fact, the second line support person you've been directed to and not a man in the middle. You don't care who that second line support person is. Maybe they aren't using their real name. Maybe they are an illegal immigrant. None of that matters to you. All you care is that they are the person you were directed to. And if they direct you to third line support, you care that the person you are talking to is the person you were directed to.

People get hung up on the wrong things with PGP IMHO. They check people's passports and include photos in their keys, etc, etc. I mean, great if you are the government trying to ascertain if a key really belongs to a citizen, but completely useless for most practical purposes. _All_ you care about is that chain.

<comment><USER9> The kernel of the conceptual problem with this web-of-trust feature is in another Filippo post[1]: when I sign someone's else's key, it is difficult (in practice: impossible) to really know the provenance of that key. The signer could have gotten the key from a keyserver (in which case you now transitively trust the keyserver). Or they could have gotten it from a random email saying "this is my new key". You don't know; the basis for trust isn't there, or rather, to the extent it is, it's only there across strong, short paths in the graph of key signatures; it doesn't scale out to the whole "web".

[https://blog.filippo.io/giving-up-on-long-term- pgp/](https://blog.filippo.io/giving-up-on-long-term-pgp/)

<comment><USER10> I'm definitely not arguing against that. I think keyservers are one of the worst things to ever happen. PGP's _implementation_ of the web of trust is hugely flawed. I'm saying the concept is still incredibly useful. I get frustrated when I see suggestions that we should abandon the notion signing other people's keys because users can't be trusted to do it properly.

I think the author of the article you link to is mostly right. Long term keys don't make much sense most of the time. A key that's signed by a million people is useless. I only care that it's singed by the people who are relevant in the context for which I'm using it. Relationships change too. If I've got a key from level 1 support to a level 2 support person, I can't trust 6 months later that the level 2 support person still works at the company. You need to have a context to describe the link in order to understand it. PGP (and by extension GPG) are absolutely horrible in that regard.

I find it ironic that the author says that the best way to reach them is by their Whisper number. _This_ is what frustrates me. We exchange "horribly flawed implementation" for a central trust broker -- who may or may not be trust worthy.

<comment><USER11> This is a very useful way to think about a/the web of trust. Thank you; I am sure I will use it later.

</comment></comment></comment></comment></comment></comment><comment><USER12> Every two other week, someone writes that openGPG is broken. Guess what they want to say is that if you use PGP in certain ways, it's broken (keyservers, addons like enigmail and so on). But nobody has ever been able to demonstrate that it's broken if you use it correctly. I'll stick with openGPG.

<comment><USER13> Is that a fork of openPGP or some other product that is based on the same specs? I could not find anything meaningful for openGPG.

<comment><USER14> That's because it doesn't have open in its name, it's called GPG or GnuPG.

It's another product based on the same specs.

[https://en.wikipedia.org/wiki/GNU_Privacy_Guard](https://en.wikipedia.org/wiki/GNU_Privacy_Guard)

</comment></comment></comment><comment><USER9> To be clear: this is a subhed from Filippo's email newsletter (which you should subscribe to), relating a news item about the ridiculous SKS/GnuPG-key- handling fiasco from last week; it is not a comprehensive summary of all the ways in which OpenPGP is broken, despite the title.

<comment><USER15> >it is not a comprehensive summary of all the ways in which OpenPGP is broken

Is there a comprehensive summary anywhere?

<comment><USER16> This article by the same author is perhaps not comprehensive, but a good place to start: [https://blog.filippo.io/giving-up-on-long-term- pgp/](https://blog.filippo.io/giving-up-on-long-term-pgp/)

<comment><USER17> Except that the article is only about one particular reason the author finds PGP use uncomfortable. It doesn't deal with any "brokenness of PGP" at all.

</comment></comment></comment></comment><comment><USER18> Just wanted to say thanks for making the awesome cryptography newsletter! Really enjoyed reading this.

</comment><comment><USER19> I've seen the link from this article before about alternatives to PGP and it bugs me for two reasons. One is the implication that everyone should write all software in Go. The other is that when you swap out one system for half a dozen, you now need to identify yourself half a dozen different ways. That seems confusing.

</comment><comment><USER20> > I don't believe in invasive tracking

And yet, I see 'utm_source=cryptography-dispatches' in the URLs!

<comment><USER21> It is tracking, but it is not invasive.

</comment></comment><comment><USER22> I've mostly been able to avoid PGP, but one workflow that I haven't been able to find a decent alternative for it Git commit signing.

Does anyone know good alternatives in this space?

<comment><USER23> Linus himself has expressed his opinion several times that signing every commit is useless. His posts here explain it a bit: [http://git.661346.n2.nabble.com/GPG-signing-for-git- commit-t...](http://git.661346.n2.nabble.com/GPG-signing-for-git-commit- td2582986.html)

<comment><USER22> Well yes, signing _every_ commit is useless. He did not however, at any point during that exchange, express the idea that commit signing is a useless activity. And that is what I was referring to.

Currently Git seems to be very much integrated with GnuPG and the same goes for GitHub's UX sprinkles over the signing feature. That is what I'd like a decent alternative to.

I considered using OpenBSD's signify but it does not integrate as nicely as GnuPG signing so I'd basically be rolling my own mechanism (which is fine I guess, but feels subpar)

<comment><USER8> For the record git signing can also use X.509 certificates but from what I see it's still managed by GnuPG.</comment></comment></comment></comment>


Show HN: "curl … | sh" is bad. - <AUTHOR> http://poww.cx/

<comment><USER2> How is this the slightest bit different than faking a site and altering the binary/source package on the other end of a regular old Download link?

(edit: Oh. You're doing user-agent sniffing for curl. Fair enough, but this still isn't any less secure than downloading and executing a binary.)

<comment><USER3> This is why most packages are distributed with checksums, so you can be sure that what you're running is what the author intended.

<comment><USER2> ... if you're getting the checksum from a trusted source that is separate from the package distribution server, or if the checksum is cryptographically signed.

But I've never seen people get up in arms about someone publishing, say, a github link to some code that isn't accompanied by a checksum signed with a published PGP key you deem trustworthy.

<comment><USER3> Right, because a single git clone can't rm -rf your drive. A single "| sh", can, which is the point.

<comment><USER4> And what's the first thing people do after cloning a project they want to try out? Some might read all of the code, most will just run "./configure" or "make" or "rake" or "script/server" or whatever. All of which can execute arbitrary code.

Piping a file to a shell isn't inherently less secure than downloading a zip or cloning a repo and blindly executing something from it.

I'm willing to bet the majority of people who are complaining about the "curl URL | sh" trick also regularly download and execute code without verifying it won't own them.

</comment></comment></comment></comment></comment><comment><USER5> Give me one reason why this is worse than downloading an unsigned binary from the same site.

It's not.

Yes, the user-agent sniffing is clever, but it's circumventing a security precaution that isn't even possible with a binary installer.

More discussion here: <http://news.ycombinator.com/item?id=2420648>

</comment><comment><USER4> Do you inspect the source code of every program you download? Do you decompile and reverse engineer the closed source ones? At some point you have to trust the developer isn't doing anything nasty, and be careful about where you get your software from.

<comment><USER3> This argument is not about trusting or not trusting code. It's about piping web output blindly into a shell, which is an insecure technique, no matter how much you trust the author or web site.

<comment><USER4> Remind me why it's more "insecure" than downloading a zip from a website and blindly running an executable inside it?

</comment></comment></comment><comment><USER6> Hmm, I usually like to prove my point without engaging in copyright infringement.

</comment><comment><AUTHOR> Go ahead and view the source. Try to spot the hack.

It's harmless to run.

<comment><USER3> The "hack" is when someone roots their server and makes it return "rm -rf ~". Even if it's the most secure server ever, it's still a bad technique, IMO.

<comment><USER7> If they're distributing .dmgs or .exes and their server gets rooted the result is exactly the same.

And if the download and webpage are hosted on the same machine (like, practically always) the checksum won't help you either.

If you want to run third-party stuff and not willing to look at every little assembly instruction at one point you're going to have to trust somebody.

Of course this can just be Apple (app store) or the Debian/insert-distro-here guys (only run code that's from apt packages from the official repositories).

I'll just take the occasional risk.

</comment></comment></comment><comment><USER8> I see what you did there. (though, doesn't work with wget)</comment>


Ask HN: Is AppStore getting better? - <AUTHOR>

I joined iPhone app developers ranks few weeks ago and submitted my first app a week and a half ago.
It first, I was really worried. One day after submitting my app I got an email from Apple, saying that my app is waaaay too simple. I agree that it's simple, but I was sure it will help someone...
My first thought was "I am f*cked". But I wrote a nice reply telling them way I think my app is not too simple. ~ 24 hours later I got a response from what looks like a human being that they will reconsider my application. Few more days later I got a message saying that my app is ready.
So my app was processed in less than a week, including new year break and one big show-stopper.
Is it just a christmas gift from Apple or is AppStore really getting better?
P.S. My App is a push notifications service testing utility.
http://ipusher.idev.lt itms://itunes.apple.com/us/app/ipusher/id348540958 <comment><USER2> I submitted an app ~1 year ago and it was approved in 4 days. I submitted a lite version of said app two weeks ago, the day before iTunes Connect went down for the holidays, and it was approved and available the day they came back from the break (about 1 week later).

I will say that I got more feedback from the reviewers this time around versus one year ago.

</comment><comment><USER3> My app, submitted January 1st, was approved a few hours ago. In developer connection, there was a note saying that approval could take around 2 hours, so this was a nice surprise.

</comment><comment><USER4> They reportedly beefed up staffing over the holiday break. Approval times (for updates at least) were on the order of 1-3 days. Maybe new app approvals are faster too.

</comment><comment><USER5> You should probably include the obligatory "Ask HN:" at the start of your title.

<comment><AUTHOR> thanks for reminding!</comment></comment>


Gates back on stand in Utah in $1B antitrust trial - <AUTHOR> http://www.google.com/hostednews/ap/article/ALeqM5j_hBtA1v_-WRM_604OBn5ZEr62hg?docId=a850a50f1a544cc18d64da1ce2c8b8d4

<comment><USER2> I was a sys-ops admin for a 30-person department in a bank back in 1994-1995. We had DOS 6.0 workstations as well as Win 3.1/3.11 desktops and used WordPerfect 5.0 (F5 Reveal Codes, I felt so powerful!) among other brands (Quattro Pro, Harvard Graphics, Paradox.)

When Win95 came on the scene, we were hesitant at first -- let others figure out the kinks -- but we were rolling out new desktops within 6 months. We had also been waiting for a Windows version of WordPerfect. The DOS version was ok, but it was awkward running it in Windows.

So we waited. And waited. And waited some more. Finally, after I don't know how long, we got our hands on WordPerfect 6.0 for Windows. It royally sucked. The WP folks had spent approximately zero time imagining their product in a Windows environment -- GUI, mouse click, that kind of thing -- and instead just pushed their F-commands into a menu system. It didn't flow at all, and our staff complained mightily.

So, we took a look at MS Office (I think it was version 4.x or something around then.) I didn't like MS Office, and knew we would have re-training issues (especially going from Quattro Pro to Excel). Nonetheless, we decided to give it a try.

Staff loved it. Not jumping-up-and-down loved it, just that it let them do their job quite easily. The analysts in our department raved over Excel, however. And personally, I could rid myself of Paradox, which seemed to dislike me more than others.

Summary: it's a small sample size, but from where I stood WordPerfect basically blew it. I can't speak to the MS/WP relationship, but I can without a doubt say that WP didn't put any thought into their product. Why they released their Windows version, I'll never know.

Was MS a tough competitor? Of course. Did they make it difficult on WP to provide their version on Windows? Maybe. But being completely unimaginative about the application and workflow? That's nobody but WordPerfect's fault.

<comment><USER3> F3 was Reveal Codes, iirc.

<comment><USER2> Duly noted. Wikipedia says the actual keys were Alt-F3.

Seems forever ago.

</comment></comment></comment><comment><USER4> From the article: "[Gates] also said there was no viable alternative to the Windows operating system in the market at the time [1995], which would mean Novell does not have an antitrust case."

That statement is only even remotely true if one interprets it to mean that there was no alternative to Windows at the time that ran on the same hardware. Macintosh computers were alive and well, no?

<comment><USER5> For the curious, this is what installing RedHat Linux 2.0 looked like cera 1995. Ah, rawrite; I don't miss you at all.

<http://www.viddler.com/explore/pdweinstein/videos/5/>

<comment><USER6> Hah, wow: <http://i.imgur.com/appZl.jpg>

"And you'll see listed here are a number of boot images. Each one of these boot images contains the configuration of a kernel that will _probably_ match one of your systems. Let's go ahead and use the DOS program 'edit' to view the images.idx file now."

<http://i.imgur.com/V0PX0.jpg>

"Here it shows in the left hand column the last four numbers of the boot images of the files we just saw earlier. On the right side is a description of the type of system we need to install it onto. For example if you look on the first line it'll show that it has IDE/ATAPI or SCSI. In other words if I take the boot image 0000 then I will be able to utilize the boot image on a system that has an IDE CD-ROM drive."

Heh. It sounds like installing Linux was as easy as 0001, 0002, 0003...

<comment><USER7> I actually did this, back then, a few times (I was a pipping teen in the day). It was enormously fun; absolutely loved it; all on a 486-dx(2?)

Recompiling the kernel manually was something you _just did_ ; it was expected. Downloading a bunch of source code and compiling the dependencies and managing everything yourself; also completely ordinary.

The best thing was going between Pillbox, Yggdrasil, Mandrake, Slackware(!) ... those were the days!

There were two floppy disks that you would boot from, the `Boot` and the `Root` if I remember right. If you had a system up and running you could use dd, otherwise there was a DOS tool that would do as much. Interestingly, this was when the first thing you'd see at boot was

      LILO

The LILO above was actually a complex diagnostic result. Getting something like

      LILILILILILILILI

was possible

or

      LIL

They all meant a bunch of different things. If you got the full LILO you would be like "phew, it worked". Otherwise, you use your rescue floppy (or the one you used to install, had to remember to keep those around) and figure out what was wrong.

CDs originally weren't bootable and lots of BIOSES didn't know how to deal with them. There was a standard that went out called the "El Torito" or something that basically talked about how CDROMS would be bootable. I think Windows 98 had this; in fact, I think it came out of Redmond (but I haven't done my homework in the Goog)

So in 199x, even if you had a fancy bootable CD, you were still making floppy images, then inserting the CD when instructed to. In fact, I still have a box of floppies just in case I need to deal with hardware pre-1999 ... which is becoming less and less relevant (I think I used one last in 2006). Then again, I used a 5 1/4 in 2003 ... so I guess it's worth keeping around another 4-6 years.

The worst memory I have is when I found out just how bad swap could be. I had to compile the NetBSD kernel on a laptop I had (IBM 360C, active color 640x480 display, NiCd battery, 2.88MB floppy, SCSI disk, huge docking station with speakers ... this is about 1999 (more of 1999 below)) and it had all of 8MB of RAM. I had to recompile the kernel to make use of an early wireless (which felt like pure magic) PCCARD I had (mind you, 16 bit, not 32-bit CardBus) and the kernel took 4.5 days(!) to compile. In fact, I remember starting it Christmas eve before eating dinner and it went on through Christmas day and then a few days after that.

I had mastered screen by this time so I was able to see that the machine was really chugging away. The reason was that the compiler used up all of my RAM and was hitting swap. After that I upgraded the machine and the new compilation took 40 minutes.

40 minutes then, seemed like getting DSL for the first time and then clicking on that 10MB file and thinking "What is going on here? A whole megabyte downloaded right in front of my eyes? In mere seconds?! I am never going outside again".

I long for these exciting days. The mobile world has it, that's about it.

More about 1999;

Speaking of 1999, two other big things, the BeOS 5 Demo, booted from windows and was awesome, then there was the "Bootable Floppy Challenge" which was done by QNX ... it was quite impressive in the day.

</comment></comment></comment></comment><comment><USER8> Dupe: <http://news.ycombinator.com/item?id=3262170>

</comment><comment><USER9> My brother is on the jury. He won't talk with me about it until it's over though.</comment>


CS221: Artificial Intelligence: Principles and Techniques - <AUTHOR> https://web.stanford.edu/class/cs221/ <comment><USER2> Sadly, viewing the videos requires login with a Stanford ID. For those inclined to learning through videos like me, this is a good alternative resource for the same - [https://see.stanford.edu/Course/CS229](https://see.stanford.edu/Course/CS229)

<comment><USER3> This is a really good course, but the one that requires a lot of background in probability and some background in linear algebra.

One of the objectives of this course is to prepare students for research in Machine Learning.

</comment></comment><comment><USER4> Forgive me, but why is the fact that a university is offering a class to its students (hacker)news-worthy? Isn't that what universities do?

<comment><USER5> >Forgive me, but why is the fact that a university is offering a class to its students (hacker)news-worthy? Isn't that what universities do?

Assuming your comment is non-troll.

A lot of the HN community happens to be involved in / has been involved in some form of higher education (especially in CS) at some point in their life, so it is always interesting to see what an institution like Stanford is teaching the next generation of potential leaders of the tech (and future HN users) especially in a field with infinite potential like AI.

</comment></comment><comment><USER6> Firstly, damn there are a lot of TAs for the course! Secondly, it's pretty interesting how the course team has basically automated everything from homework submission checking to PDF report validation. I wonder how many students are taking the course?

As for the course itself, it seems quite interesting. Too bad I already have a lot on my plate.

<comment><USER7> I am a student at online MS from Georgia Tech and a large number of TAs is pretty usual there too.

Incidentally right now I am taking the AI course there and the assignments submission and checking is automated to the core. There are a few hiccups though but the team of TAs is super responsive and working through it.

I think these are the things that should be automated by default in most courseworks as it frees up time for more important things. I see we have a lot of office hours in my course and I can basically jump to any running hangout based office-hour within few hours from the time I have a question.

<comment><USER6> What a coincidence: I actually just started grad school this year at GT but in ECE! Awesome, it's good to hear that the online MS is running smoothly. I don't think the CS department here is as large as Stanford's though, but I'm not totally sure.

<comment><USER7> Great! Good luck for your grad school journey.

I am mostly finishing up with my degree. And yes I have heard that CS department is not as large but the OMSCS is scaling up very quickly.

<comment><USER6> Thanks man! I wish you the best as well :)

</comment></comment></comment></comment></comment><comment><USER8> Rather odd that the course omits decision trees.</comment>


On Hiring Intangibles - <AUTHOR> http://rrwhite.com/on-hiring-intangibles

<comment><USER2> This is a great writeup. Any time we can bring subconscious "gut feel" into the conscious is a win for everyone, and uncovering these kernels of truth has got to be enjoyable from a CEO standpoint.

</comment><comment><USER3> The more my career progresses, the more important these things are. You can also judge the maturity of an organization by how important they relate technical skills to personal attributes.

</comment><comment><AUTHOR> Culture is at least 2x more important than you ever think it is. _Especially_ when hiring. I love this, Thank you Rich.</comment>


Ask HN: Rent servers with slow CPU, low mem, cheap bandwidth but big disk. - <AUTHOR>

I'm looking for something as awesome as Linode but that does something like a small 1G instance with huge disks e.g. 1 to 5 terabyte of disk space and really cheap bandwidth.
I want to use it as a backup server that has a shell so I can schedule jobs, run scripts to trigger and fetch backups etc.
Cost is a big concern of mine. So for example if I was billed using 95th percentile instead of for transfer, that would be awesome.
Any input appreciated!! <comment><USER2> Do you really need a server? You can launch a more powerful EC2 instance (EBS backed), upload your data, and stop the instance (alternatively you can create a snapshot and terminate the instance). Next time when you need the backup or back up more data, just start the instance. You pay the full price of storage and data transfer, but not the CPU. If your other servers are within AWS, you even don't need to pay for the data transfer.

<comment><USER3> 5TB of storage on AWS would cost >$500/month.

You could buy a server and colocate it for less than that.

<comment><USER2> You're right. That's a lot if OP really needs 5TB of storage. It's still an option if OP begins with less storage.

</comment></comment></comment><comment><USER4> I have not found any virtual with storage cheaper than Amanzon/Google (0.10 $/month/GB).

you can find "backup" VMs for cheap but:

      - these are typically OpenVZ (can't pick your kernel options)

      - very busy and slow (they meant to be for backup only.

[http://ovh.com](http://ovh.com) has physicals at around 40$/month with 2 x 1 GB disks.

</comment><comment><USER3> [http://www.hetzner.de/en/hosting/produkte_rootserver/xs13](http://www.hetzner.de/en/hosting/produkte_rootserver/xs13)

</comment><comment><USER5> Have a look at the servers that hetzner.de is offering, maybe there's something there for you, also have a look at their auction.

</comment><comment><USER6> I don't know if it fits your needs but dreamhost has some hosting where you pay once and host "forever"

</comment><comment><USER7> Some Kimsufi servers have quite a bit of disk for their price. You'd need to run a RAIS, though.</comment>


Does Coding Count as a Foreign Language? - <AUTHOR> http://www.theatlantic.com/education/archive/2016/02/do-coding-skills-count-as-a-foreign-language/470799/?single_page=true <comment><USER2> From philosophical, pedagogical, and functional standpoints, absolutely not; from a practical standpoint of whether to offer credit, why the hell not? It's not like US schools seriously endeavor to teach students to usefully speak a foreign language in schools and the students could arguably benefit more per hour from just learning simple ideas related to coding.

As someone who loves coding and natural languages it's a bit disheartening to see the two put into a cage match for budget money but I can't be too sad about more people having the opportunity to learn about the machines that increasingly run their lives.

No one in the article makes a serious claim that learning to code provides the same kind of education as a foreign language but they do include a bit of Code.org's explanation of why CS is not a Foreign Language. While I can see why the blog post is good to have as a resource its inclusion seems to imply that someone is suggesting that CS and FL education provide similar benefits.

<comment><AUTHOR> Agree on the cage-match idea. That would be absurd.

But in the not-so-distant future, perhaps effectively communicating with devices might turn out to be a far more valuable skill to have than doing so with humans.

And natural languages are not similar. Knowing languages in which more books and articles are published is going to be more valuable than ones in which there aren't that many.

Of course writing code requires different 'skills' than writing articles but looking at this from a standpoint of employability knowing certain (natural) languages makes someone a better candidate than others. Similarly knowing certain programming languages/platforms might someone more employable too. It's unlikely that someone knows no natural languages and exclusively knows programming languages.

With this background, an interesting question is how does someone who knows (say) C++, Python and Russian weigh against someone who knows (say) English and Java!

<comment><USER2> >> And natural languages are not similar. Knowing languages in which more books and articles are published is going to be more valuable than ones in which there aren't that many.

I'm not really sure this is true (barring edge cases like Esperanto: it's basically useless to know beyond intellectual exercise). For any language with a full country and culture (or many) attached to it there will be more books than you could ever read or translate on your own.[0]

It's similar to saying that if you want employment learn Java because there are so many Java jobs. You can only take one so what do you really care that there are 10 million others? Also you don't need to know a specific language to get hired to write it.

>> But in the not-so-distant future, perhaps effectively communicating with devices might turn out to be a far more valuable skill to have than doing so with humans.

I think today it already is depending on how you make your comparisons.

Arguably Stephen King or Beyoncé's job is "communicating with humans". There are also some app store lottery winners and algo traders taking home insane money and they're arguably paid to "communicate with devices". I just wanted to bring in these examples to preemptively call out outliers and generous definitions.

As a maybe useful comparison Google puts Translator as 45KUSD/yr and Programmer at 74KUSD/yr.

I think however, once you start examining the middle grounds it gets interesting. Lawyers, real estate agents, doctors and I'm sure many more professions are going to be increasingly more client facing than they've traditionally been as some mechanical burdens get absorbed by code. It wouldn't be the worst guess in the world to expect that communication skills will become increasingly valued as it becomes more relied upon.

I think the big distinction for employment is that almost no employer will hire you on the understanding that you'll pick up a human language if knowing it was core to your performance (barring some extreme cases like military/state dept), while most good programming shops wouldn't automatically reject a candidate who had no experience in their particular language. This is pretty rational.

If you already know how to program then you can learn new languages in general much faster than learning new human languages.

You can also be useful (or dangerous) much earlier in the competency curve in code than human language if you already know how to program. No one will ever feel satisfied having paid you to introduce yourself and explain where you studied Spanish. They could be happy having paid you to cargo-cult your way through updating some API endpoints while you're figuring out the new language's nuances.

There are also happily moments where knowing other human languages helps with code. I once found the answer to a DenverCoder9 [1] type problem because I speak Russian and the only link that google returned for the error was some Russian dude's blog where he had the answer.

Sorry for rambling. I vote for more of both!

[0] I'm ignoring dead and dying languages, non-naturally evolving languages, and occupational pidgins like Runglish on the ISS because the people who learn those are inherently special cases or not relevant for the discussion.

[1] [https://xkcd.com/979/](https://xkcd.com/979/)

Edit because I can never remember the formatting.</comment></comment></comment>


I created a HTML parsing library in JAVA to extract data from complex websites - <AUTHOR> https://www.univocity.com/pages/html_parser_about <comment><AUTHOR> Hi I'm the guy who built and maintains univocity-parsers ([https://github.com/uniVocity/univocity- parsers](https://github.com/uniVocity/univocity-parsers)) and I recently released my new parser for HTML.

I've been developing this internally over the years to build scrapers for my clients who need extract data from complex pages and finally packaged it into a product that others can use.

I know devs are not very keen in using closed-source code but this is a godsend if you work with website scraping as it's very fast and fast to code with. You basically don't need to write a lot of code: it's usually _one line_ of very readable code for _each data point_ to collect. It beats any other parser hands down in performance and ease of use.

If you don't feel like clicking around:

– it was built to process intricate pages with 100's of megabytes in size and generate result rows that can be directly dumped into a database. No need to traverse through nodes with code or to define complex XPATH or CSS selectors. You can also annotate a few classes to get objects and do whatever you want with them.

– you just define matching rules that crawl the page and they will be grouped into threads that will collect the data for you

– to define a matching rule you look at the element you want instead of figuring out a path that navigates to it. You only need to try to create a rule that uniquely identifies the data to match in the page based on what is around the element. For example: "match(td).precededBy(td).withText('any*name')". This will match any table cell of a page, where a cell on the left has text 'any previous name' or 'any nickname'. It can be buried into a dozens of other tables and elements, but you don't have to care about the page structure. Compare that to xpath or a css selector.

– it follows links and let you aggregate data from the linked page into your records

– it's easy to detect changes and missed elements when you want to ensure ALL available data points in a page are being matched and collected

There's also a self-contained example using it to read a website: [https://stackoverflow.com/questions/50914516/scrape- informat...](https://stackoverflow.com/questions/50914516/scrape-information- from-web-pages-with-java)

I'd like to invite you people to test and provide any feedback you might have.</comment>


Oracle hasn't killed Java – but there's still time - <AUTHOR> http://www.infoworld.com/d/application-development/oracle-hasnt-killed-java-theres-still-time-247823

<comment><USER2> Considering most Android development is done in Java, I don't see the language going anywhere anytime soon. Plus, it's not a bad language. It may not be the most convenient language to use to solve a specific problem (it's not for my usual problems) but there are many situations where it makes a lot of sense.

<comment><USER3> There's OpenJDK, there's a huge ecosystem surrounding java, and java is one of the few languages that can hold a candle to C-ish performance server-side. While being safer than C and less insane than C++. I doubt it will leave anytime soon.

</comment></comment><comment><USER4> Java is easier to learn which is an employable skill in the job market at present, there are many parties, not just Oracle with vested interests in the language. It's not going anywhere in the near future, but without anything new, Java might sound old.</comment>


How "expensive" is crypto anyway? - <AUTHOR> https://blog.cloudflare.com/how-expensive-is-crypto-anyway/ <comment><AUTHOR> Using TLS is very cheap, even at the scale of Cloudflare. Modern crypto is very fast, with AES-GCM and P256 being great examples. RSA, once a staple of cryptography, that truly made SSL accessible to everyone, is now a dying dinosaur, replaced be faster and safer algorithms, still consumes a disproportionate amount of resources, but even that is easily manageable.

The future however is less clear. As we approach the era of Quantum computers it is clear that TLS must adapt sooner rather than later.</comment>


Can gaming be the turning point for Linux on the desktop? - <AUTHOR> http://www.techradar.com/news/computing/pc/can-gaming-be-the-turning-point-for-linux-on-the-desktop--1151854 <comment><USER3> The idea that there is going to be some sort of rapid change to Linux desktop is wrong, simply because people forget that windows desktops are used by corporations and government, almost to the exclusion of any other OS. That is where the oems make the most money, at least in terms of chunks. Canonical and Steam are going after the personal computer, but nobody seems to be making inroads in the corporate desktop world. Everything runs on Windows, often exclusively on Windows. Converting to Ubuntu is a big leap away from windows xp. And the CTO is not the boss. Marketing knows power point and word and Excel, they don't want to learn libreoffice.

Not to mention that there are all sorts of weird industry requirements. Look at doctors converting to electronic records. Show me a vendor with a linux based solution that meets hipaa requirements. Or consider checkout computers, which may process credit cards, which have regulatory requirements.

Stop talking desktops and build a easy way to convert businesses. It won't be easy to build though.

Get approval from regulatory bureaucracies, get every company department either willing to switch or with a super easy virtualization solution, get it ready to support it, make sure any custom software can be ported, handle the conversion. Make sure business partners can still work with you. Oh and RETRAIN EVERYBODY.

Having heard how much people fight converting to windows 7 from xp, you are going to have a struggle to get it done.

But if you do all that, then maybe linux will have a Turning point.

<comment><USER4> That's the same thing people said about iOS.

The argument is completely flawed because people in companies do get to choose the software, however for driving the change the demand has to be really high, otherwise the cost of switching or of having a heterogeneous work environment is simply not worth it.

People in companies use Windows XP and MS Office because that's what they use at home. Even if they have Windows 7 at home, they can tolerate Windows XP at work, because it's basically the same thing.

Change is coming though. I work on a startup. I have no doubt in my mind that some day we'll be big. And we standardized on Ubuntu. Usage of OS X is only allowed for people that know their way around with whatever development stack we need, because all the documentation for setup and usage of stuff is written for Ubuntu. If they have problems, tough luck, but OS X is unsupported. People wanting to use OS X also need to buy their own personal Macbook. And usage of Windows is only allowed inside of virtual machines.

You know, some of us growing up on Unix might end up running the show inside those big companies that are impeding change.

<comment><USER5> Yep, I work for a large corporation that uses windows, however, our group is 100% Linux - servers and desktops - because of the kind of software that we write. If we were made to switch to Windows, it would be disastrous. So, there are pockets of Linux-based groups out there in the corporate world, and the question is: can those pockets grow?

</comment></comment></comment><comment><USER6> I've said it many times and I'll say it again, the only way Linux will reach a rapid turning point is the day Adobe port over Creative Suite and or Creative Cloud to Linux. Lack of Fireworks and Photoshop are the only two things preventing me from switching to Linux completely, I know many others in the same situation as I am. I currently run Linux in a VM which is fine, but not ideal.

So to me, lack of commercial and popular applications like Photoshop are the reason people don't use Linux. While there are tonnes of open-source alternatives, lets not kid ourselves, we all know Photoshop as well other applications have no decent open-source alternative that makes the switch worthwhile: especially not a decent Fireworks alternative which is a must-have tool for me.

Unless something dramatically changes, PC will always have the games followed by Mac.

<comment><USER4> Photoshop I can understand, but Fireworks? Really?

<comment><USER7> I have not used it in years, but yes.

There's gimp as a Photoshop alternative, and an open source alternative for Fireworks would be great, remember that Adobe is killing the product.

</comment></comment></comment><comment><USER8> No, games aren't nearly enough. I'm a Linux user myself, but quite frankly Windows is simply a better consumer desktop. It's also already installed on every computer.

The switching cost is simply too high and the only people outside of the tech world using Linux are generally those with old computers who had a techy friend install it for them. Problem is they'll be back to Windows as soon as they upgrade that old computer (or in my mom's case, as soon as the first thing doesn't work like it does on Windows).

<comment><USER9> The only thing I don't agree with here is this: _Windows is simply a better consumer desktop._

That's like saying the Chevrolet Impala is a better car than all Holdens. Sure, more people are familiar with the Impala, and some Holdens will certainly be less friendly to the average driver, but those are not reasons to dismiss an entire make as unsuitable to an entire class of driver.

You're definitely right that games aren't enough, though, and I think you make the most relevant point, that most computers come with and have always come with Windows installed.

</comment></comment><comment><USER10> Am I the only one who thinks it will help?

I think it will help precisely because of the market it just got exposed to. Yes, so Linux won't get pre-installed in all the computers at Best Buy, but exposing it to kids who use steam, and showing that it can play the games they know and love WILL make some of them think twice about why they're not an el1t3 haxx0r and using linux already.

Gamers are pretty close to the computer/tech loving crowd (I think that's pretty indisputable), and they'd be the easiest to convert to linux/unix systems anyway, this move just makes it even easier for them to convert, and if it does that, it will help linux grow.

Also, the investment Valve has made in games for Linux is supremely important in the consideration of any other leader of any other industry to consider linux seriously as a operating system, so yes it's important.

"Turning point"? Maybe not, mostly because that word is loaded with bullshit ideals of some underdog overcoming a 50 point deficit in a basketball game in the last 5 seconds.

But it definitely will change things. No research to support it, but I am definitely one of the people that keeps a windows partition ONLY because I can't play all the games I want to play on linux yet.

Rome wasn't built in a day, and as long as linux keeps it's use cases and adds more, there will be less and less reason for you to not choose it. Then one glorious day, linux will be capable of running enough of the software that makes people use computers, and someone (probably Canonical) will launch a marketing campaign.

That'll probably be the turning point, but for now, this is definitely a step in the right direction.

</comment><comment><USER11> Betteridge's Law applies.

Gaming helped cement DOS/Windows victory on the desktop because most enthusiasts bought computers to play games, but it did nothing for the Amiga (which was great for gaming but had a lousy ecosystem for office stuff).

On the other hand, the desktop market is collapsing and you might think that the kind of person who still wants/needs a desktop might be more likely to be the kind of person who wants/needs Linux. That's possible but it's not the perspective taken by the article.

<comment><USER12> The Amiga had an excellent ecosystem for office stuff.

Prowrite on the Amiga wasn't bettered for word processing until Word 6 5+ years later.

The Amiga could also be hooked up to a laser printer like a Mac, but not quite as well.

The main reason the Amiga was beaten because by the time it arrived on the scene DOS already had the market.

<comment><USER11> I was a heavy Amiga user in the day and constantly got into arguments with people advocating its office software. No Amiga word processor was capable of producing decent output or handling documents longer than ten pages. They looked fine (ProWrite was a MacWrite clone, Excellence was a WriteNow clone) but didn't stand up to any kind of serious use.

The Amiga was the world's bestselling home computer and utterly dominant in the games market outside the US for several years but never became a credible desktop productivity computer.

Having non-square pixels in its highest resolution non flickery display mode sure did not help.

</comment></comment></comment><comment><USER13> No

This ship has sailed.

Desktop is even less relevant today.

Linux can be a good foundation if your workflow is 100% web based, but I don't see this happening in large corporations (for now)

Still, sorry to say this, but Linux blew it. Yes, even Canonical

If someone can partner with a hw maker, do a computer that boots to a web browser (and within that domain works 100%) maybe this can work.

<comment><USER14> 100% web based? Why?

Most of the time using the same applications on Windows and Linux.

Pidgin, Chrome, Libre Office, Thunderbird, IntelliJ IDEA, Eclipse, VLC, Spotify, Steam.

<comment><USER13> Yes, this is a typical profile for a home user/developer

But for example, that's not what the computer used by the office secretary needs.

Chat - Google Apps Online Chat Libre Office - GDocs Thunderbird - <USER2>

VLC/Spotify - this can be done with html5, even audio streaming

</comment></comment></comment><comment><USER15> games is the only reason I have windows anywhere. And the inertia of rebooting my machine into windows means I almost never play (non-web) games anymore. Steam will definitely score some sales off me now, but whether mainstream gamers will switch, who knows??

I switched my GF to ubuntu 12.04 a few weeks ago. She is already preferring the system due to no malware and less crashes. So clearly desktop linux has come along way in 5 years. I have given her almost (but not quite 0) help in operating it too. Wifi doesn't work though :(

<comment><USER16> Not criticizing you - just offering an alternative viewpoint:

I can't remember the last time my windows system crashed and malware is not a problem as long as one is sensible. I have never been infected by malware of any sort and I do visit some dodgy sites.

Sandboxes and VM's are your friend as well as things like NoScript addon.

I can see absolutely no compelling reason to switch to Linux. I do use Linux on VM's for work related projects, but not seriously considering replacing my desktop with Linux any time soon. Perhaps the fact that I am also a power user of Excel colours my view.

<comment><USER17> > I can see absolutely no compelling reason to switch to Linux.

and you are right - because going with windows means any hardware is going to work _by_ default, and you won't have to waste mental energy to work out whether its going to be supported on linux/GNU. Ditto with software (tho less of a problem i suppose).

</comment></comment></comment><comment><USER18> Linux gaming may take off as Linux-based gaming console, but that won't help Linux desktop (hint: the problem of Linux desktop is not lack of games).

<comment><USER19> For me it is! Definitely!

</comment></comment><comment><USER20> I have installed plenty of ubuntu systems without touching the console; While it's the easiest way to communicate instruction on the web, it's entirely possible to use ubuntu without touching the console.

<comment><USER21> Yeah, this article is full of little snipes like this -

"Even installing the Steam for Linux Beta will involve a segment of updates, where you'll be endlessly typing [Y] into a terminal."

Or, you know, going to the Ubuntu Software Centre, typing "steam" in the search box and then double clicking "Steam" in the results, which is what I just did.

</comment></comment><comment><USER5> Hypothesis: if someone could build a Linux distribution that performs exceptionally well (better than most Windows setups) when it comes to games/graphics processing, then there would be more people willing to give it a try. Showcasing things like "X more frames per sec", and some other graphics-related stats might be enough to get the hardcore gamers interested enough to take the plunge. Because this means low level driver development, etc this is not easy and would require an immense amount of work that may turn out to be for nought.

Just like the spreadsheet drove the PC revolution in the early 80's, Linux needs a killer app that pulls people in, and games may be the genre. Perhaps there needs to be some revolutionary development in the graphics realm (I have no idea what this could be or else I'd be writing it right now!) that is exclusive to Linux, that could give it the gravity that it needs to make it into people's living rooms. Think some new 3D technology, something that big corporations can't do quickly, or some area that is out in the open that the big corps aren't paying attention to right now.

If any of this turns out to be true, and if Linux ever does make it BIG wrt gaming, that it's likely going to be some startup that makes it happen. The major players don't feel threatened by Linux, but imagine if some game like Minecraft came out that only supported Linux. It would take them by surprise and by the time they figured out what is going on, it would be too late. Now, licensing makes this tricky, so perhaps this will never happen, but that never stopped those that want/need to try to make it happen from trying.

</comment><comment><USER22> Never.

1\. Only one thing wins the desktop: pre-installations.

2\. Gaming requires superb driver support, which almost always means commercial drivers. Linux's licensing inflexibility makes this very difficult.

</comment><comment><USER23> I use a Mac at work and a Windows 7 PC at home. I spend more time on my mac than my PC and like quite a bit of it. But when I think about switching at home (cause the hardware is so so nice and the OS fixes so many things that frustrate me with Windows), I start to make a list of things I do with my home PC and either can't do or the equivalent isn't as nice/doesn't have as much choice, doesn't run as well for whatever reason.

The same thing happens whenever I think about switching to Linux at home, but the list is much much longer.

Let's pick games, I don't game nearly as much as I used to. But I like having the option to do so, with pretty much any game I happen to want to play, and not worry about it not being ported to my platform.

Sure there are things that I can do on Mac or Linux I can't do on PC (reliably run rails for example), but they aren't necessarily things I want to do at home. Sure it might not run as smoothly, or it crashes every so often or whatever, but the desktop, consumer, software support for it is at least 2 orders of magnitude better than either other platform.

In the end Windows, despite its warts is a compelling platform because of all the shit you can do with it (and explorer is so much better than finder).

I enjoy my MBPr, _a lot_ , I hate using my home PC for work-type stuff. Walking around with a thin light laptop in my backpack with great battery life that I can open pretty much anywhere and spin up a half dozen VMs and still have a performant web experience is really f-ing impressive. I don't even try and use my old windows laptops anymore, _that_ experience feels far too clunky.

<comment><USER4> I remember the clusterfuck that codecs created on my Windows machine, when after installing big and broken packs of codecs I was still unable to play some movie.

The first time that I experienced a movie playing experience that was smooth was on Linux, by means of MPlayer. Then later came VLC.

Of course, software like VLC is nowadays multi-platform, thanks to the virtue of being open-source and having contributors that wanted to see it ported to Windows.

However, for other tasks things aren't so smooth. There are many things that I need to do in my daily routine, that would be solved by simple utilities that are known and available in the Ubuntu/Debian repository and that work well. In Windows, even for things like compressing or uncompressing a format that's not ZIP, or for mounting an ISO file, or for burning DVDs, or playing music, or whatever, you end up installing proprietary software that's either broken, or mallware, or bloated crap, or all of the above.

These are just examples from the last time I tried, YMMV, but this happens every time I try it. Last time on my Windows desktop at home, I tried playing around with the latest Visual Studio Express. The installation process simply choked and I ended up with a broken Windows. It's like every time I try using Windows I experience death through a thousand cuts.

In general, most of the utilities I end up using on a Windows box are ports of software who's primary audience comes from Linux/BSD and why not use the real thing anyway?

Also, I don't really need games because I'm playing the greatest MMORPG of all time ... being a software developer.

<comment><USER23> > Also, I don't really need games because I'm playing the greatest MMORPG of > all time ... being a software developer.

Yeah, and I find that attitude common among lots of software devs. If you spend all your work day and all your free time involved in software development activities, windows is probably not the right environment for that.

I am always surprised at all these "I did x and windows completely fell apart" anecdotes by software developers though. I'm not kind to my home system and it's been more or less rock solid over the last 4 years. Much more so than OS X has been (which hasn't been too shabby mind you).

<comment><USER4> I'm not trying to have a holier-than-thou attitude, however I personally find video games pointless.

Speaking of free time, especially since I already spend unhealthy amounts of time in front of a computer, why would I want to spend some more time in games, when I can prefer going out to the movies, or taking walks in the park with my son, or go out for beers with friends?

You know, those software devs that you found with this attitude, they might be on to something ;-)

<comment><USER23> They might be. I'm finding myself playing games less and less and doing more walks in the park myself.

I didn't mean it to come of with a negative connotation towards the word "attitude", I think it got lost in the ASCII. I only meant it as an observation.

</comment></comment></comment></comment></comment><comment><USER24> Games are not a game changer. What makes Linux great is grep. That is why it will not be a mainstream alternative. The tragedy of casting Android as a success for Linux is that it comes to the mainstream on locked down devices and as a vector for widespread corporate data collection on individuals and their personal lives.

</comment><comment><USER25> If it becomes possible to play up to date and current games, then yes this will change the picture allot. I have tried to persuade many of my friends to switch to Linux, but I am always met with the same question: can I play X,Y,Z. And when my answer is not as well as on Windows, then they always decline. Gaming is the only barrier that I have met from my friends.

My wife wants MS office because that is what they use on her workplace. So the point about low conversion do to the corporate world could seem plausible, but I do not think so. Most companies that I have work for is afraid to change because the employees are afraid of change.

If people start using GNU/Linux at home the barrier for change will be much lower in the workspace. And adoption can move ahead rapidly.

</comment><comment><USER26> «Developed for just over two decades and it's still barely made a mark on the consumer consciousness.»

What about Android? Linux is in the pockets of way more than half smartphone users in the World. If that's not making a mark... what is?

I know they're talking about desktop, but this sentence is still incredibly missleading and false. Consumers buy Android phones. Period.

<comment><USER27> How many of those consumers know it's Linux under there? I think that's what they mean by "consciousness". For most Android users, you're lucky if they even know what "Android" means, let alone Linux.

<comment><USER26> You're right, I hadn't thought of it that way.

</comment></comment></comment><comment><USER28> Maybe.

Mac sales increased when the iPhone/iPad was introduced, the same can happen with linux. It doesn't really help when Ubuntu hides the term "Linux" on the homepage.

There is very little brand recognition among regular consumers.

</comment><comment><USER7> I would argue for something far simpler.

There's not a good alternative for HeidiSQL in Linux. There are not good GUI clients for MySQL in Linux.

Not a killer application, but something nice to have.

</comment><comment><USER29> No, I think the fact that consumers are moving towards devices and so are the operating systems for them means Linux will win the content creators.

</comment><comment><USER30> So they argue that "Mac and Linux have the same fatal flaw: few games", and claim Valve is the solution.

Valve has been on Mac for a while now, right? Did it help?

<comment><USER31> Isn't Apple the company with the most PC sales in US?

</comment></comment><comment><USER19> If GOG would have started to release Linux versions of their games I would have been using only Linux ever since.</comment>


Study: More Problematic Use Observed After Marijuana Legalization - <AUTHOR> https://jamanetwork.com/journals/jamapsychiatry/article-abstract/2755276 <comment><USER2> They should have asked whether the current state of legalization affects their willingness to report when compared with pre legalization.</comment>


When It Comes to Facebook Scale, You Can Throw Out the Rulebook - <AUTHOR> http://techcrunch.com/2014/09/24/when-it-comes-to-facebook-scale-you-can-throw-out-the-rulebook/

<comment><USER2> We are the integration partner for Facebook, at least in Europe, and one of our divisions helped them work through some design challenges re: heat dissipation, PDU routing, and HDD density. We are _NOT_ the EMS who manufacturers the servers for them, and the well-known company they're using is providing crap quality. We see about 10% failure (to the point of having to scrap the server) rate after we rack and start burn in and system test.

Honestly speaking, one of the things that interested me the most was the fact that FB is running a custom Linux kernel ... and they update it way more frequently than our test engineers are happy about. I'm happy to answer non- NDA questions.

<comment><USER3> I'm not sure if you're able to answer this or not. Is it a FB specific configuration? Or are they writing their own drivers/cpu-scheduling?

<comment><USER2> The latter. It's extremely irritating because they expect us to write the system tests for everything from the HDDs to RAM to Fusion I/O cards to network interfaces, and all we have to start from are the standard stuff ... so when they change things and don't provide tests, it is unpleasant.

</comment></comment></comment><comment><USER4> Nice puff piece :-) The interesting bit is that if you're going to be servicing a lot of machines, then even if it costs you more to build/acquire them, you can get back more in savings in operating them. This is called "trading capex for opex." And while it takes a reasonably savvy CEO to "get it" the number of CEOs who just "don't get computers" seems to be on the decline (at least in spaces that use a lot of computers).

In one way this also puts pressure on folks like Amazon since their margin on EC2 and other services is a mix of over-provisioning and opex savings, having other folks be able to do this is a win. Perhaps the saddest thing was talking with the HP "Gen8" folks (trying to sell me servers to replace my Supermicro ones) who don't get this at all. But for them they came from one server / one app not 500 servers / one app. I expect they could reclaim some market share that way but I don't expect they will.

</comment><comment><USER5> I used to be a server monkey long long ago, and played with the mockups of these servers that were set up at FB HQ. One thing to realize is they are _heavy_. Loaded with hard drives, one of these servers is roughly the size, shape and weight of a long 120mm mortar shell.

Easier to rack than the Dells of yesteryear, sure. But there can be up to 120 of these bad boys in a single standard rack, which means 60 of them have to be lifted above waist height during rack and stack. That is pretty strenuous, and technically you should use a moving lift and / or a lifting partner. Especially when you're talking about hundreds or thousands of racks.

Thinking outside the box and keeping the poor floor staff in mind, I've always wondered why we don't build little catwalks or half-height rack units, or even moving racks, like a dry cleaner's.

<comment><USER6> I don't see anything in this article that sounds like throwing out the rulebook. It sounds a lot like throwing out a few stupid rules. But not the whole book.

<comment><USER7> Of course it sucks, It's techcrunch, they can't actually write about tech. A bunch of vaguely clued in non-techies writing about tech companies for AOL don't target an audience that wants to hear about server hardware. They want to hear about how great (innovative, rule-breaking, etc...) facebook is. If server hardware is the vehicle for that story, so be it.

This article is "company finds business value in customizing critical component instead of using COTS." And that's only interesting to people who understand the components. So they represent it poorly, but only a little bit, not badly enough to merit the weight we typically associate with the word "misrepresentation".

</comment></comment></comment><comment><USER8> I don't see much that's novel in the article, other than perhaps the rack dimensions. Corporate servers and workstations have been designed for easy, screwless maintenance for a long time, going back to the 1990s I think. I'm pretty sure I also hot swapped array drives back then by just pulling a lever. I can't remember the last time I needed a screwdriver for a corporate server/desktop; I even see laptops now (HP Elite line) that are screwless, at least the parts I've seen, and designed for easy maintenance.

<comment><USER9> The drive sleds are easy to insert and remove but to remove the drive itself from the sled for replacement you have to remove screws. At least that was my experience. I remember typically 4 easily accessible screws though, not really as big a deal as the article makes out.

<comment><USER10> You're correct, OEM hot swap trays are only tool-less once it's screwed into the tray (Though the OEMs do tend to ship most drives preinstalled to their trays). The OCP stuff is designed to drop the bare drive into the JBOD/Server.

</comment></comment></comment><comment><USER11> I remember seeing a video from the Facebook server engineering/maintenance crews and was really impressed with all that they were doing.

 _"Many silo these engineering teams –server, storage, database, [and so forth]. We don't create these barriers,"_

Does anyone know how they are structurally organized?

I also wonder who directed that all of these innovations be standard, eg. was it Zuckerberg, Sandberg, Corddry or what?

<comment><USER12> Maybe the Googler teams they recruited?

</comment></comment><comment><USER13> Does anyone have a link to more info on their differently sized racks or the storage arrays described in the article? I'm not too familiar with the open compute project, but the storage vault design they have is 2U: [http://www.opencompute.org/projects/open-vault- storage/](http://www.opencompute.org/projects/open-vault-storage/)

which doesn't match the article.

<comment><USER10> Don't have anything to link to, but you're right, everything still ends up in a 2U, technically OU (Open U, 2 inches per OU instead of 1.75), chassis. Each ODM has their own unique sled setup for the server nodes, but everything ends up in a 2OU framework for the busbar connection.

</comment></comment><comment><USER14> Nothing new, but there are still lessons to take away. As a software engineer, I agree with removing constraints/rules to see what new things could happen, bringing in people across different domains to tackle new problem instead of just software engineers, and absolutely watching your users use your product.

</comment><comment><USER15> Come on facebook, screwless design is oldhat let's see a fully automatic drive replacement system.

<comment><USER16> Indeed. As I read this article I found myself thinking of my CoolerMaster case at home.

</comment></comment><comment><USER17> >>Facebook has found when engineers work together instead of in isolation interesting things begin to emerge.

Well, let's face it, this is hardly a groundbreaking new discovery...</comment>


Ask HN: How to decided what to do with life. When you want to do lots? - <AUTHOR> <comment><USER2> Don't try to do everything at once.</comment>


Ask HN: What happened to Starfighter? - <AUTHOR>

Exactly 120 days ago, patio11 announced starfighter: https://news.ycombinator.com/item?id=9173939. I signed up for the mailing list and never received anything.<p>The home page hasn't changed. What gives? We love you guys. <comment><USER2> Thanks for the interest and sorry re: the lack of email -- team made the decision to be relatively quiet while we were in the code cave. I have been crunching for the last six weeks in preparation for closed beta, which started Wednedsay. If all goes well, we will have something on AWS that actually works by the be of today.

Next up, a few weeks of iterating on level design, difficulty level, etc, and then...

<comment><USER3> Keep up the good work! I'm confident SF will be worth waiting for.

</comment></comment><comment><USER4> We'll be releasing any year now!

(Patrick is running private alpha tests of his levels.)

</comment><comment><USER5> Follow him on Twitter, you know his handle.

</comment><comment><USER6> Here is a tweet from June 29th:

"Starfighter progress update: private beta test in "the not too distant future." Watch this space (or your inbox) for more updates."

So, it appears to still be a work in progress.</comment>


Trump's nominee for USDA science post calls new U.S. climate report 'genuine' - <AUTHOR> https://www.sciencemag.org/news/2018/11/usda-science-nominee-calls-new-us-climate-report-genuine <comment><USER2> Well I'm glad Scott Hutchins is at least doing the bare minimum.</comment>


Ask HN: phpBB/vBulletin-like Python-backed forums software? - <AUTHOR>

Are there any open-source Python-backed phpBB/vBulletin-like  forums engines out there? Preferebly no ORM, Tornado or web.py. Thank you. <comment><USER2> I know of a variety of Django-based forums, but none that use Python directly. Even if I did, I wouldn't have paid much attention to any that didn't use SOME sort of ORM, so I would have dismissed them immediately.

If no ORM, what database are you wanting to support?

Is Django an option for you?</comment>


Introducing Coinbase Open Source Fund - <AUTHOR> https://engineering.coinbase.com/introducing-coinbase-open-source-fund-116617a1f6ec <comment><USER2> So excited that Coinbase is sponsoring styled-components! <3 Shoutout to the folks there for being supporters from (almost) day 1.</comment>


Rippling's funding round gives founder second unicorn chance - <AUTHOR> https://www.bloomberg.com/news/articles/2020-08-04/rippling-s-funding-round-gives-founder-second-unicorn-chance <comment><USER2> Every time I hear about this dude I only can remember that he publicly rescinded the offer of an engineer who asked in Quora on whether he should take an offer from Zenefits or an offer from Uber.

A harmless and rightful question that many people do ask themselves when considering an offer (taking x or y job offer) and the dude treated it like it was some sort of cult loyalty matter.

I hope he has learned from his past mistakes since he seems pretty smart and driven.

I just can't stand those cult-like cultures some companies/founders try to create. And I'm talking also about those companies that pose like they are a family and everyone is together no matter what. Drinking their own kool-aid... That's so far from the real transactional nature of a job.

To create good working cultures founders should start by realizing that the relationships between employees and employers are no different from the relationship between a buyer and seller. Both parties should seek for transparency, respect and fairness in their relationship. It shouldn't be some sort of lifestyle type of decision and they should never be challenged to pick between their personal life and their professional life. Your employees will never be as passionate as you're about the mission's company so if you want them to really stick and do their best, start by realizing they are not you.

<comment><USER3> > Every time I hear about this dude I only can remember that he publicly > rescinded the offer of an engineer who asked in Quora on whether he should > take an offer from Zenefits or an offer from Uber.

Hah, same here. I'd avoid the guy like the plague as an employee (and maybe even moreso if I were an investor). Not to mention that Zenefits was marred by a few HR scandals, too. Just goes to show it really must be "who you know."

<comment><USER4> re: "who you know" \-- this may indicate the opposite.

Consider how "looked down" this kind of investment would be, if the CEO has a bad record.

Yet, they still invest -- why? Because they think they will make a good return

<comment><USER5> "Who you know" is about people being treated certain ways by the people they know _regardless_ of reputation or underlying attributes.

</comment></comment></comment></comment><comment><USER6> We are in the process of closing our Rippling account. A few things that happened:

\- They signed us up on an introductory deal, claiming they'd reach out before the deal expired. This never happened and we got billed for tons of services we had not ever used.

\- We used their 1password copycat to share passwords between team members. We discovered that a former employee we had terminated through rippling had access to tons of sensitive accounts several days after their departure date. They claimed there was a bug and it took them a week to solve it.

Basically, highly negligent behavior.

<comment><USER7> We had a similar experience, and to be honest, I am disappointed that a founder with prior bad behavior is so easily forgiven and able to seemingly repeat this type of behavior in SV as it makes it harder for founders with less comfort with aggressive tactics to compete. Long term it will undermine consumer trust and do real damage to the market.

</comment></comment><comment><USER8> Interesting. Rippling is the only company I've ever interviewed at that, with full knowledge that they were doing so, offered me a job working more hours for significantly less pay than I was currently making. When challenged, they calmly assured me that it was a good deal, asked me to value the equity at something quite above this new valuation, and urged me to take the offer. Bold, but not the way I would choose to try and grow a company.

<comment><USER9> that's the same with many startups, that you'd need to work longer and for less salary. but more potential upside on equity. they would have been telling you that the equity could be worth more in the future if they IPO etc. not that it'd be worth more in this round of funding.

<comment><USER10> Rippling pays top dollar in the Indian job market. Know a couple ex-FAANG engineers who are quite happy with their compensation and work.

</comment></comment></comment><comment><USER11> One thing I will say about Rippling, their sales team is clearly incredible. And this fraudster asshole of a founder must be good at what he does too.

I've used their device management and single sign on products, and those are horrible. Much worse than the competition. Maybe their payroll and benefits management is fine? But so is Gusto, and Zenefits, and Just Works, it's basically a commodity at this point.

It all makes no sense to me at all, but hey it seems to be working out. Wild.

I guess it's another example of how unintuitively massive the enterprise software market is, as patio11 has written a lot about.

<comment><USER12> We use Rippling, and it's fine as payroll software. I chose it over Gusto because the complete integration between IT and HR is a really great and as far as I can tell unique offering.

In addition to payroll I get a "good-enough" password manager, MDM, SSO, integration with Gsuite, equipment purchasing. In theory, one-click and an employee is commissioned or decommissioned. If/when it works, it's a great idea. Having worked in a SOC2 compliant enterprise (we aren't and don't expect to be) previously, this would have saved me from purchasing several services AND given me documentation to pass my audits.

There's totally unique value there, and I wonder why they're basically the only ones to do it, though it's not currently as smooth as advertised.

</comment></comment><comment><USER13> This guy, again? How can I bet against any company founded by the guy responsible for the "creation, distribution and use of software designed to evade broker licensing education requirements."[0]

[0][https://dfs.ny.gov/system/files/documents/2020/03/ea170407_y...](https://dfs.ny.gov/system/files/documents/2020/03/ea170407_yp_dba_zenefits.pdf)

</comment><comment> cs-szazz We use Rippling at work, and I'm not quite sure what justifies a billion dollar plus valuation. (not to say it doesn't, I'm just super curious)

Anyone care to weigh in? I suspect there's a lot of things that behind the scenes as an employee, but to 5x it's valuation in a year... must be special.

<comment><USER14> It's almost certainly based upon a multiple of revenue. That multiple will be adjusted for growth, margins, and sector-specific hype.

<comment><USER9> I'd argue that it's almost certainly NOT valued on a multiple of revenue at this stage. still a lot about the founder, market size, story etc

</comment></comment></comment><comment><USER15> Well, at the very least cancel culture has not yet permeated the SV / VC bubble.</comment>


Conversations with some of the most interesting people in science and tech - <AUTHOR> https://www.ihmc.us/stemtalks/ <comment><USER2> Thanks for this, I was casting around for new podcasts. Looks good.

<comment><AUTHOR> I love these podcasts. Many of the talks are about Ketogenic diets and nutrition. Super exciting to see, as I've been following it for past 2 years myself and did a lot of research on it.

</comment></comment><comment><USER3> Site is down

"Error establishing a database connection"

<comment><AUTHOR> Most likely due to traffic from HN. Try searching for stem talk podcast if you've itunes or an iphone</comment></comment>


YouTube Chief Pushes Ahead with Subscriptions Despite Questions - <AUTHOR> http://blogs.wsj.com/digits/2015/07/24/youtube-chief-pushes-ahead-with-subscriptions-despite-questions/?mod=ST1

<comment><USER2> I foresee quite some nervousness for the future of Google because of the rise of ad/tracking blocking and privacy awareness.

</comment><comment><USER3> I do wonder if it would succeed in a wprld of ad blockers.

<comment><USER4> [https://www.youtube.com/yt/press/en- GB/statistics.html](https://www.youtube.com/yt/press/en-GB/statistics.html)

Half of YouTube's watch time is on mobile and trends show it growing faster: [http://www.businessinsider.com/youtube-video-watch-time- grew...](http://www.businessinsider.com/youtube-video-watch-time- grew-60-2015-7)

Ad blockers might be concerning but I don't believe they're currently widespread on mobile and with one mobile OS developer being hostile to 'advanced' apps like ad blockers and filesystem browsers and the other being an ad company, I don't think that's likely to change significantly.

It's easy to forget when your job has you on a desktop all day but mobile is now the 'default' way many (most?) people access the internet. Google receives more search queries on mobile than on desktop in many countries: [http://adwords.blogspot.com/2015/05/building-for-next- moment...](http://adwords.blogspot.com/2015/05/building-for-next-moment.html)</comment></comment>