The Hushed Dangers of Startup Depression - <AUTHOR> http://www.betabeat.com/2011/11/22/u-cant-haz-sadz-the-hushed-dangers-of-startup-depression/ <comment><USER3> Just as broken bones are a danger inherent in riding a motorbike, depression is one of the dangers inherent in trying to start a company.

Understanding this leads to two helpful realizations:

1\. It's nothing to be ashamed of and should not be stigmatised

2\. You would be wise to take precautions to protect against the danger (just like you would wear a helmet when riding).

The danger is particularly strong for solo founders, simply because of the lifestyle some have to live. Long periods of time spent on your own, slow progress toward your goals -- these are signals that the depression-triggering algorithms in your mind will latch onto.

Some things that may work to counter those signals:

* Socialise with friends, family or new people every day. If you can't socialise on a particular day, spend some time making plans with people to socialise in the near future.

* Be having sex, and regularly. Seriously, this is a very strong signal.

* Exercise a lot. Run, swim, work out -- even just walk around the neighbourhood.

* Plan your work to have near-term achievable milestones.

* Eat healthily and avoid alcohol. A weak immune system leads to frequent illness, which leads to slower progress.

<comment><USER4> > Be having sex, and regularly.

I know that hipsters and other socially capable people have invaded the technology industry in the last few years, but it should be noted that an entreaty to most technologists to "just have more sex" is extremely unhelpful. Would you tell a homeless person to "just make more money"?

As a matter of fact, telling this to someone whose depression has a large social disconnect component to it may trigger further feelings of inadequacy via the mental model of "I'm the only one who seems to be incapable of doing what is obviously so easy to this person, and everybody else."

<comment><USER5> The "have sex" comment is less "you suck if you're not getting laid" and more "if you have a SigOther, have sex". I've definitely found myself too tired for it after all the craziness of a day...

<comment><USER6> The problem is that somebody who is depressed doesn't think rationally - <USER2> fact, in the vast majority of the cases this dysfunctional thinking is precisely WHY they are depressed to begin with. They WILL see the advice in the negative way, not the positive way. Furthermore, in cases of severe depression or stress, a diminished sex drive is quite normal so sex isn't even an option - further fueling the feelings of inadequacies mentioned.

</comment></comment></comment></comment><comment><USER7> I know nothing about depression and even less about the "startup community", but I still think that this might be a good thread to throw in some of my thoughts, for what they're worth:

First, a little background...

In March, 2008, I attended my first Startup School. Even though I had been programming for many years, it was my first in-person exposure to the "startup community". It was incredible! For the first time in my life, I felt like I was immersed into the group of people with whom I belong. (The closest feeling I had before that was here at Hacker News.) Two great days talking about passionate things with like minded people! Then I got on the plane home and sat with 2 girls reading "People Magazine". All I could think was, "Welcome back to the real world."

Fast forward to today...

Sorry to say, I'm having trouble distinguishing our "community" from the "community" of those 2 girls. Sure, they were probably interested in celebrities while we're interested in technology & business, but the similarities are still striking: We're both often caught up in the latest fads, the "cool" stuff, what the fanboys are interested in, who got funded, who met with whom, who knows whom, where everyone's hanging out, etc., etc., etc. There are days when I come to Hacker News and have trouble finding a single reference to the most important thing: our customers.

I became interested in building digital things because it was such an incredibly cool way to provide for others. I still feel that way.

Whenever I start thinking about the "startup community" and all the details we mistake for issues, it's no wonder people get depressed. Sometimes we just lose our way.

But whenever I start thinking about my customers, what they need, why they need it, and how cool it is to help them get it, it's almost impossible to get depressed.

If you think you're getting depressed because of all the distracting details, find someone who needs something, focus on them instead of yourself, and build something.

Just a thought from an unqualified observer too busy and having too much fun to get depressed.

<comment><USER8> Suicidal depression rarely has anything to do with how much fun you're having. It's an illness. You can't pushup your way out of cancer, jog your way out of MS, and you can't fun your way out of real depression.

You make several good points, but let's not trivialize mental illness. I doubt (a lot) that it's something endemic or "taboo" among startups, but any time we can make any group of people more aware of the signs and symptoms of clinical depression, let's do that.

(Lost several friends, one of them close, to suicide).

<comment><USER9> As far as I know, the standard treatment for depression is medication to provide a short term fix (thereby convincing the patient that the therapist can help) and cognitive behavioral therapy as a long term fix.

As I understand it, CBT is basically teaching the depressed person how to "fun" (or stress manage/expectation manage) their way out of depression.

In any case, I believe the distinction between "illness" and "not an illness" is usually not very important - it's usually an attempt to appeal to medical authorities rather than address fundamentally social and ethical issues.

[http://lesswrong.com/lw/2as/diseased_thinking_dissolving_que...](http://lesswrong.com/lw/2as/diseased_thinking_dissolving_questions_about/)

<comment><USER10> I'm sorry but I take issue with your tone. I've been on around 4 antidepressants since reaching adulthood and I've dome (I'm still somewhat still doing) CBT. I'm fine now without further treatment but while I was being treated I must say that the pills work. Some more than others. Some people need them forever and some don't. The point of taking them is to get you motivated and just functional enough to start working out the cause. In my case they gave me just enough energy to get slightly involved in a few things. Those things then snowballed to the point where I didn't need the pills and had other outlets. I still am prone to be depressed far easier and more often than most but the treatment got me to a point where I have the tools lift myself out of it each time despite the fact that depression really is totally crippling and makes you believe there is no solution.

I still go to CBT though not often just because I really enjoy it and I get a lot out of it. Even the therapist agrees I'd be fine without it but it makes me happy so I go once or twice a month.

Depression _is_ an illness just like addiction or diabetes. I mention addiction because that's another one people like to write off as a moral failing or something that just isn't a real illness.

I could be misunderstanding your point but my experience tells me you're wrong on this.

<comment><USER9> I'm sorry you dislike my tone. But do you disagree with any of the factual claims I made? If so, which one?

From your comment, it sounds as if pills motivated you to try CBT, and then you lifted yourself out of it (via fun or other methods). I.e., you underwent the exact process I described - pills make you happier short term, therapist taught you to solve your own problems long term.

I'm also glad that you've also discovered CBT is an enjoyable hobby.

 _Depression is an illness just like addiction or diabetes. I mention addiction because that's another one people like to write off as a moral failing or something that just isn't a real illness._

Why do you feel that being an illness and being a moral failing are mutually exclusive?

Try reading the lesswrong link I posted. The gist of it is that the label "disease" describes a collection of heterogeneous objects, and drawing implications by analogy to some objects in the collection (e.g. cancer) can give misleading results when applied to other objects in the collection (e.g., drug addiction).

Similarly, this claim is an example of the same logical fallacy: "A penguin is a bird, just like a pigeon, therefore it can fly."

<comment><USER10> The thing I really didn't like was how you used the word "fun" as if to minimize the seriousness of the problem. In fact, it came off to me as if you were minimizing the seriousness of depression in general. I could have just taken it that way without you meaning it like that.

Your comment about pills also came off as if to say its not a valid solution. Like maybe pills are somehow for the weak or lazy.

Honestly, I just really detected a lot of snark in that comment and in this one and I don't know why. You just called my participation in CBT "an enjoyable hobby" like a backhanded compliment. I wouldn't call it a hobby at all.

Maybe if you want to get technical and argue semantics a moral failing and disease may not be mutually exclusive. But we're talking about the real world. As it applies to depression and addiction, disease and moral failing _are_ mutually exclusive. People are looked down upon and carry a stigma because so many people want to call it a moral failing. They say "just snap out of it" for depression and they call addicts weak people when the reality is so far from being so black and white.

Everyone can pull out studies to discredit the other guy's study that he pulled out. Let's be real when we talk about this stuff and not hide behind studies. Researchers disagree all the time so the best we can do is use our own experience, best judgement, and widely accepted truths to argue our points.

At the end of the day I took less issue with your facts than your ton. It just sounded demeaning and like you were minimizing the seriousness of this stuff. Plus there was a bit of snark detected. I don't think I was the only one either. That's all, this isn't a personal attack, man. Correct me if I'm wrong.

<comment><USER11> It seems you're being overly sensitive.

I don't really know what you mean by moral failing. To morally failyou have to start doing something that is immoral, like killing kitten or something

Just out of curiosity (I don't really know what the answer is because I don't have depression), but do you think it's impossible for a person to become depressed due to being weak or having a weak character?

Could for example being a loser make your life difficult and lead to depression?

Now I understand "loser" is kind of a meaningless term, but I'm just using it as an illustrative example.

Say for a particular set of reasons (having to due with your character/personality) everyone around you always teases you. Couldn't that lead to depression; and if you were that kind of person, wouldn't addressing what makes you a "loser" be the correct way ultimately to deal with your depression.

Or is depression never caused by problems with one's own personality/character?

<comment><USER12> Never? No. And sometimes Type 2 diabetes is caused or exacerbated by bad life choices. But no one denies that the symptoms are real.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I work a full time job and am a small time weekend entrepreneur. I work with one other partner at a distance and developers half way around the world.

I find it is very easy to slip into crippling depressions for a few reasons:

1) Working after you get home from work is exciting at first, then very quickly becomes grueling and exhausting

2) Every time you take time off after work you begin to feel guilty and start assigning all free time guilt because you should be working on your startup

3) You are constantly aware that when you work alone, or mostly alone, your work can easily trail in scope and head in a useless direction. There is no one to check this for you.

4) You have to be everything, your own marketer, designer, UX/UI dev, product testing, QA not to mention planing and ideation for product features.

These all add up to really, biting off more than I can chew, which in itself is probably the cause of a lot of depression -- the sense of an insurmountable task.

Not sure the best way to combat that.

<comment><USER14> Use it to your advantage. Seriously.

I have been there, several times now. Each time I learn a little more and each time I come away more effective. I've found that when it gets really tight and overwhelming by simply not giving up you begin to notice the things that are critically important and that need to get done and the things that are just nice to have.

In the end when you start noticing these things and get the important tasks done and let the non-important ones slide it feels pretty good.

I still struggle with #2 though. It often feels like no one else I know ever feels that same guilt. The only solution I've come up with so far is if I'm doing something that isn't work then it needs to feel like I'm not wasting time. For some reason I don't really understand yet playing golf doesn't feel like I'm wasting time. Maybe because it's a solo sport and for me it's competitive? I don't know. It helps though.

Edit: To acknowledge the spirit of this thread I am not suggesting a depressed person push through and use the stress to their advantage. This is advice for someone who is not depressed. I do know what depression is like, and if you're depressed and experiencing the above then I don't think it's possible to make it through. Acknowledge your mental state (Very hard to do, talk with other people, seek help) and come back later.

<comment><USER13> Your comment identifies that my above comments aren't really depression -- more of a dissapointing lull, and should not be confused with a real clinical level of depression which I'm not sure I've ever experienced.

<comment><USER14> I can only speak from my own experience. Taking that into account from the points you identified that is not depression, rather a state of being knocked down and overwhelmed. Something that in my experience you can push through and learn from.

Depression is different. The best way I can explain it is if you've ever experienced the kind of euphoria associated with a deep connection with someone else. Not just lust but a deep connection or love - depression is the exact opposite of that and just as powerful.

Unlike being in love, you may not know if you're actually depressed or just experiencing what I have taken your points to be as a state of being knocked down.

</comment></comment></comment></comment><comment><USER15> I'll admit I'm never a huge fan of other founders asking me how my startup is going as a conversation starter. There are often three scenarios:

1.) Nothing new or exciting has happened since last time, in which case I feel pretty crappy.

2.) Something cool has happened, but I don't feel particularly boastful nor do I want to get into a long discussion of why that thing is cool.

3.) Something very amazing has happened, but I'm actually not allowed to talk about it.

I do notice when I return the question, I almost always hear the answer this article suggests ("awesome, best month ever, crushing it"). I guess that's why people always gave me funny looks when I used to give an honest assessment.

Now I just always answer, "Good good, we're pretty close to (some lofty feature or pseudo-pivot that is months away)". It's a convenient way to change the subject. Keep in mind this primarily applies to casual meetups with people I see regularly every 1-3 months but don't consider close friends.

<comment><USER16> 2) To combat this, I make sure my partner shows off his stuff to me all the time, and vice versa. Sometimes just showing someone who understands that something is cool and getting just some truthful criticism is really encouraging. If my partner builds something cool, even if I can figure it out... "show me".

1) If nothing exciting happens, I try to talk about something good happening in their life, try to keep focused on the happy part of your life vs the frustrating/hard part to keep spirits up.

3) You can always talk about it with your partner. Or. You can talk about it, with friends. Its good to have a friend who is willing to sit there and listen even if they don't fully get it and you know they won't backstab you.

</comment></comment><comment><USER17> So, being pedantic, is Diaspora even a startup? I've thought of it more as an open source project. And even if we're willing to label it a startup, why jump to the conclusion that doing a startup was the trigger? Couldn't it just as easily be a breakup, family problems, various emotional issues, etcetera? Why do we assume that the incidence of depression and suicide is higher among founders than non-founders?

I don't mean to trivialize the interplay, often strong, between emotions and work, but we're making a lot of assumptions here that as far as I'm aware are unfounded.

<comment><USER18>
        1. Life as a founder is often incredibly stressful.
        2. Prolonged periods of stress exacerbate/cause mental illness.

If you agree with both of those statements, the logical conclusion is that incidence of mental health related problems is likely higher among founders than the general population. At any rate, talking about these issues is of some value regardless.

<comment><USER10> I agree with those statements but the incidence of mental health problems isn't necessarily higher among founders because it. Being a founder (a real founder, not just an idea man with no execution) takes a special kind of person. These people seem to be able to handle the lifestyle and the stresses involved better than the general population. I wouldn't say they're immune but I'd say their ability to execute on a great idea and even be marginally successful at it puts them a cut above the rest.

So maybe we can safely say that founders are more likely to be at risk while at the same time saying that they don't succumb to depression in as high of numbers as other groups would despite that risk. I'd add to that lime of thought by saying depression is still far more common than we realize as it just isn't talked about so it doesn't show up on our radar.

</comment></comment></comment><comment><USER19> It seems like the bigger problem may be denial. I don't think depression is unique to entrepreneurs. Just living in NYC brings an exceptional set of challenges for someone to overcome (The article tells stories from NYC). For start-ups though, constantly having to put on a pretty face for everyone (employees, investors, clients, customers, friends and family) and deny the fact that you're a total mess on the inside technology-wise, business-wise and personally is the root of the problem. It creates incredible pressure, and if you can't live up to all the beauty you say you have, it makes you feel sad, angry, frustrated, and lost. Throw in not eating properly, not exercising, and not getting enough sleep and you have a recipe for depression. If we could just talk about how messed up everything is, we might find that we aren't the only ones and feel better about it. I'm a founder in NYC, so if anyone wants to talk, hit me up!

</comment><comment><USER8> This is an article whose lede is about a 22 year old killing himself, with a lolcat title ("U CANT HAZ SADZ"). I stopped reading right there. Can anyone summarize?

<comment><USER20> "Depression is a taboo subject in the startup scene, despite being very common. Be aware that it's common, don't be surprised when it hits you, and do something about it (and be sympathetic to those other founders who are depressed)."

<comment><USER8> Is it really taboo, or is this just the simplest framing for a trend story now that a writer at BetaBeat has heard two stories about startup founders killing themselves?

<comment><USER20> There is certainly a chest-thumping habit in the startup world. 90% of the startups you speak to in any meetup are probably doing dismally, but you'll almost never hear them say anything negative until they suddenly fold and start doing something else.

"How's it going?"

"Great! Our user base is growing, and they love the product, and blah blah blah"

 _6 months later_

"Oh, you're doing something else?"

"Yeah, it worked well, but it wasn't successful enough." (or, if they're more honest, "Our users loved us but we were making about $100 a month of turnover")

</comment></comment></comment></comment><comment><USER21> I think what's happening is that all the positive spin about why you should make a startup are just drowning out the negatives, and this makes sense. I work for a company that makes over 100 million a year and one of the founders told me that if he knew how much work starting the company would be, he wouldn't have done it. There is a part of being an entrepreneur that is about ignoring the negatives. It's a very Han Solo, "Never tell me the odds" kind of thing.

I spent the first 3 years post college using all my free time in a new city trying to bootstrap my startup by myself at home in front of a computer almost every night and weekend after my day job. Luckily I met my now wife along the way which helped keep me motivated and gave me someone to talk to. I didn't really feel I had time to make any other friends. My business succeeded and survived, but depression was probably the biggest obstacle. It will absolutely crush your motivation, and when you get unmotivated, you see the project stagnate which pushes you even deeper into a lack of motivation, burnout, and depression. I felt I was really all alone in it. My now wife even stopped being supportive after a couple years of no profits. She's not really someone who has the same passion for entrepreneurship, so she just saw me spending all my time on something that had gone nowhere, getting depressed, having no social life. She was right to be concerned. This probably has something to do with why co-founders are recommended. If someone would have been on the journey along with me it would have made it so much easier, but I went it alone because at the start I didn't feel I had enough skills to offer anyone legitimate as a co-founder, and at the same time, I didn't want to partner up with a friend who wasn't really interested in sticking it out through years of after-work bootstrapping and no profits while we learned.

Right now I'm embarking on a new startup, but I'm doing many things differently. It's important to understand yourself. The last 2 years I've worked hard at making close friends in the area where I live. I need to keep those friendships healthy even if it means less time working on the startup. Secondly, I work out at least twice a week. Again, both of these take away from my startup since I still have a day job too, but they are absolutely crucial and I've come to realize that 4 hours of healthy motivated time is better than 16 of depressed unmotivated time.

</comment><comment><USER22> Honestly, the hardest thing about running a company is that you have to be a cynical bastard and a rosy-cheeked optimist at the same time. Juggling those two paradigms of viewing the world is harder than anything else I've ever done.

Improving your product almost requires cynicism, since you have to view what isn't good enough; but you have to be able to stay optimistic and know you're going to get "there" someday. Otherwise, you get depressed and feel massively alone.

That is the dichotomy.

</comment><comment><USER23> Talking about mental health problems is important. Some of them commonly start around the early twenties; stress[1] can be a trigger; having "rainy day action plans" can be immensely helpful making any times of illness much less disruptive to the sufferer.

Knowledge helps people around the person too -- knowing that pulling someone aside and just talking to them about their feelings is a good, helpful, thing could save lives. Knowing that this person has a disorder that makes them incredibly effective for a few months but that comes with a risk of "crashing" allows them to put support in and encourage taking of meds or contct with professionals.

In the UK employers are not allowed[2] to discriminate against people with mental health problems, so knowledge is again really useful.

[1] "Stress" means slightly different things to different people. I tend to use it for unhealthy harmful stress, and "pressure" for the stuff that people enjoy and thrive on. Pressure for one person could be stress for another.

[2] I guess there's some exceptions.

</comment><comment><USER24> Is this particularly endemic to start-up culture? University was also extremely demanding and brought many people to their knees. And while on the one hand, you may work harder than you ever had in your life, you are working for yourself, your own goals. There is a liberation in that (I can certainly speak for myself - to be reminded that every drop of effort I'm putting in is for my own forward movement keeps it going).

I hope those who are young and just learning how hard they can push themselves have a mentor. I owe mine a million thanks a thousand times over.

<comment><USER25> _Is this particularly endemic to start-up culture?_

On the one hand, no. Depression is very common and strikes everywhere.

On the other hand, startup culture does make it unusually difficult to cope with depression. There's a cult of very long hours and complete focus on work, which is a recipe for burnout. Most startups need every employee to be a marketing face of the company – which generally involves a constant projection of optimism and energy, and which in the era of Twitter can require you to keep your game face on 24/7.

Speaking of Twitter: Software startups are the first and most energetic adopters of the internet, the social structure of the internet is not (yet?) well designed – it is still early in its history – and frankly the internet is not an emotionally healthy environment. It's a fishbowl the size of the planet. There are all kinds of things that none of us are comfortable discussing in public, mental health is right there on the top of that list (in American culture, at any rate), and there is nothing more public than the internet.

University is a far less scary environment. There's rituals and schedules. There is, believe it or not, less time pressure. There are lots of peers who are easy to interact with _in person_. There's restaurants and bars and student unions and clubs and sports and hobbies. There's professional counseling. There's bailout options (you can drop classes, petition for pass/fail status, take leaves of absence). Most important of all, there's less of the culture of relentless optimism. People _expect_ students to get into funks now and then. Everyone knows that sophomores spend hours having crazy philosophical discussions at three in the morning. The Ph.D. is practically _basic training_ in depression-management techniques. Everyone knows that grad students spend evenings sitting around sipping microbrews and moaning about their advisers; back at Cornell they had a T-shirt: DON'T ASK ME ABOUT MY THESIS.

<comment><USER26> No one is giving a student $4,000,000 and expecting it to be $40,000,000 within 3 years either.

</comment></comment></comment><comment><USER27> Likely some useful insight to be found in the military. The "loneliness of command" is not exactly a new phenomenon.

<comment><USER28> Loneliness of Command is a very different sort of pressure.

</comment></comment><comment><USER29> One thing that exacerbates my startup depression (yep, I've got it too) is the fiscal pressure of being a founder - even if I stick with founding startups for many years, and do so many times, the odds are that I'll end up with significantly less wealth than if I just got a "real job".

The #1 reason for this is that investors require that founders "stay hungry" (aka get paid less than market compensation). Couple that with the periods of getting paid nothing (before you raised money, and when you are in-between startups) and the very low likelihood of a significant exit (thus all those founders shares are usually worth $0) and the result is one more thing to be depressed about; the fact that you are working your ass off, and being mostly miserable, without getting paid for it.

</comment><comment><USER30> Speaking from my own own experiences, I wouldn't class depression as a disease, but as a disorder (wikipedia seems to agree).

I would describe it as having a heavy inertia towards negative thoughts and feelings of hopelessness. It's totally possible to have moments of happiness, be cheerful etc, but these moments are fleeting because they take such considerable effort to maintain. It's even more effort to force yourself into a good mood, and part of the problem is that you don't actually want to.

Whilst I'm skeptical about the efficacy of anti-depressants, I would say the effect I've (subjectively) noticed is to decrease this inertia to the extent that it's easier to have good moments. They don't actually make you happier, they just make it easier for other methods to work, eg CBT or Meditation.

With regards to startup depression. I'd be very surprised if it's something that affects everyone, but there are certainly people who aren't currently depressed whom have character traits that would trigger depression in a startup environment. These people are typically over-invested in outcomes, or tie their ego up with their successes.

My advice to anyone considering joining a startup would be to honestly assess themselves and work out whether they have some of the traits that would put them at risk of depression. Then tackle them before getting involved, almost all the lessons I've learned from books and therapists are applicable in some way to everyone, not just those with depression.

</comment><comment><USER31> I treat mental illness like I treat, race, gender, and other "sensitive" issues. Honestly, outside of my personal experience, I don't understand and probably won't ever understand the subjective experience of another.

So I try my best to listen. I don't always succeed, but I do understand that listening is the first step.

</comment><comment><USER32> you'll be surprised how much exercise, sports, meditation, or spending a little bit of time doing something unrelated to your project can help a lot. Unless it's really clinically severe anyone should do their best to avoid anti-depressants.

</comment><comment><USER33> great article. founders need to read this - launching something new is such an emotional rollercoaster and the incredible highs can be matched by devastating lows.

any startup involves visualizing a future that doesn't yet exist, and the path to trying to reach that version of the future is always more difficult than it seems. most startups fail and this is depressing for the people who invest their lives into them... we should step away from being cerebral coders sometimes and just accept the emotional stress we come under when we try to change the world!

</comment><comment><USER34> we should bring this up at the next startup community meeting

</comment><comment><USER35> Well, depression in this context doesn't surprise me.

I think of the "Let's build a company to sell and retire" startup as an attempt, in desperation, to avoid the rat race, by working your ass and some of your best years away, with extreme pressure and slim chances of success.

We only get to here the success stories, 99% of the time, though, which makes it seem much more glamorous.

I much prefer the building of a sustainable business a la "37 Signals", or failing that a series of good paying / sensible time jobs working in interesting problems.

Come to think of it, most of the hackers I respect most weren't at all "entrepreneurial", some were in academia and others worked in companies, from Brian & Richie, to JWZ, to Knuth, to Guido, etc.

And I don't have much respect for the "successes" in the startup sense, like Zuckenberg et al, nor I think Facebook, or Groupon, or Spotify (or whatever the flavor of the day is) as "changing the world". Tim Berners Lee changed the world from a small office at CERN. Mosaic/Mozilla also changed the world. The IBM PC and the Mac changed the world.

Overhyped IPOs and social networks? Not so much. (And don't get me started on the overselling of western media of the supposed role Twitter et al played in Middle Eastern riots/revolutions).

<comment><USER12> I prefer the 37 Signals approach as an ideal, but it's still a lot of hard work and frequent disappointment. As far as I recall I've never seen anyone at 37 Signals acknowledge that. They make it sound like it's a nitgts & weekend thing that will take off based on design alone.

<comment><USER35> Well, there's always the fact that it took them several years to gradually get to where they are now, including a couple of years of hard work in the beginning that weren't even visible.

</comment></comment></comment><comment><USER36> These sorts of pressures are the reason that I made <http://www.CompassionPit.com> \- a site where you can chat anonymously, 1-1, with someone who will listen to you. Just join as a venter. Or, if you're feeling charitable, join as a listener. "Get it off your chest without it biting you in the ass".</comment>


Hardly Working: Start-up Guys  - <AUTHOR> http://www.youtube.com/watch?v=LMmdl4VltD4

<comment><USER2> Painfully accurate.

</comment><comment><USER3> hilarious and has some truth to it ;)

</comment><comment><USER4> I love this.</comment>


FBI paid professional hackers one-time fee to crack San Bernardino iPhone - <AUTHOR> https://www.washingtonpost.com/world/national-security/fbi-paid-professional-hackers-one-time-fee-to-crack-san-bernardino-iphone/2016/04/12/5397814a-00de-11e6-9d36-33d198ea26c5_story.html <comment><USER2> Responsible disclosure involves notifying the vendor (Apple) first.

[https://en.wikipedia.org/wiki/Responsible_disclosure](https://en.wikipedia.org/wiki/Responsible_disclosure)

If the FBI wanted to protect the public, responsible disclosure of the exploit is a first step.

Sigh.

<comment><USER3> Apple used the FBI hearings as a public relations project. They lost all sympathy from the Feds after that. They really should have played their card differently but instead wanted to rally the public against a federal law enforcement agency so they can prove to customers that they take privacy seriously.

I'm not sure if Apple intended to rile up the Snowden/tin-hat wearing crowd who thinks the government is out to get everyone, but that sure didn't leave a nice aftertaste in the FBI's mouth.

Looking at this objectively, Apple shouldn't expect the curtesy of responsible disclosure. If this makes the public wary of Apple ability to protect their privacy, well, so be it. The FBI's duty is to actually protect the public, not to protect the customers of a single corporation.

I think this is brilliant counter-marketing on the part of the FBI and a real "fuck you" to Apple for turning a criminal investigation of a mass murder in to some fucking sideshow circus where they could show the public just how much more they care about privacy than the government.

EDIT: I'm sorry, but I have a rate limited account because my conservative opinions are not valued by the HackerNews community. I have some follow ups to your comments:

\---

> That includes protecting the public's communication from criminal > eavesdropping, which they are undermining when they keep an exploit secret > instead of responsibly disclosing it.

I'm sorry, but this is not how the courts see things. Please see [https://en.wikipedia.org/wiki/Third- party_doctrine](https://en.wikipedia.org/wiki/Third-party_doctrine)

As far as I'm concerned and as far as the US government is concerned, as soon as you broadcast radio and electrical signals from your private person or property, it's been published. That's how it's been since the beginning of the country and that why Apple and Facebook are even allowed to sell your information to third-party marketers. Everything that leaves your devices legally has to be made public so our data can be legally sold.

This is also related to credit reports, doing-business-as, and many other kinds of public record keeping. You should not expect privacy when buying and selling goods in a public marketplace. How could you possible stop someone from monitoring what you're buying and selling? Consumer reporting, public record keeping, and public census data are incredibly important parts of our institutions.

We're going to need a newly defined set of laws and regulations to actual define what I've been calling "privished" works, that is, information that a third-party is liable to both the individual as well as the government, to make sure that the 4th amendment is still a two-way contract.

I suggest you brush up on some of your constitutional and common law interpretations of what privacy actually means with regards to mass communication. I think most of the HN threads are missing half of the social contract and fail to see the importance of granting the government the right to warranted search and seizure.

<comment><USER4> > wanted to rally the public

Source? Preferably the press release in question.

It's FBI who was pushing the polemic, and that's the same polemic you are now pushing.

Also, this isn't a show. These are legitimate privacy concerns that require active protection. The FBI is hardly in the business of protecting information from hackers. If they were, they probably wouldn't need Apple's help in the first place to penetrate their security. They simply don't have the expertise.

Again, I'd like to point out that it was the FBI who took to the PR stand to address the public directly in a political manner.

<comment><USER5> Allegedly Apple wanted this request from the FBI to stay under seal, and it was the FBI who pushed to make it public. If that's the case, then it may have indeed been the FBI not Apple who turned this into a PR situation.

<comment><USER6> Somebody inside the FBI was greedy for a raise and took the risk to try to take a bite out of the Apple. I doubt they got demoted or took a salary hit. The career upside for the individuals involved would have been huge. Perhaps they believed in their anti-terrorist cause but no more than an Apple employee proud to build the next version of iTunes.

</comment></comment></comment></comment></comment><comment><USER7> Am I the only one who reads the quotes in this article as "see Apple, if you don't give us what we want then we may just have operational reasons to not disclose vulnerabilities to you, wouldn't that be a shame..."?

<comment><USER8> It does come off a bit like a multidimensional pissing match - with the FBI alternately saying, "We can force you to break this phone", "We can break it ourselves if we want to", "We will break it and not tell you how", "We can insert a succession of stories in the media that will call your security into question."

<comment><USER3> It is of course a territorial pissing match. Apple, and most of Silicon Valley, thinks and acts like they are more important and powerful than the country that granted them a corporate charter and the public infrastructure with which to do business.

<comment><USER9> > Apple, and most of Silicon Valley, thinks and acts like they are more > important and powerful than the country that granted them a corporate > charter and the public infrastructure with which to do business.

Apple was defending the fundamental rights of the public - "we the people" (i.e. country that granted them a corporate charter) - against an agent of said country who tried to overstep the bounds of the power the country (again "we the people") granted them.

The court was the way for the agent to prove what they don't overstep the boundaries of the power that the public granted to the agent, and for all we know the agent failed to do so.

to the "venomsnake" below : i didn't say Apple always defends the fundamental rights, i even didn't say that Apple in this case was motivated by the defense of the fundamental rights. The fact that we do know is that Apple in this case defended the fundamental rights - for whatever motivation, probably for profit as a corporation and that would be my guess is that Tim Cook was doing it for the fundamental rights really or may be just to piss off FBI for fun.

<comment><USER10> If apple believed in any form of fundamental rights for their users they would have given root, unlocked boot loader and alternative appstores to the people.

<comment><USER11> You can believe in a fundamental right to privacy without a fundamental right to full control over devices.

In fact a strong enough emphasis on privacy leads you to restricting the ability of the user to undermine their own security.

You dislike apple's methods, which is fine, but it doesn't make them hypocritical.

<comment><USER10> You can't have privacy without control. It is impossible. You cannot hide from your sysadmin - that is axiom.

<comment><USER11> Unless you have a staff of experts, you're not going to be able to secure the device yourself. So Apple has to be involved in almost everyone's security whether you like it or not. Putting the user in charge is good for freedom, but it takes you from one failure point to two failure points.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Missing from TFA: any consideration of whether the "work phone", which was subject at all times to repossession and inspection by San Bernardino County, stored any information about terrorism, particularly information worth overturning fundamental assumptions about the duties of electronic device manufacturers.

<comment><USER13> Iirc comey said in one interview that they wanted to know which path they went on during missing minutes on the day of the shooting when the phone was with them, and hoped the phone had location data.

Edit: see [http://nytimes.com/2016/03/02/technology/apple-and-fbi- face-...](http://nytimes.com/2016/03/02/technology/apple-and-fbi-face-off- before-house-judiciary-committee.html)

<comment><USER14> That data is easily available via tower pings without needing to unlock the phone. Who sets up their phone to record constant GPS coordinates?

<comment><USER15> Do towers record past telemetry data? Assuming they do, the granularity of knowing that a particular tower handled a phone ping is comparatively useless. A guessed location (stored on the iPhone) based off of cell tower triangulation and the occasional GPS calculation is far more valuable.

I do agree that we should consider the FBI's statement with skepticism.

<comment><USER16> > Do towers record past telemetry data?

Yes. Did everyone forget about COTRAVELER?

[http://apps.washingtonpost.com/g/page/national/how-the- nsa-i...](http://apps.washingtonpost.com/g/page/national/how-the-nsa-is- tracking-people-right-now/634/)

> the granularity of knowing that a particular tower handled a phone ping is > comparatively useless.

No, it's not. A simple correlation with other phones tells you who is traveling together (co-travelers). This only requires knowing which phones are near each tower, at a fairly low temporal granularity.

I'm sure there are additional ways to analyze that data, too. The travel and relationship map that COTRAVELER discovers is merely the project we know about.

</comment></comment></comment></comment></comment><comment><USER17> Sorry, but selling to corrupt governments for personal profit makes you black, not grey, hat.

</comment><comment><USER18> How come the FBI isn't afraid these guys are going to sell the same exploit to foreign governments which will use them to break into US government phones?

<comment><USER19> ? The FBI probably assumes that yes, other actors do have access to unknown exploitable vulnerabilities.

It's 2016. Any data that hasn't been airgapped for the entirety of its existence needs to be considered if not public, then at least known to the enemy. (if accountants in tax havens would take that to heart, they wouldn't be in the predicament they are in now...)

</comment></comment><comment><USER20> FBI also paid professional researchers to deanonymize the Tor network, so I don't see how this comes as a surprise to anyone.

</comment><comment><USER21> Philosophical rudderlessness: Fidelitry, Bravery, Integrity.

If you want a successful career in public service, don't serve the public. The FBI does not want the public protected from this vulnerability.

<comment><USER22> The FBI is willing to protect you how they see fit only, notwithstanding how that may fit within the bounds of Constitutionality. If you are not willing to give up such rights, the FBI will protect you through any means necessary - through force if it comes to it.

</comment></comment><comment><USER23> Does any suspect that this might all just be PR posturing? They found a zero day exploit but they don't have to say what it was. They don't have to whether or not more interesting data was found. Nothing. Could it be they are just trying to save face? Granted they've looked quite foolish in all of this but still.

</comment><comment><USER24> Working under the assumption the FBI works for us, the people, I would hope two things:

1) They disclose the vulnerability to Apple and make us all safer

2) Having now unlocked the phone, disclose if there was additional information that materially helped the case.

I'm cynical about them doing either, but I think they're both reasonable requests from the population.

</comment><comment><USER25> Just had a thought: couldn't you copy the encrypted phone, run it in 10000 emulators and try a different PIN in every emulator? If the problem really is just a 4 digit PIN, that should work?

Or is the flash memory and the flash memory controller doing the decryption entangled on a single chip so that they can not be physically separated?

</comment><comment><USER26> > "The U.S. government now has to weigh whether to disclose the flaws to > Apple..."

Apple is going to find the flaw. They wrote all the code and have some of the smartest people in the world working there. No reason for Apple to even ask the government to disclose the vulnerability to them.

<comment><USER27> Well, the same smartest people unknowingly put the bug there. It's not as easy to find a security flaw (without someone telling about it) as you think. They'll eventually figure it out, but may be not immediately.

</comment></comment><comment><USER28> I suspected as much. Those guys who kept jailbreaking time after time seem like good candidates.

<comment><USER29> geohot is busy doing car AI

</comment></comment><comment><USER30> Did the FBI pay for them to hack or pay for the (exclusive rights to the) exploit? The rest of the article implies the latter- but if the former, what is stopping Apple from paying the "hackers" for the exploit?

</comment><comment><USER31> So not the NAND mirroring thing, right? Just a software exploit?

<comment><USER23> Whats the NAND mirroring thing? Could you explain?

<comment><USER32> You copy the storage of the phone (the NAND) and then put it into a bunch of iPhones and try all 10,000 possible pins. If a phone gets locked out, you just restore the mirrored (the copied) NAND.

</comment></comment></comment><comment><USER33> I wonder what the price was.

</comment><comment><USER34> I knew those clowns couldn't have done it themselves. The FBI are more or less inept.

</comment><comment><USER35> Apparently the code was 6969. Got it on the third try.

</comment><comment><USER36> Yes, yes that's exactly what happened. Apple had nothing to do with it. And that charade they put up about suing then not suing, etc, was not a charade at all. /s

<comment><USER7> I'm continually baffled by the pathological disdain some people like yourself seem to show towards Apple... Is it the cognitive dissonance that "Google does no evil", therefore if Apple is seen working for the privacy of their users (which they have both sound business reasons and I have no reason to doubt moral convictions to do), where Google does not, then they must have a hidden agenda?

<comment><USER36> i said nothing about google, i am cynical about the whole industry in terms of its collusion with the government. you sound like an apple fan boy.

<comment><USER7> Fair enough, the Google comment was unfounded (and I do believe that many at Google also have strong convictions to protect their customers' privacy but it's a lot harder to do when your business model depends on storing your customers data in clear-text on your servers).

Personally I am disturbed by the continual government assault on the security of personal data and I believe that companies like Apple are our strongest stalwart against it.

I may be a bit of an "Apple fan boy", indeed.

<comment><USER37> It's great that Apple is a company with lots of money that can stand a chance in court and all that, but that also means they're a government-legible single point of failure. Their business model is still "administer our users' devices". While this is _much_ better than Google's "surveil our users", maintaining their privileged access puts their users at risk, as highlighted by this recent battle.

<comment><USER38> It seems fairly clear that Apple's trying to engineer out as much of their being a single point of failure as possible.

<comment><USER37> I haven't heard of any plans of making the updating process more self- controlled (eg allowing users compare checksums with friends before updating, or additional third-party signatures), or hardening their firmware against local tampering (since their security model incorporates trusted computing). The references to "secure enclave" seem mostly for comparison rather than any direct analysis, and it seems like another general-purpose easily-updateable chip.

It doesn't seem like it's actually possible to do all that much without releasing source for a TCB, especially with the possibility of NSL (etc) mandating secret backdoors for every device.

But maybe I have just missed the recent news.</comment></comment></comment></comment></comment></comment></comment>


The Inside Story of How Facebook Responded to Tunisian Hacks - <AUTHOR> http://www.theatlantic.com/technology/archive/2011/01/the-inside-story-of-how-facebook-responded-to-tunisian-hacks/70044/ <comment><USER2> I have a bit of a problem with the description of the hack as "The software was basically a country-level keystroke logger"

I think this is unnecessary dumbing down.

For most readers who already knows what a keylogger is, it should be fairly obvious to them that this is not what they were doing.

For any reader who does not know what a keylogger is, describing the hack as being like a keylogger is not going to help them understand.

Furthermore, if you are in the demographic that know what a keylogger is, but can't see how that it is obvious that is not what was going on here, it just obscures what was really at play here: authenticating over (unencrypted) HTTP.

The writer probably did not want to make this a story about authenticating over HTTP, but misdescribing a central feature of the story is misleading.

<comment><USER3> I thought this too, but if you go look at what was actually done, 'keylogger' is a fairly accurate description.

They were injecting a Javascript keylogger, not doing packet sniffing or the like. Not the same as a keylogger actually running on your OS, but I would say still the correct term.

Facebook sends login credentials over HTTPS, they aren't so dumb as to authenticate over HTTP. But they serve their login page over HTTP which is what allowed the Javascript keylogger to be 'installed'.

(edit)

PS Here's a link to the purported exploit: <http://www.hackerzvoice.net/node/105>

<comment><USER4> I've spent time arguing with some fairly large and supposedly security-minded entities, about just this practice -- delivering login forms over HTTP. It doesn't matter that the specified destination is HTTPS. A MITM can do whatever they want to the form and its enclosing page while it's on its way to the client browser.

There's a quite successful startup, much beloved by HN, that has exactly this problem with one version of their sign on page. I won't say which one, because I don't want to make targeting too easy. I've been having a back and forth on a support ticket with them, after noticing the problem. They did say they followed up and looked into my concern. But they compared their design to Facebook et al. and said they were following "best practices".

An aside: Once you start using the term "best practices", you need to take a _serious_ look at your design and engineering perspective. Especially in security, your thinking should _always_ be challenging the established model. You may not find a better way, and you should be very skeptical of yourself when you think you have. But you need to be a bit... paranoid, always challenging the "established truths".

EDIT: To that company, if you happen to read this. I posted this after emailing you. And before the coffee fully kicked in. It wasn't my intention to create so blatant a cross reference for you to follow between me here and me in email. (I.e. not some twisted version of karma; just trying to make the point.)

<comment><USER5> The RFC curmudgeon in me says we shouldn't be using login forms anyway; we should be using HTTP Digest authentication. No passwords are sent over the wire, in the clear or not.

</comment></comment></comment></comment><comment><USER6> I didn't see a shift from http to https in the protests day. However, pages that report anti-government news, asked their audience to use <https://login>. so they can open censored pages.

Back to Facebook, it had played a very important role and was key to the protests success. In the past, information is spread through word of mouth. There isn't trust, when it's spread that way and also no images or videos. The information that arrives isn't quite adequate.

Emails and forums are good, but due to Video websites censoring, they can't play an important role, since only a few fraction of the Web users in Tunisia can run a proxy.

Facebook changed everything, anti-gov. pages have from 200K to 600K fans. That's more than the half of the connected Tunisian population. In the last days, activity on Facebook was terrible, I would estimate that I post 50 to 100 videos, status and images; same for my friends.

Information spread essentially from these few pages with huge popularity. In a discussion, Admins seems to be using proxies and VPN to make secure connections and they have an anonymous Facebook account to communicate with the protesters (receive videos, photos, and information).

The urgent news would take only 30 minutes at most to spread through the network. Most of my friends, spend all the night (and dawn?) until late 4 and 5 A.M.

</comment><comment><USER7> Good for Facebook. From the article, it sounds like they did two major things: 1) shift all Tunisian IP addresses to https instead of http. 2) anyone who logged out/in while the keylogger code was running was shown a social CAPTCHA. The CAPTCHA asks you to identify friends in photos.

<comment><USER8> I've had to answer the social CAPTCHA myself, when logging in from a different country while on vacation. Details:

You are shown two pictures of the same friend, with the tag of him/her showing (i.e. a square around them, like what you get when you hover over their name in a tagged photo). You are then asked to say which friend of yours it is, choosing from a list of around 7 names.

You can skip as many of these questions as you like, in case you've got pictures where the tag isn't very good (e.g. someone tagged a comic or something instead of an actual photo). But every question you answer _has_ to be correct.

<comment><USER9> How can this possibly work for blind people? Facebook is already pretty inaccessible but this seems utterly impassable.

<comment><USER10> Blind people have to click on Stevie Wonder.

</comment></comment></comment></comment><comment><USER11> A couple of things:

1)how sure can we be that switching to SSL really got rid of the sniffing going on? I'm asking because I assume that it's totally within the capabilities of the government to sneak-install a CA certificate on clients.

Or they don't bother and trust people to just click through the security warning.

2) is that "identify your friends" check maybe a bit pointless as the needed answers can probably be determined using data from already hacked accounts.

3) playing devil's advocate here: if the laws of Tunesia allow for the government to do such things, is it Facebooks place to violate those laws? And: could they be pressed into giving away that data anyways due to political pressure from wherever?

I wouldn't use Facebook to post anything that I would not want a third party to see - unless I encrypted it beforehand.

<comment><USER8> About 2), I'm not sure how that's possible. I've written details of the method that I think they used in another comment, but basically, they're showing you tagged pictures of friends and asking you who it is. A computer will be unable to translate the picture of a friend to a name.

<comment><USER12> Why not? Facial recognition algorithms are becoming common features. I'm not saying the Tunisian government would have had the ability to drum up a hack like that, but the concept has been proven possible by several independent entities.

<comment><USER13> At this point of complexity, it might be easier for them to get a valid cert and mitm everything.

</comment></comment></comment></comment><comment><USER14> This is in french but the code used by the Tunisian dictatorship is here: <http://www.hackerzvoice.net/node/105>

<comment><USER3> Crazy, so if this is legit, this really is more akin to a keylogger than them sniffing the network traffic, which is what I thought was meant by it.

Tunisian IPS's were injecting some javascript code on Facebook's login page that was watching the keystrokes in the login/password fields. When someone clicked LOGIN, the script would send those credentials to a URL, but also Facebook's HTTPS login page, so everything proceeded as normal.

Interesting vector for an attack, seems like the solution, of serving the login page itself in HTTPS as well is simple (and cheap) enough that everybody should adopt it.

</comment></comment><comment><USER15> "The country's Internet service providers were running a malicious piece of code that was recording users' login information when they went to sites like Facebook."

Right, for all those pre-21st century sites that still don't enforce SSL for authorization. It should be a standard, not a counter-measure.

<comment><USER16> But login requests on Facebook do use SSL- if you use firebug on the Facebook homepage, the login form points to " <https://login.facebook.com/login.php?login_attempt=1> ". The issue seems to be that code is injected in pages that merely contained a login form: [http://blog.rootshell.be/2011/01/13/tunisia-tracks-users- wit...](http://blog.rootshell.be/2011/01/13/tunisia-tracks-users-with- javascript-injection/)

<comment><USER17> But if the page containing the form isn't served through SSL, it's subject to alteration by a man in the middle --- which is what actually happened in this case. And users who don't "view source" every single time have no way to notice the difference before logging in (and precious little after, if the logger quickly resubmits to the real McCoy).

<comment><USER18> And if the page that has the link to the login form isn't served through SSL, it's subject to alteration by a man in the middle to hijack the login page. And if the page that has the link to the page that has the link to the login form... you get the idea. Use SSL on every page, or you lose.

</comment></comment></comment></comment><comment><USER19> Bravo, Facebook.

In short, there were indications that the government was swiping passwords on each new Facebook login. Within days, Facebook switched all Tunisian sessions to HTTPS, and required people whose passwords had likely been compromised to go through a password-reset based on identifying pictures of friends.

(Also, the article suggests that Facebook is a more important news and organizing outlet in Tunisia than Twitter.)

</comment><comment><USER20> A tunisian citizen here. I wanted to add that this kind of attacks was not limited to Facebook. GMail, Yahoo mail and Live mail were also affected. I've checked the source code of their login pages if served over HTTP and they contained a similar JS snippet.

</comment><comment><USER21> The broader aspect here is what is going to happen to Facebook in the longer term? Shaky Governments now must be getting very worried about this type of political activism - an entire nation can be turned around with hardly anyone marching in the streets. Or a large protest could be organised as a kind of flashmob. While it's not Facebooks problem - only one Government has jurisdiction over Facebook - I'm wondering where this will all lead to. I know I'm not the first to ponder these things, but I can't help thinking this is either a great force for good, or something that could easily be used against people. A small government like the one of Tunisia is pretty much powerless against facebook unless they turn off the entire internet in their country. And that's not likely to win friends. Just blocking the facebook IP would be bypassed easily and would spread in a viral way.

As for the anonymous activism - the power with Facebook is the real identities attached. People believe it because they know and trust the people sharing the news and images. Twitter tends to degenerate into a retweeting mess of platitudes around any major news event, and the anonymous nature of most tweets makes exaggerations and rumors spread like wildfire.

</comment><comment><USER22> I admire the company for the steps that it took to protect the passwords of Tunisian users, but the story of how it responded surely can't help its efforts to get into China and other states that rely on information control to stifle dissent.

</comment><comment><USER23> Perhaps the article doesn't have enough detail in it. But it sounds like ISPs were just sniffing HTTP packets for usernames and passwords.

It doesn't sound like a directed attack on facebook, though perhaps it was a session replay attack.

The real question for me, is why didn't facebook already require SSL login.

<comment><USER20> > But it sounds like ISPs were just sniffing HTTP packets for usernames and > passwords

Nope, Facebook's login page, if requested over http, was manipulated on the fly to inject a javascript code that is triggered when the login button is clicked. It retrieves the login/password values from the form and sends them to another url, besides Facebook's login url.

</comment></comment><comment><USER24> On a related note,I hosted glype (a free proxy script) on a server in the US to help people from Vietnam access facebook. But javascript is disabled and I m having trouble enabling it. If you are interested in helping me, pm me please. My php/proxy skills are pretty limited

</comment><comment><USER25> Governments will find it easy to target any commercial or centralized system. P2P and open source couldn't have arrived sooner.

</comment><comment><USER26> The story's "Everybody says Twitter played a huge role, but really Facebook's role was bigger" angle suggests that Facebook PR played a big role in pushing this one.

This is not to take away from the truthfulness of the story or the awesomeness of Facebook's response. In fact, given how prominently Twitter has featured in stories about the Iranian revolution et al, this is to be expected.

</comment><comment><USER27> Mmm, does that mean the Tunisian ISP modified the login pages from Facebook to include a key logger?

<comment><USER15> no that means that like any ISP they have full access to unencrypted traffic, including login POST requests

<comment><USER16> But login requests on Facebook do use SSL- if you use firebug on the Facebook homepage, the login form points to " <https://login.facebook.com/login.php?login_attempt=1> ".

The issue seems to be that code is injected in pages that merely contained a login form: [http://blog.rootshell.be/2011/01/13/tunisia-tracks-users- wit...](http://blog.rootshell.be/2011/01/13/tunisia-tracks-users-with- javascript-injection/)

<comment><USER28> This is why any page that lets you login to a site must also be accessible over HTTPS-only.

<comment><USER18> Or any page that points to a page that lets you log in to a site must be accessible over HTTPS-only. Or any page that points to a page that points to a page... you get the idea. SSL everything, or you lose.

</comment></comment></comment></comment></comment><comment><USER29> What's happening to the ISPs for collaborating with the previous government on these requests?</comment>


I'm obscurely famous - <AUTHOR> http://techcrunch.com/2010/08/10/disqus-rolls-out-improved-global-profiles-community-box-and-more/

<comment><AUTHOR> The best part, my google alerts that normally would remind me of kind mentions failed due to it being an image reference.

I found out only from a friend on AVC.com</comment>


Best network monitoring software? (for figuring out how Google Docs works) - <AUTHOR>

What software can I use on Windows to monitor and log network activity in an easy-to-read way?<p>I'm trying to monitor how Skype and Google Docs set up their connections, and I know they do so through an elaborate process that I'd like to document. <comment><USER2> <http://www.wireshark.org> Never leave home without it.

</comment><comment><USER3> Wireshark</comment>


Installing CyanogenMod 7 on your HTC Desire - <AUTHOR> http://blog.markhatton.co.uk/2011/08/17/installing-cyanogenmod-7-on-your-htc-desire/

<comment><USER2> I ve somehow managed to make my desire unrootable. I rooted it with an android 2.2 rom (dont remember which!) then one day i formatted the SD card. I 've tried every possible combination to root the phone again but nothing works. Also, because the build i am using is "passion", unrevoked3 refuses to root it for me.

<comment><USER3> You can change the "passsion" flag. it's in the /system/build.prop file. Open it as root and change it to what is right. (check for the correct value in the file from the cyanogenmod release) Otherwise, just install alpharev and kiss that partition limitations HTC put goodbye. (you can flash permanently any recovery you like.)</comment></comment>


More Snowden leaks – and this time Al Qaeda is the surveillance target - <AUTHOR> http://www.csmonitor.com/World/Security-Watch/Backchannels/2014/0130/More-Snowden-leaks-and-this-time-Al-Qaeda-is-the-surveillance-target

<comment><AUTHOR> Don't get me wrong, I think the terrorism card is definitely overplayed. The article brings up an interesting point, though. The redacted portion flies in the face of the accusation that the NSA isn't using its capabilities to pursue legitimate terrorist targets. Yes, that one phrase doesn't prove that all of its targets are legitimate, but it makes me wonder what else is in all of those redactions and missing slides. Do they jive with the existing narrative? How much is left out for national security and how much is left out to make a better story?

<comment><USER2> To be fair though, how many people actually believed that none of what Snowden revealed was ever being used for pursuing such legitimate targets? Or that a news organization might not spin a story to fit a particular bias?

Even given everything else, I would think that would be a pretty obviously extremist point of view.

<comment><AUTHOR> Maybe I've just been reading too many comments on HN. :)

I think most of the reporting so far tends to further that bias. It seems like a lot of the disclosures talk a good deal about how the NSA collects information and just leaves the reader to fill in the part about who they're targeting, which in turns causes most people to jump in and assume that it's being used against _everyone_. I went back and re-read the articles on the New York Times[1], Guardian[2] and Propublica[3] and I see something that I notice in just about every NSA revelation: they always mention that the documents in question don't say how much of the communications of Americans or ordinary civilians were collected, but they also don't give any examples of whose communications were being collected. The Angry Birds articles would be more accurate if they said something like "The documents did not reveal if any U.S. citizens were targeted, but did indicate that this information was being gathered from members of a middle-eastern terrorist organization." But then, if they said something like that, there wouldn't be so much of a civil liberties angle to play (in fact, it might backfire and draw some outrage to the news outlet itself).

Which brings me back to my original question - what's in all of the other redactions?

[1] [http://www.nytimes.com/2014/01/28/world/spy-agencies- scour-p...](http://www.nytimes.com/2014/01/28/world/spy-agencies-scour-phone- apps-for-personal-data.html?_r=0)

[2] [http://www.theguardian.com/world/2014/jan/27/nsa-](http://www.theguardian.com/world/2014/jan/27/nsa-) gchq-smartphone-app-angry-birds-personal-data

[3] [http://www.propublica.org/article/spy-agencies-probe- angry-b...](http://www.propublica.org/article/spy-agencies-probe-angry-birds- and-other-apps-for-personal-data)

<comment><USER2> Ok... HN users who already believed that governments were a facade built on extortion and ultraviolence notwithstanding...

It's a good question. We see what's presented to us and what's presented to us clearly is constructed as a narrative. Glenn Greenwald's agenda, at the very least, is to keep people hooked in to the Guardian.</comment></comment></comment></comment>


Twitter Open-Sources Clutch.IO, Mobile A/B Testing Service - <AUTHOR> http://techcrunch.com/2012/10/11/twitter-open-sources-clutch-io-the-mobile-ab-testing-service-it-recently-acquired/

<comment><USER3> hope they zeroed out those amazon keys:

[https://github.com/clutchio/clutch/blob/master/clutch/settin...](https://github.com/clutchio/clutch/blob/master/clutch/settings.py)

<comment><USER4> Good catch, I just deactivated that key. I thought we scrubbed out all of the keys but this one slipped through. Thanks for pointing it out!

<comment><USER3> i would have emailed you directly, just didnt have an email and github doesnt have the inbox feature anymore - <USER2>

</comment></comment></comment><comment><USER5> For some reason, the framework looks like something that could potentially be packaged in a nice DSL inside a gem for rubymotion.

Probably is just the lack of sleep talking here.

</comment><comment><USER6> I couldn't find any tests for the server. Was this really created without them? Interesting...

</comment><comment><USER7> Good move, Twitter. They just bought an A/B mobile testing service for mobile apps which is super awesome given that their Twitter apps have always sucked and now they make it available for the rest of us for free. Making friends with both the users and the developers so maybe people will forget about promoted tweets and API policy changes.</comment>


Facebook isn't broken, I'm just not interesting - <AUTHOR> https://medium.com/on-facebook/b0c524c582f3

<comment><USER2> Medium.com's voting ring is capable of putting 4 posts on the homepage at the same time without tripping the circuits, impressive.

</comment><comment><USER3> "Dear users: you're doing it wrong".

I don't think this is a very good answer. If the majority of your users think that your site isn't useful (and I'm not at all sure this is the case, although I can certainly identify with this sentiment) then you need to go back to the drawing board.

</comment><comment><USER4> I think the disconnect is that Facebook sells itself as a way to stay in touch with all your fiends, when in fact, as we all know, it doesn't really work that way. Every change to the site seems to take is farther and farther from the ideal of staying in touch with everybody.

Personally, I seem to have it tuned fairly well right now. By keeping a lot of people on "Important Only" updates, I don't see the memes, cat pictures, and political crap unless it's noteworthy enough to generate more than a few comments. Yet I do see the prom pictures of their kids or other things that I actually care about because they do generate enough activity to trigger whatever the threshold is to be an important post.

</comment><comment><USER5> While I generally agree with the post (after having also read the other FB- related post), I'd like to think that the reason I recently left FB (yet again) is that I was one of virtually 2 other people in my network posting interesting things to read or watch, rather than post nonsense like the majority.

Either I falsley think the content I linked to is, in fact, interesting or my FB friends aren't interesting...or, perhaps, there's just a disconnect between my friends and what I think is interesting. I know otherwise intelligent people who continously post rubbish.

</comment><comment><USER6> This is exactly what I was thinking when I read the 'The Facebook experiment has failed' article. It seems like just another case of people not knowing how to filter their wall feed.

<comment><USER7> I still wish I could switch to an unfiltered mode. I use a service like facebook because I want to keep involved in my friends lives and see all the stuff they post. FB seems to conspire to make the feed/wall experience an echo chamber of the few people you interact with the most. It's precisely the folks I don't interact with most that I want to hear from...

<comment><USER8> Interesting, I'm not a facebook user, I deleted my account 3 or 4 years ago. Is there a way to setup multiple concurrent filters so you can basically switch modes? So you could have your feed/wall (sorry I'm not great with the fb terminology) show you:

1) Close friends & family

2) Posts related to the subject "Programming"

3) Posts from people who haven't otherwise made it to your wall in the last 30 days.

Basically what level of granularity is currently offered in terms of FB filters, and can you setup multiple ones to switch between them?

Is this an area that FB are currently working on? Seems like this would be a good remedy for people who aren't finding the content they want.

Users are still going to be required to do some work to setup their filters though, I really don't see how you can avoid that though.

<comment><USER6> I don't know if you can get as fine-grained as "posts relating to programming" or "people you haven't interacted with in X days" but you can add people to "Lists" and then switch your wall view between those lists. One person can be in many lists.

</comment></comment></comment></comment><comment><USER9> You acknowledge that most people probably have similar problems; the stuff their friends are posting isn't interesting, and also acknowledge that you don't follow along with your friends' posts.

You're agreeing with the original post. That is a sign that the site is useless as is, except as an echo chamber for you to post things you are interested in but nobody else cares about.

You're posting running stuff, and there's millions of people who are interested in running stuff, but instead of those running posts finding other runners, they find your friends and family most of whom aren't interested.

That's the problem with Facebook. This is less of an issue on Twitter where it's normal for you to follow whomever you want, not just friends and family.</comment>


Ask HN : Where do you work (if freelance) ? - <AUTHOR>

I live and work in an apartment.
Most of the week days it's quiet so i can get things done. But as soon as my upstairs neighbor arrives from his day job, i have a hard time to concentrate into my work. I'm very noise sensitive. Even if i listen to music during my work (loud enough) i hear the vibrations from upstairs. The neighbor's sons play rockband on the wii i think and i told them to lower the sound several times but there's nothing i can do about it. I even asked the landlord to warn them and two weeks later, the noises are back.
It's a pretty shitty apartment but it's surrounded by trees and near of everything (grocery store, train station, etc) and that's why we choosed to live here. We tought it would be quiet. We hate the city. But we need to be in the suburbs to meet with the clients in the city by public transportation (we hate cars).
Where do you work if you're freelance? <comment><USER2> I live and work in an apartment and my nextdoor neighbors like to kick it with the good vibrations too. I used to go over there and ask them to turn it down. I've since given up. Now when I hear them kicking it I just start blasting some techno or classical music. Overall I'm not that ticked at them because they keep their noise to their post-work and before-bedtime hours. It still sucks though.

I like going to a coffee shop or tea house sometimes. There is a nice a teahouse walking distance from where I live. The only thing is as a bootstrapped type, I've cut out the luxury of $5-10/visit to the coffee shop/tea house. When I'm there, the noise isn't annoying and I enjoy being around the people.

For awhile I was heading to the library of the local University. They're open 24/7 and its a good mix of people and quietness. It was kind of fun taking my 12" PB and hacking code at 2am on campus. :) I'm graduated now but may pick that up in the future if my ID card still lets me in.

Working from the apartment, sucks, sort of. Try and make sure you're getting out of it regularly. I go work out almost every day. If there is a gym in walking distance, I recommend joining it. A regular gym visit does a lot to help force a sense of routine and it gives me a break to look forward to.

Also,I have two computers I use for different purposes. I use a small laptop for most consulting work I do. I tend to write specs and whitepapers so this suits me. I find being able to relocate to my couch, read, write, and take notes is a nice break from "the office" 10 feet away. I do all my startup work on my normal computer.

Good luck!

<comment><AUTHOR> thanks for the advice! It seems that we have the same kind of problem. :-S

</comment></comment><comment><USER3> I'm a student and I live in an apartment near the University of Texas campus, working just a few feet from my bed. Freelancing to pay the bills, and my start-up stuff to exhaust whatever surplus I have, which is--thankfully--a lot more lately thanks to my new niche. Noise is high (especially Thursday through Saturday nights due to parties) but I like having noise going on most of the time. If I want some quiet, I can just wake up earlier.

Rent is high, but I see it as an opportunity to find a great way to work that will provide even more surplus/tangible income when I move to somewhere cheaper after school.

I focus on speed of production and finding several small gigs a day. As a designer, it's a lot easier than being a programmer in this regard; lately demand has been at $400 a day but I am only willing to supply $200-300. I don't keep a backlog either, so my rates still have room to grow. This lets me cover my bills and still keep my main focus on my startup (an iPhone app currently, but I have several projects in line, such as <http://www.epictee.com>).

Here's my setup. My bed is immediately behind my chair: <http://i40.tinypic.com/e69085.jpg>

<comment><USER4> Your design work is great. I do my freelance work (mostly PHP) over at Cafe Medici on Guadalupe once or twice a week. I lived on west campus when I was a student, but was too busy participating in the Thursday-Saturday night parties to get anything done while I was in school :). Send me an e-mail if you would like to meet up or need someone to collaborate with.

I work out of my apartment most days, but usually head over to a coffee shop (Epoch, Spiderhouse, etc.) when I feel the need to get out.

</comment></comment><comment><USER5> I work from home in a highrise condo (that I'm leasing) conveniently located in the middle of the city. That being said a lot of my neighbors are much older (35+) than me (22) and don't listen to loud music. It is dead quiet 90% of the time with a remaining 5% being on the weekends when some neighbors have guests over and another 5% for when occasional cleaning crews are on the floor or when the lady above me that wears high heels is home and walking around.

As for when I need a "change of scenery", I sometimes move down to the lobby floor where there is a secluded library that has the added benefit of smelling like books.

Granted it is rather expensive and I live by myself, but it helps me to be very productive and the fiber Internet line is always a plus.

<comment><USER6> I'm in the same situation. When I need a break I head to the local coffee shop. If that's too loud I'll head to school or the library. Changing scenery often helps keep the juices flowing.

I find even moving around the apartment helps. I have a movable desk, so I've been experimenting with working in different locations throughout the day.

</comment></comment><comment><USER7> Life's rough when you hate both the city and cars. America isn't well set up for that.

</comment><comment><USER8> for anyone who lives in the general Boston city limits (including cambridge, somerville, brookline, jp, etc etc) I highly recommend checking out the Boston Public Library (right under the Hancock Tower). It's quiet, there's wifi, the Sebastian's cafe there has great tables and comfy chairs, and in the summer the courtyard in the middle is absolutely fantastic.

I usually work out of my condo's 2nd bedroom (what we call our office) but when I have the itch to get out and really get work done I head to the BPL.

<comment><USER9> I work in Boston, live in Belmont, will definitely check out Sebastian's, thanks for the tip!

</comment></comment><comment><USER10> _I'm very noise sensitive._

With new technologies (including viscoelastic dampening compounds) you can cost-effectively soundproof your apartment. Ted White can help you: <http://www.soundproofingcompany.com>

</comment><comment><USER11> Currently work out of my home office - have for > two years. Regularly go onto the clients' site, though, which I have found quite helpful in upping my productivity (breaks the routine, and there's something about meeting people in person that just rejuvenates.)

At first I was thrilled to work at home, and overall I still appreciate it. But I'm starting to want to have a separation of work and home environments. One of my goals for 2009 is to get my passive income high enough to pay for an office a short walk from my house (I live in a mixed-zoning part of SF, so this is certainly practical). If I'm going to work at all, that's the ideal situation, imo - physically separate spaces, but near zero time lost to commuting.

(Temporary - just until the passive income explodes and I retire to code open source full time, of course :)

</comment><comment><USER12> Usually I work from home, but I also tend to head out to coffee cafes as many others here obviously do. Unfortunately, I would think that for you the cafes in general are more distracting than working from home. I prefer a noisy environment for some reason and find it easier to get work done.

Another thing to check out is the co-working groups in some cities. There are usually places you can rent a desk, or there are groups of independent web- workers (like Jelly) that meet up occasionally to work together. There's some networking involved, but most of the time the meetings are pretty quiet and productive with everyone going out together for lunch.

</comment><comment><USER13> I understand your problem with noise. I've had many people suggest that I use headphones or play music but I find that equally distracting. I learned something recently that might add some understanding to your problem. It's called Highly Sensitive Person (HSP), you can read about it at wikipedia:

<http://en.wikipedia.org/wiki/Highly_sensitive_persons>

If moving to a place without shared walls is not an option, you might want to shift your schedule a bit. Continue to work while they are not home and also work after they've gone to bed. Then it's very quiet.

</comment><comment><USER14> Google SilentEar its a type of earplug, very effective. About $10 or £5. Not sure about the vibrations bit, but people have to routinely grab my shoulder to grab my attention, as I can't hear any noise or voice when I have them on.

<comment><USER15> How about noise canceling headphones? Bose makes them, but I think there are cheaper alternatives. I haven't tried them, but I would be interested in comments.

<comment><USER10> _How about noise canceling headphones?_

1\. They are for use on airplanes.

2\. They do not work. [http://www.google.com/search?q=noise+canceling+headphones+%2...](http://www.google.com/search?q=noise+canceling+headphones+%22don%27t+work%22)

<comment><USER16> I went into a Bose booth in an airport (I was bored) and they were showing people the noise canceling headphones.

The employee would flick a button after you put them on that also turned on some subwoofer that made a huge amount of grey noise.

Now sure that is somewhat airplane-ish, but that's sneaky.

<comment><USER7> I used the QC2s for a couple years when I was traveling the poker circuit. I liked them a lot at the time. They do greatly reduce certain types of noise. (You can Google for why anything sucks or doesn't work and find results, it doesn't mean much.)

Then another player introduced me to Shures. I've now owned a few sets (most currently <http://tinyurl.com/8eyhck>) and I would never go back.

The best way I can quantify how much better they are is to say that on a plane, with the QC2s, I would have my volume at 17 (out of 20) but with the Shures it's at 10. And the difference when considering non-ambient noise is even greater. With these in and no music, you can't hear people talking to you from the same room.

They're also significantly less bulky, and more durable. The QCs crack easily, and really require a hard case if you're traveling with them at all. I did have a pair of Shures where the earbuds separated, but they honored the warranty even though it was a year out of date and even sent me a newer, significantly more expensive model as a replacement.

On the other hand, I also had a pair fall out of my pocket, which is $400 lost in an airport.

<comment><USER17> Hearing people talking with the QC2s is a feature -- they equalize the noise canceling to cancel out engine noise but allow you to still hear people.

What the QC2s have going is comfort. The high end earphones, namely the Shure and Etymotic and at the highest end, custom in-ear monitors offer superior noise isolation with sound quality comparable to the best in existence.

You can get Etymotic ER-4Ps for $174 on Amazon. They're comparable to the highest end Shure earphones. The Ety's will have less visceral bass.

<comment><USER7> The Etymotic's just don't have the range that Shures do. With the Shures, it's a little jarring to hear that sort of bass without simultaneously feeling it in your gut, the way you would from a speaker. It's that great.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> When not working at a client, I work from home. I tried renting a very small office but almost went crazy from the isolation and it was not cheap. Now, when I need to get out of the house, I hit the library, coffee shops, or a Jelly (<http://wiki.workatjelly.com/JellyinColumbus>). Jellies/co-working are a great option. See what you think.

</comment><comment><USER19> I wrote an app called NoisePact that makes it simple to tell your neighbors to turn down loud music. I'm not really sure how far I got, but the idea and most of the functionality is there. If you want the source, I'll be happy to give it to you to improve upon (uses code igniter).

It works like this: you sign up, print off an invite sheet, stick it on your neighbor's door. They sign up, and you can login and alert their phone via SMS when it gets too loud. It virtually requires zero human contact, which is nice. But like I said, I'm not sure how far I got this. I did it on a Saturday afternoon to see how much code I could do in one sitting.

<http://phunctional.biz/NoisePact/?welcome>

</comment><comment><USER20> Before we had an office, the three of us worked in the Oak Park Public Library, which was excellent. Free wi-fi, very quiet, nice desks.

<comment><USER21> Wow... so did I (another Oak Parker!)... but OPPL blocks all outbound ports except 80 and 443. So I couldn't do alot (like SSH admin of remote servers). However, I did create an EC2 instance once where SSH was running on port 80 -- and that worked splendidly. :-) But I can't do _all_ my work that way. Did the blocked ports bother you? Or did you get around it?

<comment><USER20> Not to get too far off track for HN (and hey, why don't I know you? Should get coffee some time.) but OPPL doesn't block SSH outbound, and I use Meebo for IM. I still go there every once in awhile; our office is getting crowded.

There's a whole other conversation to be had about why libraries have these crappy security gateways. Blue Socket randomly locks me out for "bad behavior", but forgets about the lockout if you browse directly to the logout handler. I keep meaning to go find the library IT guy and demanding that they allow AIM.

<comment><USER21> (I just updated my HN profile with my contact info... Let's meet at the Buzz sometime!)

Hmm... I think I was trying some wacky ports like "4444" (Selenium) and 5901 ('raw' VNC). I also use a non-standard SSH port (not port 22) for my remote servers. I'll have to give it another go sometime. And yeah, I know I should be doing everything over an encrypted channel anyway. :-)

</comment></comment></comment></comment><comment><USER9> I have a hard time working from my home office (my bedroom) for long stints of time because I get bored and restless really quick. I love working in like a starbucks or something like that but I feel weird just being in there for that long and only getting like a coffee lol.

</comment><comment><USER22> Certain libraries are good.. in some of them you can even get a private study room with internet access. I would look at college campus libraries before public libraries. And libraries vary a lot, so I'd recommend checking out a few of them before giving up on this option.

</comment><comment><USER23> Move. Treat the next place as an investment in your productivity and happiness.

</comment><comment><USER24> I have an office that another startup lets me use (for a few more months). We are working on getting some sort of coworking space going which would be ideal for me. Otherwise I will rent a small office somewhere (I can't get anything done at home with my wife and 4 kids there).

</comment><comment><USER25> Library, still the best.

</comment><comment><USER26> coffee shops.

<comment><USER27> What do you guys do when you have to go use the restroom facilities? I tend to bring my laptop in with me since the loss of it would piss me off more than the embarrassment of taking it with me.

<comment><USER28> Just kindly ask someone to watch your laptop while you're away.

<comment><USER4> I always just leave it out and go to the restroom. Maybe some would call that foolish, but I'm not too worried about it. It seems like everyone at the coffee shops I go to already has their own laptop that is better than mine anyways :).

</comment></comment></comment></comment><comment><USER29> We hates the city, don't we, precious? Yesssss, we do... We hates it and all the nasty bright men in it...</comment>


Stop blaming Apple and take responsibility for tech addiction - <AUTHOR> https://techcrunch.com/2018/02/04/stop-blaming-apple-and-take-responsibility-for-tech-addiction/ <comment><USER2> This is just an advertisement for the authors tech addiction company.</comment>