H.R.1981, the end of online privacy as we know it. - <AUTHOR> https://spideroak.com/blog/20110803172630-hr1981-the-end-of-online-privacy-as-we-know-it

<comment><USER2> > Bill H.R.1981 contains legal responsibility for any Internet Service > Provider to keep detailed records of "your Internet activity for 12 months, > your name, the address where you live, your bank account numbers, your > credit card numbers, and any IP-addresses you've been assigned."

The quotation marks imply that the quoted text, which the entire remainder of the post is built on, is part of the bill. It's not, as far as I can tell. In fact, there's no requirement that resembles those described in any conceivable way. Assuming the version on the Library of Congress website [0] is current, the only section regarding record-keeping by ISPs requires them to keep track of customer IP address assignments for 18 months:

> A provider of an electronic communication service or remote computing > service shall retain for a period of at least 18 months the temporarily > assigned network addresses the service assigns to each account, unless that > address is transmitted by radio communication (as defined in section 3 of > the Communications Act of 1934).

The only interpretation I can come up with is that the linked post is a deliberate lie.

[0]: <http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981>:

<comment><AUTHOR> Definitely not a deliberate lie. The bill amends previous bills on the topic by adding the retention of IP-adresses etc.

If I was unclear in the post I am very sorry and will amend the post.

That said the core of the post stand. The linking of currently stored data with IP-addresses creates a direct link from internet usage to personal data. Something that should scare most people.

<comment><USER2> But the part everybody's getting worked up over is the tracking of Internet activity, which is not part of current law, and is not part of the bill in question. I have no idea where that part came from, so I'd be glad if you could make that clear.

<comment><AUTHOR> I have updated the post to reflect the fact that the amendment or previous bill does not explicitly refer to tracking of internet habits. I will continue to investigate the bills and available data etc.

I would like to thank you for pointing this out and I took the liberty of thanking you in my update of the post.

<comment><USER3> I think it's great that you're actively open to feedback and fixing it, but basically it means that you started out writing about stuff you, apparently, knew nothing about, so just assumed things.

That sounds a lot like FUD tactics. The internet freedom camp seems to apply these more and more, seriously blurring the debate and screwing it over. Why are you doing these things? Why do you act as bad as the people crafting these laws? Why do you allow both camps in this debate to remove all truth altogether?

</comment></comment></comment></comment></comment><comment><USER4> Wait, they actually called it "Protecting Children From Internet Pornographers Act"?

I'm speechless.

<comment><USER5> The main daily newspaper in San Francisco had a front page article trumpeting a "takedown" of a child porn ring. I commented online that this was an advertisement by the government to encourage surrendering our rights to "protect the children".

The reaction was pure hate for my posting because it was defending pedophiles (it wasn't). It felt like an angry mob that had nothing but revenge on its mind.

This is why the efforts to destroy all privacy will succeed. For the kids. Yeah, that's it.

<comment><USER6> The thing is, that takedown, an Ars Technica article about which was on the HN front page briefly last night, was accomplished without this heinous legislation. To my mind, that rather puts the lie to the need for such laws.

</comment></comment></comment><comment><USER7> If they'd just waited a little longer it could have been H.R. 1984.

<comment><USER8> Sure enough! -- maybe that's what everyone should start calling it anyway :)

<comment><USER9> That is most _definitely_ what everyone should start calling it.

</comment></comment></comment><comment><USER10> For me it's worthwhile to actually read the resolution and the law. It just makes it more real for me rather than a random internet posting.

The resolution is here: <http://thomas.loc.gov/cgi-bin/query/z?c112:H.R.1981>:

The resolution modifies the legal code (law) given here: [http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703----...](http://www.law.cornell.edu/uscode/18/usc_sec_18_00002703 ----000-.html)

[Edit] There is a reasonable write-up of the action from an ACLU blog here: <http://www.aclu.org/blog/tag/HR%201981>

<comment><USER11> Booooooring. I'd much rather just battle against dystopian strawmen as a cover for my lack of interest in voting or knowledge of civics.

</comment></comment><comment><USER12> This sounds vaguely familiar to the Data Retention Directive, already in place in several european countries. If you ask me, it's bullshit. For the people that would be afraid of getting caught by this, they should know that it takes about 5 seconds to connect to a VPN and then you have bypassed it all together. This means that the innocent will be watched, while the criminals smart enough just bypass it with ease.

I live in Norway, and the DRD (Data Retention Directive) will be activated July next year (I think). At that time, I will push all my traffic through a VPN. My 5 cents.

</comment><comment><USER13> If everyone in the world clicks that "one click petition" to protest the bill, what happens?

</comment><comment><USER14> How does this affect services like Vyprvpn? Are they an "ISP"? Or is that a loophole so as long as you're using a VPN, you're save from government snoops?

</comment><comment><USER15> So, is there any reliable estimate of how much it will cost to implement this kind of records retention?

</comment><comment><USER16> Could an anonymizer such as Tor help get around this?

<comment><USER17> Yes, in the sense that your ISP will still know your IP address (how could they not?) but won't know what you're doing. And the servers that know what you're doing won't know your IP address.

<comment><USER18> Only if you ignore the possibility of compromised exit nodes.

<comment><USER17> A compromised exit node also doesn't know your IP address.</comment></comment></comment></comment>


Show HN: VocalTap: Personal support groups for startups - <AUTHOR>

We wanted to create a tool that we know more established companies make great use of - peer groups (think advisory boards, CEO roundtables, etc.)
Our goal is to help like-minded business owners learn from each other in a deeper, more intimate way online. Think of it like as a place where startups act as a personal advisory board to each other.
Would love to hear your thoughts and feedback? - http://beta.vocaltap.com <comment><USER2> Live link: <http://beta.vocaltap.com>

Do you think your competitors follow your progress closely is a good idea? As far as I understand from the homepage of VocalTap, it helps startups to follow each others progress, right?

<comment><AUTHOR> The goal is to match non-competing businesses together in small groups. Not to just follow each others progress but to act as a sounding board/mentor to each as well to get over the whole "lonely at the top" feeling frequent among entrepreneurs.

</comment></comment><comment><USER3> So basically a BNI (network) group for entrepreneurs/startup-ers?

<comment><AUTHOR> Not quite. BNI is more for referrals and networking. The goal is NOT to network, but to form a closer, more intimate group where you can discuss things at a deeper level.

So a better analogy would be - rather than a networking event where everyone exchanges business cards, it's more like a small monthly breakfast meetup where small biz owners discuss how they're growing their business, cutting cost, tackling employee challenges, or whatever else.

<comment><USER3> So a forum for google groups of people you know or may not? I guess I am just trying to understand the use case as well as revenue model.

<comment><AUTHOR> Yes, a way for startups to learn from each other using peer groups. We're looking into also adding expert advice-givers for those who need it as a revenue model.

<comment><USER3> I would recommend reaching out to <http://clarity.fm/home> if you want expert advice.

As for peer group I see it in 2 ways: 1\. You know the people but don't have a weekly/etc. meeting 2\. People who you don't know but working on building a product/company

Another thought would be more of a mastermind group. Limit it to 10 people or something and focus on weekly meetings to encourage everyone to get things done. What did you do last week, what are you planning to accomplish, etc.

Just a thought

<comment><AUTHOR> Awesome, thanks alot for your feedback. A place to find mastermind groups is essentially what we're working to build. We just don't use the phrase because most people have never heard of it.</comment></comment></comment></comment></comment></comment>


The EU's copyright proposal is so bad, it even outlaws Creative Commons licenses - <AUTHOR> https://boingboing.net/2018/04/11/evidence-free-zone.html <comment><USER2> It might be worse than this. EU might be able to make open source illegal.

[https://savecodeshare.eu/](https://savecodeshare.eu/)

</comment><comment><USER3> Controlling your population to the point that they cannot choose what to do with their own work is shady

I don't follow EU politics that much, but the news stories I do see these days paint a grim portrait of it. You cannot waive your "right to privacy" (GDPR), nor can you freely distribute your work.

Treat your people like sheeps and they will become sheeps

<comment><USER4> But I don't get the point here. The EU people have rejected the EU, yet again, just a few days ago. And once, again, the EU says "bad voters ! BAD ! try AGAIN" (note that the previous election was already an accelerated election. So this is not just rejecting the bad outcome of an election. They did that, STILL got an outcome they didn't like and rejected the redo-election".

[http://www.spiegel.de/international/europe/italian- president...](http://www.spiegel.de/international/europe/italian-president- mattarella-the-man-who-wouldn-t-yield-a-1209982.html)

<comment><USER5> Those darn 'EU people' (whomever that may be), holding elections at will, until people elect what they want.

It's a bit like the typical anti Apple fanfare, nobody's buying the devices because Apple can't keep up with demand!

<comment><USER4> What I meant specifically is that Italy elected a government that promised - and wanted to implement - a currency parallel to the Euro, and then the Italian president exploited a loophole (effectively claiming there was no agreement between the parties that made up the government) to avoid putting this government in power. He made it no secret that this is exactly why he did that.

So Italians wanted a parallel non-EU-controlled currency in Italy and elected a government to do that, and this was denied, by a pro-EU politician. This was already a do-over election of sorts so that makes it even more of a farce.

Several BIG costs have to be carried by the Italians as a result. First, the actual monetary cost already paid: 1.5% on 6.5 billion euros, or about 100 million euros, effectively charged to them by the ECB. This will keep growing. Second is the fact that there is no government in charge, and the legitimacy of the "experts" (picked -surprise !- by pro-EU parties) that will be in charge until the next election (July or September) is heavily in question, and that government's only loyalty is to the Italian president who got kicked out by the electorate.

Of course, several EU commissioners have called out for punishment of Italy for these election results, and although Oettinger has now apologized, it shows you just what kind of people they are.

All of that, just to protect the EU. Again.

</comment></comment></comment></comment><comment><USER6> I really hope this is just a bad idea from someone who got a lot of khm... "idea" from media companies, because it would break the internet immediately. GDPR is breaking a few monetization methods, but this would break links and free information.</comment>


Ask HN: Need advice on my first time freelancing which involves fees - <AUTHOR> For the past few years i was helping my friends and relatives by hosting their websites in my cloud host service. I did those for free only, as the intention was purely to help them.
Now, a freelancing request came through my friend which involves deciding the fee which i need to charge for a small service.
The service requirement is: Begin AWS instance, install DB, define schemas and upload data(one time process). Then check the AWS instance on a biweekly basis and take some backup of data. Not more than that.
How much should i charge? Requesting your suggestion, as this is my first time freelancing effort which involves money. <comment><USER2> My advice is to start out keeping things simple:

1\. Charge by the hour. Don't discount.

2\. Provide an estimated range of _your time_ based on your understanding of the scope work at the start of the project. Let the client work out how much it costs on their own.

3\. Make it very very very clear that the estimate is non-binding. If it takes more time, the client pays more. If it takes less time, the client pays less.

4\. Require a retainer for a large portion of the estimate. The retainer is to be applied against the last invoice so that you are never in a situation where the client owes you money.

5\. Have an invoice schedule. Invoice on the schedule.

6\. Walk away, if the potential client doesn't like your terms. Preparing proposals is a way of _qualifying_ potential clients. Good clients, accept and pay under your terms.

Often, just saying, "I charge X per hour" is enough to determine if a client is serious. Amateur clients have unrealistic expectations. People you know will expect you to work for free. Don't. It's not worth it.

Good luck.

<comment><AUTHOR> Thanks a ton. These points are clear and informative. I will try my best to abide by this.

</comment></comment><comment><USER3> I would think about setting this up as a subscription with automated invoicing through a paypal subscription or Stripe.

Maybe $49/mo including setup and twice monthly backups/status checks (look at automating this). (Adjust monthly subscription on your typical hourly rate and value of service you are providing, I'm just throwing a number out there).

<comment><AUTHOR> Thank you for your valuable comments

<comment><USER4> If you go the subscription route, rather than billing by the hour as brudgers suggests, then make it _VERY CLEAR_ what your subscription service includes. Anything past that, they need to pay up.

When in doubt, spell it out, because if you don't, it's likely people will expect more of you than you're offering.

</comment></comment></comment><comment><USER5> Usually when you are recommended by a friend this would cause some extra task and support which are expected in friendship. that is the cost of getting customer easily. This means if you suggest less than normal it will not have profit for you. However, you can not claim more because there are too many competitor ready and online. All in all I think something around normal services would be fare.</comment>


If Everyone Else is Such an Idiot, How Come You're Not Rich? - <AUTHOR> http://www.theatlantic.com/business/archive/2011/12/if-everyone-else-is-such-an-idiot-how-come-youre-not-rich/249430/ <comment><USER2> If you've ever run a company or any sort of organization, you'll realize that walking around blind is the default. It takes effort to get information on what's going on. Because you can't wait forever for perfect information, you end up taking calculated risks like Netflix did with Qwikster where it's not clear in advance if it will pan out.

As the OP realized, this results in Monday morning armchair quaterbacking from people who ask "why didn't they make the right decision in advance, are they stupid or something?" When in fact, no, they are not stupid, they just don't have perfect information about what will happen.

Incidentally, this is the largest advantage of startups- the cost of a risky bet is much lower because you don't have to risk hemorrhaging hundreds of thousands of customers each time you make a bet. As a result, you can take many more risks and come to a better solution more quickly.

edit: downvotes? what?

<comment><USER3> it should be interesting to us, for you and only you to be able to see who downvoted you.

<comment><USER4> That would be a fantastic way to promote "revenge" voting.

<comment><USER5> Also a fantastic way to promote grudges. People who have been "publicly" ugly tend to want to justify it and are thus inclined to continue to be ugly as "proof" that they were right to do so to begin with. I would rather people have the chance to change their mind about me and move on. I have certainly changed my mind about some people and am less inclined to downvote their remarks than I once was (which sounds more personal and ugly than I mean it -- I am trying to say that getting to know someone better can change how you interpret something they have said). First impressions aren't always accurate.

<comment><USER3> no, it's a means to encourage those above the karma threshold to be more austere about their downvotes.

and only those below the karma threshold for downvoting should be able to see who downvoted them. this deals with the problem of grudges. and as someone mentioned below, the downvoter should also have the option of leaving feedback.

<comment><USER5> I don't see how this deals with grudges because I am talking about the psychological impact on someone who knows that it will be known they did the downvoting, not the psychological impact on the person getting downvoted (plus don't underestimate the long memories of some people who will still remember who downvoted them a long time later, after they have their own downvote privileges). Also, people who downvote currently have the option of leaving feedback by simply replying. So I don't really understand where you are coming from.

</comment></comment></comment></comment></comment></comment><comment><USER6> One of the important points I've heard Clay Christensen make is that incumbent companies often get destroyed (disrupted) by small players not because they're incompetent, or even because they're making bad decisions. Each decision along the way seems perfectly rational. Christensen frames it ultimately as a problem of measurement, that people are measuring the wrong thing, therefore optimizing for or solving the wrong problem.

I think this article correctly points out that Hastings isn't stupid, but he's in a tight spot, just because of the circumstances.

<comment><USER7> Even more grossly significant than this is the fact that "logical and/or beneficial at small / individual / short-term scale" need not equate to a best solution or alternative for a population at large or long-term timescale.

A classic case in economics is explained very clearly in Mancur Olsen's _Logic of Collective Action_ , which explains why group-based decisions are often at odds with the interests of the group as a whole.

Another is Arrow's Impossibility Theorem, which hods that there is no method for constructing social preferences from arbitrary individual preferences. In other words, there is no rule, majority voting or otherwise, for establishing social preferences from arbitrary individual preferences -- so long as you also require unrestricted domain, non-dictatorship, Pareto efficiency, and independence of irrelevant alternatives. In other words: democracy not only may not, but _cannot_ deliver an optimum outcome.

There are many other such paradoxes and conflicts, many of which I'm becoming increasingly convinced undermine key and manadatory assumptions of a properly functioning free market economy.

What changes might fix these is of course a rather longer discussion....

<comment><USER8> Winston Churchill was clear in his writing that America could not be trusted as an ally in anything that required steadfast determination over longer timelines. The winds of democracy make America a fickle ally. See 'The Gathering Storm.' Public schools don't often teach any of the shortcomings of a democratic society.

<comment><USER7> The US has often turned to dictatorships for its "friends indeed", though this doesn't always pay out particularly well.

While there's a limit to the amount of pain a democracy will shoulder, there's also a pretty strong tenacity to its true friendships. Such as, say, the "special relationship" much heralded between the United States and Britain. Once we got over some initial sore feelings, by the late 19th century, economic and cultural ties had pretty solidly cemented the two countries together.

By comparison, the USA' s dictatorial allies have been steadfast ... for roughly the duration of the dictatorship, if that. And the fall of same can leave a very long period of mistrust and poor relations: Iran, and much of Latin America are testament to this.

Public schools are indeed a fairly mediocre source, but fortunately we're not limited to the knowledge spooned out in them. I found university to be rather interesting in this regard, and have made some study of related matters since.

So: I'd take odds with Mr. Churchill's assessment.

<comment><USER8> Churchill was not speaking in regard to feelings and a relationship with another nation, but rather dependability in mutual long term pursuits. I think what he says remains true and a useful filter at times.

</comment></comment></comment></comment></comment><comment><USER9> This article ignores a very central tenet of becoming rich:

Luck.

Most people didn't get in the position they were because they were geniuses. Few individuals fill that role. They get there because they were lucky. Bill Gates certainly wasn't the best programmer of his day and he most definitely wasn't the most adept businessman and he wasn't the most brilliant thief.

He was lucky.

He turned out a product that everyone wanted at exactly the right time. Now, as businesses have evolved alongside technology there certainly is slightly less luck (I would personally contend only slightly). But the founders of Netflix probably weren't the first people to think about mailing rental DVDs to customers, they just had the money and the capital to make it happen when the market was just enough ready to accept their existence. They developed expertise in that particular business, mailing DVDs to customers, and killed an entire other industry (for all intents and purposes) in the process.

How the author relates this to their streaming model (what was motivated the change) is baffling to me. Her entire premise seems to try and imply that the wealthy are somehow more intelligent and that, pardon the frankness, is fucking idiotic.

Netflix didn't become a giant through streaming content. They parlayed DVD money into a streaming business because the whole industry was making a very obvious shift in that direction. I mean hell, if they were half the geniuses that the author makes them out to be they wouldn't have selected Silverlight as the backbone of their service.

All I saw was a group of lucky people in one industry try to jump into another industry that appeared deceptively similar, and just because Hastings is their CEO doesn't make me think he's intelligent. If anything he's demonstrated that he doesn't fully understand the economics of splitting media.

The Quickster Announcement came off to me as a very stubborn businessman, tricked into thinking himself intelligent and a captain of industry by his fabulous luck, making a rash decision to vindicate a strong opinion he had behind closed doors.

The only thing I can take from this article is that money does a very good job of making the rich think that they're intelligent.

<comment><USER10> this belief pays little if any rent.

<comment><USER11> It pays _plenty_ of rent. It tells us to expect all the usual randomness results about Wall Street, traders, hedge fund managers, etc. It tells us to expect something that looks like a random distribution like a Poisson in most terms of business success. It tells us to expect plenty of leaders to flame out simply because they got where they were through random rolls of the dice and for once their dice came up snake eyes.

<comment><USER10> I'm sorry but quantifying the role chance plays in some given process DOES pay rent, the general belief "X is like Y because of luck" isn't useful.

</comment></comment></comment></comment><comment><USER12> After working in finance I've come to believe that most wealth is accumulated through brute force. You get money by using leverage to take other peoples money -- its actually very simple from an intelligence perspective. It may take some genius to gather the resources necessary to forcefully gather wealth, but the actual gathering of it is not a matter of 'smarts'.

<comment><USER13> No. Perhaps most of the wealth that you saw, working in finance, may have come from brute force (although I would disagree with that claim, prima facie, as well); but that doesn't mean _most_ wealth is accumulated that way.

 _You get money by using leverage to take other peoples money_

No. That theory is called mercantilism, and we figured out that it's wrong about three hundred years ago. You get money by bringing about the manifestation of value into the world. People who make money via leverage are doing that in a very specific way, but it's far from the only way to do it.

<comment><USER14> 1949 was 300 years ago?

<comment><USER13> 1700 was three hundred years ago, when John Locke pointed out in his _Second Treatise_ that the amount of wealth in the world is not fixed.

<comment><USER15> Interesting... I would be like to look up the direct quote. Would you have the chapter or section reference?

<comment><USER16> You need a citation that some guy once said that the amount of wealth in the world is not fixed? What would the world look like if it weren't true? There's no reasonable or useful definition of wealth for which the world of today has exactly as much wealth as the world of 10,000 years ago. (Or 1,000, or 100. 10, well, that can be successfully argued either way. It's not been a great 10 year run.)

<comment><USER17> I believe he's looking for a reference that Locke was a proponent of the idea, not that the idea is true. Similar to how you might ask for a reference if somebody suggested Shakespeare as the originator of the Theory of Relativity — it's not that you disagree with relativity itself, just the history given.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Reminds me of the following Terry Pratchett quote:

>A European says: _"I can't understand this, what's wrong with me?"_ An American says: _"I can't understand this, what's wrong with him?"_

>I make no suggestion that one side or other is right, but observation over many years leads me to believe it is true.

This post is about exactly those two attitudes, though here it has nothing to do with what side of the Atlantic you're on!

</comment><comment><USER19> A company in the 70's sold 500 of it's restaurants (it's main source of revenue) and the "pundits" called them crazy. The stock took a hit but the CEO remained on course. He stuck to his guns.

30 years later, it is one of the most successful companies in its industry. You may have heard of them- Walgreens.

The CEO of Netflix is not dumb. He killed Blockbuster. He knew what he was doing when he split the company to save the future of his company.

His only mistake was not sticking to his guns.

<comment><USER20> That seems like a bit of confirmation bias. You're arguing that Neflix can do no wrong because:

1) They took out a large incumbent competitor, therefore it's impossible for them to make bad decisions.

2) A single company in the past made an unpopular decision that worked out well for them.

I could similarly say that Apple firing Steve Jobs was the best thing that they ever did. Just look at them today!

<comment><USER21> I imagine there are quite a few people who would agree with you; had Jobs stayed on at Apple, he wouldn't have learned the hard-won lessons from starting Pixar and NeXT.

<comment><USER22> Yes, but the lesson learned should be "sometimes things unexpectedly wind up working out well", not "fire your CEO and you too could become the highest market cap company in the world"...

</comment></comment></comment></comment><comment><USER23> > Hastings wanted to get the DVD-only customers off of Netflix so that he > wouldn't have to pay for streaming rights they weren't using (or paying > for).

I've heard this argument multiple times now, but it flies in the face of the much more logical argument made in the very next paragraph that the content companies want to replace their cable income (no matter what). Meaning in this case if he splits the company in two then they double their prices on the streaming. Given this, splitting seems like a big step for a temporary reprieve.

</comment><comment><USER24> Wealth does not necessarily correlate with intelligence.

<comment><USER25> Yes. "Smart people make more money but don't end up any wealthier" is the more accurate statement

[http://tierneylab.blogs.nytimes.com/2007/04/25/smart- doesnt-...](http://tierneylab.blogs.nytimes.com/2007/04/25/smart-doesnt-equal- rich/)

<comment><USER26> Wealth accumulation roughly follows the process of "1. Earn money 2. Don't spend it" - It doesn't strain credulity that IQ might be correlated with the former, but not the latter.

I'm curious as to the effect on quality of life - measuring wealth in dollars is easier, but a pretty imprecise measure of the overall effect on someone's life of a few IQ points.

I'm even more curious as to the effects on happiness...

Edit: Not much, apparently: [http://www.quora.com/Happiness/Is-it-true-that- less-intellig...](http://www.quora.com/Happiness/Is-it-true-that-less- intelligent-people-are-happier-than-smart-people-Why-or-why-not)

</comment></comment></comment><comment><USER27> I think the issue is more about timing your business decisions, not making smart or stupid ones.

Netflix is worried about the end of physical media, as they should be. They are looking 3 or 5 years down the road and trying to position the company to be successful then (as well as today).

However, for the average customer today, DVDs are still very important. And for the average investor, next quarter's earnings are much more important than earnings in 2015.

I think Netflix made the right decision for next year, or maybe 2013 -- but made it too early; they got ahead of their customers. (An easy thing to do when you live in Silicon Valley.)

<comment><USER28> >And for the average investor, next quarter's earnings are much more important than earnings in 2015.

I hear this all the time, and it's just not true. I see stock moves all the time based on the prospects for distant future earnings - Amazon is a prime example. So is any stock with a high P/E.

<comment><USER29> This can be true:

> I see stock moves all the time based on the prospects for distant future > earnings - Amazon is a prime example. So is any stock with a high P/E.

and this statement can also still be true:

>And for the average investor, next quarter's earnings are much more important than earnings in 2015.

<comment><USER28> Investor sentiment is accurately reflected in the stock price. If investors were incorrectly letting short term thinking dominate their buy/sell activity, then a long term investor should be able to make higher-than-market investment returns by betting against those incorrect short term thinkers.

I don't see this happening, hence I don't buy the idea that investor sentiment is incorrectly biased towards short term thinking.

Consider Amazon again - its stock zoomed for many years after its IPO and despite losing vast sums every quarter and many predictions that it would never climb out of those losses. Obviously, investors were pricing the stock based on a very long term outlook (and were amply rewarded for their prescience).

</comment></comment></comment></comment><comment><USER30> You're assuming that all the smartest want to become rich.

Maybe not.

<comment><USER25> Yes. Ask Stallman, Linus et al

<comment><USER31> Also all the old Bell Labs people who're now at Google. I'm sure Rob Pike could get more money than he does at Google if he wanted to go into the startup game, but he isn't interested.

</comment></comment></comment><comment><USER32> I can think of a couple of counterarguments.

First, the video rental business was ripe for disruption once DVDs became sufficiently popular. Once you had a video medium that was small enough to cheaply ship through the mail and durable enough to keep in circulation for a while, it was inevitable that somebody would challenge the incumbent brick- and-mortar stores and win. Netflix may have simply been in the right place at the right time through sheer luck.

Second, intelligence isn't a single thing. It's a blanket term for a huge collection of disparate characteristics. The intelligence which lets me write code at a level well beyond most of the population is not the same kind of intelligence that would make me succeed in business. Perhaps the kind of intelligence that lets a person build a successful business from scratch is not the same kind that lets a person _sustain_ an existing large business.

I think the article makes a good point, that we tend to ignore complication and subtlety in favor of simplistic explanations like "he's stupid", but I think it goes way too far in the other direction. Rather than assume the CEO is stupid because his company is having trouble now, the author assumes the CEO is smart because his company had success in the past, which is no better.

</comment><comment><USER33> It was a good plan executed too quickly. First price increase to make mail less attractive, then split the companies down the road, then get rid of your part with mailing DVDs completely and then truly become the _Net_ flix company you want to be. The only thing they seemed stupid about was how fast they could execute those steps. They did it too quickly and it unnerved customers and investors.

</comment><comment><USER34> While I am opposed to blatant armchair quarterbacking, we must be careful to avoid the "appeal to accomplishment" fallacy (<http://en.wikipedia.org/wiki/Appeal_to_accomplishment>), or any derivative thereof. Analysts can be justified in critiquing a CEO's strategies, even if they've never been CEOs themselves. Critics can knock a bad movie, even if they've never personally directed a movie. Sports commentators can critique a basketball player's performance, or a coach's call, even if they've never played or coached. Etc. You don't have to have done something in order to form a cogent opinion of it.

Of course, it is certainly unfair to label Reed Hastings an "idiot," or to claim that Netflix, as a whole, has "no idea" what it's doing. History has proven both of those positions wildly untrue, barring a few hiccups here and there.

</comment><comment><USER35> I think this boils down to the fact that if you look at historic proceedings the outcome seems obvious, because the details which make it obvious are the ones reported. There is a total bias to write what looks like a progressive narrative, when the reality is usually far from it.

i.e. A->B and B->C then CLEARLY A->C. Except when A went to B, A could also have gone to D, E, or F, but you don't write about that, because clearly covering all your bases would be ridiculous, and it's generally difficult to evaluate the likelihoods of any options except B, where the likelihood of B is 100%.

</comment><comment><USER36> Because the idiots compromised my health before I knew better, or rather knew how to get away from and effectively avoid this.

This is the part of abuse that people persistently don't get: It often works, by chronically if not permanently disadvantaging the victim. There are people who succeed in spite, but you're down to talking about individual circumstances and variables, then.

<comment><USER5> Health issues and abuse (largely separate issue) are a big part of my story. I've been recovering from both, but at high cost -- like I'm deeply in debt and being evicted from my apartment. Perhaps not the best place from which to be giving "money" advice (not that this is really that). In my case, I'm clear my finances would be far worse if I had not recovered my health, that my current fairly dire situation is still an improvement over what I would face with conventional treatments/accepting the problem. I'm still trying to figure out how best to share information on how I accomplished that. It's possibly stupid (and often goes over very badly) to try to offer encouragement in that regard given the large gap between that encouragement and my ability to adequately convey what I did.

Suffice it to say you have my sympathies and agreement.

<comment><USER36> Thanks for stepping forth to respond.

I... without trying too hard to find my own words -- understand, or experience for myself, the difficulty in trying to communicate about such a situation.

These days, I no longer try too hard, and I tend to keep things brief, myself. Only if someone seems both genuinely interested _and_ capable of understanding, will I willingly go further. (I still kick myself for those times when I slip and say more than my intuition tells me is wise.)

I also should qualify my comment by saying that I don't want to cast myself and the worst of victims.

Such experiences are so personal. And it's difficult when someone wants to "lay them out on the table" with a measuring stick, and probably also whatever brand of Scotch tape they happen to carry.

:-)

<comment><USER5> Agreed: Trying to play "who's the bigger victim" does no one any good. Just saying that one can heal more than most people seem to be aware and I try to gently spread the word, where possible. Even though that journey has been quite the challenge, I feel it has been well worth it.

</comment></comment></comment></comment><comment><USER37> The answer to that question is simple, but unpopular: ready access to capital (i.e., being rich). There's a reason why all the money in the world is held by less than 1% of the people, and this has nothing to do with the 1% being the smartest.

<comment><USER38> A very rich man was asked by a journalist how he made his first million.

The rich man answered that he started off with just a few pennies, put them in a pay phone and made a phone call: "Dad, can you please lend me a million dollars?"

</comment></comment><comment><USER39> The rich don't think everyone else is an idiot - they think everyone else as marks, johns, consumers, customers.

</comment><comment><USER40> MS. McArdle is a journalist with strong insights in tech and finance. Her blog is a good read, if you skip the politics content, which isn't so bad either.

</comment><comment><USER41> Just to take the headline without the context: being rich and being smart are not necessarily synonymous and one never required the other.

In other words, smart people often do NOT aim to be rich. They have more interesting goals and they usually either sacrifice "common wealth" for them, or are just ok with a decent amount of money. Money's nothing. Money's not a goal. Never been. Smart evil people go after power control and knowledge. Money is a side effect. Dumb people only go after money (which comes and go, really).

<comment><USER42> Well, smart people also choose to pontificate about topics on which they consider themselves smart. If your aim isn't acquiring wealth, you may not be the best authority on the topic of acquiring wealth.

</comment></comment><comment><USER43> This same principle often applies to reading others' code. It's common to look at it, see something inscrutable, and decide that the author was an idiot. Then you try to rewrite it, trip over all the same bugs that the author had learned to avoid, and maybe - if you're smart and honest with yourself - accept that you had unfairly maligned your colleague. I've written about this before, as have many others including Joel Spolsky. My favorite is this:

<http://notinventedhe.re/on/2010-4-22>

If you re-read the article with an eye toward how it describes the behavior of programmers even more than it describes that of business people, it becomes much more valuable.</comment>


Expect bigger orgs - <AUTHOR> http://www.overcomingbias.com/2013/09/expect-bigger-orgs.html?utm_source=buffer&utm_campaign=Buffer&utm_content=buffer88166&utm_medium=twitter

<comment><AUTHOR> I know a lot of Hacker News readers haven't worked in a truly huge company but this kind of distopia feels me with despair. Big bureaucracies are should destroying.</comment>


India's largest bank SBI leaked account data on millions of customers - <AUTHOR> https://techcrunch.com/2019/01/30/state-bank-india-data-leak/ <comment><USER2> This situation is so bad in India, that I can't even begin to summarise it... The biggest culprits are financial institutions themselves - they have such stupid requirements for passwords - need to change it regularly, can only contain @#!, need one caps, one small, one number, can't be the same as last 5 times, can't be shorter than 8 chars, but can't be longer than 15 chars either(!?!), etc - that you are either forced to write it down somewhere, or need to necessarily use a password manager. For the less computer savvy people, the second option is a non-starter, so they resort to the first option. And then, these stupid banks and mutual fund companies actively try to sabotage the working of password managers, and even disabling paste on password fields.

And then, there are incredible incidences like this: I received an SMS from a loyalty program a few weeks back:

Login at www.raymondrewards.com with your mobile no. & password <base-64 encoded string> for program benefits. Update your birthday & get 750 bonus pts in your birthday month.

And I just sank in utter despair.

<comment><USER3> Honest question:- Does a typical Indian care about privacy/security?

When I was their I had my colleagues mention that most of them find any kind of password a burden to use a service that they see usage drop significantly if they enforce strong password requirements. I don't think that is a reason not to, I am just saying what the reality seems to be. Hopefully it's just a subset of population and most of them (increasingly) care about security.

Also are privacy/security laws enforced as strongly in India as other parts of the world?

<comment><USER4> > Honest question:- Does a typical Indian care about privacy/security?

It depends, what you mean by "privacy". A vast majority of Indians grow up in an environment with lack of privacy in personal life. Imagine 3-4 people (or more) in a family growing up in a 2 room accommodation.

Most people I know, have no issues giving away PII: phone numbers, addresses, income-tax identifier, aadhar (social security numbers, for those unaware).

> Also are privacy/security laws enforced as strongly in India as other parts > of the world?

Not quite. Law enforcement, and the general public is not really aware of a lot of these laws. Right to privacy being a fundamental right was something that was debated in the courts in 2017.

<comment><USER3> > A vast majority of Indians grow up in an environment with lack of privacy in > personal life. Imagine 3-4 people (or more) in a family growing up in a 2 > room accommodation.

That is a good perspective on how your social life in the real world indirectly effects your online world. Thanks for sharing

<comment><USER5> Yep.

Grew up with 6 people in a 2 bed apartment and our family income put us squarely in the middle class.

My neighbours at one point, had ~8 people in a 1 bedroom. I used to think of myself as the one with the big house.

Privacy was a dream. My parents themselves didn't get privacy, let alone us kids.

</comment></comment></comment></comment></comment><comment><USER6> This reminds me of my client.

We have SBI as our client and often they raise issues to us. Most of their technical staff is a joke, coz they don't even follow the basic etiquette during a call.

For ex - The engineer from SBI allowed me to have control of her server, and in a carefree manner called her BF. She knew I would take about 45-50 min to fix her issue, so she went on gossiping with her paramour in the regional language, and all of her lovey-dovey talks were audible to me loud and clear. She didn't even bother to mute her mic. In the same state of passion, she went to have her lunch without bothering about me (She's supposed to be at the server while I am working). After some time her server got locked coz I was pondering over the notes from my computer. I had to wait for the next 30 min for her to finish her lunch and be back at her cubicle to unlock the server.

</comment><comment><USER7> Not just SBI,I bet every nationalized bank in India has pathetic security. I've worked with some of them & I will say that if you want to sleep peacefully don't keep your money in a nationalised Indian bank; unfortunately private banks are out of reach for majority of the population.

Anyway, it's not that a criminal needs to target the banks for sensitive data when the govt has made it easy by giving a central depository of citizen data in the name of Aadhaar; for the ease of use -it is linked with bank accounts & mobile numbers as well!

<comment><USER8> Bill Gates is a big fan of Aadhaar: [https://www.gatesnotes.com/Development/Heroes-in-the- Field-N...](https://www.gatesnotes.com/Development/Heroes-in-the-Field-Nandan- Nilekani)

<comment><USER9> Easy to be a fan when all the harm falls on other people on the other side of the world.

<comment><USER10> Also easy to be a critic when the harm falls on other people on the other side of the world. There is a cost to inaction as well.

<comment><USER11> Hi. I'm an Indian saddled with an Aadhaar account. Am I allowed to be a critic?

<comment><USER12> Certainly. It's a free country after all. There's already an army of "critics" in Indian Supreme Court who want Aadhar to be thrown into the bin under Article 21.

<comment><USER13> It won't happen any time soon or even ever. There are already talks of a Universal Basic Income by two major parties. They need this kind of infrastructure to roll out their scheme soon.

In short it will be mostly activist rage on Twitter, and beyond that nothing much actually.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> From the looks of the screenshots in the article, it's possible they are using MongoDB (json format, $oid field). Old versions had insecure defaults [0].

I'm currently in India, in the finance field, and I think it could happen to my company (passwords on post-its, computers left with unlocked sessions, some servers accessible from any employee - or anyone inside the office actually...). Security is sometimes tough to advocate, and raising awareness is easier said than done.

[0] [https://news.ycombinator.com/item?id=13374715](https://news.ycombinator.com/item?id=13374715)

<comment><USER15> Honestly, this could happen at any company, for all the same reasons - in my experience, any workplace that isn't actually, or at least run as if it were, military is _rife_ with subpar physical security.

And I can't claim not to be part of the problem - I'm forever wandering off to get coffee without locking my screen, holding doors for people I _kinda_ think I _might_ recognise... every security sin you can name, I'm guilty of it at some point. And so are you. Yes, you. No, probably not you, Mr. Schneier.

<comment><USER16> I have an amusing anecdote about the military and password security. I worked with some folks on a base once and everyone used the same keyboard pattern such that if I knew the first character of a password, I knew the whole password. This pattern was openly shared as a way to "remember" otherwise impossible to remember complex passwords.

<comment><USER17> So do I. Worked at a contractor hosting multiple sensitive/classified document repositories for one of the service branches. One of their attorneys' passwords expired for the document review platform. So this highly-qualified, TS/SCI cleared person accessing sensitive data emailed a bunch of our IT support and PMO distribution lists - basically an unknown number of anonymous third-party personnel - with an angry request to "reset [my] password back to [pass1234]! Right now!"

One thing I learned is that, with the exception of those directly concerned with the firing of weapons in anger, most military personnel don't give a hoot about operational security, and they HATED our IT department who did.

<comment><USER18> What about the nuclear launch codes being all set to 0000000. [https://gizmodo.com/for-20-years-the-nuclear-launch-code- at-...](https://gizmodo.com/for-20-years-the-nuclear-launch-code-at-us- minuteman-si-1473483587)

</comment></comment></comment></comment></comment><comment><USER19> You have to wonder because SBI is the biggest and possibly best run public sector bank of India.

Given the employment structure of Public Sector Banks, its always a challenge how the tech infrastructure is maintained.

<comment><USER11> My understanding was that most of this tech is built and maintained on contract by Infosys or some other company. Is that not the case?

<comment><USER20> It seems like 'Nucleus Software' has many asian bank clients but cannot see SBI in the list ([https://www.nucleussoftware.com/customers](https://www.nucleussoftware.com/customers))

</comment></comment></comment><comment><USER21> Quote: "But the bank had not protected the server with a password, allowing anyone who knew where to look to access the data on millions of customers' information."

</comment><comment><USER22> The disregard for security is so bad, I was actually surprised. How does India, a giant in terms of providing technology and tech workers have such bad standards?

And I quote: "The passwordless database allowed us to see all of the text messages going to customers in real time, including their phone numbers, bank balances and recent transactions. The database also contained the customer's partial bank account number. Some would say when a check had been cashed, and many of the bank's sent messages included a link to download SBI's YONO app for internet banking."

Most importantly why wasn't this tested for security purposes and instead allowed to go live with adequate QA?

<comment><USER23> > The disregard for security is so bad, I was actually surprised. How does > India, a giant in terms of providing technology and tech workers have such > bad standards?

Most of these data leaks and hacks occur on nationalized banks/govt institutions. Thanks to various legacy decisions such as quotas on everything other than skills and merits, politics, decades of socialism, etc, the actual skill tech workers (or any kind of skilled workers) go to private institutions or immigrate out. You won't hear any private institutions of having data leaks with such frequency. Private sector companies have high standards. Many of the high performing and skilled people across USA are Indians.

What not many people understand is than up until the last two decades, the only comfortable job in India was in the government. Private sector jobs were few are far between.

Therefore, parents often pressurized kids to get into government services so that they can get official cars, manors and "benefits", without having to do any work. You can imagine what kind of people get into government institutions with such a culture. Rank idiots and rote learners. No one in India is surprised by such shoddy inefficiencies in a govt agency. It's basically expected.

Politicians do not try to change this culture as it benefits them immensely and because of opposition pushback. Modi has been trying to offload more and more government agencies into the private markets, but the sheer amount of bureaucratic pushback is not helped by the opposition trying to portray him as a crony capitalist to earn political brownie points.

</comment></comment><comment><USER24> There is no concept of privacy in Indian banks. My father in law owns a business that has to deal with large sums being exchanged through checks. Now, unlike USA bounced checks in India are as good as lost money. So most people will simply refuse to accept checks. Since my father in law does large number of transactions with nearly every bank in town he simply calls up the manager and asks "Does Mr. X has Y money in his account ?", the bank manager then gladly tells him how much money the customer has in his account and based on statement if the check in en-cash or not.

</comment><comment><USER25> On another note, tech crunch seems to have done research where they actually monitored information passing through. Is this an ok line to cross in security disclosures? It doesn't feel right. Like as soon as you know you are looking at customer data, realtime or not, you should be closing the terminal/browser/whatever and reporting it immediately. Assuming you aren't a paid for by company security researcher that is.

Curious what the more canonical opinion is on this.

</comment><comment><USER26> I remember I was in the NRI section of a SBI bank in Kolkata maybe ~20 years ago and we needed to get a travelers cheque transaction completed before their closing (bank strikes happen often so timing was critical when we were there, after days we were finally able to get into the bank to do business). Anyways, we were discussing things and the bank manager learned that I was good at computers and I kid you not, he asked me (a customer) to help him with some errors that his computer was making. I obliged because at the time I just didn't care and wanted my transaction to go through. IIRC there was a .com/dll/ocx error, nothing wanted to mess with by looking for a file, trying to run regsrv32, etc. Luckily a reboot fixed the problem ..but yea you can see how screwed up things are there. Things have definitely gotten much more strict recently but I'm sure there are still lots of these shenanigans happening amongst employees

</comment><comment><USER27> Reading from the article, this was READ ONLY access. So privacy implication only. It doesn't make it any less sinful though.

<comment><USER28> Privacy only? What do you mean? If you had requested in details in sms often your account can be profiled with some basic parsing. The hacker can create highly accurate targets for social engineering. This is a massive blunder.

<comment><USER11> He meant, it could have been worse. They could have _changed_ your details. The phone number associated with your account, for example. Or they could have added transactions.

</comment></comment></comment><comment><USER29> When their key software was in needs of urgent upgrade, my friend has to drive two wheeler to their server location and had to replace couple of file using USB sticks.

</comment><comment><USER30> Is that MongoDB again?

<comment><USER31> That's what I'm thinking! I bet it's MongoDB too.

</comment></comment><comment><USER10> Are there any websites that give deeper technical briefs about these large security breaches?

This article provides a little bit of information, but often times these articles provide little to no information about the nature of the breach, point of weakness, etc.

<comment><USER12> [https://krebsonsecurity.com/](https://krebsonsecurity.com/) has a lot of technical details on various breaches. But I doubt if they will cover this case.

</comment></comment><comment><USER32> Sigh. I'm starting to half-seriously long for a bank that doesn't use computers at all. Maybe just for encrypted communication between bank staff. I don't really think Canadian banks are all that much safer either.

<comment><USER33> Why do you think Canadian banks are insecure?

<comment><USER32> I've just seen enough shoddy work in the financial sector. The money is safe. The information isn't. Not in the long run, anyway.

</comment></comment></comment><comment><USER34> Actually we can trust the security researcher or hacker! Not the SBI bank you donot know when the impose fines and min balance fine

</comment><comment><USER35> A quick look at the audit trail would have prevented this leak;</comment>


Ask HN: How to find a good creative partner for solo projects? - <AUTHOR>

Some of us on HN have ideas we want to turn into products, but lack the creative talent to put a pretty face on an otherwise solid idea.
I know crowdsourcing may fit some quick/simple projects, but for more complex projects that require ongoing collaboration and effort, it seems a more dedicated partner would be a better fit.
What are some good ways to find solid creative talent to help partner for solo projects? <comment><USER2> This is the technical co-founder question in different skin. Most creative people don't want to "put a pretty face" on your idea. The best way to find creative talent is to get them excited about the idea early on and involve them through the project.

<comment><USER3> The problem with this is that creative people are authorial bring them to "put a pretty face" on other idea is hard work. I have this problem while trying to develop my startup idea ([http://mypileof.com](http://mypileof.com)) I'm technical and it is hard to found the "creative" or even "business" side...</comment></comment>


After Raising $250 Million, Lyft Cuts Prices By Up To 20% In All Markets - <AUTHOR> http://techcrunch.com/2014/04/07/lyft-spring-pricing/

<comment><USER2> Uber and Lyft are fighting to starve each other off it seems.</comment>


Don't Be Scared to Hire Someone Better Than You - <AUTHOR> http://www.nytimes.com/2013/12/20/business/spencer-rascoff-chief-of-zillow-on-leading-by-example.html?src=rechp&_r=0

<comment><USER2> As hire As, Bs hire Cs. A quip, but Ive certainly seen it in practice. My personal interpretation is that the best performers seek to be challenge themselves. Others, who may not strive or lack confidence etc, end up hiring those who are at or below their level.

</comment><comment><AUTHOR> Really interesting. Says we might do this unintentionally (because can't recognize talent). Or subconsciously. But doesn't suggest that we do this consciously... I wonder how often this happens.</comment>


Shellinabox - Project Hosting on Google Code - <AUTHOR> http://code.google.com/p/shellinabox/ <comment><USER2> I've implemented something similar in Loggly's shell based UI. One of the things we needed to implement was dynamic content - images and graphs alongside text content in the browser.

I was inspired by <http://goosh.org/>, which is a nice little command line interface to Google.

<comment><AUTHOR> Shellinabox is interesting for me mainly because it looks web-like (in contrast to things like anyterm and ajaxterm) and presents normal pty device on server side (and thus can run arbitrary interactive unix programs). Also it is easiaer to deploy than anyterm and seems more reliable and faster than ajaxterm (and also it is more flexible because it can pass used URL to service that it wraps).</comment></comment>


Mobile Mail Client for collaboration? - <AUTHOR> http://theairmailproject.com/

<comment><AUTHOR> What's your opinions about a mobile first mail client that helps you connect through mail instead of What'App or Skype? What about persistant folder move if you have a clear indicator that there's something new in a folder? What about highlighting sections of mail for later use?</comment>


New Tor Denial of Service Attacks and Defenses - <AUTHOR> https://blog.torproject.org/blog/new-tor-denial-service-attacks-and-defenses

<comment><USER2> In a nutshell, the flow control algorithm was designed with trustworthy peers in mind and buffering on a node was controlled by signals sent by its peers. This allowed a misbehaving peer to spam buffer commands, exhausting available memory on the target node. An attacker who carefully chose their targets could force a TOR user to use a specific route, thereby de-anonymizing them.

Really just seems like TOR's version of slowloris. I'm rather disappointed they didn't call it slowtoris.

<comment><USER3> For those (like me) who didn't know about slowloris: [https://en.wikipedia.org/wiki/Slowloris](https://en.wikipedia.org/wiki/Slowloris).

</comment></comment><comment><USER4> Holy... crap...

This is a big deal.

 _> ... found that we could disable each of the fastest guard and the fastest exit relay in a range of 1-18 minutes._

 _> We also found that the entire group of the top 20 exit relays, representing roughly 35% of Tor bandwidth capacity at the time of the analysis, could be disabled in a range of 29 minutes to 3 hours and 50 minutes._</comment>


From CVS to Git, 9 Things I've Learned - <AUTHOR> http://eclipsesource.com/blogs/2011/06/09/git-lessons-learned/

<comment><USER2> Wow, there are people out there still using CVS?</comment>


Hardly anyone buying Teslas or electric vehicles in US - <AUTHOR> https://www.theregister.co.uk/2019/11/12/us_electric_vehicle_sales/ <comment><USER2> The monster truck narrative of the U.S. in this article is not really a fair portrayal. Electric cars are expensive, even the Tesla Model 3 costs about the same as an entry-level Lexus.

</comment><comment><USER3> An electric car's cost is very unreachable for the average American.</comment>


Comcast could mandate a monthly data cap on all customers in the next five years - <AUTHOR> http://www.theverge.com/2014/5/14/5718746/comcast-says-it-could-bring-data-caps-to-home-internet-service-for-all

<comment><USER2> I lived in Australia in the past where data cap is the norm. Even "unlimited" broadband plans mean a 20GB download limit.

I don't think data cap is controversial, in fact it makes a lot of sense doesn't it? You pay for what you use

<comment><USER3> Yes, but it is a little bit annoying when the same company is arguing at the same time that it should be entitled to more money from content providers (such as Netflix) by killing Net Neutrality. These increased content costs would just get passed along to customers. We would pay more at both ends of the pipe.</comment></comment>


Gitlab Postgres Issues - <AUTHOR> https://twitter.com/gitlabstatus/status/1006558437063479297 <comment><USER2> Nice to see how they are solving the issues: [https://docs.google.com/document/d/1WmOMKq63Rap2wfQ- yy7sHyoc...](https://docs.google.com/document/d/1WmOMKq63Rap2wfQ- yy7sHyocFvmbJgIt1UIj2xEXEco/preview)

</comment><comment><USER3> "Yorick hupping unicorn"

I picked a bad day to stop hupping unicorns.</comment>


Making Sense of Data Stored in Our Machines and in Our Heads - <AUTHOR> http://nautil.us/blog/making-sense-of-data-stored-in-our-machines-in-our-heads

<comment><USER2> Speaking of supplemental memories, it reminds me of a plot-point in a novel:

> The chip itself was an immensely complex sandwich of organic and inorganic > molecular layers about five by seven centimeters broad and half a centimeter > thick, which rested in a vertical position between the two lobes of Illyan's > brain. The number of neurological connections that ran from it made a jump- > pilot's control headset look like a child's toy. The greatest complexity > seemed to be in the information retrieval net, rather than the protein-based > data storage, though both were not only fiendishly ornate, but largely > unmapped--it had been an auto-learning-style system which had assembled > itself in a highly non-linear fashion after the chip had been installed.

> [...] "Now I was under the impression the thing worked in parallel with > Illyan's original cerebral memory. It doesn't actually replace it, does it?"

> "That is correct, my lord. The neurological input is only split from the > sensory nerves, not shunted aside altogether. The subjects apparently have > dual memories of all their experiences. This appears to have been the major > contributing factor to the high incidence of iatrogenic schizophrenia they > later developed. A sort of inherent design defect, not of the chip so much > as of the human brain."

> Ruibal cleared his throat in polite theoretical, or perhaps theological, > disagreement.

> Illyan must have been a born spy. To hold more than one reality balanced in > your mind until proof arrived, without going mad from the suspense, was > surely the mark of a great investigator.

\--"Memory" by Lois McMaster Bujold</comment>


Police believe they've solved a murder in 1984. But what if they're wrong? - <AUTHOR> http://www.theatlantic.com/magazine/archive/2015/10/a-death-at-torrey-pines/403186/?single_page=true <comment><USER2> This is one of those scenarios where I'm sure both sides quickly realized they were wrong, but instead of doing the right thing and apologizing, they instead doubled down and tried to make the evidence fit their incorrect theory.</comment>


About That Whole 'We're Going to the Moon in 2024' Thing - <AUTHOR> https://www.popularmechanics.com/space/moon-mars/a29492598/congress-nasa-2024-moon-return/ <comment><USER2> Maybe I just don't get it but what is the point if we have established that there is very little on the moon that is useful for us

<comment><AUTHOR> tactical advantage, and staging.</comment></comment>


Ask HN: Abandoning app alternatives? - <AUTHOR> So we're a little start up and we've got a couple of apps on the App Store that are selling just about alright (a few hundred $ a day on avg). Due to other commitments, we can't really spend much time over the next 6 months maintaing them and adding features. Seeing the apps just rot for such a long time doesn't seem right and we've been thinking of possible alternatives.
One option would be to hand them off temporarily for a certain % of the profit to someone who's got free time on their hands and wants to work a something that's being used by people. I'm not sure how realistic that is or whether we want to do it, so any thoughts on the subject would be greatly appreciated.
Thanks. <comment><USER2> If it's making a few hundred $ a day, that's not bad going, that's a few thousand every 10 days. You should be able to take someone on and pay them to maintain and improve the software, surely?

<comment><AUTHOR> We're a bit inexperienced when it comes to hiring people - I wouldn't expect to find anyone reasonably good with say $1k for a single week of work? The apps definitely don't require a full time person for the next six months - maybe a proper week of worth every month would be appropriate.</comment></comment>


Leaked Microsoft Email Chain Reportedly Describes Hellish Workplace for Women - <AUTHOR> https://gizmodo.com/leaked-microsoft-email-chain-reportedly-describes-helli-1833817967 <comment><USER2> This Gizmodo post consists entirely of quotes and paraphrases from the original article (which they do at least link to):

[https://qz.com/1587477/microsoft-investigating-sexual- harass...](https://qz.com/1587477/microsoft-investigating-sexual-harassment- claims-overlooked-by-hr/)

<comment><USER3> It also got important facts wrong: The alleged partner was in reality a Microsoft senior employee.

There was already a large lawsuit in 2015: [https://www.theguardian.com/technology/2018/mar/13/microsoft...](https://www.theguardian.com/technology/2018/mar/13/microsoft- sexual-harassment-lawsuit-lacklustre-response)

</comment></comment><comment><USER4> > "I would like to offer to anyone who has had such demeaning experiences > including those who felt were dismissed by management or HR to email me > directly,"

This is such a fucked up thing to say. Basically, "if you have damaging information like this, please send it to the top, so we can most effectively suppress it. Don't tell anyone else. Definitely don't use our normal channels, they are not effective."

It really proves that this particular HR department is not set up at all to handle the situation, and that their strategy for dealing with this is just to wing it. There's no process here, just damage control.

</comment><comment><USER5> Literally shocking to me. I am not disputing any of the sources. However, I will say that my experience in the developer tools division two decades ago was of nothing but exemplary behavior (I admit to being a privileged white male). It is the work experience I remember most fondly from the last 35 years and not least because the people were so wonderful. As a guy raised as a feminist I watched carefully the treatment of women and minorities and at least from the outside saw literally nothing to be ashamed of. This is sad.

</comment><comment><USER6> It's interesting that one quote said there were secret James Damores at the company. My first thought was that's a GOOD thing. I guess his kerfuffle really is a bit of an ink blot test.</comment>


Usability Improvements in GCC 9 - <AUTHOR> https://developers.redhat.com/blog/2019/03/08/usability-improvements-in-gcc-9/ <comment><USER2> Great! This directly addresses one of the reasons I use Clang most of the time, and it's great to see that the GCC realizing that error message quality- of-life is important. As an aside:

      $ gcc-9 -c cve-2014-1266.c -Wall
      cve-2014-1266.c: In function 'SSLVerifySignedServerKeyExchange':
      cve-2014-1266.c:629:2: warning: this 'if' clause does not guard... [-Wmisleading-indentation]
        629 |  if ((err = SSLHashSHA1.update(&hashCtx, &signedParams)) != 0)
            |  ^~
      cve-2014-1266.c:631:3: note: ...this statement, but the latter is misleadingly indented as if it were guarded by the 'if'
        631 |   goto fail;
            |   ^<comment>

this is a cute example ;)

<comment><USER3> It saves us frequent users of C++/python from ourselves :P

</comment></comment></comment><comment><USER3> Another major improvement to GCC9 is gcov - starting with GCC 9, gcov can spit out coverage results in JSON format as well as take multiple coverage files as arguments, spitting out all the results to stdout, 1 json object per line (this is huge).

This will allow much of the code coverage calculation process to be done in parallel (i.e. _much_ faster than is currently possible). This is because currently gcov writes everything out to files, which forces the wrapper to be single threaded lest one gcov process overwrite the output file of another.

For fun, I wrote a parallelized GCC9 gcov wrapper in python that generates an LCOV coverage report that genhtml can consume. Unofficial/anecdotal bench marking shows incredible gains over lcov on my own personal projects (700ms vs. 90 seconds). I'm sure it could be improved even more.

[https://github.com/RPGillespie6/fastcov](https://github.com/RPGillespie6/fastcov)

<comment><USER4> lcov can be really, really slow in how it handles its own file format. I ended up rewriting the genhtml stuff myself in Python (originally, it was to drive a treemap view, but extending it to handle the actual detailed coverage wasn't difficult), and then moved the "merge two files into one file" into Python as well for a >10x speedup. And Python is not known for its blazing speed.

After that, I ended up shifting to tackling the generation of the initial data from .gcda and .gcno, which is where I discovered bugs in both lcov and gcov in the collection process. One bug is that gcov somehow manages to compute negative edge counts on certain cycles in the graph, and when that happens, it double-counts those cycles.

</comment></comment><comment><USER5> My main issue with g++ compiler output is that for each coding error, I get a few lines of useful information, followed by a hundred "note:" lines detailing the finer details of increasingly improbable failed substitutions.

<comment><USER6> Clang by default shows only 20 error lines, or something like that, so you have to scroll up a ton less when compiling. I swapped to clang just for the improved error messages.

</comment></comment><comment><USER7> "With -fdiagnostics-format=json, the diagnostics are emitted as a big blob of JSON to stderr"

<comment><USER8> I've previously been thinking about what would be the consequences of implementing a subset of Unix tools to work with a binary protocol.

For example, tables would be output with type info and proper unambiguous delimiting of some sort.

Unrelated to that I once wrote a program in the past several years ago as two distinct parts that communicated over a pair of Unix pipes; one part the GUI which embedded a web view and the other part which contained the program logic and which output HTML to stdout. The code was quite ugly, but anyway it did the job at the time.

But the idea of outputting JSON is somewhat in between this two things. But the main takeaway here IMO is the idea about outputting a specific format as controlled by a flag. Of course other tools have done this too in the past.

Consider a few Unix utilities reimplemented to work a bit tighter together in terms of how some data is represented, and using for example Cap'n Proto to serialize the data and piping that between them but also writing a library for destructively converting to plain text representation and then using some method or combination of methods for deciding when to use binary piping. For example,

\- A user-provided flag. Tiresome to type.

\- A user-provided environment variable. Problematic when mixing tools that implement serialization with pure plaintext tools.

\- The shell could be aware of which programs implement this serialization and invoke them with the flags or env vars corresponding to whether or not each program on each side of each pipe in a pipeline supports the serialization. Possibly the way to go.

In this way one could incrementally rebuild the Unix tools to work this way without having to change everything at once and still being compatible with the universal interface of plaintext forever, since no-one wants nor can implement this in every Unix tool out there.

Once you have a couple of tools support this then the possibility for new ways to interact with pipelines becomes available.

I still love and will use the classic command-line. But in some situations the possibilities enabled by this would be very compelling indeed.

<comment><USER9> What you describe is PowerShell. It is available for most Linux and macOS.

<comment><USER10> IMHO what kills PowerShell is that it's so incredibly verbose.

<comment><USER11> Even with the built-in aliases?

</comment></comment></comment></comment></comment><comment><USER12> > One concern I've heard when changing how GCC prints diagnostics is that it > might break someone's script for parsing GCC output

Honestly though, who would build a tool which depends on the (presumably undocumented) text output of another application, and then expect it not to break?

<comment><USER13> Compiler error string formats are well-documented. Tools have been relying on the : delimited format mentioned in the article since at least the mid-90's (probably longer).

That makes them even more stable than flavors of the decade like xml or json.

In fact, the : delimited compiler error format is so well established that it will probably outlive the json schema the article presents, and maybe even json-as-defacto-standard.

I'm not saying the json thing is bad (it provides rich information that will be useful to some tools), but it's shelf life will probably be much less than 25 years.

<comment><USER14> > it will probably outlive the json

your comment reminds of of a hilarious but very true ringing anecdote here¹ about json and _' The Sins of the Father'_ :-)

¹ [https://news.ycombinator.com/item?id=8708617#8709223](https://news.ycombinator.com/item?id=8708617#8709223)

</comment></comment></comment><comment><USER15> I've been using Terraform a lot lately and aside from no debugger and even line numbers on errors, I wish it had used a real language and had usable errors like this. Great too see, it's the human computers that are the most expensive to run so you don't want to waste their time.

</comment><comment><USER16> I would be really interested to know what kind of unit testing was done to prove that a feature like this won't break anything. I see that he left the original messages and added more guidance, so it would be possible to regress against GCC8. But the addition of the new guidance must require a certain degree of code partitioning and hand-inspection, given how complex GCC is under the hood.

</comment><comment><USER17> Nice

</comment><comment><USER18> > What is the optimizer doing? > ...

Nice! Now, can we get warned about UB?

<comment><USER19> You can at run time with ubsan. At compile time it doesn't make sense, because undefined behavior is used for cases where the overwhelmingly common case you won't see undefined behavior. It'd have 99% false positives, pretty much by definition.

<comment><USER18> This is nonsense. The optimizer makes decisions based on UB at compile-time. It should warn about this, especially when deleting code.

> overwhelmingly common case you won't see undefined behavior.

You think so. But this actually can be a source of serious security vulnerabilities. I want at least the option to know.

<comment><USER19> Would you like to have a warning for every "for(i=a; i<=b; i++)" loop, where the compiler assumes the loop is not infinite?

Or for every a[i++] in a loop (including a[i] with i++ in the for loop of course), where the compiler assumes it can convert the induction variable to *p++?

Both of these are undefined behavior if "i" is signed and it overflows.</comment></comment></comment></comment>


Unbabel (YC W14) raises $60M Series C to become the world's translation layer - <AUTHOR> https://techcrunch.com/2019/09/25/unbabel-gets-60m-for-its-blended-approach-to-business-translation/ <comment><USER2> > We are now translating over 1,000,000 customer service messages a month

> The company told us it now has more than 100k registered translators > providing translation services for its platform.

So... each human translator translates (on average) 10 messages per month. In fact, _less than_ 10, because (presumably) some messages are also translated by AI.

Odd numbers.

<comment><USER3> "100k registered translators" probably means "5-10k active translators" (just a guess).

Either way, translating 1mm customer support messages per month sounds impressive regardless of the number of people translating.

</comment></comment><comment><USER4> I've known Vasco since we met in the Pittsburgh tech scene a decade ago. Such a great guy and been through a lot to get here. Congrats Unbabel!

</comment><comment><USER5> Congratulations to Unbabel, but I've heard some nasty horror stories about the inside and I would be skeptical of any claim to become the "world's translation layer".

However, if investors are willing to risk it, then good luck to them. More Portugese tech companies getting funding is always a good thing!

<comment><USER6> > * I've heard some nasty horror stories about the inside>

Is this related to their technology, their culture, or both?

<comment><USER7> Not OP, but I've heard they used to have a compulsory surf day per week or month, or something like that. Not bad if that's your thing..

</comment></comment></comment><comment><USER8> Among other things, europe's language diversity is listed as one of the reasons why europe isn't a good place for founding a tech company: the american market is much more homogenous. However, for translation startups, this diversity makes europe the best place to be in the world.

They definitely won't run out of diversity, and it also has the european single market which makes it easy to conduct business across inner-european borders. Furthermore, the single market is only a recent addition so many companies and governments which start having to communicate across language barriers are still figuring out how to do it. Canada for example already has an established system as Switzerland has, too. But on an european level, the market is new and fresh and there is no incumbent that needs to be disrupted. It's great to see unbabel and deepl choosing europe as their main base of operations.

<comment><USER9> Europe's language diversity is a trivial cost of business and does not impede tech companies.

But, obviously, that does make Europe a very good market for translation companies.

<comment><USER10> > Europe's language diversity is a trivial cost of business and does not > impede tech companies.

This can't be serious. This is laughable by any stretch of the imagination.

Here's a list of how it impedes tech companies:

1\. Localization effort for 20+ languages (for mainland EU). Every time a new feature that has some words included in it, it has to be translated. Screenshots in support have to be updated.

2\. Training - if you have to train users, you need language specific training.

3\. Account management - account/success managers need to be language specific.

4\. Support - having support personnel that can speak different languages.

None of those are trivial and all cost significant money.

<comment><USER9> It is indeed laughable to claim that absolutely all languages should be supported at all times and that a localisation is costly ("screenshot have to be updated", come on...) By the way, in the EU a population equal to the US's is reached by going for the 5 most populous countries (granted, as it happens that does mean 5 languages, including English, but that also means that these 5 languages cover a population larger the US's).

The rest of the points, if needed, grow with the size of the customer base and do not impede tech companies' growth in the EU v the US.

Rudeness and bluster are not arguments.

<comment><USER10> Clearly your definition of "impede" is very different from mine.

> should be supported at all times

Where did I say that? We're talking about impeding growth, which is along a continuum of time. Any additional "n" amount of effort required during a growth period is going to slow it progress. Additional effort is absolutely necessary to support a different local language by definition. It doesn't mean growth is impossible, it just means it requires extra effort and resources, which in turn means additional time and money.

> that a localisation is costly

Are you claiming it doesn't incur _any_ cost? At what scale (let's use lines of translated text as a barometer) have you ever operated at?

> ("screenshot have to be updated", come on...)

Have you ever had to create support documentation in different languages? For the French specifically? Your reaction tells me this is not the case.

> bluster are not arguments.

Where specifically was I acting in a threatening way in my argument?

<comment><USER11> Canadian here and doing this for French and English has not been a major deal breaker. One of the qualifications we put on our documentation team was being bilingual.

You can also NOT use typical screenshots for documentation but rather have templates screenshots that contain no text and then layer the text over top of those and use things like language selection in the browser to load the correct language.

Employee training can be simplified by headquartering out of one country and having a "primary" language that you work out of day to day.

For many early startups having full fledged customer support (call center style) isn't likely anyway, doing it via chat / email / support tickets can be translated or you can diversify your support hires to cover the languages you officially support.

So is there additional costs - definitely - are they enough to impede and side rail a startup... likely not, and if they are that startup likely wouldn't have been able to succeed anywhere else either.

You're getting push back for the same reason you are shaking your head at the other poster - they are making it sound like it's free, and you're making it sound like it's going to crush someone.... it's slightly more effort with possibly a greater reward if you are able to do it properly.

<comment><USER9> I acknowledged that this was a cost and never suggested it was free.

My point is that, in general, it is a small cost relative to everything else.

Another point that someone in the US might not know is that if you are in a major EU capital city or around you can relatively easily hire people who are fluent in at least 2 languages, so some level of multi-lingual support may thus come "for free" and it's not unusual to have 4+ languages spoken at native level even in a relatively small team (in the tech industry).

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Not sure why you would bet against Google on this.

<comment><USER13> Google translate is tolerable for reading content in a language you don't know, but it would be terrible for translating messages to your customers! Human-human interaction requires a lot more understanding of nuance and idiom and even things like culture-specific expectations of politeness. Translation AIs are nowhere near good enough.

<comment><USER14> Even when you are interacting with a human support agent they're usually reading/copy/pasting from a script, noticeably jaded and lacking empathy from dealing with a never-ending stream of complaints that they are not empowered to actually do much about, and/or not a native speaker. There's not usually a whole lot of nuance in these interactions as it is.

</comment></comment></comment><comment><USER15> Reminds me of back when Google Translate used to be called babel. Did Google acquire them or was it just a branding change?

</comment><comment><USER16> there are already excellent suctions to this problem... why is this better?

and why do you need/want ai to be involved?

</comment><comment><USER17> Please run as fast as you can. This company is toxic waste.

<comment><USER18> Can you explain why you hold that opinion? I'm curious as two people have mentioned it in the comments so far.

<comment><USER19> That same user posted this "Tell HN":

[https://news.ycombinator.com/item?id=19562222](https://news.ycombinator.com/item?id=19562222)</comment></comment></comment>


The ugliest code I ever wrote: a parser generator in XSLT - <AUTHOR> http://nathanwiegand.com/wp/2010/04/the-ugliest-code-i-ever-wrote-parser-generator-written-in-xslt/ <comment><USER2> Mmm, coding with mere hours (nay, minutes!) left has caused me to produce simultaneously some of the msot awful and cleverest code I've ever written. But you know what they say about clever code...

</comment><comment><USER3> Ouch. I hate working with XSLT, I used to use these to update eclipse update sites when I was doing release engineering at my old job.

As an aside, if I took all the effort I spent in doing things the hard way to prove somebody wrong and spent that effort on making money, my life would be a lot better right now.

<comment><USER4> I'm sure you can't make any significant money. Prove me wrong!

You'll thank me later... ;)

<comment><USER3> lol where were you 5 years ago?

</comment></comment></comment><comment><USER5> I recently moved from using XSLT in MVC web frameworks to StringTemplate and I have to say that I am really enjoying it - XSLT can be nice, but often isn't, and can suffer lots of irritating problems with namespaces etc.

I'm still quite fond of XPath though.

</comment><comment><USER6> I friend of mine swears by using XLST for his Java code generator, because its syntax is orthogonal to Java and therefore the code really 'stands out'.

Haven't used it myself in years though.</comment>