Delegated Credentials in TLS - <AUTHOR> https://engineering.fb.com/security/delegated-credentials/ <comment><USER2> This is/ will be part of the dividend from TLS 1.3 encrypting more of the handshake.

Historically deploying a feature like delegated credentials was impractical because some large and unpredictable fraction of connections would go like this:

Popular Web Browser: "Hi, I want to talk TLS 1.2 to somesite.example, I know how to handle DelegatedCredentials if you've got any"

Some Site: "Hi, here's our delegated credentials for somesite.example and now let's..."

"Security" MITM Box: "Oh no you don't scumbag! I don't recognise that certificate - FIN. FIN. This connection is an attack!"

With TLS 1.3 that MITM box's operator has to make a decision up front, since it can't understand the part where the remote server actually identifies itself because that's now encrypted. It can either just give up and let the Popular Web Browser do TLS 1.3 unmolested and not break random features OR it can proxy everything and then since it doesn't claim to understand DelegatedCredentials the remote server won't bother trying to use them.

This way if you have middle boxes everything stays no worse than before, but if you don't you get the benefit of new features.

Unfortunately although TLS 1.3 makes it possible to begin deploying this, the end game which reaps the benefits seems a bit fraught. But hey, can't get there if you don't start.

</comment><comment><USER3> The part I find a bit weak is the discussion of RFC3820 proxy certs, which I remember from the grid-computing days. They were originally designed in the different era of the late 1990s, but I would be interested to read a more in- depth comparison of the approaches.

Those proxy credentials were primarily for delegating "limited" client/user credentials, which in turn might be used as either the client or server role for subsequent TLS connections during the lifecycle of a distributed, scientific computing job. As I recall, the practical "limited" characteristic in the Globus GSI system was a single bit flag that was interpreted in the ecosystem to prevent recursive delegation, i.e. out of an abundance of caution about things like batch jobs turning into worms.

<comment><AUTHOR> This is a very good question. We actually did consider proxy certs and name constraints certs first and had a long discussion at the IETF about these different options. At the end the consensus was that it would be much better to have a very minimal structure which could only do 1 thing and nothing else. DCs also have the advantage that they are cryptographically bound to a particular End entity certificate vs a particular public key only, and hence can only be used with their properties, so it really is the minimal possible thing you need and nothing more.

</comment></comment><comment><USER4> While the proposal is nice, it's a bit sad that the RFC invents its own serialization scheme instead of just using ASN.1, like everything else that touches X.509:

> The signature of the DelegatedCredential is computed over the concatenation > of:

> 1\. A string that consists of octet 32 (0x20) repeated 64 times.

> 2\. The context string "TLS, server delegated credentials" for servers and > "TLS, client delegated credentials" for clients.

> 3\. A single 0 byte, which serves as the separator.

> 4\. The DER-encoded X.509 end-entity certificate used to sign the > DelegatedCredential.

> 5\. DelegatedCredential.cred.

[https://tools.ietf.org/html/draft-ietf-tls- subcerts-04#secti...](https://tools.ietf.org/html/draft-ietf-tls- subcerts-04#section-3)

<comment><AUTHOR> DER encoded ASN.1 is used for the X.509 end-entity certificate, however generally this follows how CertificateVerify works in TLS 1.3 [https://tools.ietf.org/html/rfc8446#section-4.4.3](https://tools.ietf.org/html/rfc8446#section-4.4.3)

<comment><USER4> Hmm fair enough. Case rested then.

<comment><AUTHOR> generalized asn1 parsing can be super tricky and the industry is generally avoiding asn1 for new protocols. There has been some really interesting work from microsoft on verified parsers for asn1 [https://www.usenix.org/system/files/sec19-ramananandro_0.pdf](https://www.usenix.org/system/files/sec19-ramananandro_0.pdf)

<comment><USER5> You're supposed use parser generators for ASN.1. The reason ASN.1 is so difficult in TLS and other crypto standards is precisely because ASN.1 messaging is intermixed with ad hoc messaging (as in this case) and implicit state, which means you couldn't even use a parser generator for everything even if you wanted to.

The excellent open source ASN.1 compiler, asn1c ([http://lionet.info/asn1c/compiler.html](http://lionet.info/asn1c/compiler.html)), can generate C data structures and a parser and composer for X.509 DER certificates from the formal ASN.1 description. But it's not widely used because, among other reasons, you end up having to write too much ad hoc parsing anyhow, which makes the investment in the parser generator seem not worthwhile. (AFAIU, asn1c is far more popular in the telecom industry, likely because telecom uses fully ASN.1-based messaging.)

Of course, if you're not going to use ASN.1 as intended, then the binary encoding (e.g. DER) can be quite tricky to parse using an ad hoc parser, including most parser combinators, mostly because TLV encodings aren't context-free. But I managed to write a full X.509 parser using LPeg. LPeg has an extension for match-time captures which provide a way to invoke a subexpression parameterized on the value of a previous match (e.g. the decoded length context), which can return match success or failure along with a resumption point to the parent expression. See [http://lua- users.org/lists/lua-l/2019-04/msg00226.html](http://lua- users.org/lists/lua-l/2019-04/msg00226.html) and [http://www.inf.puc- rio.br/~roberto/lpeg/#matchtime](http://www.inf.puc- rio.br/~roberto/lpeg/#matchtime)

I feel like there's simply no good answer here. The fundamental problem is the tension among 1) strictly specified, formalized protocols (which ASN.1 DER absolutely provides), 2) efficiency in time and space (ASN.1 DER does well, PER takes it to an extreme), 3) the need for forward compatibility so protocols can incrementally evolve (partly technical, partly a social management issue), and of course 4) ease of implementation. Context-free encodings help with #3 and #4, but fail at #2 (e.g. field names aren't necessary, and variable length values require a more complex encoding), and in a security context cause problems with #1 (better to have a failed parse than to successfully parse unknown elements that you ignore).

</comment></comment></comment></comment></comment><comment><USER6> What is preventing this from turning into another "Turktrust fiasco?" Is the delegated signing privilege only valid for explicit DNS names?

[https://nakedsecurity.sophos.com/2013/01/08/the-turktrust- ss...](https://nakedsecurity.sophos.com/2013/01/08/the-turktrust-ssl- certificate-fiasco-what-happened-and-what-happens-next/)

<comment><USER7> All this is doing is allowing the server (or client since the protocol allows client certificates to do the same thing) to use a different key pair with a shorter validity period than the CA signed certificate.

The delegated credential is not another cerificate and doesn't have a DNS name in it at all. The original certificate who's private key was used to create the delegated credential still has that information and the client still gets that. The delegated credential only consists of four pieces of information: validity interval, public key, signature algorithm and signature. I.E. just enough information to provide the public key and verify it is signed by the CA signed certificate.

RFC is here if you want to read the details: [https://tools.ietf.org/html/draft-ietf-tls- subcerts-04](https://tools.ietf.org/html/draft-ietf-tls-subcerts-04)

</comment></comment><comment><USER8> Why would not they run their own CA for short term certs?

Few CDNs have this exact problem and they sign their short term certs with their master cert.

<comment><AUTHOR> As a CA you can issue certificates for other domains as well which might be undesirable. There are existing mechanisms such as Name constrained CAs and proxy certificates to reduce this scope. While they were originally considered there are issues with them. There is no widespread support for either and there is no way to know whether both sides support them. DCs allow for a extremely minimal subset of what you might need to issue credentials with your own lifetime and it only affects you. DCs are cryptographically bound to the leaf certificate as well. A bunch of this is documented in the draft.</comment></comment>


The Coolest Business Plan Ever (2008) - <AUTHOR> http://ricksegal.typepad.com/pmv/2008/05/the-coolest-bus.html <comment><USER2> This is one of the reasons why you should send documents like this as a PDF.</comment>


Why Analytical Applications Fail - <AUTHOR> http://www.juiceanalytics.com/writing/why-analytical-applications-fail/

<comment><USER2> Comparing travelocity and kayak is interesting, but the best flight scheduling interface is ITA's demo app (seems to be down right now):

<http://matrix.itasoftware.com/>

It gives a color coded matrix of flights, and all the info is captured in one screen. I think orbitz and others use their optimizer as a backend.

<comment><USER3> This has been referenced before on News.YC; this is an interesting paper about the design and implementation of ITA's optimizer.

"Computational Complexity of Air Travel Planning" by Carl de Marcken (2003) [http://www.demarcken.org/carl/papers/ITA-software-travel- com...](http://www.demarcken.org/carl/papers/ITA-software-travel- complexity/ITA-software-travel-complexity.pdf)

</comment></comment><comment><USER4> Cool!

Its a very detailed analysis of analytical sites. Examples shown serve different fields - travel and web traffic. And even usability of analytical sites is broken down by time!

That was a great read for. I am developing a set of news analysis tools and this post helps.

But I am still wondering what could be done in my case?

I have a totally varied set of tools. Some of them show graphs, some maps and some text data. I have separated the mashup into sub-tools. But now after reading this post, it makes me think about presenting the overview of all the types of results on the overview page like the Google Analytics dashboard. Then, I still have to think about users with slow internet connections, since the page load time might increase (and there might be time out errors from my servers resulting in half-loaded pages).

</comment><comment><USER5> I think the target user for sites like travelocity is probably fairly inflexible in their preferences. They want higher income, price insensitive business people who specifically want from point A to point B at time X. The sites and airlines don't really want to cater to College Kid Joe who's carefully weighing his options and playing around with them to save $150. Those people just don't drive revenue.</comment>


SPHINCS: practical stateless hash-based signatures - <AUTHOR> http://sphincs.cr.yp.to/ <comment><USER2> And that's what djb is good at, not writing code.</comment>


Ask HN: How can one deal with bad management? - <AUTHOR>

I'm working at a big and renowned software company, but I'm not living in the USA, so my experience could be different from people working there. After all, big companies only come in third-world countries for cost-savings.  I also read pg's essays, which I liked, so I may be influenced by his thinking.
I am a regular software developer, and I'm really passionate about my work, that's why it hurts me to no end when I see decisions being made that do not benefit the project. Some gripes include, but not limited to:
* changing a good design with one that's not visually appealing, and
   is really confusing, because we had to make it look like it's part
   of the company's website
* to change the design, and to accomodate future changes, we are
   including external server-side files in our HTML, files that
   gathered a lot of cruft over the years, with bad coding practices
   (inline CSS/Javascript). We have to load them from external
   sources, such that when they change, it changes for us too.
* With our old design the main page had 100Kb, with 80Kb being cached
   static content. Now we have 1 MB of static files that do not have a
   cache header set, and a ton of inline code that adds an extra 300Kb
   to one request. And this is after we negotiated with the right
   department to slim down those files.
* we rewrote the administration interface because it was considered
   to have business value the usage of a certain technology,
   sacrificing months with code going down the drain.
* cool features that provided value to real users where pushed in
   favor of features that provided value to the upper-management. How
   useful is a statistics dashboard for a product that doesn't have a
   community yet?
* hacking on cool stuff is not encouraged. After all we have a
   release coming. No reason to waiste time on unplanned stuff.
* we had to negociate a period dedicated to increasing the quality of
   our infrastructure / code.
* we have been working for over a year and I would really be ashamed
   to place it on my resume: I really don't know on what we worked for
   the whole year.
* my manager has a certain mentality that I don't like: he says he
   trusts the upper management because they have more experience, he
   says that we don't know what customers want (where customers mean
   both real customers and the upper management). This one time, a "UX
   expert" placed a link totally random and out of place, and my
   manager agreed with the decision because the expert knew better.
* I have been practically forbidden to talk about these issues with
   the team members.
So part of the blame is that of our management. I have never seen a "NO" answer given to any request. Not to mention that my manager is in the habit of passing blame ... the milestone release went wront? No problem, we can blame it on John from Sales because he was the one to request a last minute feature.
I also have an annoying passive-aggressive attitude, and because I care about the project more than I care about my job, I think I became the whiner, the bad apple of our project. I hate myself for this, but the morale of the team is really low, and I'm not alone in thinking that every possible bad decision ever was already made, although the others cope with it better.
Of course, I was blamed for affecting the team's morale, since I was so straightforward and sincere about it. I do admit that sometimes my words are not "politicaly correct", but this project is like my child. And since feelings are involved it is really hard to be "politically correct" and say things in a "nice way".
So how can one cope with bad management? Am I wrong to think like this? <comment><USER2> Fire them.

Life is short, and jobs exist elsewhere. If this one makes you unhappy, change it. If you have a family to support, you obviously have less flexibility, and will probably need to line something up before leaving the current position.

Of course, you may be too inexperienced to recognize the wisdom of some of managements actions and decisions (and we can only see your side of it from where we sit, so maybe we're missing that wisdom as well). Your application may be a small piece of a very large puzzle, and the cost of making other pieces fit what you're developing is far too high and the benefit too low. Humans often consider the things they are familiar with to be far more important in the grand scheme of things than the community as a whole does. Where you see huge glaring problems, management may see something that negatively affects only 5% of their users only once per month, while making the sweeping changes required to implement your vision could potentially effect all users 100% of the time.

Again, I dunno. I can only see what you've shown us of the picture.

As for this:

 _I also have an annoying passive-aggressive attitude, and because I care about the project more than I care about my job, I think I became the whiner, the bad apple of our project. I hate myself for this, but the morale of the team is really low, and I'm not alone in thinking that every possible bad decision ever was already made, although the others cope with it better.

Of course, I was blamed for affecting the team's morale, since I was so straightforward and sincere about it. I do admit that sometimes my words are not "politicaly correct", but this project is like my child. And since feelings are involved it is really hard to be "politically correct" and say things in a "nice way"._

This is a serious flaw on your side of the equation. The words "nice way" should not be in quotes...and since you've put them in quotes, you make it clear you hold them in the same disdain you hold "politically correct" (which most folks do have a bit of scorn for, these days). But, basic civility in the workplace is something that isn't optional.

Work on it. You cannot change things in your current state. Victims don't make things better for anyone, including themselves...and though the situation may not be your fault, if you want it to get better you'll have to take some responsibility for making it better. Which could mean accepting that this is not the company for you and moving on to another (maybe starting your own, since we're on a startup-focused forum, and most of us think starting a company is the only way for us to keep our sanity).

I've known several folks who quit their corporate job, and yet continued to work on the same project as a contractor...making four times the money for the same job, and able to come and go as they pleased. But, this requires circumstances that probably don't match yours (project is vital to company, employee is vital to project at least for the short term, and everybody still likes employee when he announces his intention to leave--and he is able to make a strong case that he's doing them a favor by staying on as a part-time contractor for a few months while they transition in new people for the project), and if you've given yourself a reputation for being difficult to work with, you'll probably find they're not so eager to have you back.

In short, you can't change other people. They are out of your control. What you can change: Your approach to working with those people, whether you work with those people at all, and your own approach to the problems you perceive that are making you unhappy.

If you can't change jobs, and you can't make this one a better fit by dealing with people more diplomatically, the best you can do might be to simply view your tasks in smaller, more humble, pieces. Instead of making the whole application beautiful (and thus requiring buy in from every department and uncooperative management)...make your little pieces beautiful...not visually, if visual beauty requires going against management mandates (I think you'd be surprised what you can do within such constraints--embrace the limitations and try again--color scheme, logo at the top of the page, and type is probably all that is really required to keep your bosses happy, but even if many things are dictated by style guides and such, you can still build nicer look apps than the standard by being simple, consistent, standards-compliant, and accessible). Just make your code smaller, more concise, nicely commented, well-tested, and reliable as hell. When you've done that, volunteer on any new projects that come up that touch your code...and do the same. Eventually, everything _you_ have to deal with is wonderful (or as wonderful as you're capable of making it), and at some point you'll hopefully be happy enough to not be a jackass to your co-workers, and they might even begin to appreciate that you know better than they do on some things. You might just find yourself in a project management role and able to make real changes (not likely, but stranger things have happened). I can assure you that picking fights won't do it, though.

<comment><AUTHOR> Thanks @SwellJoe,

This is the kind of advice I searched for. I actually feel like a jackass, but I don't have experience which such conflicts and I let things get out of control. I actually was under the impression that I could change things just by pointing out the flaws. I was wrong of course.

Unfortunately I am the type of developer that's interested in multiple topics, ranging from algorithms (parsers, data-mining, inductive reasoning), to usability. And it sucks because I have opinions about everything.

Thanks,

</comment></comment><comment><USER3> Learn this lesson very quickly: Do not complain! You care about what you do, but think about your priorities. Really, think about them. You want to:

1\. Be happy 2\. Make money 3\. Be promoted

It's not a startup, so you are not trying to be ultra rich. Now, when you complain you are first and foremost making yourself unhappy. That defeats the purpose of working there. First rule is that you be happy. And the best way to be happy is to ignore the bad stuff, focus on the good stuff and work on making everyone else happy.

You guys may be producing terrible code at work, but imagine a workplace where you are producing terrible code, but everyone is laughing and making jokes and so on.

Refocus your energy on making you and everyone around you happy. Forget the technology - let them make the decisions! That's what they are there for! Just focus on making yourself happy and your team members happy.

When everyone is happy, morale goes back up, make your manager part of this pleasant team. When people are laid back and relaxed, they are more likely to do sensible things.

The minute negativity comes into the team, it's all going to go downwards. You dislike your job, everyone gets infected by your dislike, and even if you win the argument, you lose at life.

So, forget the technology and focus on the people.

<comment><USER4> This kind of hits it on the head because it begs the real question of how are you fundamentally motivated? Art or Commerce? Or?

Most people are perfectly happy settling for commerce. :-/

<comment><USER3> If one wants to create art, then one should be implementing ones own ideas. If you are implementing someone elses ideas, you are a builder, not an architect. A builder should do his job as best as he can, which is to make sure the thing gets built according to the architects vision. He should not be challenging the architect.

One really has to consider these issues. If you NEED to make art, then go do your own stuff! If you are there to make money, then do the best job you can for them, which means that you should not drag down the entire workplace.

And anyways, I would not waste a day of my time in a place where I could not make myself happy. That's the most important focus - people have to make themselves as happy as they can within the system. If you want to change the world, then don't start by being a html programmer in a large company.

</comment></comment></comment><comment><USER5> Leave.

The bullet points all sound like typical developer gripes, except being forbidden to talk to team members means one of two things: 1\. Management is all messed up and is attacking 'troublemakers' instead of the problems. 2\. Your coworkers have complained to management that you are a ball of negativity that they don't want to hear.

Read the book "My Job Went To India". It's a great book for career planning and it'll help you figure out whether you're in 1 or 2, I can't guess which. If it's 1, you can't fix it, you need to find a company with a healthy culture. If it's 2, you need to start fresh with a good attitude at a new company.

Best of luck with your career.

<comment><USER6> _Leave._

And start your own company. It's easier than you think and you'll be a hundred billion times happier.

And if it doesn't work out, well, you can always go back to a regular job...

<comment><USER7> Point of caution: _"Leave and start your own company"_ is exactly the same advice you're always going to wind up getting on this site.

You'll get it in response to any question from "I think I have a great idea for a company, and..." to "My coworker slurps his coffee" and "I can't decide what colour tie to wear today".

That doesn't make it bad advice, of course.

<comment><USER6> I think you should leave YCNews and start your own company.

</comment></comment></comment></comment><comment><USER4> Aww man, you couldn't have described my situation any better. I came to the decision it wasn't worth my time to try to make a difference (they didn't really deserve the help anyway). I started working only hard enough to not get fired while living like a miser and working crazy hours on my own projects. It was really only a few months before I was ready to make the jump.

Unless it's a job you very deeply care about you probably need an exit strategy. Both you and the world will benefit so much more if you're passionate about your work. If squeezed, management will often make concessions, but they almost never actually GET IT. If you choose to stay you will go bat-shit crazy unless you just resign yourself.

Also, you mention you're passive-agressive and I'm right there with you... I'm a type-B INTP. One thing I have really had to confront head on was that while I do great work, I have a ton of fear and uncertainty about changing gears because I'm simply not like the type-A jackass in management with more confidence than brains. So everyday I have to confront that and just be willing to live in place that feels uncomfortable and reckless.

</comment><comment><USER8> Well I've got the viewpoint from the other side here. I work for a large company in the US that has set up an office abroad for outsourcing some of the engineering. (I'm actually planning to leave to start my own thing soon, but that's a different story.)

I think points 1 through 7 you made are typical in any large company. I've found that I've had to just pick a few things, and learn to ignore the rest. It helps to have at least one higher-up who agrees with you...find that person and get them to like you. It's probably better for your career not to be the one who always complains and upsets people. This is pretty difficult when you get attached to a project and think that the contributions of others are making it worse, but you have to be diplomatic about it.

Your last two points are intriguing thought. I recently had to sit through a training session on "How to work with India". It was chock full of ridiculous generalizations, mixed in with a few useful comments on the cultural differences. They have an equivalent "How to work with the US" class over there and I'd love to sit through that one too.

However, the two things you mentioned echo a lot of my experience with our foreign counterparts. I rarely get a "no" or any pushback, and I really wish I did. Our management here relies on the low-level engineers to make the implementation decisions. They, after all, are closest to the problem and have the most information to base their decision upon. For some reason our management here however treats our Indian counterparts as a black box project factory - requirements go in, solution comes out, and there's little to no feedback in between. The class we sat through made this out to be a cultural difference, where it's disrespectful to disagree with a superior, and the manager is always supposed to have all the answers. Maybe that is a cultural difference, but it's not benefiting either party in the long-term. I tend to think it's really because we've treated them as cut-rate engineers for so long that it's now an ingrained behavior. Of course, if we didn't and instead genuinely expected their productivity to match ours, then we'd have to pay them a full engineer's salary and that sort of defeats the purpose. I'd love to hear some comments on how this plays out at other companies...

In any case, it sounds like you're unhappy. In that sort of situation, your output will eventually decline to average, at which point you're doing neither them nor yourself a favor by staying. At a minimum you now know what to look for when finding a new job. But if you take a job at another big company, know that some of these issues will follow you there and you'll have to learn to pick your battles. But if you can at least find a boss you respect (and get him to respect you), it'll really help to mitigate the issues.

</comment><comment><USER9> I see a lot of bad behaviours on all sides here and have to agree with many of the posters below that it may be time to jump ship to a different company. Or if the company you work for is large enough you can transfer to a different department, just get away from where you are now.

In regards to some of your points above, I think that it is often an issue that changes are made by upper management or by someone in control/power that do not make a lot of sense to everyone else. I'd suggest taking a positive and proactive approach to this situation. You can begin by approaching the individual responsible in a friendly manner and ask something along the lines of, "It was interesting how you decided to do XYZ. I want to understand your thinking here. Can you tell me why you decided to do that?" The basic idea is to get them to open up to you. They may have a very good reason for their idea that you aren't aware of. Maybe it will make perfect sense to you afterwards, or maybe their idea is sound but how they implemented it does not make a lot of sense, or could be improved. If the later is the case then you can work with them to help improve it, maybe start with, "That's a really interesting idea. Do you think that it would be helpful if we were to move the link over here to make it more visible to users?" or something along those lines.

A good technique when you have to say something negative is to make a sandwich out of it. Start with something positive, state your negative, and finish with something positive.

Shame on your manager for passing blame. IT sends a bad message to everyone. A good leader takes responsibility for their team work even if someone else screwed up. If someone is going to get fired over it, then it's a slightly different story, but for the most part a good manager is a shit shield for their employees.

Passive-aggressive = bad, unhealthy attitude It will only cause problems and you'll lose respect and friends Being a whiner= bad, you can "complain" constructively so it doesn't come across as whining. You'll get a lot more accomplished and gain recognition/status in the process.

Decreasing team moral = bad. It's not always easy to say the right thing or be "politically correct", but if you want to be a good team member you will need to do so. You want to make change for the better, but you might be hindering the change as much as anyone else. You can be "straightforward and sincere" without bringing the team down.

This book might help you in learning to be a force of change in your company while being positive at the same time: [http://www.amazon.com/Human-Factors- Project-Management-Techn...](http://www.amazon.com/Human-Factors-Project- Management-Techniques/dp/0787996297)

</comment><comment><USER10> I have two comments:

(1) Though you didn't say it, the comparison to startup life is always implied here, so let's just be clear: most of these problems _do not_ go away at a startup. The pressure to "just get things done" instead of "doing it right" is greater when it's your own company on the line. GitHub, for instance, was apparently bootstraped by shell-out'ing to the "git" command line tool. _Shudder_.

Yes, you can mess around with aesthetics and hack on cool things without getting yelled at your own company. But on the other hand, a lot of the time, when you do that, you're killing your company. I might rather get bitched at.

(2) You seem to care about some unimportant things. For instance, the "visual appeal" of your current app versus the company standard. Or the download footprint of your Javascript libraries. Or the soundness of your company's UX hired guns.

If you loved the app that you were working on, loved it for its own merits, you wouldn't care about trivia. You sound bored. It doesn't sound like a management problem. Maybe you just need to switch from payroll and pension benefits management software to Flash games? You can do that; just be prepared for the pay cut. Supply and demand, yo!

</comment><comment><USER11> Sorry to hear about your situation.

I can't speak for the options available in your city / work pool, but it sounds like you've gone about as far as this job will take you.

If you are perceived to have a bad attitude (regardless of your actual intent) it is going to make your progress at the company difficult. Forget about moving up, and expect your opinions to be ignored because you will be perceived to be submarining the company. So much for that.

Brush up your resume (sad as this last year may seem) and consider what you learned here and what you'd like to see in a future role. Cast the lessons you learned in a positive light and try not to harbor any bitterness.

A former manager of mine (probably borrowed but) once said: "What do you get when you don't get what you want? Experience."

A lot of the things you're seeing are realities of the business world. Management doesn't outsource to overseas to argue with them, they just want something done cheap. Your management may not be doing the most they can to register their dissent, but it might be in the interest of saving their job, not in some form of ignorance. This isn't specific to overseas/outsourcing relationships, it's disappointigly common in conventional middle management, as well.

If it's any consolation, not all places are like this. You may find you can transfer to a better team within a company or may have to get a different job. I was in a similar place once (twice, ugh) and it was a huge weight off of my back when I got in to my new role where dissent is appreciated.

</comment><comment><USER12> I'm in the same situation but only until Friday!

I gave my 2-week notice last week.

My morale went down while working for the company. I have always been told no on pretty much everything.

I'm unhappy. I told them about my situation but they never did anything.

For the past year, I hoped for things to change. But sometimes you have to be realistic. Developers can do a lot of good things but fixing the management is beyond what we can do.

All I can say is that you should leave too. Your morale or spirit is down right now. Leave before you have none left.

</comment><comment><USER13> 1\. Buy shares of that company (ESOP ?).

You will automatically become co-owner of the company.

2\. Leading, Managing, and Administering are 3 different aspects. 3\. Change your priorities: People First, Processes Second, and Technologies Third

You will automatically align with your management.

</comment><comment><USER14> you are not wrong, and there are many companies that operate like this. it sounds like you're in a service-oriented company, where the product is built to fit the requirements of the customers. there are many companies that operate like this. they're typically steady paychecks, but not engaging or challenging jobs.

if you dislike whats happening, you're not going to change it, as the atmosphere is typically a byproduct of management's direction for the company. look for a job elsewhere.

</comment><comment><USER15> In a big company, some problems can't be solved from the bottom up. Maybe you should find a better place to work.

</comment><comment><USER16> Leave.</comment>


How I Deal with Sexual Discrimination in a Positive Way? - <AUTHOR> http://www.tammycamp.com/2011/05/21/how-i-deal-with-sexual-discrimination-in-a-positive-way.html <comment><USER2> It's hard to take this blog post at face value. My experience with the industry has been that IT people are terrified of offending women and go far out of their way to avoid being perceived as sexist. I do know a couple guys that flirt with women at work but that's a far cry from sexual discrimination.

As long as we're sharing anecdotes:

* My girlfriend of 3 years also works in this industry, and she has never complained about an incident of any kind.

* I worked with a female developer who was fired and complained about discrimination. But this was not the case, she was fired because she was terrible at her job.

* I also worked with a gay developer who was fired. He complained loudly of homosexual discrimination... but I saw his check-ins (or lack thereof)--he was also terrible at his job.

So the two major cases of discrimination I personally know about in Silicon Valley have both been frauds. Is discrimination real in Silicon Valley? Certainly, yes, there's always a few bad apples in any large community. Is the problem being blown out of proportion here? I think so.

<comment><USER3> I'm married to someone who went on an IT job interview and was shown a naked picture of the hiring manager, while he was interviewing her.

That's one of the stories I'm at liberty to share.

Happy to cancel you out!

<comment><USER2> Yikes. Maybe it was this guy? <http://onion.com/cGj5Xy>

<comment><USER3> Am I supposed to find some clever cat picture to reply to you with?

<comment><USER4> Would have been better than the snark. Lack of contribution to me is not license to reply with even less contribution.

<comment><USER3> "I'm sorry. I can't help but be amused that some opinion on a forum somewhere has made your life a less happy place. The tiniest of my violins mourns your loss."

<comment><USER4> There was more substance to that comment than what you quoted.

<comment><USER5> Jesus Christ this moron will never get it. He thinks it's all about him.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> I think this post is mistitled. Sexual discrimination is about unequal opportunities -- passing over women for promotion, asking inappropriate questions in job interviews, etc.

The OP is describing something more like a _crime_. Extortion.

</comment><comment><USER7> Okay, I'm going to reach far now: Sorry, but this is blogspam. You have to ask yourself: What is the purpose of this post here? What exactly do you want to achieve by posting it here? The answer is clear, this is posted here solely for generating publicity. Now let's dig again: Why do you want publicity for this? If there is a real issue here, take it up with someone who is actually responsible for fixing it. If you want to publicly shame people, then keep posting it on sites like HN.

99% of all the people visiting this site won't ever concern this issue, and as surprising as it is to myself, I'm actually a little offended by your insinuation that I should care about this. But that's not the actual problem I have with your post. The real issue is that this kind of topic has been discussed a million times, and therefore has no place on HN.

<comment><USER8> "If there is a real issue here, take it up with someone who is actually responsible for fixing it." <\-- the problem is that addressing the issue with the person who is actually responsible doesn't solve the problem. Unfortunately, in many cases, some sort of public shame is the only real way to rectify behavior. We see these issues of sexual discrimination and harassment all the time, and even with years of lecturing people still don't get the message.

"If you want to publicly shame people, then keep posting it on sites like HN." <\-- Unfortunately, I don't think that was her point. If others are made aware of the circumstances, and see that someone relatively influential is making a comment about it, other women won't feel like they are alone. Having been on the receiving end of other types of discrimination, I can empathize with the feeling of loneliness and desire to keep quiet.

<comment><USER9> What kind of helpful public shame is supposed to come about? Men who are not pigs will probably just think "this doesn't concern me". Men who are pigs are not shamed by the blog post in any way, so they are unlikely to change their ways because of it.

Since no names were called out, there is nothing the innocent bystander could do (like boycotting the conference).

</comment></comment></comment><comment><USER10> A few days ago I ate at the Sales/HR cafeteria instead of the engineer cafeteria. A table of HR people I didn't know that was 80% female invited me to join them for lunch, and eagerly chatted me up for the next half hour.

This was a really illuminating experience that highlighted for me what an impact the male/female ratio can have. Getting that level of female friendliness/attention at work is totally foreign to me (I don't work directly with many women), and was kind of nice.

I think there is a vicious cycle where women in technology get too much attention from female-deprived men, which conditions them to have a guardedness about them, which conditions the men to feel even more female- deprived (and leads some of them to be creepy). It's unfortunate.

I'm not sure if this has anything to do with a conference organizer who demands sex (it _certainly_ doesn't excuse it, even a little). But I do think there are a lot of lonely guys in tech.

<comment><USER11> There would be a lot less lonely guys in tech if it wasn't such a generally female-unfriendly field in many areas.

Also, there is a fair bit of overlap between the "lonely guys" and "guys causing this problem."

</comment></comment><comment><USER12> Any kind of accusation made public is a tricky beast.

There are 3 possibilities for the accusation: 1\. The accusation is correct in it's entirety and should be taken at face value 2\. The basis of the accusation is correct, but additional information casts it in a different light. 3\. The accusation is false.

If you discuss it, publicly stating that option 1 is true is the only strategy that will keep your reputation intact. Anything else makes you look like a douche.

<comment><USER13> And 4. we do not and cannot really know whether the accusation is fully or even partially accurate, and therefore should keep all our mouths closed about it and let the legal system handle it.

"accusation == guilt" is never a smart default

<comment><USER11> It should be worth noting here that the accused have every bit the opportunity to deny the claims. If a woman—any woman—were to absolutely falsely accuse some guy of having raped her in a very public manner (with or without having gone to the police beforehand), by what logic would the guy, who _knows_ he didn't rape her, not deny the accusations? He could deny them in equally public fashion and/or go to the police himself.

The thing is: women _know_ that making such an accusation in public will get them harassed for it, whether it's true or not. But it's really only worth the immense vitriol that they will have to endure when their accusations are true.

Additionally, women also don't have some kind of weird "inherent motive" to do this to men, but countless of reasons not to.

Stepping to the police is _always_ the right first move. Publicly outing rapists is a brave (as it is dangerous) additional step to take which, among other good things, will alert other women about the rapist.

Anyone who argues that it is unfair should shut the hell up and first think about how fair it was to the woman that she got raped in the first place. Hint: she didn't deserve what happened to her. The guy who did the raping? Totally does.

<comment><USER13> Two quick comments.

1\. there are many possible motives for a false accusation; all kinds of permutations have happened historically; it happens sometimes

2\. no rape mentioned or implied in the OA. just a refusal to have sex, supposedly

<comment><USER11> 1\. Yes, there are always possible motives. However, unless you have some data showing there are more false reports of rape than truthful ones, or even that the disparity between the two _isn't_ a night-or-day difference, that's not something we ought to consider each and every case of doing.

2\. Correct; my response was more about the general discussion taking place here than the specific OA one. That said, while not speculating on Tammy Camp ever having been raped, these three men who have banned her from three different conferences just for refusing to sleep with them sure are doing their best to interfere with her career.

<comment><USER13> You're making assumptions again I think. She didn't say there were 3 different conferences and 3 different men. Merely, that something "similar" has happened 3 times in the last year. Technically, it could all involve the same conference and same person. And it might not have even been a tech conference or industry related at all, who knows. Maybe, but not specified.

Assumptions are what put innocent people on death row. And what drive people to break out the pitchforks and torches. They're not a mark of modern civilization. I hope. :)

<comment><USER11> I'll agree that there was some level of assumption involved, but it's pretty clear this was not "the same conference and same person" given that _that doesn't make logical sense_.

How could she have been banned three times from the same conference, and why on Earth would she have written this post the way she did if it had been the same person three times in a row?

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> "Never speak ill of the wrong or negative person. It takes you down to their level."

If someone is trying to force you into sex, and you stay silent about it, they're probably going to do it again. At some point you have to speak up.

But being a guy, I have no idea how hard it would be to come forward with such allegations. I've never done anything comparably brave.

<comment><USER15> If I were a woman I would take a picture of the guy and post it to my blog and just let it out. There isn't enough for anything to be done otherwise it will get worse if the person is just left to do it again without any consequence... even if the only consequence is a blog post.

It does appear all of the guys decend upon the women and try to take them apart but they have nothing to gain in this... well except for hopefully the next woman in line hopefully won't get harassed (and excluded) in such a way.

<comment> X-Istence Yeah ... not a good idea: <http://news.ycombinator.com/item?id=2571972>

</comment></comment></comment><comment><USER16> Wow, lots of hysteria. I was hoping to find a comment that said something like the following:

It sucks that things like this still happen. I've seen or heard about a few stories like this and it's heartbreaking to think that the industry I love can cause such pain to people. Worse still is the thought that these incidents punish everyone, from the women who are turned away to other, less risky fields, to the managers who struggle to find competent female hires, to the other men who get unfairly tarred for just being in the same gender.

I understand it's tempting to say "but this might be made up!" - yes, it might. We don't have any facts and we should be cautious not to use it as an excuse for a witch hunt. But would you be surprised if it was true? Put-money- on-it surprised? If not, that's problem enough. These things happen and we know it.

The thing that gets me is that theoretically HN is a place for people who aren't satisfied with "oh well, that's how it goes", who instead disrupt and innovate, who find novel solutions to problems nobody thought solvable (or even worth solving), and who change the world for the better in the process. Where's that spirit now? Surely we can find a way to make things like this less frequent or less damaging?

<comment><USER17> I definitely found reading posts in this thread rather bizarre. This has become more of a spectacle than an event that happened to an actual human being.

</comment></comment><comment><USER9> Does "one of the organizers" imply that the other organizers know of the reasons for the ban and play along with it? Obviously there are many jerks in the world, but I admit I find it hard to believe that there could be such a random concentration of jerks. Or were they all jerks who bonded through their jerkiness and then decided to launch a conference?

<comment><USER15> Your logic is that another organizer would step in when probably they won't because they have enough people to pull from they don't really have to battle it out to get any one person in over another persons objections. And the person with the objection isn't going to say outright what the vetting process was, just that there were other people he thought would be better (after passing her over for the lack of sexual exchange).

</comment></comment><comment><USER18> _This past week I was banned from one of my favorite conferences because I wouldn't have sex with one of the organizers._

This makes me wonder about all the quips like, "Who do I sleep with at [ ] to get featured in [ ]?"

A part of the public image of companies like YC and Berkshire Hathaway involves their associating with _good people_ \-- because good people tend to produce real value. Likewise, if the Silicon Valley startup scene is more than just a hollow reputation market, then there is some real value on which a real stand for values can be based.

Conversely, I feel that such behavior is one symptom of the economics of a possible reputation bubble at work.

</comment><comment><USER19> It's embarrassing for the entire industry that men act like this. I can't imagine devoting yourself to the business of software with all your heart only to be treated like a piece of meat. Must have taken a lot of courage to write this.

I would like to know who the conference jerks are, though. If you by 2011 haven't learned to treat women decently, you need to be publicly shamed and, if possible, brought to justice; anti-discrimination laws exist for a reason.

<comment><USER4> It is not embarrassing for the entire industry and any attempt to paint this as an industry-wide issue is insulting to those of us who do not behave like this.

<comment><USER20> Whether you like it or not, whether it's true or not, computing has a reputation for being a mens' club. And things like this don't help. So yes, this _is_ an embarrassment to the industry whether you're directly responsible or not.

<comment><USER4> Again, wrong. _The work force_ has a reputation for being a mens' club. There is nothing specific to computing about it.

Please do not disrespect the industry you and I are a part of by kidding yourself that we are different and somehow a problem.

<comment><USER21> Actually as far as I can tell computing has a reputation of being _especially_ this way.

Personally I don't really understand why you'd want to defend the "there's nothing wrong, ignore this woman" point of view. You acknowledge there's a problem, although you don't think it's specific to this industry. Why take the course of action/defend the point of view least likely to improve the situation?

<comment><USER4> And your sweeping generalization of computing is based on? Some things you read on the Internet? A story you heard once from a female coworker?

I don't know how your shop is but in my shop this shit does not happen because we are overly selective with our hiring and extremely quick to fire. One tactic we have in interviews is to take the applicant to dinner and get him drunk with a female colleague present. Multiple otherwise-awesome applicants have earned a circular file at dinner.

<comment><USER21> > And your sweeping generalization of computing is based on?

The same thing as yours. My personal experiences and what I've heard. You have no more evidence that there is nothing especially wrong with computing than I have that there is.

> "but in my shop this shit does not happen"

That you've heard about. Although I suspect that if you share the same kinds opinions around your coworkers as you are sharing here, you've made a fair number of your feel uncomfortable and unwelcome without ever realizing it.

> One tactic we have in interviews is to take the applicant to dinner and get > him drunk with a female colleague present.

Wow. IANAL but using a female coworker as a honeypot is probably opening your company up to liability. The standard for harassment or unfriendly working environment is what a reasonable person would consider the same. I'd vote in favor of the plaintiff if a colleague of yours asked to perform this duty ever sued your company. As a matter of policy you're knowingly putting an employee in a situation where they are more likely to be harassed specifically for the purpose of seeing if they get harassed.

Well, it's your ass on the line and not mine; for that I am thankful.

<comment><USER4> You're right, you're not a lawyer so you should be less willing to throw the word 'liability' around. You're armchairing your way to a legal conclusion based on two facts and a situation you're unaware of. Namely that this colleague was the one who came up with the idea and enjoys the responsibility. Look at her angle. She gets a less hostile workplace by helping screen out the creepers who will come after her later.

Feel free to armchair lawyer someone else because you really suck at it.

<comment><USER18> _Feel free to armchair lawyer someone else because you really suck at it._

Armchair lawyering -- from my experience it usually looks and sounds much better to the practitioner than it does to any trained lawyers. Those practicing it are often _convinced_ that they speak with authority, even though they're laughably wrong.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> How does this even work? I'm not accusing Tammy of making it up, but how does this even come about? The mind boggles.

<comment><USER4> Just enough details to start a flame war but really convey no context whatsoever. Cool huh?

<comment><USER23> The second you provide context you start providing clues that can be used to piece together the person allegedly responsible for this, and then once that cat is out of the bag it turns into a full blown he-said, she-said thing with legal ramifications.

</comment></comment></comment><comment><USER24> And... crickets.

I know she's going for the high road but it seems like the most good would come from naming names or at least naming the conference.

<comment><USER25> You should read this thread, about an incident last fall: <http://news.ycombinator.com/item?id=1875718>

She named names, and was given so much grief because of that.

<comment><USER8> I think the issue really stemmed from outing individual people. The problem with that approach is that it boils down to a he-said-she-said, and its natural in such a situation to side with the more prolific character.

If Tammy were to out the organizations, I would know which groups not to donate money to

</comment></comment></comment><comment><USER26> Sex appeal has been repeatedly demonstrated to yield significant advantages. Discrimination, although contemptible, is just the other side of the coin.

<comment><USER27> Does that mean we should accept it? Does that make it OK?

<comment><USER28> No, but it means women aren't _always_ discriminated in favor of men.

</comment></comment></comment><comment><USER29> I've been "banned for life" from things having nothing whatsoever to do with a sexual situation. I've chosen to walk away from other things where sexual stuff (including but not limited to discrimination) was a big part of the problem. I'm wondering if anyone else here can raise their hand and say "yea, verily, I am also banned for life from something and it had nothing to do with sex/gender". I'm sorry for this person's experience and I don't wish to talk bad about them but I really think folks blow some things way out of proportion and make it about "I'm female" or "I'm black" or "I have X issue and everything in life that goes wrong is about that issue". Just looking for some perspective.

</comment><comment><USER30> Go to the police, writing about it like this on a blog doesn't solve the problem.

<comment><USER27> It's been a crime for years and the police don't seem to have been able to stamp it out. Gosh, it's almost as if they can't be everywhere at once and that citizens will have to take some responsibility themselves for what constitutes acceptable social behaviour. Writing about it on blogs and news aggregates and raising awareness is the only way the problem will get solved.

<comment><USER30> Stealing has been a crime for years, and the police haven't been able to stamp it out. Is that a reason for not reporting it? If victims weren't reporting stealing to the police, that wouldn't be helping in any way.

What good does writing a blog post that as far as we can tell doesn't contain any checkable evidence do? (and I'm _not_ advocating publicly shaming the guy -- again, the legal system is the established road for crimes, and this is no exception).

</comment></comment></comment><comment><USER31> This does not tickle my intellectual curiosity. The issue is a very important one, but HackerNews isn't god_damn Oprah. Bring on the downvotes.

</comment><comment><USER32> It is appalling that sexual harassment and discrimination is not outlawed in this industry. Florian Leibert, the harasser who was identified in the incident last November is still working at Twitter. Why haven't the founders and/or executives at Twitter taken any consequences?

<comment><USER33> Why should they take consequences for what is quite possibly a false accusation?

</comment></comment><comment><USER34> Maybe people aren't speaking up because they don't know what to say. If I witnessed this, what could I do? I'm looking for specific ideas here.

</comment><comment><USER35> For the people saying she should go to the police about this: what crime (meaning something that would be criminally prosecuted as opposed to something that might be the cause of a civil suit) do you believe has been committed in this case (I'm not a lawyer; I don't know)? There was no mention of physical assault in the blog post. Even if this incident broke some law, how would there possibly be enough evidence to prosecute?

Wrt the argument that these things happen because guys will be guys or because nerds have grudges against women: That may be a reason, but it's not an excuse for this sort of behavior. People should be expected to act professionally when in a professional context.

As for whether publicly naming names accomplishes anything: If a person's sense of professionalism (not to mention simple human decency) is low enough to engage in blatant sexual harassment, they clearly need some external incentive to not behave in this way. How does that incentive get provided if the people being harassed keep it to themselves?

<comment><USER11> > _For the people saying she should go to the police about this: what crime > (meaning something that would be criminally prosecuted as opposed to > something that might be the cause of a civil suit) do you believe has been > committed in this case (I'm not a lawyer; I don't know)? There was no > mention of physical assault in the blog post. Even if this incident broke > some law, how would there possibly be enough evidence to prosecute?_

Imagine a store owner standing by his entrance, letting people in one by one without even batting an eye. Then a woman approaches, he likes the look of her. He holds up his hand and says "Hold it! You may not enter unless you have sex with me."

That doesn't sound like extortion, sexual coercion and unlawful discrimination to you? Well, it does to any sane judge.

As for evidence: testimonies and/or email trails can produce plenty of evidence, easily.

<comment><USER35> I'd rather not "imagine" anything or speculate what a "sane judge" would think. What criminal law is being broken, given what we know? If you think it's obvious consider that sexual harassment in the workplace is usually considered a civil, not a criminal matter (though, in some circumstances it can be criminal).

As for the evidence, we don't really know what evidence exists in this particular case, but it seems premature to assume an e-mail trail or testimony other than the "he said/she said" variety.

<comment><USER11> It seems premature until you read the comments in her thread, wherein Tammy points out that she has received "an alarming number of emails" from other women who experienced the same or similar things.

And while I'm neither a lawyer nor that intimately familiar with US or California laws in particular, I'm _fairly_ certain that this falls under extortion laws, as it is a form of oppressive exaction.

</comment></comment></comment></comment><comment><USER36> Don't you guys see that she's writing for other women – and anyone else that's encountered some form of ugly discrimination?

She spends most of her post describing what's it like to be on the receiving end, and more importantly, what she's done to deal with it.

</comment><comment><USER37> I'm sorry that this happened to Tammy Camp, for her, for the other organizers of the conference, and for the attendees.

Regarding many of the HN posters here who argue that Camp shouldn't have blogged about this, or that she must be lying: why assume that it's about you?

As another comment notes, what happened to Camp is attempted extortion. If you've not done this to someone, Camp's blog post is not about you. Presumably, you're able to read about someone's experience of burglary, non- sexual assault, or other crime without immediately impugning the victim's motives or truthfulness, arguing that the crime was an isolated incident, or requesting that the victim just shut up. Camp deserves the same respect her, unless you can demonstrates she is lying.

And for those who doubt that Camp's blog post can achieve anything: it's not about HN. This thread demonstrates, mostly, the same tired back and forth. But there is a whole world beyond HN (really).

In that world, if you've experienced something like what Camp went through, you've just discovered an ally, and maybe the world feels a little less lonely. A win.

And if you have ever been the perpetrator of this kind of extortion, you know not to try this with Camp - a win for her - and maybe the world feels a little less safe for you and your crap. A win for all of us.

Not bad results for a simple blog post.

</comment><comment><USER38> I don't know this person, but it can't be that hard to actually deduce the conference...

</comment><comment><USER39> What conferences are there next week?

<comment><USER40> There are quite a few of them:

<http://lanyrd.com/places/usa/>

</comment></comment><comment><USER41> I can't believe she edited my original comment on her site.

</comment><comment><USER4> I'm looking forward to the absolutely riveting discussion that will take place on this submission. Remember Noirin Shirley naming the Hadoop committer who fucked up at ApacheCon? Here's how this conversation goes and I remember because I was involved in one during that fallout:

\</comment><comment>

She should name names.

 _Why?_

Good to shame the asshole and get it overwith.

 _And what good does accusing someone of something like this with an entirely one-sided account in public do for anyone?_

It lets other women know he's a scumbag! Why are you fighting this? You must be a chauvinist.

 _No I just think everyone should be spared from trial by Twitter because character assassination is kind of a big deal and there is always the chance that facts are being misrepresented by either side. We do not have the full story but it will not matter because one story has already been presented and conclusions drawn. Any comeback the accused has is already lost._

You're a pig and the problem with men in IT.

 _It has nothing to do with gender or sexual assault and everything instead to do with having a chance to defend yourself._

It has EVERYTHING to with gender and sexual assault.

\</comment><comment>

Seriously, save yourself the involvement in this thread. We all know it happens but anything objective you have to say about the accusation or the person making the accusation will be drowned out by misandry. Do not read anything below my post. It is a complete and utter waste of time.

Personally I think shit like this should not be blogged at all but whatever. I am not ready to fight this battle again.

<comment><USER42> What is the alternative - accept that victims of sexual discrimination and harassment stay silent?

If they don't name names, nothing changes; if they do name names, they're accused of submitting someone to trial-by-Twitter. A catch 22 if I've ever seen one!

As to your "shit like this shouldn't be blogged about" comment, that seriously bothers me. Are you SERIOUSLY suggesting that victims of sexual discrimination stay silent? Jesus tap-dancing Christ, the Rapture came and somehow I got teleported to the 50s.

<comment><USER4> Wrong: if they do name names nothing changes. And I am suggesting that your first thought after being the victim of any crime should not be to broadcast it publicly on your blog. Blogs change things for the worse in a lot of cases and this is one of them. How can you expect an impartial trial when the victim has already laid out the entire crime publicly? This is why some civilized countries have insane legal controls on broadcasting a trial in progress.

Seriously I am not going to fight this battle again only in the end to be accused of being a woman-hater.

<comment><USER43> > be accused of being a woman-hater

This only seems fair, as your opening salvo began with accusing anyone who disagrees with you a man-hater.

I seriously doubt that a blog post was the "first thought" in any of the many prominent incidents of this nature. It's a very serious, very personal topic, after all; and I've seen no evidence whatsoever that putting it up on the internet for all to see was a 'first thought'.

What you really mean in your suggestion is that these women should _never_ make a blog post.

One compelling reason for publicity is that these problems go beyond individual occurrences and permeate the startup/IT culture. No number of quiet police reports or settled lawsuits will bring about changes to that culture, but a glaring spotlight may have an effect.

<comment><USER44> It doesn't seem fair. We are intelligent entities who can isolate the different points he makes and decide for ourselves whether they make sense or not.

 _these problems go beyond individual occurrences and permeate the startup/IT culture_

Can you provide some dependable data to support this? My experience is that most IT people are terrified of being considered sexist and would go out of their way to be fair and just to women.

In fact, my experience is that women get much better treatment in IT than men any day. The few cases where this does not happen are exceptions, not the rule, and this shows the anti-male perspective of people like you, who carelessly accuse the entire IT culture of being sexist when the truth is that our culture couldn't be farther from that.

<comment><USER4> What I walk away from discussions like this with is:

 _Everybody in IT is like this so my behavior is justifiable._

That's the only explanation that makes sense for the sweeping generalizations of men in computing.

</comment></comment></comment></comment></comment></comment><comment><USER45> If you want improvement in this area get your daughter to date a nerd in high school.

Men who go into technical fields suffer serious scars from social rejection that's every bit as painful as apartheid. Considering that techie men spend their sensitive formative years being completely shut out and excluded from the company of women, a woman is pretty presumptuous to think she will be treated fairly by technically oriented men.

<comment><USER19> As a coder and geek I find it horrible that I'm not expected to treat women like an equal simply because I might have been "excluded from the company of women". The idea that techies somehow are entitled to women is sad and pitiful.

<comment><USER9> Maybe it was not a feeling of entitlement but rather a problem with dealing with rejection that caused the problem - like a nerd could hurt and hence find it unbearable to be around the desired woman. That would take some practice.

<comment><USER19> But that's very different from the situation which Tammy Camp found herself in, i.e. requested to have sex or leave the conferences. Being socially inept is one thing, being a discriminating douchebag quite another.

<comment><USER9> Honestly, I don't think we really know that. We only know Tammy's interpretation. I think there must be some background story at least? Or do conference organizer just go through the photos attached to applications and say "hey, she's hot, let's blackmail her for sex"?</comment></comment></comment></comment></comment>


Finally Confirmed Vitamin D Nearly Abolishes ICU Risk in Covid-19 - <AUTHOR> https://chrismasterjohnphd.com/covid-19/finally-confirmed-vitamin-d-nearly-abolishes-icu-risk-in-covid-19 <comment><USER2> Can we please change this to the actual study rather than this somewhat suspect-looking personal blog of a guy who is trying to sell books about vitamins and supplements?

[https://www.sciencedirect.com/science/article/pii/S096007602...](https://www.sciencedirect.com/science/article/pii/S0960076020302764?via%3Dihub)

The difference they report there between patients receiving calcifediol (Vitamin D) and those that do not is strikingly large, to the point where it makes me somewhat suspicious:

> Of 50 patients treated with calcifediol, one required admission to the ICU > (2%), while of 26 untreated patients, 13 required admission (50%)

If that is true and replicates in larger sample sizes this would be an incredible powerful drug, wouldn't it?

<comment><USER3> And it would tell us heaps about how serious vitamin D deficiency (and likely other deficiencies) can really be. If, for example, reports of large amounts of African Americans being vitamin D deficient are true and vitamin D plays a significant role in many pathologies, safely getting those people to the right level without inducing vitaminosis could possibly lead to improvements in health issues that occur with higher incidence in African Americans (asthma comes to mind). It would have huge benefits to individuals and by extension healthcare systems.

For everyone reading this, please make sure to get blood work done before supplementing more than 1000 or 2000 IU per day.

Taking vitamin D in its complete and ready form sidesteps the bodies regulation mechanism because that happens _before_ the body produces vitamin D from components after sun exposure. Taking it orally basically skips that regulation and therefore you CAN overdose with potentially severe health consequences.

<comment><USER4> >For everyone reading this, please make sure to get blood work done before supplementing more than 1000 or 2000 IU per day.

rewritten for to be more actionable:

For everyone reading this, make sure to take 1000 or 2000 IU per day since you may be deficient ([https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6259547/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6259547/)). You should, if possible, get a blood test to see if you are severely deficient and if so to take higher doses according to your doctor's recommendation.

<comment><USER5> I'm deficient even AFTER taking 5000 iu's. I added a multi w/ 7500, figure I'll maybe add some more if I get covid. I had gastric sleeve though, so I have some absorption issues.

</comment></comment></comment></comment><comment><USER6> I'm very uncomfortable with the assertive tone of this post. It's probably the right move to push for vitamin supplements, but we really should be careful with asserting the benefits with basically 100% confidence like he does, to the point of guaranteeing causal connection and claiming that further studies will only illuminate few more details in the picture. It's almost irresponsible, specially in the context of an ongoing pandemic.

And I've read that vitamin D has been touted and later dismissed as the solution so many times...

<comment><USER4> FUD - Fear, uncertainty and doubt - many/most people are vit-D deficient ([https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4581139/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC4581139/)) and mild doses (1000-2000 IU/day) are not typically dangerous (less so than being deficient)

</comment></comment><comment><USER7> I wonder how much a connection there is between levels of vitamin D production from exposure to the sun depending on how much melanin your skin has (and also how much exposure you give your skin), and higher rates of ICU admission and death among people with black and brown skin?

How much of the higher rates are caused by physical health issues due to genetics, rather than social policy issues as has been said in the media (at least the media that I watch)?

Since March I've been taking 5000 IU of vitamin D every day regardless of my skin colour.

This seems like major news and if I were in the health system or in a position of power I would personally not be waiting for larger trials before rolling out vitamin D right now. This is because I don't want people to die. (Do our politicians have the same goal?) Vitamin D is already known to be safe if not taken at too high a dose.

Sometimes solutions to health problems are simple, and it's beautiful.

<comment><USER8> 5000 IUs is definitely high enough that it can be poisonous. Don't do that unless you get regular serum level checks as well.

<comment><USER7> OK maybe I'll dial it down slightly. Every second day or 2 every 3 days. Cheers.

<comment><USER9> Its better to take vitamins (that you lack) everyday in small doses. Rather than a lot every few days.

The overflow of your body stores goes straight out of your body. That's why vitamin D hypervitaminosis is causing kidney stones.

</comment></comment></comment></comment><comment><USER10> Only 76 patients and only 25 in the control group? Are sample sizes that small normal for this sort of experiment? I understand putting more people in the treatment group if you believe it'll help, but that seems like such a small test group...

<comment><USER11> I understand this is small, but the study was fully random and double blind, done at a single hospital. And it is consistent with other studies related to vitamin D and Covid.

<comment><USER12> It was not blinded. It was open-label and the outcomes were subjective (ICU admission). The doctors involved with the trial knew who got what and may have biased their actions based on that. Given the subjective outcome and small number of participants, this is particularly important. The trial would be slightly underpowered even if it were blinded.

Other studies on Vitamin D are retrospective cohort / observational studies which are heavily biased with possible confounders with respect to Vitamin D.

My personal opinion is that Vitamin D may help in COVID-19 but this trial does not 'confirm' that. Someone should run a similar trial with more participants and/or a fully blinded trial / a trial with more outcomes (biomarkers, etc).

<comment><USER13> While it's important to acknowledge the limitations of the pilot RCT, I think calling the outcomes as "subjective" goes too far - besides ICU admission, patients were tracked until discharge or death - a pretty hard outcome, to say the least.

The ICU admission procedure is also discussed: "The patients were admitted to the ICU by applying the rigorous protocol of the Reina J Sofia University Hospital (see supplementary material). Several fundamental aspects were considered when evaluating admission to the ICU: Presence of comorbidities, either individually or quantified in the modified age Charlson Comorbidity Index; Barthel's Index for functional assessment. It establishes the level of dependence of a patient according to his or her needs and clinical criteria: CURB-65 and SOFA scale and ATS/IDSA criteria [27]. A multidisciplinary Selection Committee was created, made up of intensivists,pulmonologists, internists and members of the ethics committee who decided on admission to the ICU."

WRT to bias, the description of the study is a bit confusing to me as it is described as "open label" (treatment known to the doctors and the patients) but also "double masked" which should hide the appearance of the treatment to the patient, investigator, or medical personnel.

The study describes the masking as: "The list generated was accessible randomization only to nonmasked specialists in the study in an attempt to minimize observation bias. The patients' data were recorded in the hospital's electronic medical record, with blind access by the technical data collectors and the statistician who carried out the study."

This description still leaves me confused, so hopefully that can get clarified (since treatment was oral, should be simple to mask w/ placebo), but in any case, the results are strong enough (and in concordance not only with the prior suggestive retrospective studies on Vitamin D and COVID, but also many mechanistic and RCT studies on Vitamin D's effects on respiratory illnesses and immune function) that hopefully a more rigorous, larger scale followup is being done somewhere. (Some other things about the study that I noticed is that patients didn't have Vitamin D status collected on intake, and as mentioned in the paper, obesity, BMI, and other metabolic markers weren't measured either.)

</comment></comment></comment></comment><comment><USER14> > 106,400 IU vitamin D

This is quite a lot of vitamin D?

> I think the best way to take action on these findings is to maintain 25(OH)D > in 30-40 ng/mL.

Also what does this mean in layman's terms?

<comment><USER15> 30 min in midday sun can produce 10.000-20.000 IU. It's big but not outlandish. One time mega-dose safety is established at 10.000 IU/kg for infants and toddlers [1]

[1] [https://pubmed.ncbi.nlm.nih.gov/19506025/](https://pubmed.ncbi.nlm.nih.gov/19506025/)

<comment><USER3> The body regulates vitamin D production from sunlight exposure. It cannot regulate orally taken vitamin D because by the time you absorb the supplemented vitamin D you have surpassed the regulation step.

You cannot get too much vitamin D from sunlight but you sure as hell can overdose by taking it orally.

<comment><USER15> I should have probably been more precise but that is what I tried to say: one time mega doses are safe and your body is able to produce big quantities even through short sun exposure. That doesn't take from the fact that you shouldn't take those mega-doses multiple times in short course.

</comment></comment></comment></comment><comment><USER16> Topic-adjacent: Some time ago there was an article posted, but I can't find it anywhere. It was about why does vitamin D seem to correlate with a lot of health issues / recoveries. Does anyone know what was the main idea, or what other keywords I could look for?

(It was serious content, not one of the "vitamin D cures everything including cancer" people)

<comment><USER17> Could be [https://www.devaboone.com/post/vitamin-d-part-1-back-to- basi...](https://www.devaboone.com/post/vitamin-d-part-1-back-to-basics)

<comment><USER16> Not the article I was thinking about, but it has the same ideas. Thank you very much.

</comment></comment></comment><comment><USER18> Let's say we take the benefits of D supplementation at face value. How do you get a hold of some that you can be confident is actually what it says it is and well-formulated for bioavailability, given reports that it's common for what's sold in stores to be dodgy?

[https://well.blogs.nytimes.com/2015/02/03/new-york- attorney-...](https://well.blogs.nytimes.com/2015/02/03/new-york-attorney- general-targets-supplements-at-major-retailers/)

<comment><USER19> Sit in the sun for 20 minutes a day. Of course that comes with it's own risks.

</comment></comment><comment><USER20> How far does this go in explaining the huge variance in seriousness? I'm thinking things like:

1\. The age correlation might be partly down to indoor vs outdoor activities

2\. The drop in ICU admissions over time might correlate to improved weather.

3\. Geographical differences might correlate with climate and lifestyle?

4\. Ethnic and gender differences could be partly behavioural/dietry?

<comment><USER21> Age correlation is primarily linked to expression of coronavirus binding sites (ACE2), which are more prevalent in older people and people with lung damage. ACE2 expression is also affected by genetics and lifestyle factors

Reference: Individual variation of the SARS‐CoV‐2 receptor ACE2 gene expression and regulation [https://onlinelibrary.wiley.com/doi/full/10.1111/acel.13168](https://onlinelibrary.wiley.com/doi/full/10.1111/acel.13168)</comment></comment>


Ask HN: Affordable and reliable hosting for static pages - <AUTHOR> I am planning to get a hosting service for a client. we are not using any kind of server side programming and the server will just serve a couple of static html, pdf and flash files. What is the most affordable (while reliable) hosting that we can get? <comment><USER2> <https://www.nearlyfreespeech.net/>

Excellent Pay as you go hosting with specific plans for static only content.

<comment><USER3> I second that. With no traffic, 10$ lasted me 4 years. They have decreasing cost per GB of bandwidth too.

<comment><USER4> NFSN is very good for me too.

</comment></comment></comment><comment><USER5> You can host a Sinatra app on Heroku for free. Here's the complete app:

      require 'rubygems'
      require 'sinatra'

      get '/' do
        File.read(File.join('public', 'index.html'))
      end

Just put all of the files in /public and you're good to go.

<comment><USER6> If you're just going to host static files, just host them directly through Rack as described here: [http://mwhuss.com/2009/12/13/static-sites-on-heroku- in-two-l...](http://mwhuss.com/2009/12/13/static-sites-on-heroku-in-two-lines)

Also, make sure you are using http caching - that way Heroku will use Varnish to cache them.

</comment></comment><comment><USER7> I ran BCC off of GoDaddy's $4 a month Linux hosting for nearly 2 years and only had a problem once.

</comment><comment><USER8> s3 / cloudfront

<comment><USER9> This is what I'd suggest too, with the proviso that the most likely "single point of failure" moves from being some technical decision you make to being the credit card it's paid for with. At ~3c or 7c/month it becomes easy to forget you need to update the expiry date every 3 years...

<comment><USER10> The credit card I used for a development account expired in January, and Amazon sent me email reminders. They also continued to charge the (expired) card.

This suggests to me that card expiry is not a likely failure mode.

<comment><USER9> No no, that's _exactly_ the failure mode to keep an eye out for.

I've seen AWS not actually bill me, and just send email accounts, for months and months. It's not worth their time billing a few cents or even a few dollars a month, so by the time an account "goes wrong" it can have been half a year or more since your card got re-issued, and you've forgotten you need to update Amazon for anything.

(it's much less of an issue if you're piggybacking your AWS stuff on a regularly used Amazon account/creditcard, but if you set this up as a one-off for a tiny S3/CloudFront "web hosting" setup, it could easily bite you on the ass in a few years time...)

</comment></comment></comment></comment><comment><USER11> I'd definitely recommend dreamhost, very reasonable, great one click installers for things like wordpress. also they support rails/django. Something like $8/month.

</comment><comment><USER12> If you want to have the option of doing dynamic stuff later, you should try Akshell (<http://www.akshell.com>). It's really good for static sites too though, since the newly added Git support allows you to deploy with a git pull from a remote repo, giving you revision control and all the goodness that comes with it.

</comment><comment><USER13> AppEngine would probably be free and is reliable.

</comment><comment><USER14> Go with Google App Engine... you'll probably never break the free barrier.

</comment><comment><USER15> I've been using Dreamhost for my static (and an initial version of my Django site) for a few months now. I've been happy with their uptime and support.

</comment><comment><USER16> Github Pages is a great choice for hosting static files IMO. However I'm not sure if you can host gh-pages on a private repository or not.

<comment><USER17> You can host them from a private repo.

</comment></comment><comment><USER18> <http://news.ycombinator.com/item?id=2142510>

</comment><comment><USER19> <http://pastehtml.com>

</comment><comment><USER20> I would try S3 as for now

</comment><comment><USER21> weebly

</comment><comment><USER22> dropbox?

<comment><USER23> ^ This. Use dropbox. You get 2Gig for free. It is available from the web and you get total control from anywhere.

You can even get a $5 domain to point at your dropbox web location.

<comment><USER24> Note that some corporate firewalls block dropbox for security reasons. This means your site is blocked too... Caught me out once!</comment></comment></comment>


CSS Death Star - <AUTHOR> http://codepen.io/calebnance/details/CxaBt <comment><USER2> IT'S A TRAP!

:) But seriously, very cool stuff.</comment>


Due to GDPR, you can't mail our support any more - <AUTHOR> I got the following from a hosting company today: "In order to tighten up security and streamline our support operations in preparation for the implementation of GDPR, we will be removing the ability to email in support requests. Email is not an infallible technology and there are instances where support requests have not reached our team."
Asking them to explain further they wrote back : "Email is not a secure medium and tickets often end up in the wrong account / place. Only by removing this can be ensure that requests are entirely submitted under the account in question and we can thus comply with removing all personal data."
I hadn't heard of a company doing this due to GDPR and it never occured it would be an issue for our own client support. Thoughts? <comment><USER2> "Email is not a secure medium and tickets often end up in the wrong account / place."

I'm assuming this means that their ticketing system is shared across all their functions (so facilities use the same ticket system as IT and so on), if I email a ticket in with 'my account number is 123, my name is mrpatch and my phone number is 0123456789' and it ends up in the facilities queue, or a queue that is available to facilities, then they are breaching GDPR as that is PII that is visible to people who are not authorised to view that information.

By removing the ability to email in a query the data that is entered into the ticketing system can be better managed (from the example above the telephone number can be entered into the correct 'telephone' field that facilities can't see).

Perhaps a bit of a sledgehammer to crack a nut from a company that's struggling to fit their existing systems around the new legislation.

</comment><comment><USER3> It's rubbish... they obv can't handle data correctly or securely.

If an email ticket ends up in the wrong account why would you trust them with your hosting business?

<comment><USER4> if you're emailing email@example.com and it ends up in a shared mailbox, then it isn't allocated to your account like it is when you're using the ticketing system.

when using a ticketing system a unique mailbox is created for the issue, only the agent that was allocated to the issue has access to data.

<comment><USER3> A ticketing system can collect messages from a mailbox, I don't see what the problem is... support@ should be for support = simple as that. It shouldn't be a shared mailbox that the whole company can access - that is my point.

I've several contract with many different suppliers, hosted ticking systems myself and never had this issue (And yes - dealing with the dreaded GDPR myself now too).</comment></comment></comment>