Ask HN: Leaving cushy job for startup (hire #1). Feed me your wisdom elder ones! - <AUTHOR> As it turns out, comfort bores me, a LOT. After trying the whole office job career thingy, I've decided it's either jump out the window or start taking risks again! (And promptly settled on the latter (I'm only on the third floor so it would only kind-of-hurt).)
However, I need a quick education on startup culture, jargon, inspiration, and how to avoid stupid mistakes. I know next to nothing about funding, dilution, employee compensation, etc. etc.
I want to be smart about this and make good decisions. What makes your personal list of the best no bullshit books / talks one should read before embarking on ye ol' startup journey?
I have asked for a reasonable salary (same as current) + equity. The company model looks like it will either get huge (already growing + actually makes money), or crash and burn like a glorious zeppelin due to regulatory issues. I find this very exciting as it's truly disruptive(TM) in a space that needs it.
If it does fail, I want to use this as a stepping stone / learning experience for a next venture. I do not, EVER, want to go back to boring 9-5 punch in and out life. After two years at a stable big-corp job, I've decided that it is my personal version of hell on earth (and I've been through cancer! which could come back any day! -- life really is short... and I don't plan to spend any more of it in meetings with middle management or building something that I don't own a part of just to make someone else rich... you know it's bad when hospital days feel like a welcome relief from daily routine). -- I also get bored of programming unless I feel I'm building something that matters or is challenging. I don't care about being a Professional Software Engineer, I just wanna build cool risky shit and play mad scientist with smart people.
Okay, now it's your turn to tell me what to shove into my brain before embarking on this journey (preferably in book or video talk form). <comment><USER2> 9-5 is shorter than 9-9, remember that.

Startups have a reputation of running developers into the ground. Corporate work, while boring at times, can be great if you want a work-life balance.

If you're going to be one of the first few hires, expect things to change as the startup fails to gain traction and the money runs out. Even if it successful, you'll probably find yourself in a management role as more people are brought in and you're the expert on the business domain (as well as the landing pages, marketing emails, CRUD apps, account details, etc.).

In some ways, a solid corporate gig can be more honest. IME you get hired for a role and you do that type of work. Maybe you haven't found the right cushy corporate gig?

<comment><AUTHOR> Hi, thanks I'm taking that into account. For me overwork is relative... I can burn out in 4 hours doing something I find boring or don't care about, then spend a weekend without sleep working on something a lot more challenging but interesting.

I would be okay with my role changing over time. Code is just another tool for turning ideas into things. I'm probably naive about some things, but one thing I'm sure of: routine is poison, comfort is overrated.

<comment><USER3> I am not in a startup, so take this with a grain of salt. I have a number of people I talk to who have been in startups though, and a common refrain is that when you sign on very early you wear many hats - some fun, some not. Don't expect all your time to be coding, just like when you have a child you shouldn't expect all your time with that child to be play time.

I say this because if you burn out in 4 hours doing something you find boring then you might not be able to deal with everything needed. However another common refrain is that every startup is different, so you have to decide for yourself based on your read of the startup.

One last bit of caution. If you push yourself to the wall all the time then you might not have the energy you need when the time comes where the business really needs that push. From what I've been told, and from personal experience on a number of fast paced projects, it's better to pump out a consistent 40-60 hours a week with an occasional push to 80, than it is to do 80 every week until you crash.

</comment></comment></comment><comment><USER4> Lots of other good info has already been posted so the one thing I'll mention is that eventually people get sick of the "mad scientist" (I know as it has happened to me).

It's great to try new things and live on the bleeding edge but at some point the people you work with are going to get tired of switching to the new hot thing. You can only re-do your architecture so many times before people start tuning you out or start to say "no", then what happens?

You'll go back to doing the same thing you were doing such as adding new features (using the already existing tech), fixing bugs, scaling out, etc. That or you'll find a new place to work which, depending on how long you lasted, means you might lose that equity you were given.

Honestly, if you want to play mad scientist and build cool shit you should be a contractor and build solutions for companies that come to you with problems. You get to build it, hand it over and then move on to the next new thing.

</comment><comment><USER5> \- There is a 90% chance the company will fail and you will end up working harder than you ever have for less money and with a less marketable resume. Even though you say that being a "professional software engineer" doesn't matter to you, you're more marketable coming from stable big-corp for product manager, data scientist, engineering manager, TPM, director of engineering etc. etc. roles than some guy from a startup nobody has heard of.

\- Even if this company is insanely successful, most likely you are going to make peanuts. I have worked at two startups as a relatively early employee, one acquired for XX M and another for XXX M. In both cases, the money I would have made/made was hardly life changing. There is a 99% chance that this is a bad economic decision.

\- Even if this company is insanely, insanely successful, the founders are going to be flying in private jets, and you'll have a down payment on a house in Palo Alto.

\- The only reason to join a startup as an early employee is the learning experience. You will learn more than you can imagine. You are going to work really really hard, and it is going to push you to your limit. You won't be the same person on the other side. It will have some incredible highs and some incredible lows.

</comment><comment><USER6> Often people behave differently when things are going well, than when things start to fail. For example, when the runway (amount of time left before the available funding dries up and the company goes of business) starts to get on the short-side, the stress level is likely to increase.

People don't always have a realistic view of what they are heading into (and this includes ourselves).

As with most anything worthwhile, the inspiring challenge for today will likely have some periods of the "daily grind". Be realistic with yourself - are you willing to stick through some of these times, or are you likely to jump ship at the first sign of difficulty? There is a balance to strike between perseverance and knowing when it is time to leave. This can be tricky.

Edit: fix punctuation

</comment><comment><USER7> > I have asked for a reasonable salary (same as current) + equity.

Consider that the equity represents an ownership stake in the company, you are now a junior partner responsible for its success. No longer a flunky employee. This should impact your thinking and outlook on everything.

You will find Jay Abraham's 'Getting Everything You Can Out of All You've Got' excellent food-for-thought > [http://www.goodreads.com/book/show/89969.Getting_Everything_...](http://www.goodreads.com/book/show/89969.Getting_Everything_You_Can_Out_of_All_You_ve_Got)

</comment><comment><USER8> Honest wisdom: odds say it will end in tears, so have fun and... good luck!

</comment><comment><USER9> "I also get bored of programming unless I feel I'm building something that matters or is challenging"

Keep an interesting idea of your own as a side project to do at home at nights and weekends. The startup is somebody else's idea. It may or may not be challenging to you, and it may or may not interest you after a while.

</comment><comment><USER10> We're in the same boat, I always got envious of the people doing the mad cool stuff and playing mad scientist -- that's what makes the tech blogs, but missed the fact that $MAD_COOL_THING was only a fraction of what they did and that all jobs come with a lot of cruft. Big corps come with more overhead and bureaucracy, and small corps/startups require you wear a lot of hats, some of which you will abhor but need to -- like setting up email marketing/configuring web servers / debugging that support app someone wrote as a one off a year ago that's feeding the CEOs spreadsheets mysteriously and no one knows how. etc. You will dislike some of what you do and it won't be playing mad scientist all the time.

That said, here's a couple things I've learned the hard way to pay attention to when joining a small corp / startup:

1) Ask bout funding. Seriously. How much do they have, what's the burn rate, when do they expect to be self-sustaining (running on sales/revenue rather than seed/VC $$), how profitable are they now, is their capital tied to any contingencies (i.e. they may have "access" to $X dollars to fund the startup but only if they achieve sales figures $Y-Z w/i a certain time frame, I got burned bad by not knowing this). Know the funding situation and be cognizant of what you're getting into.

2) Keep your work/life balance. It's very easy for small companies and startups to eat your life and you're spending all your good hours in the office putting out someone else's fire without any additional compensation / comp time / what have you. It's just expected of you and it's easy to slide into that role. Be vigilant about protecting your free time outside of work and setting boundaries to recharge and refresh yourself. Go to meet ups, go for a run, meet new people, whatever you do. Explicitly carve out time for that and defend it zealously against creep. There will always be more work, another fire, and another do or die moment, without fail. There won't be a redo on life. Live yours.

3) They (leadership) may not be loyal to you. Companies, especially startups, expect fanatical devotion to the product, company, and their vision but they won't be loyal or necessarily upfront with you about how the company is doing. You can get a sense of some of these things based on what crosses your desk, but don't expect die hard loyalty or a commitment to treat staff right. Understand petty politics / business concerns will impact you, especially if there are personality conflicts. Get a sense of who you'll be working with and your rapport and decide if you're comfortable with them. Yes, this is cynical to a certain degree, but I've seen it play out repeatedly to the point of carefully screening coworkers and direct managers to the best of my ability before deciding to join. Life is too short to work with/for people you can't stand (and vice versa).

Edited to fix wording.</comment>


China's Government Must Now Approve Every Mobile Game - <AUTHOR> http://kotaku.com/chinas-government-must-now-approve-every-mobile-game-1782966997 <comment><USER2> Not sure how one can be against this censorship but support the Apple walled garden.

I remember Apple censored all Bitcoin wallets for years while they brought Apple Pay to market.

<comment><USER3> I don't support the Apple walled garden, and wouldn't own an iOS device, but still, there's a difference between voluntarily choosing a walled garden and having it imposed by the government on all platforms.

</comment></comment><comment><USER4> Makes me wonder... How did this country become such a global supplier?

<comment><USER5> Objectively, you don't know this decision is bad yet.

<comment><USER6> Where any decision stands on a range between good and bad is a subjective judgement.

<comment><USER5> There's that too. I can rephrase it as we don't know if these measures will have positive or negative short term repercussions for China.

<comment><USER7> What could the positive effects be of not being free to buy "South Park: The Stick of Truth" in Australia? I think South Park itself is one positive effect of not inhibiting free speech just because it offends.

[https://en.wikipedia.org/wiki/List_of_banned_video_games_in_...](https://en.wikipedia.org/wiki/List_of_banned_video_games_in_Australia)

<comment><USER5> Generally these things only exhibit negative effects in the long term.

If it exhibits short term negative effects, it'd be obvious what to do.

<comment><USER7> The AU governments' censorship of video games spans _decades_ and no clear upside has emerged yet!

In addition to video games we also censor television, books, porn, the internet and music. Slippery, slippery slope... it's now illegal for doctors to talk about the facilities and treatment they observe working with attempted-illegal immigrants detained indefinitely by the AU government.

[https://en.wikipedia.org/wiki/Censorship_in_Australia](https://en.wikipedia.org/wiki/Censorship_in_Australia)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Good luck with innovating.

<comment><USER9> Innovation doesn't happen too much in China, their patent/copyright laws are so weak as to strangle anyone that would attempt to do so.

<comment><USER3> What are your thoughts on bunnie's posts on gongkai, including the documentary he made with Wired?

[https://www.bunniestudios.com/blog/?cat=20](https://www.bunniestudios.com/blog/?cat=20)

</comment></comment></comment><comment><USER10> That's beyond fucked up.

<comment><USER11> This is what happens when the government protects its people from themselves</comment></comment>


The Lost Art of Typing Shit by Hand - <AUTHOR> https://daveceddia.com/the-lost-art-of-typing-shit-by-hand/ <comment><USER3> Even if you're not literally typing things by hand, having an attitude of "I won't use this code until I understand what each keyword is actually doing" is very useful. As the article says - learn what each word in "public static void main( String[] args )" actually means.

This is the primary reason why old-style Visual Studio Windows programming really freaked me out: you start with a massive template, full of complex- looking code, and you're expected to just ignore it and write your own code in the little marked-out areas. I really like the new approach in C# using partial classes: all you have in your source file is your own code, and it's really easy to see how that maps to the UI that you're building. The rest is under the surface and can be treated as library code.

<comment><USER4> Someone close to me has been learning to program (self-taught), and this is what I've tried to impress the most, the path to being an intermediate level programmer definitely cuts right through understanding as much as is reasonable about the effects the text you type have.

I think it's also hard for this advice to help certain beginners if they don't know where to stop when they start going for knowledge about what's happening... It's so easy to start looking up keywords and all of a sudden end up being bombarded with terms you understand even less.

<comment><USER5> If they don't know where to stop, then how they can learn where to stop? The only way, I think, is making errors. It's nothing bad in taking a glimpse of something too difficult to understand. Even failed attempts to understand something too difficult is not bad. The only risk is the loss of motivation because of failure.

<comment><USER4> So generally I would say that they learn where to stop (or never see the depths of the endless pit that is knowledge in the first place) with the help of a good teacher or textbook.

A textbook that tells you just what you need to know, and just enough of what's happening under the covers to let you think you understand, and solidify what you're learning

</comment></comment></comment></comment><comment><USER6> Right now, somewhere on the web, someone is writing a blog post about how we should not type things out by hand, why it is a waste of time, how the nature of programming is changing, how the calculator meant that we no longer had to do long division and other contrary points.

<comment><USER7> Wouldn't that person just use a markov chain to generate the article instead of wasting their time writing every point out by hand ;)

<comment><USER6> That person might be using the markov chain to go to market fish that answer this question now for all you people out there who know.

</comment></comment></comment><comment><USER8> "How To Start Typing in a World With Ctrl-C"

Been a few years since a Windows machine was my daily driver, so I thought, "What does breaking command execution have to do with anything?"

<comment><USER9> Ctrl-C is how you exit insert mode when you're typing something in, obviously. :-)

</comment></comment><comment><USER10> I'm a big fan of typing new code. My most recent example was while learning Webpack. You could pick from oodles of pre-existing configuration, but it's meaningless if you just copy and paste it in to your editor.

I normally type something out and then if I can't come up with a moderately reasonable assumption about what it does, then I'll pull up the docs and read about it.

<comment><USER11> I find that typing things out by hand organizes my brain to focusing on one thing at a time. If I read over a code snippet, I tend to sort of gloss over it; typing it out slows down the thought process a bit so that I can focus on some of the nuance.

<comment><USER12> Watching presenters type code has the same effect.

</comment></comment></comment><comment><USER13> When I was 10, I literally taught myself to program by typing out open source projects by hand, looking up the functions I didn't understand as I went.

I truly believe this is one of the best ways to learn.

</comment><comment><USER14> I don't remember which one, but one of the plethora of "teach yourself to code!" guides floating around the web has all of their code snippets as images, so every time you used one of their example programs, you had to type it in by hand. It was horribly annoying (so I stopped,) but it was a deliberate choice to try and force understanding.

<comment><USER15> Yeah that seems to go a little too far. There are valid reasons for wanting to copy-paste code, even if it should be typed out most of the time.

</comment></comment><comment><USER16> Before keyboards everyone taking CPS at my university (1978) were taught to write out code in yellow lined paper.

We handed in our code to the (female) adjunct for review. Run time was expensive. Then we made our deck of run cards.

I used this "write it out by hand first " method during my entire tech career.

For me, writing it out was a really good way to learn (next to actually teaching others)

</comment><comment><USER17> Up next week: "The Lost Art Of Rote Memorization".

You see, when I was studying for an amateur radio license, I had a realization. Memorizing page after page of meaningless numbers and acronyms could actually instill a sense of curiousity about what those numbers and acronyms meant. What is a sideband and why does it single? Who is a Hertz? Why would I want to limit third-order distortion to below 0.1% of the principal frequency? You see, nobody had ever told me that it might be good to be curious about the thing I'm doing!

Sorry, this is meaningless drivel. Yes, you should know what the keywords do in a function declaration, but once you are aware of what 'static' means then typing it yet one more time does not help you whatsoever in the least. Yes, you should know know what various delimeters do in your language, but if you're not sure just go look it up, it doesn't make sense to fight it.

The reality is that there are all kinds of things that are best left in reference material. I have the Regular Expression Cheatsheet pinned right next to my desk; I could easily write a regex without it but by having a reference right there I conserve that mental bandwidth for tasks that matter. Pop quiz: which is the code for a word character, \w or \W? Is that something you want to be thinking about while you're also trying to juggle business logic for three other classes?

The same thing applies to all kinds of other things. We have documentation for a reason, memorizing the order of function arguments for a function I only use once a year is a waste of brain space. Some functions have all kinds of quirky behavior that you really need to double-check unless you use it daily - <USER2> example, anything in the C stdlib. It's not worth introducing bugs for the sake of avoiding using your IDE.

It's true that for skilled programmers, most of what we do is thinking about how to solve the problem rather than mechanically typing it in. _But that 's no reason to make the act of typing it in needlessly difficult_. Programmers have been using intelligent assist systems for as long as we have had interactive computer systems, dating right back to vi/emacs macros.

These are a good thing: after I've encapsulated fields in getters/setters for my first five classes, the next thousand that I'm going to do over the course of the year buy me nothing, and I might as well let my IDE handle the mechanical act of declaring ten pairs of getters/setters for yet another class.

<comment><USER15> Perhaps I should've been clearer in the article, but it's aimed at people _learning_ to program. Absolutely, as a professional, use the tools available to be as efficient as possible. But as a newcomer, relying on tools (and copying jQuery snippets from StackOverflow) too early slows down the learning.

<comment><USER17> If you don't know what "static" means then sure, that's a good thing to learn because it's an important concept to understand how the code will behave. But a lot of programming stuff is either syntax or just convention/The Way It's Done.

Why is it static void main(argc, argv) in Java? Well, that's the way C did it. Why did C give main() function arguments, as opposed to (say) environment variables? Well, that's just the way it's done. Why is return 0 success and other values fail? Convention. Why are curly braces used to delimit code and parentheses used to delimit arguments? Because the spec authors said so.

Basically, I think most of what constitutes programming can be done without ever typing a line of code. It's the process of decomposing a large task into small, simple ones, in a way that can be processed efficiently. The rest is just notation.

Pedagogy is absolutely fine, but at the same time we all stand on the shoulders of giants. Nobody is writing their own TCP/IP stack, we all rely on "copied and pasted" code (encapsulated in a library) so that we can focus on business logic. Obviously if you don't know what you're doing you can easily cause a mess, but the physical act of typing is probably the least important part of programming. Conceptual understanding is what matters, and the random syntax and half dozen keyword modifiers you will learn by typing are not going to push you very far in conceptual understanding.

</comment></comment></comment><comment><USER18> I understand the controversy, In my experience, both statements; 'typing it does nothing' and 'typing it is everything' are accurate. Just for different people.

In a similar way, some people don't see music until they play it, some see it before it is played. I really don't know what it is that creates the difference.

For me, doing the typing (or writing in my notebook) really connects the knowledge somewhere in my head that is harder to erase/lose than just reading or seeing it. I discovered in college that I could look at a homework problem and solve it but later in an exam couldn't bring back all the finer points of solving it, _unless I had actually written down my solution._ Very strange but a good thing to know about oneself.

</comment><comment><USER19> This reminds me that I once made a stupid game where you type code scraped from random github repos. The goal is to predict the next character that will appear. The premise being that typing real code, and consciously trying to predict what will come next, forces you to quickly learn the syntax and style of a new programming language.

[http://houshalter.github.io/perplex/perplex.html](http://houshalter.github.io/perplex/perplex.html)

<comment><USER20> Wow that is a very clever idea! It seems like though that I would get green letters even though I had never made a guess. For example punctuation, e.g. newlines and whitespace and dots, would be green instead of red, even though I'd not typed any character at all. Awesome idea nonetheless!

<comment><USER19> Oh yes, that was a feature I added. If you don't make a guess, it automatically guesses the most likely next character. You can see in the table to the left what it's predictions are. Which is just the letters most likely to appear after the last letter seen.

<comment><USER20> Oh, okay, that makes sense, then. So it's almost like I've got a computer partner that's also "learning" the syntax with me? That's actually _really_ clever, because it helps me by demonstrating correct characters that I wouldn't have otherwise guessed. Very cool!

<comment><USER19> It was originally intended just to be a few hints to make it a bit easier. But I thought it made sense, that if you don't make any guess at all, it might as well guess the most likely character for you, and give you a few free points.

</comment></comment></comment></comment></comment><comment><USER21> This makes a lot of sense. I don't think cut/paste makes anything stick in the head (no pun on "paste"). Maybe this is how my old-fart mind works (I go back to the punched-card days) but I've found that my millennial students also learn more by typing. It's a bit like studying ... using a highlighter can be better than just reading, but to really grasp difficult material, it's important to write things down in your own words/equations.

<comment><USER22> It engages additional modes of learning: language based and kinesthetic. Plus it extends understanding.

</comment></comment><comment><USER23> I am programming for 30+ years and I am still doing this. As mentioned in the article it's a good way to memorize stuff, but it also acts as a checklist: As I re-type each line I make sure I understand what exactly it is doing and whether that's what I want it to do. It's a good way to reduce bug count IMO.

</comment><comment><USER24> I sort of agree with this. I got my start typing listings from Microhobby[1] into a ZX Spectrum... I was around 5, so I guess a big chunk of my early learning was by osmosis!

[1] [http://www.microhobby.org/](http://www.microhobby.org/)

</comment><comment><USER25> If he ever worked with a convoluted business and data layer with about seven layers of boilerplate code that needs to be written every time a new feature is added, I doubt he'd still be singing the tune that everything must be typed. Because typing all that is a chore, not a benefit.

But that being said, when learning something new I do tend to type it out myself to help reinforce things. Same reason I handwrote my notes in college.

But I'm not going to type everything all the time. I'll get carpal tunnel, and it'd take me a lot longer to get tasks done.

<comment><USER26> I think the suggestion to retype was specifically about learning things and not about boilerplate you already understand or don't need to.

<comment><USER27> At the same time, why do we tolerate excessive boilerplate in our systems? Particularly in areas where it offers no measurable improvement in the output, and probably a reduction in quality due to the increased opportunity for error.

</comment></comment></comment><comment><AUTHOR> The Lost Art of Writing by Hand is a thing too. A sad one at that.

</comment><comment><USER28> I went through the Rust Mio guide this way, it really helped! Along with learning it better by typing it out, you can compile your code after each line and get better insight into why the code was written the way it was.

[https://github.com/carllerche/mio/blob/getting- started/doc/g...](https://github.com/carllerche/mio/blob/getting- started/doc/getting-started.md)

</comment><comment><USER20> Maybe I'm weird, but I still type things out even when I'm copying them from another place. Except, for example, string values or something in configuration data. But if it's just some code I'm learning, I type it all up. I mean, you're trying to learn it, right?

</comment><comment><USER29> Also, handwrite your lecture/conference talk notes. Writing by hand is even better for understanding than typing by hand.

</comment><comment><USER11> Wow, I thought I was the only one who still did this.

</comment><comment><USER30> > badassity

The word is most definitely "badassery"

<comment><USER15> Pretty sure you're right, but I like "badassity", it's got a nice ring to it. Plus MMM [0] agrees.

[0] [http://www.mrmoneymustache.com/](http://www.mrmoneymustache.com/)

</comment></comment><comment><USER31> How long would it take to type out the CSS from your favorite Bootstrap tutorial :-)

</comment><comment><USER32> Not interested in the vulgarity of the title.</comment>


Color difference between the OP an commenters - <AUTHOR>

I'm posting this unsure. I think I'm seeing a color difference between the OP username color and the commentators name color. Is this right?
If it is, please use a different one. Being colorblind, I'm having a hard time noticing the difference.
Better yet, let me configure it. <comment><USER2> It's the same color for me. People with new accounts have green color.</comment>


Ponder a thought from Alain de Botton (philosopher) - <AUTHOR>

Profit is the reward for correctly understanding an aspect of reality ahead of your peers. <comment><USER2> Like, the reality that if I stab someone the throat I am free to help myself to the contents of his pocket?

I'm not sure how useful that definition is. Plenty of people have correctly perceived reality far ahead of their peers and as a result reaped nothing but persecution.</comment>


Voting in Organizations, Clubs, Meetings, and Families - <AUTHOR> http://democracychronicles.com/voting-in-organizations-clubs-meetings-and-families/

<comment><AUTHOR> This is a pretty general purpose article, but I've found it really useful deciding things at work, too. In particular, it is really useful getting a good answer for the question "Hey, team, we've got 30 things we could work on. What's the most important?".

<comment><USER2> erh! I just had a flashback to a well know uk coop I was a member of we sent an entire after noon disusing which STV method to use :-)

Citrine or Roberts are much better in practice for taking democratic decisions.</comment></comment>


Show HN: ScreenCube – App Mockup Toolkit - <AUTHOR> https://screencube.co <comment><AUTHOR> Hello guys, I wanted to share my new project I've been working on for the past few months. The goal for ScreenCube is to make it fast and easy to create app and product mockups for marketers, developers and designers.

The main differentiator from similar type products is that ScreenCube displays the devices in 3D which allows a deeper level of customisation and flexibility when creating images.</comment>


Parachuting Beavers into Idaho's Wilderness? Yes, It Really Happened (2015) - <AUTHOR> http://www.boisestatepublicradio.org/post/parachuting-beavers-idahos-wilderness-yes-it-really-happened <comment><USER2> At least they had parachutes. Fish just get thrown off the plane - [https://www.huffingtonpost.com/2014/07/10/aerial-fish- stocki...](https://www.huffingtonpost.com/2014/07/10/aerial-fish-stocking- utah_n_5574768.html)

<comment><USER3> Pioneered in Maine btw! The fish seem to do just fine[0][1]. At the end of video I've linked you'll notice they'll dump them out after landing if possible.[2]

>Department biologists using scuba gear have had trout dropped around them and observed as the fish hit the water and swam away. The biologists report that most of the trout easily survive their aerial drop without injury or harm.[0]

>The Aviation Division also supports the bureau's resource management efforts through aerial fish stocking and various data collection efforts. Aerial stocking is the least stressful method of delivering live trout and salmon to _inaccessible or distant locations_ , Maine's Warden Pilots release more than 182,000 of them — over 28,000 lbs. — into 195+ lakes and ponds each year.[1]

[0][https://www.aopa.org/news-and-media/all- news/2006/may/01/tro...](https://www.aopa.org/news-and-media/all- news/2006/may/01/trout-raining-from-the-skies)

[1][https://www.maine.gov/ifw/warden-service/specialty- teams.htm...](https://www.maine.gov/ifw/warden-service/specialty- teams.html#aviation)

[2][https://www.youtube.com/watch?v=lYAwaf4CBj4](https://www.youtube.com/watch?v=lYAwaf4CBj4)

</comment></comment><comment><USER4> As god is my witness I thought beavers could fly.

<comment><USER5> We shall not forget the Cincinnati Turkey Tragedy...

</comment></comment><comment><USER6> I suspect the program wouldn't last long once they realized the beavers would "come back". Not the same ones, but new ones to the same place they removed them from.

Beavers move too wherever they can find a 'good' spot to build a dam and lodge. If your back yard is such a spot, beavers will move in. As the article says, the right solution is to find ways to live with them.

In my childhood home, the big pond behind our house (maybe 200ft across?) existed because of a big beaver dam. Generations of beavers maintained it. We'd lose a tree or two occasionally, but well worth the benefits.

<comment><USER7> Why beavers make dams is very interesting - they tend to instinctively build at the site of the sound (beavers are nearly blind) of running water. Canadian wildlife management has used this knowledge to trick beavers into not building dams where it would be inconvenient for highway management.

</comment></comment><comment><USER8> There's a nicely illustrated children's book written about this called __The Skydiving Beavers __:[https://sleepingbearpress.com/shop/show/11751](https://sleepingbearpress.com/shop/show/11751)

</comment><comment><USER9> Previous discussion: [https://news.ycombinator.com/item?id=10438240](https://news.ycombinator.com/item?id=10438240)

</comment><comment><USER10> A follow on article that includes a video of the drop can be found here - [http://www.boisestatepublicradio.org/post/remember- parachuti...](http://www.boisestatepublicradio.org/post/remember-parachuting- beavers-story-now-theres-video#stream/0)

</comment><comment><USER11> At least they didn't just think of killing them like here in Chile.

</comment><comment><USER12> Here in Boise, you can get some fun Beaver shirts.</comment>


We can no longer leave online security to the market - <AUTHOR> https://www.nytimes.com/2018/10/11/opinion/internet-hacking-cybersecurity-iot.html <comment><USER2> Government regulation? They can't keep themselves secure. There was just a post here a couple of days ago saying how vulnerable the DOD's systems are. How are they going to police others when they can't police themselves?

I work in the banking industry where security IS regulated (by the FDIC). We have government auditors come and review our technology once a year. These guys don't know what the hell they are doing. We have had blatant security problems (now addressed) that they couldn't see right in front of their nose. Community banks have terrible security. Larger ones are better, but still rife with problems.

I fail to see how government regulation and intervention has helped in my industry, or how it would help in any. If by regulations, you mean that we would get fined if some data got compromised, that already happens through negligence lawsuits. It is not an effective motivator though.

In my experience, the threat/worry of bad publicity is actually the best motivator in a company getting their security up to par.

<comment><USER3> I'm going to exploit this comment which is at the top of the thread and stands above another comment that argues against government regulation in software industry to tell you guys this: hopefully this industry will be regulated from top to bottom before too long. GDPR came, hopefully more will come, w.r.t. security, privacy, and even UX standards (e.g. all companies should be required to accomodate all sorts of disabled people, probably by allowing assistive tech in browser to work properly on their websites).

You guys will not and want not to fix the status quo where shitty software is pushed onto us. You guys will not stop implementing unethical, "agressive" software. So someone should be watching over you, entrepreneurs and devs, and that someone is the government.

Government regulation need not be perfect. But it needs be there. That means companies will be more incentivised to keep their shit together. Surely your bank would be doing worse if nobody was watching over. If more budget and worktime is devoted to such regulation, it will become better.

I understand that no regulation is a strong political position in the US, but I call bullshit on it. I wouldn't bother writing as I'm mostly at the user side of things these days but I wanted to write this given most of you are devs here. It is not about some silly social network or an irrelevant SaaS anymore. The world runs on this, software is as important as medicine and food to our livelihood, and the software industry needs to be regulated like medicine or food industries are. Something simple like Twitter and Facebook affects lives of the masses. You'll have to get your... act together.

<comment><USER4> Your argument is that banks don't have the will to fix security issues. The parent was arguing that security is hard and that the government is not particularly competent at it so is not in a position to define raised standards. You're not even having the same conversation.

<comment><USER5> > The parent was arguing that security is hard [...]

It isn't though, at least not compared to the state of things. Pretty much any government would be competent enough to mandate some sort of two-factor authentication that would greatly improve security and make a lot of phishing and hijacking a thing of the past. Of course different governments would have different success rates, if not in terms of security at least in terms of elegance. But that is like everything else. People die everyday by the lack of road safety and healthcare.

<comment><USER6> Oh yeah ... I see it now. Instead of the "do you accept cookies" in your face idiocies we now need to identify ourselves using 2 factor authentication on every website.

That sounds SO great.

Obviously there are no realistic security measures that are 100% effective. All this will amount to is further cementing the power of large internet companies. You know this, so why ask for it ?

<comment><USER5> "Do you accept cookies" is only relevant because there isn't a separate login mechanism in HTTP. Actually knowing whether you are sharing data with the website, and what website that is, would be a major improvement. Security measures don't have to be 100% effective. Just like road safety you should focus removing the impact of flaws, not to prevent flaws as such. A separate authentication mechanism would remove a large amount of security issues, including potentially phishing and password leaks entirely. These common security issues of compromising the system of the user or the company would simply not have the same impact anymore.

A not insignificant part of the large Internet companies power comes from that they are the only ones who can handle, or people trust to handle, security. It isn't that hard today to create your own e-mail system or smart phone. But managing those systems, especially for a reasonable cost at scale, is just beyond what most new entrants in the market can handle.

<comment><USER6> Government mandated authentication mechanism. This question is almost a joke: what could go wrong ?

Everything can go wrong.

> A not insignificant part of the large Internet companies power

So it's about breaking the power of large internet companies ? Figures. Can we please do that WITHOUT destroying the web ? The last regulation that tried to break the power of large internet companies was the GPDR, and that has significantly entrenched the position of the large internet companies instead, while creating a ridiculous amount of inconvenience for everybody. This ... will do the same.

People WANT to share that data. Or perhaps I should say, they want the things that happen when they do. Quick searches that get them the products they want, on Google, on Amazon, on clothing shops and on tons of small webshops. Even the obnoxious image ads. People want them.

That means that a login mechanism will just be an extra hurdle with zero of the effects you want.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I disagree with Bruce's assessment that government regulation is the best solution to this problem. As someone who has read a lot of government regulations regarding technology, I have often found existing regulations to be unsatisfactory when it comes to actually protecting consumers. (recommending old and broken encryption schemes, arbitrary/nonsensical password requirements, etc.) The speed at which the industry moves far outpaces the ability to regulate effectively.

I would much rather see software engineers follow the lead of electrical engineers and embrace non-profit (or even for profit) certification companies à la underwriters laboratories. It would be easier for consumers as the could just see a seal of approval and know they are getting a quality product. (Think LEED certification for buildings)

If anyone is interested in starting such and organization let me know as I do think it could do a lot of good in the world.

<comment><USER8> Having the government outline minimum penalties for data breaches would go a _long_ way toward fixing the problem. It's much easier to justify fixing a known issue or dedicating time to updating dependencies if you know there's a defined cost (per customer!) of failing to do so.

<comment><USER9> > Having the government outline minimum penalties for data breaches would go a > _long_ way toward fixing the problem.

Then companies start covering up data breaches because disclosing them would cost millions in fines, resulting in people not even knowing when they've been compromised.

You also have the problem where politicians/media have no idea what they're talking about, e.g. calling the Google+ issue a "data breach" when it was actually a vulnerability discovered internally with no evidence of anyone having ever used it. If that's the standard then every time there is a vulnerability in a major operating system or TLS library, no one will be safe from the litigious trolls.

<comment><USER10> > Then companies start covering up data breaches because disclosing them would > cost millions in fines, resulting in people not even knowing when they've > been compromised.

Couldn't you make this same argument about any law that punishes bad behavior? As an extreme example, if we make murder illegal, that incentivizes covering up the act, at the expense of closure for victims' families. It seems flawed to me.

<comment><USER9> It's a lot harder to cover up a murder than a data breach. People notice when a someone turns up dead or mysteriously disappears. If some criminals break into your servers, who has any way to know other than you and the criminals?

There is also the issue of intent. Murder is illegal when you intend to do it. Nobody intends to have a data breach. In that case sunlight is more important than punishment because it's in everyone's interest to prevent it happening again, which requires understanding how it happened, which requires cooperation. Putting otherwise-aligned people on opposite sides creates unnecessary conflict at odds with the common goal.

<comment><USER11> I'm not sure you could cover up a data breach _that_ easily. Those data dumps are going to be sold on the black market eventually, and I speculate that in many cases government agencies will be able to identify unannounced breaches.

Slap a 10x (or even 100x) fine on companies whose data breaches are discovered independently and covering stuff up won't look like such a good idea anymore.

<comment><USER9> > Those data dumps are going to be sold on the black market eventually, and I > speculate that in many cases government agencies will be able to identify > unannounced breaches.

Sure, but how do you prove it was covered up rather than merely discovered externally before it was discovered internally?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> As an alternative to government regulation, how about an approach like Underwriters' Laboratories?

Those guys got their start around 130 years ago with regulations about fire doors in factories. Now they have standards for all sorts of EGoT (Electric Grid of Things) devices, from lamps to toasters.

They get their teeth from the fire-insurance companies who back them. If you have non-UL junk in your office, an insurance risk-manager inspector will instruct you to change it. If you have that kind of junk in your apartment, heaven help you if you have a fire and make a claim.

Industrial shops have Factory Mutual filling the same role. One place I worked required Factory Mutual certification. Those guys are not fooling around; they improved our products.

If Walmart and Best Buy discontinued selling uncertified IoT products it would help the cause. Even MicroCenter and Fry's could help get the ball rolling. But they can't do that until a certification process is workable.

A UL or FM approach is more workable with USA attitudes toward government regulation. And workable is what we need.

<comment><USER13> Fires are incredibly expensive, which makes everyone buy fire insurance and incentivizes fire insurances to push fire safety on their customers.

In contrast, most data breaches are very cheap. In most industries the market doesn't seem to punish breaches at all, so there's only the unquantifyable cost of that data benefiting your competitors.

If there was a multi-million-dollar fine on data breaches regardless of fault and countermeasures, we would get exactly what you describe: the market working to reduce risk and average insurance payouts, making everyone's life better in the process.

</comment></comment><comment><USER14> Authentication is the real issue. We treat SSNs as a lifelong shared "secret" - shared with just about everyone. When so many need to have this "secret", trying to hide SSNs is futile.

Someone should be able to steal a database of my info and whatever the shared secret is should only be tied to that org, and of course not stored in plain text.

<comment><USER15> How will everyone keep their dozens or hundreds of shared secrets safe?

<comment><USER16> Password managers appear to be growing into this role. As secret questions become increasingly ineffective better answers are random and unique. It quickly reaches the point that human memory and paper can not accommodate.

EDIT: forgot 'not'

</comment></comment></comment><comment><USER17> From the tone of articles like these sometimes I feel like I must be the only person left in the world without an internet connected refrigerator or robot vacuum cleaner.

<comment> village-idiot You're not alone! I had to go with the monoprice Sous Vide cooker, since it was the only one that could be operated without a smart phone.

It was also cheaper, which is nice.

<comment><USER18> That was a good choice. There is a nasty worm going around that will turn your water up from 55 degrees Celsius to 56 for 15 minutes ruining any chance of perfect 48 hour short ribs. It hit a lot of Michelin star restaurants in Iran really hard back in 2010.

<comment> village-idiot I'm more interested in having my Sous Vide cooker continuing to work after the company goes under or Google buys them and cancels support.

</comment></comment></comment></comment><comment><USER19> I don't get the premise of this. On the one hand he's making the assertion that government regulation is needed because consumers won't pay for added security.

He then immediately goes on to say that in the past security breaches weren't life threatening but now they are because refrigerators and cars are connected to the network.

Okay so people won't pay more for security when it's not life threatening but this time the threats are different, but people still won't pay more. How does he know this if the threats are different this time?

Tbh though he lost me when he advocated for government regulation as the fail safe solution.

</comment><comment><USER20> One thing I've learned in ~25 years of working in what the NYT would now call "cybersecurity": Internet hacking is _always_ "about to get much worse".

<comment><USER21> I mean, are they wrong? It sure appears to have been getting progressively worse.

Granted, some chunk of that is from an expanding surface area vulnerable to attack, and an expanding amount of valuable data available for the taking.

<comment><USER20> They are wrong (so far), and it is not getting progressively worse. In the 1990s, it was realistic for an amateur hacker to aim at _owning up a whole backbone network_. You broke into computers by running "showmount -e" and looking to see which ones were exporting their root filesystems r/w to the entire Internet. In the early 2000s, worms targeting Win32 vulnerabilities were so effective there was almost legislation. _Nothing_ was sandboxed (except for, ironically, Java applets), and virtually every web application on the Internet was riddled with SQL injection. The first time I ever did a professional consulting application penetration test, I logged in as "admin" with 'OR''='.

It's a lot more _fun_ to be an attacker today (I mean, if you dig computer science), but I don't know a lot of people in this field who think it's gotten _less challenging_.

<comment><USER22> I think you can agree that _worse_ doesn't necessarily imply _harder_. More critical systems are online, software is more complex, more actors are in the mix, etc. Feels like semantics, anyway.

<comment><USER20> I don't agree at all that more critical systems are online. What I see instead is a greater recognition of the variety of critical systems that are and always have been exposed, leading in turn to _better_ security for those systems. And we're kidding ourselves if we think that the attackers we're facing today weren't active 10 years ago.

20 years ago, owning up someone's voice mail was a funny joke (teenagers were literally owning up switching systems.) Today, we're all carrying HSMs in our pockets. Things are better, not worse.

<comment><USER23> Owning someone's voice mail, or even a PC, is ultimately very low impact on societal scale. But what about the increasing amount of physical systems that are on-line - factories, powerplants, hospitals, cars, pacemakers (via phone), etc.? Is this not as big of a problem as it seems to be?

<comment><USER20> The point isn't that voicemail is super important; the point is that infrastructure wasn't even secure a decade and a half ago. The systems you're talking about were all exposed then too.

<comment><USER24> It's clear to me that this is nowhere near accurate and I'm not sure why you insist on making these sort of claims.

One only has to look at self-driving cars to disprove you.

Dan Geer also entirely disagrees with what you wrote [1] [2] and you're no Dan Geer, sorry to say..

[1] [http://geer.tinho.net/geer.indiana.19x17.txt](http://geer.tinho.net/geer.indiana.19x17.txt)

[2] [http://geer.tinho.net/geer.uncc.5x16.txt](http://geer.tinho.net/geer.uncc.5x16.txt)

<comment><USER20> Look, Dan Geer is fine, so I won't snark and say "that's one of the nicer things anyone has said about me on HN"†, but let's be clear: Dan Geer and I have a very different kind of day-to-day workload. We'd probably come to different conclusions about all sorts of things. I would also in a million zillion years never quote Nassim Taleb on anything. He's wrong here, as he has been in the past. We've all been wrong about things! I just happen to be right about this one thing.

† _Sure, I just did, but I 'm being upfront that it's a cheap and unfair thing to say. I'm human._

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> There are already a lot of safety regulatory agencies in the world. These government sponsored organisations managed to make food and other consumer products a lot safer.

These type of discussions often end up with mass control by the government versus free market will solve it by itself.

The sweet spot is somewhere in the middle, like many of these agencies have proven for decades.

</comment><comment><USER26> Here's a hard reality: The people who can fix the security problem are the ones who are already working on it. There's no magic dust or elite squad of cyber security professionals that are going to walk through the doors of a FAANG and turn things around. Security is hard, and security at global scale is still an unsolved problem that no one has the answer for. What I do know from working in the valley is that neither the government nor the media has the damndest idea of what they're talking about when it comes to technology, and they certainly wouldn't know how to secure Google let alone keep search running globally for a night.

<comment><USER27> Most people working on security don't have much power, and are reduced to tinkering with small incremental improvements that don't break anything.

case in point: If you look at the history of malware infactions in organisations, one vector historically stands out since the early 2000's: office/pdf attachments in emails. It's been obviously a catastrophic combination to feed untrusted, unauthenticated complex office formats to insecure productivity applications, but nothing was done about it despite weekly new public vulnerabilities and pwnage continuing over 20 years.

</comment></comment><comment><USER28> The market won't solve it. Regulations won't solve it. Why can't we just have meaningful legal frameworks where impacted parties can sue these negligent corporations?

</comment><comment><USER29> There's a YouTube talk from Uncle Bob where he foretells a future in which software kills some people and then regulations are put into place governing software development.

I think he was close in his vision. It will be Facebook and Google and millions of IOT devices that push us to that future.

Big companies won't be hurt, but your startup better be able to afford the certs or too bad.

[https://youtu.be/ecIWPzGEbFc](https://youtu.be/ecIWPzGEbFc)

</comment><comment><USER30> The #1 risk are nation states. They became a threat by means of convincing politicians of "cybercrime" being ordinary violence. Violence is something the state has a monopoly thus the idea is easy to sell. However, online security should be left to the market otherwise we'll only see more "violence". Vulnerabilities kept secret and online targets being compromised.

</comment><comment><USER31> If anything should be regulated it's ethical hacking and security research. Having a bug bounty program that is accountable to some government agency should be mandatory for every single enterprise that does some form of development and the prizes/awards should be some function of the revenue and the severity of the vulnerability.

</comment><comment><USER32> Governments are not neutral parties. They have interest in mass surveillance. Moreover, I don't believe a neutral party is possible. Organized groups with enough motivation and resources will find a way to influence neutral parties. Just take a look at journalism, or even education, today. Both of those groups were intended to be neutral, but they are not because they are heavily influenced from outside. I know education in regulated, but it shouldn't be. I don't believe the original intention was for heavy handed political parties to use education to meld young influential minds to their liking.

On a side note: companies and governments alike believe that a single security audit before each release is sufficient (many don't even do that much). They are wrong. Instead, they should be hiring a team of full-time penetration testers that work in parallel with standard quality control testers.

Now back to my original train of thought. I believe the solution is exactly what we have -- natural selection. When the financial loss exceeds the executives tolerance threshold they will either fold, or adapt. The organizations that are better at adapting will survive. It will take time, but as long as the losses are great enough natural selection will affect the course of things to come.

</comment><comment><USER33> " _The primary reason computers are insecure is that most buyers aren't willing to pay — in money, features, or time to market_ "

Im not sure this is true. That the market is not producing adequately secured stuff is fact, but... It strikes me as similar to " _journalism is broken because people aren 't willing to pay for good journalism anymore"_. Maybe be it's true in a sense, but I don't think it's a useful sense.

It's not like computers come in regular or secure, with a 20% discount on regular. Money is not always a direct lever on things. Some software has crappy UI. This does not generally correlate to UI spending. A much bigger influence is the type of market that software is in. "Enterprise" will likely be much worse than consumer stuff, because of market structure, incentives and hard feedback loops.

Bureaucracy/rules come with costs that can't be easily priced too.

For example, gdpr...

The writer complains that current laws are written from a naive perspective, as if the internet existed within its jurisdiction. That nativity is inherent in regulatory/rule-based systems.

GDPR was written as if it will be written by a person writing software. It's not. It is written by lawyers, hired by companies to "do gdpr." Mostly, lawyers reduced this to paperwork. Policies that must be meticulously written. Checkbox software that must be installed. Agreements with vendors that must be updated.

..All things that cost money, put lawyers and compliance officers in more powerful positions, and do very little to improve user privacy and agency over their data.

If you want to start a company in a regulated market, your first hire is a compliance expert, preferably one with a personal relationship with that specific regulator.

Regulators are process oriented, not results oriented.

For example, let's say some drug is overprescribed. Regulators respond with new small print that must be included in ads. They will meticulously measure "compliance," but may not even take an interest in results. Ie, they may not even check to see if sale/consumption of the overprescribed drug have gone down.

Anyway... Whether through regulation or whatever, security is hard. It is almost always reactive, responding to past crisis.

Personally, I'd start with laws (not regulators) targeting after-the-fact disclosure. I think self reporting is the most useful/successful part of gdpr, for example.

Light helps. It can also create the pressures, incentives and information required for change.

</comment><comment><USER34> Such gorvernment certfification organization (or something like that) will harm local firms and benefit chinese, because chinese companies will ignore all those regulations and flood market with cheap devices. Honestly, I cannot see any solution other than mass education system that teach people what security is and how to use it. Every consumer MUST clearly undestand what exactly he/she is going to lose when using insecure appliance.

<comment><USER35> > flood market with cheap devices

To some extent that already happens with safety regulations, & imports/sales of these products are illegal. That doesn't mean that you should just give up.

<comment><USER36> Exactly. It's trivial today to purchase electronics without any required certifications (UL, FCC, etc) from aliexpress, etc. However, those certification programs are still alive and well, and knowledgable consumers can still seek them out.

</comment></comment></comment><comment><USER37> "The National Institute of Standards and Technology's Cybersecurity Framework is an excellent example of this... The Cybersecurity Framework — which contains guidance on how to identify, prevent, recover, and respond to security risks — is voluntary at this point, which means nobody follows it."

How "excellent" of an example could it be if no one follows it?

If he's worried about low-cost devices today that don't have security teams, it seems that fining companies for having security issues could lead to some percentage of them going bankrupt, which in turn would lead to more devices that are abandoned by their manufacturer post-launch.

I also think it would, to some degree, stifle innovation. Even if what's involved is paying some fee for some new security technology or license, that's still less money that a startup can spend on the part of the product that customers are paying for.

I wouldn't say we shouldn't have any sort of regulation whatsoever, I'm just skeptical that the government could do a good job of it.

<comment><USER38> >> We also need our standards to be flexible and easy to adapt to the needs of various companies, organizations, and industries. The National Institute of Standards and Technology's Cybersecurity Framework is an excellent example of this, because its recommendations can be tailored to suit the individual needs and risks of organizations. The Cybersecurity Framework — which contains guidance on how to identify, prevent, recover, and respond to security risks — is voluntary at this point, which means nobody follows it. Making it mandatory for critical industries would be a great first step. An appropriate next step would be to implement more specific standards for industries like automobiles, medical devices, consumer goods, and critical infrastructure.

> How "excellent" of an example could it be if no one follows it?

I can be very excellent indeed, from the computer security perspective. The problem of why it's not followed is probably twofold: 1) organizations don't know about it (and aren't motivated to find out) and 2) business leaders don't want to spend the money to implement it if they do know. Making it mandatory nicely solves both of those issues.

> If he's worried about low-cost devices today that don't have security teams, > it seems that fining companies for having security issues could lead to some > percentage of them going bankrupt, which in turn would lead to more devices > that are abandoned by their manufacturer post-launch.

That's no big loss, because those devices are inevitably abandoned today.

> I wouldn't say we shouldn't have any sort of regulation whatsoever, I'm just > skeptical that the government could do a good job of it.

The government will do a better job at regulating in this area than anyone has ever done before, because no one has ever tried.

</comment></comment><comment><USER39> Continuous security upgrades means byers no longer buy a device. They buy service and should be charged for one

</comment><comment><USER40> I don't buy the regulation argument. Regulators will not have a sufficient understanding of the systems they are regulating, and of course regulation is too slow to react to a dynamic phenomenon. Perhaps more basic regulation stipulating liability if something goes wrong would be of use.

I suggest we apply some lateral thinking to the underlying problem and approach it from another perspective entirely. Over the last 30 years or so, really since the end of the Cold War, high on idealism and technological utopianism, we've built a whole new high tech infrastructure to replace the low-tech infrastructure that preceded it. In so doing, we have invariably embraced technologies that we did not and do not understand, technologies that have never really been tested (as in been subjected to the test of time). Was this wise? Should we be using new, unproven technologies for security critical systems? These new systems have untold vulnerabilities, and their often centralised structure makes them very susceptible to disruptions. Should we not be building robust, decentralised, low tech solutions instead? Could something as fundamentally vulnerable as modern undersea cables have survived a cataclysm like the Second World War? I anticipate that any valuable data sitting on a networked device anywhere is at risk of eventually being lost, leaked, or stolen. Any networked safety critical system will be hacked or otherwise exploited (or fail catastrophically). It is only a matter of time. So much of modern (hybrid) warfare hinges on sowing discord, confusion, using disinformation and misinformation to cripple adversaries--and we have collectively built an infrastructure that is tailor made for this kind of disruption. What I mean is virtually everything that has come into being in the last 30 or so years, from complex global supply chains to modern banking. What that exists now would survive a SHTF scenario (not hard to imagine)? Again, we should be designing systems to be robust, decentralised, secure, and wherever possible, totally independent of high tech gadgetry. What use would 'identity theft' have been in the 1970s? Exactly.

</comment><comment><USER41> Why? Incompetence will always exist. Now youre just wanting to stifle the free internet.

</comment><comment><USER42> We can no longer leave article writing to Muppets. All journalists should be HIGHLY regulated, certified and only licensed journalists are legally allowed to write articles for the public.

</comment><comment><USER43> I think he's right - the line between regular hacks and cyber warfare has been blurred to invisibility, and defending the nation is one of the most basic of governmental responsibilities.

<comment><USER44> that's a really interesting point. A good example is cops patrolling streets. But if these cops force their way into your house to "protect" you without your consent it's not protection anymore, so voluntary consent is neccesary to make it protection and not a regulation.

<comment><USER45> Cops have always been able to force their way into your house to protect society. They aren't just protecting you, they are protecting you as part of a larger group that employs them.

</comment></comment></comment><comment><USER46> We should fine companies for data breaches.

</comment><comment><USER47> At best, we will end up like China.

</comment><comment><USER48> online security will always be cat and mouse. that has nothing to do with the market. if you get the government to step in, then it will just be the government that fails instead of the market.

<comment><USER49> Its not entirely cat and mouse. Especially in some older banks. There is a local home town bank whose online banking only works in IE6. Its a joke.

<comment><USER48> the bank example is interesting because I do think banks might belong to a special class of institution that deserves to be regulated, but I think most other businesses really don't need it.

</comment></comment></comment><comment><USER42> I would rather take any insecure device over any regulation from any government, particularly the US. Your government has no business interfering in what hardware I decide I should run and from who. You are a muppet.</comment>


Top Danish Undiscovered Startups - <AUTHOR> https://www.equidam.com/top-denmark-startups-march-16/ <comment><USER2> How come a startup that has not even launched yet ([http://planpenny.com/](http://planpenny.com/)) made its way to the top?

<comment><AUTHOR> It's about the opportunity and the number of people they have, I'm personally not a big fun of the larger one wins..</comment></comment>


Show HN: Be The Camera – Open Source Realtime HTML5 Camera Simulator - <AUTHOR> http://bethecamera.com/ <comment><AUTHOR> I created this over a year ago with the intention to use it for:

1\. An interactive camera tutorial. 2\. A tool to help choose which camera to buy, emphasising the image quality and shallow depth of field that a large absolute aperture gives you.

Since I have no immediate plans to continue with this, I thought it would be cool to share the source code for anyone to play around with.

Enjoy! And feel free to ask me any questions.</comment>


Colombia Rebels Sign Deal to End Half-Century Conflict - <AUTHOR> http://www.wsj.com/articles/colombia-rebels-sign-deal-to-end-half-century-conflict-1474931073 <comment><AUTHOR> As a Colombian citizen this is amazing. My memories as a child are of Pablo Escobar's bombings and later of the guerrillas kidnappings and killings, and when I was a teenager of the paramilitary tortures. It's incredibly amazing to believe that soon I'll live in a country where politics aren't done with guns and democracy actually works.</comment>


Quarterly: A Subscription Service for Wonderful Things - <AUTHOR> http://quarterly.co/

<comment><USER2> Not sure I follow. A group of people you select sends me random physical objects every month?

<comment><AUTHOR> You follow exactly! The added detail is that these people are by and large thought leaders and you are getting a curated group of objects, presumably related to their area of expertise.</comment></comment>


Ask HN: feedback on my trip and travel planner site - <AUTHOR> http://www.zipalong.com

<comment><USER2> Allow people to use your site before signing up. This is a recording.

<comment><USER3> Hilarious comment, but seriously: after 4 or 5 clicks, I just didn't feel like clicking on anything else. I didn't see anything interesting until a small little list of a few interesting existing itineraries.

It's trying to be too many things. Do one thing really well. Are you about making lists? Be the best dang list maker there is. Get people bought in as soon as possible. This doesn't mean grab their contacts or get them to put in invited friends. This means get them to create some content they have an attachment to, and fast.

Demonstrate value as early as possible, and keep the user's attention. Every part of the process should be analyzed with a fine tooth comb -- each piece of UI and call to action should have a strong reason to exist. Otherwise, you're just wasting valuable and finite user attention.

</comment></comment><comment><USER4> Those photos on the home page map get all the attention, buy aren't clickable? (not that I didn't try...)

<comment><USER5> Yeah I expected it to do _something_ , have the photos interact with the mouse in some way, or some cool effect.

But then I shouldn't be looking at a nice map made up of pictures, wondering what the website is all about. I think a tagline/elevator pitch is needed somewhere obvious.

<comment><USER6> <http://www.rolyn.co.uk/wub.htm>

</comment></comment></comment><comment><USER7> You definitely need a tagline on what the site is doing straight below the TOP LEFT corner. No many people will click into the "what is zipalong" link.

If I didn't get to the site from YC news, I will think that it is just another photo site rather than a travel site.

It's clever that you put the logo at the top right corner. But, it may hurt the usability because users tend to think that logo should be at the top left corner of the site. It is good to innovate but sometimes it is even better to follow the norm since most of the sites put the logo at the top left corner.

Anyway, I have no time to review the site now. I have to leave my office now. Will let you know once I get back to my home.

<comment><USER8> I like the design (though perhaps a bit gradient-heavy, I prefer flat) but you should definitely add some sort of tagline, or at least put the "what is zipalong" link in a different color or something; I didn't even see it the first time I opened the site. Just seeing a login form, I immediately closed the tab. Good thing I read the comments, because this looks really cool.

One small usability tip: you could pretty easily combine the login and registration forms. Just put an extra "register" button, do a username check, then add a second password box and the name fields. Also, it'd be a little nicer (though I see what you're doing with the in-one-line thing) if you stacked the password confirmation box under the other; I usually visually compare the lengths before hitting "enter".

Also, I noticed that the look and feel is in many ways similar to Flickr, especially the colors. I don't know if that's a positive or a negative; on the one hand, it will immediately associate your site with photography for anyone who's used Flickr before, while on the other hand it may make it harder to establish a unique brand.

I haven't explored the inside of the site much, but from what I can tell, you've done a pretty good job. Keep up the good work, and good luck.

</comment></comment><comment><USER9> I feel like the site isn't really selling its benefits to me. I do organize some trips, but I wouldn't use this now because I don't want to bother everyone by telling them to sign up to this service, when I don't really know what the benefit would be.

Travel is such an interesting area, mostly because it is seeing so little new innovation that I feel there must be something big lurking just around the corner. There are few well known types of sites, such as review / listing aggregator sites, flight price comparison engines, these organize-your-own- trip sites (that seem to be quite niche) but it is so rare to see any new ideas. The only really new thing I've found is SeatGuru, which lets you find the best seats, which really provides useful information for the travel planning process. Those Facebook applications where you can show your travels on a map in your profile were a nice idea too.

Anything I'm missing?

<comment><USER10> Thanks, we're trying to improve the selling pitch :)

What makes us different from other travel sites is that we try to take a semantically meaningful view of a trip so that you can organize anything and everything about your trips in one place.

And we hope to do it so that you can come back in 10,20,30 years and retrace your steps and have fun with your past trips.

<comment><USER11> First, great work! You have a nice site, at least that is my impression from the tour. The sales pitch of keeping everything in one place and sharing it with friends who may be meeting us along the way is great.

My wife and I are planning a trip around the world. It's been pretty complicated so far. Just getting that amount of air travel figured out has been difficult (mainly because the Star Alliance RTW tool appears to have a recursion depth of 1...). We're just now working on booking places to stay, tours to take, shoehorning various experiences and adventures into the spaces between flights.

Convince me to use your site. What significant advantage will it have over a spreadsheet full of travel plans? Over a blog with pictures and a google maps widget? What does "semantically meaningful" mean to me as a traveler? Do you mix in current data (travel warnings, visa requirements, etc.) with my plans so they are relevant at later dates?

<comment><USER10> Thank you!

We have done a lot of traveling ourselves, and the original inspiration for the site was to package all the various spreadsheets, notes, and disjoint sites that we've used during the planning.

Are we at the point where we can replace all of that? Not yet. But we are getting there, and using the site gives you automatic access to all the tools that are coming online the next little while.

You have a _nice_ place (no nasty ads) to store all the information related to your trip, in a way that you'll enjoy in the future (in fact, you will have access to some really cool stuff that we have planned almost for free as you'll have all the relevant information in one place). So the more we develop the site, the more you'll get out of your data without you having to do anything additionally.

Now, you seem like a sophisticated user, and probably you'll still need your spreadsheets. But we can certainly use feedback from users like you in terms of features that would help you ditch those spreadsheets.

So indeed, short term plans are to mix in the current data with your plans. Give you customized documentation based on your itinerary. Make it easier for you to search the best travel rates (or even doing it automagically for you).

We'll get there shortly.

<comment><USER11> I'll give you a hint, I am not the sophisticated one ;)

I'm looking forward to giving your site a whirl!

</comment></comment></comment></comment></comment><comment><USER12> I took the tour and from what I saw it seems like an amazing service with loads of features. I also love the design (from what I saw in the thumbnails). Agreed that you should switch the logo and courtesy nav... logo on top left, nav on top right.

This is a no brainer: Make the whole continental thing, as well as the logo (only on the front page) link to the tour. I got to the site and didn't know what to do. As a travel site, guess what's the last thing you want your users to feel when using your site? Lost.

As per the tour (I have no need to sign up for this service right now), it looks incredible. All the thumbnails look beautiful and the site looks loaded with really awesome features. Unfortunately, the stupid slideshow kept moving forward even when I explicitly clicked on a number. Not a big deal because only a small percentage of people will care enough to view a picture in the slideshow anyway, but it wouldn't hurt to fix.

If you really want to impress users, there's no substitute for a live demo. Lead users to the tour, and on each page of the tour, link them to the demo account: "see it live in a demo" If you're worried about crap in the demo, just have the demo reset itself every hour.

If it were up to me, I'd keep the continental thing, but only as a background. I'd put a nice faded box on top of it with the following:

1 sentence telling me what you do: "[logo]zipalong[/logo] lets you organize and share your trips" and two buttons: "live demo" and "tour of features".

</comment><comment><USER13> Seems like a cool site so far :-)

The itinerary "Summary" on this sample trip <[http://zipalong.com/zip/Trip.page?tripId=42626548>](http://zipalong.com/zip/Trip.page?tripId=42626548>); was quite long. The map neatly fits the browser window, but I have to scroll down past it to see all of the summary. Also, the content of the summary seems quite verbose. Many of the entries in this list could be represented more compactly while still managing to improve comprehension.

I think that this itinierary view has more than a few things in common with Google Maps' public transportation directions. Plan a bus trip around your favorite supported US city and see if that inspires you to improve this view.

<comment><USER14> Thanks for your time. We like it too :-)

You're right about the long Summary list. Improving this one is actually on our ToDo right now. Great suggestion, thanks!

</comment></comment><comment><USER15> Loaded the page saw a pretty cool photo continent collage, but was unable to interact with such and there was no text to tell me briefly what zipalong does.

As stated above, it's best to allow use of your site without requiring sign up or have facebook/open social sign in if it requires sign up.

good luck!

<comment><USER16> I second that - really great collage begging to be clicked on - make us able to interact with it somehow. One suggestion would be a bit of information about each destination on mouse over.

</comment></comment><comment><USER17> I have no idea what this does better than TripIt/TripAdvisor/<insert travel site here> or why I would want to use it.

</comment><comment><USER18> Wow, looks slick and nice Just curious, how many people have been working on this?

One small thing is that you should maybe allow people to view a sample trip from your main page (maybe also a link to something like <http://zipalong.com/zip/TripAnimation.page?tripId=42887183>) When I arrived on the main page, I tried clicking on the map and it didn't work and I would have closed the page if I wasn't coming from here to give feedback. I almost didn't click on the What is Zipalong? link. Your tour is slick, well made and made me want to sign up though but I usually prefer seeing a real use case rather than a tour usually.

</comment><comment><USER19> Looks cool. I signed up. Going to have an API?

I like the icons/graphics.

<comment><USER10> Yes, we are considering providing an API.

We just added "trip embeddability" which allows you to create a trip on Zipalong, and then embed it (a-la Youtube) inside other web pages, such as you blog.

Of course, that's not really an API, but it's a start. We'd be interested in use cases for the API, it would helps us build a more useful API.

</comment></comment><comment><USER20> I signed up:

+ve: very slick and liked the design a lot.

-ve: whilst the UI was slick I found it a bit clunky. It took too many clicks to achieve things, particularly adding an Itinerary - I think being able to blast a bunch of cities into a text box would be the way I'd like to start.

<comment><USER14> Great idea - one of the best suggestions we got for that area of the site. We'll look into implementing it in the next little while. P.S. Glad you like the looks :)

</comment></comment><comment><USER21> As others have mentioned, you desperately need to explain what you do on the front page. Once I understood what your site is, my first thought was "Facebook for traveling."

Now the hard part. What do you provide that people can't already do on Facebook? This is what you need to stress.

</comment><comment><USER22> Show, don't tell. Show me a diary that somebody wrote recently so that I can imagine myself using this.

I do like the integrated-ness of the diaries + photos functionality. Deep Facebook integration would be great (either add to my Facebook photos + notes or at least post as shared items to my profile).

What do your competitors look like?

I'm thinking of using this for a trip I'm taking in the summer (<http://str8.to/around-the-world-at-twice-the-speed-of-fogg>)

</comment><comment><USER23> I know the guys who made this, they've been working hard on it for over a year. I'm curious what news.yc thinks.

</comment><comment><USER24> I'm getting this after a long wait:

      The proxy server received an invalid response from an upstream server.
      The proxy server could not handle the request GET /proxy/FrontPage.page.

      Reason: Error reading from remote server

</comment><comment><USER25> Looks really cool. I don't travel much, but next time I do I'll give it a try.

</comment><comment><USER26> Very nice UI. Unfortunately very commonplace idea.

</comment><comment><USER27> Wow, this looks great. Just signed up.</comment>


What's New in Entity Framework 5.0? - <AUTHOR> http://www.developingthefuture.net/whats-new-in-entity-framework-5-0/

<comment><USER2> Was waiting for enum support, because of the core-changes that have to be made, it's a long awaited future ;)

Nice, EF 5.0 is certainly worth the wait.</comment>