Face ID, Touch ID, No ID, PINs and Pragmatic Security - louis-paul https://www.troyhunt.com/face-id-touch-id-pins-no-id-and-pragmatic-security/ <comment><USER2> > ...when you do use the biometric options we're about to get into, you're > still going to need [a pin] on your phone anyway. For example, every time > you hard-reboot an iPhone with Touch ID you need to enter the PIN

This is what has been missing from every discussion of this issue that I've seen so far.

The face scan isn't "insecure" even if you're worried about border searches. Just turn off your phone when you get in the security line! Pin will be required on start.

Pin is also required when plugging into a new computer.

The rest of the time when you're going about your daily life, and are not worried about a government agent spoofing your face or pointing the phone at your face, you can use this nice feature.

Most people will be _less_ secure without it. They don't want to punch a pin every time they want to tap their phone to pay for coffee. So without the face scan feature, they will opt for no security at all.

The reboot/plug-in pin requirements change the discussion quite a bit, but are usually ignored, seemingly so bloggers can state the obvious "but someone can spoof your face!"

<comment><USER3> I don't want to be that 'if you've got nothing to hide then' guy but why are people so worried about what border agents in particular will see on their cell phone?

I am not saying that I wouldn't mind at all if my phone was searched. But I can't think of anything in particular that I would be concerned about if it was. Sure in theory the agent could remember some personal information and come back later and use that info or pass it to someone for some nefarious purpose. But that's a pretty small chance event. It's more or less the equivalent of thinking you will get sick because you find a hair in your food at the restaurant. You don't like it and you send it back or demand a refund but the actual harm is more mental in nature.

Or what am I missing here?

<comment><USER4> Depends on how difficult it is to produce an automated system whereby one needs only plug an unlocked phone into a computer in order to hoover up all locally-stored messages, contacts, saved passwords, synced browser histories, etc. The agent themselves doesn't need to care, they can just be instructed to "unlock the phone, plug it in to this computer, wait until the progress bar finishes, hand phone back". Are you on Github? Is your Github password saved in your browser? Do you have commit access to any marginally important projects? God only knows who has commit access to those projects now. Considering this is HN, I imagine this is an attack vector that a lot of people here are particularly concerned about. Given how much code we use that's written by others, it ought to concern the rest of us as well. :)

<comment><USER5> This is not an attack. This is iTunes. This is trivial to do.

</comment></comment></comment></comment><comment><USER6> I really liked this write-up because it focused on the _practicality_ of the various security mechanisms. Most articles I see usually have a blanket statement like "All biometric security mechanisms are bad!". I think this article does a good job comparing the various logins and describing the pros and cons for different people. Specifically, I appreciate the author calling out when people bring up the "What if" edge-cases, where the correct response is you likely have much bigger problems at that point than the security level of your phone.

<comment><USER7> >All biometric security mechanisms are bad

They are though, if bad == insecure. Customs can make you unlock with fingerprint or face. If you can't lock yourself out, it's not secure.

<comment><USER8> Customs can do that anyway if you have a password.

<comment><USER9> Constitutionally, an individual can not be forced to enter a password for law enforcement (including customs agents).

<comment><USER10> That's the point, "constitutionally" while they lock you up for hours/days on end to obtain the warrant needed to give up your password unless you are willing to stay locked up.

<comment><USER9> Get that sweet settlement for wrongful imprisonment.

<comment><USER11> Or, you know, no settlement, and not even a "sorry, oops" either.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Re: the pushback the author got on Twitter; I believe in skepticism towards corporations and marketing claims, but the level of cynicism online towards any new tech idea or product seems a bit out of hand. There's a certain trend, on Twitter especially, of people racing to prove they're either more woke or smarter than the teams of people behind things that are yet to even be released. I mean a "wait and see" attitude wrt the actual effectiveness is good, but I don't get why we need to concoct extreme hypotheticals here suggesting Apple is somehow irresponsible for adding an optional feature.

<comment><USER13> > There's a certain trend, on Twitter especially, of people racing to prove > they're either more woke or smarter than the teams of people behind things > that are yet to even be released.

This has been a trend of a vocal minority on the internet for as long as I've been connected to it. Remember "No wireless. Less space than a nomad. Lame"?

<comment><USER14> > _Remember "No wireless. Less space than a nomad. Lame"?_

I hate linking to that site but this will always be golden: Apple's New Thing (a post from 2001) [1]

[1] [https://forums.macrumors.com/threads/apples-new-thing- ipod.5...](https://forums.macrumors.com/threads/apples-new-thing-ipod.500/)

</comment></comment></comment><comment><USER15> Given that the authentication methods are "differently secure," wouldn't it be good if we were offered the option to combine them and require both for unlock? I would love to use Face ID + PIN or Touch ID + PIN for better security.

<comment><USER16> I want this, and also the ability to secure different areas of my phone.

I want to be able to set touch or PINs for certain apps, so that I can have multi level security. Why is there so much emphasis on one master password/touch ID/face ID instead of having multiple security checks?

<comment><USER17> All of my banking apps, among others (e.g. password manager), include options for both pin and touchID auth. Do we not already have what you're asking for?

<comment><USER18> I think he's requesting it on the system level. For example, if iOS allowed you to force PIN+TID when opening a specific (not necessarily secure) app for the first time after an unlock. Intended for apps that don't necessarily have security built in already.

<comment><USER19> This is especially useful for when the app developer doesn't think there is a reason for them to develop such a system. For example, I don't want my son playing a zombie game, but I myself play it often. I could then lock him out of said game, but still give him my phone to use.

<comment><USER20> This isn't exactly what you are looking for, but have you tried Guided Access on iOS (or whatever the equivalent is on Android)?

<comment><USER19> Yes, that is the way I do it currently. It's a real pain though.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> It would be interesting if we could specify a particular face pattern to unlock the phone. Imagine you set up your phone to open only if you smile, now if someone picks up your phone and try to unlock it by pointing it at your face, not smiling would be easier than closing your eyes or looking away. Not even mentioning the health benefit of just smiling :)

<comment><USER22> It would be awkward to smile/pose before/after a funeral, just because I need to call my mum or check my email...

That being said, I do think that there could be a legitimate use case here. One could set up a particular "emotion" (a face pattern) associated with someone forcing them to unlock a phone using their face. I mean, if someone pulls a gun or a knife on me, I'll probably just do as they say and look at the phone, rather than risk an additional hole in my body. But unlocking a phone _and_ sending a distress call is something I could live with.

<comment><USER23> y, if someone has a knife or gun I would just give them what they want and worry about a distress call after you're safe instead of getting fancy trying to activate an 'I'm being mugged' feature.

I think that could be a nice feature but would add stress to the situation when you should just be focussed on staying alive trying to remember how to do that special thing or enter an alternate code.

<comment><USER22> I'm thinking of a situation when the phone, for example, is not enough for them. What if the don't leave you alone after that? What if you're a girl and they are going to try to rape you? What I'm thinking of is not about a "fancy" _help-me-I 'm-being-mugged_ "duck-face" pose, but actually a face pattern which, simple enough, could offer assistance in a difficult situation. What if they take away the phone and I'm left with no change of calling for an ambulance?

You are right, though, that this requires some "friction" and probably some self control.

</comment></comment></comment></comment><comment><USER24> This is a really well-written, considered view of the trade-offs for using different options for security. I learned a lot from reading, and the plain language discussion of the topic allows most any reader to better understand the trade-offs present for each option.

Much appreciated to the original author - it takes a good deal of time and effort to write something that lucid. Thanks.

</comment><comment> irq-1 > a thread emerged about abusive spouses. Now if I'm honest, I didn't see that > angle coming and it made me curious - what _is_ the angle? I mean how does > Face ID pose a greater threat to victims of domestic violence than the > previous auth models?

If someone has the PIN and the phone, they can get in without the person (without their biometrics.) Fingerprints and Face recognition increase the chances that an abusive spouse needs the other person _every time_ they access the phone.

Parents who have their childrens passwords are in the same situation -- they can't snoop on their kids biometrically secured phone (like reading a kids diary in the old days.) They have to have the kids open the phone, which means the kids know that it's happening.

<comment><USER20> I'm not sure, but I know with my spouse and I, we always put each others Biometrics into each other's devices (I add her fingerprints to my phone and vice versa), share a lastpass account so we know each other's passwords, add our email accounts to each other's devices so we can always look at each others email, etc. If you are married to someone and don't trust them enough to do the same I have to question the foundation the marriage is built on. As for kids, we just don't allow them to have a phone or other device until they are old enough to buy it with their own money, which so far has never happened until they are nearly 18 and getting ready to leave for college anyway.

<comment><USER25> Not trying to tell you how to live your life, but being an open book to the other isn't very trusting. If your trust is build around being able to spy on the other, maybe you aren't trusting each other that much. My wife and I both have our own separate phones and computers without each other being able to access it and I trust her not to do anything that goes against our interests and vice versa. That's what trust is, not having to know what the other does and knowing they are doing the right thing.

<comment><USER26> I also let my spouse unlock my phone. It's not so much "being an open book" as it is "I trust her not to snoop, and sometimes it's convenient that she can open a map on my phone." That meets your definition of trust: not having to know what she does because I know she'll do the right thing.

<comment><USER25> Very fair point. In fact, my wife actually knows my phones passcode for the exact same reason. "Open book" was definitely the wrong phrasing here, I wasn't trying to say that you have to keep everything secret from your spouse. Just that the exact opposite of that also strikes me as very distrusting.

</comment></comment></comment></comment></comment><comment><USER27> Would be interesting to enable voice authentication contemporaneous with face scanning to make sure the lipreading matched the utterance matches the voiceprint matches the expected face. Bonus points that a vocal channel could be used to detect duress (especially if accompanied by, say, raised eyebrows) and either require further authentication (passphrase entry) or a "false unlock" to reveal only a nearly factory fresh app and data underlying. Could also potentially send a notification to friends that your phone had just been unlocked under duress. Bonus points for in parallel hard-scrubbing the underlying true data while displaying the false boring phone interface.

</comment><comment><USER28> Near-field worn devices.

[http://nfcring.com](http://nfcring.com) is an example of what I have in mind.

What I'd like to see is this tied into an identity system, such that the ring (or other very-hard-to-misplace, but replaceable and discardable) token is not _itself_ an identity, but rather an access token to an identity store which can present any given identity to any given system.

That might be a _consistent_ identity across multiple sessions or _unique_ identities on each session. The identity might be tied to some central certifying agency (e.g., a motor vehicles department or national pensions fund), or not.

There are several elements of this which I'd like to see developed further, including how keys might be reconstructed or recovered using a quorum system of trusted sources (divide your key into pieces, share those amongst friends, family, or some local authority, such that key loss need not equal data loss), and possibly via law enforcement.

I'm also looking at the possibility of a public ledger system which might allow for both workfactor requirements _and_ public disclosure of keys being revealed. This may be a viable application of crypto, though I'm not entirely sure of this.

(The feature might also be optional -- you could take the risk of key loss, or allow for recovery. But the present situation with PKI of losing access to _all_ previously-encrypted data in the event of key loss would be mitigated.)

There's also the requirement for devices to have support for near-field readers. I'm told this is alreadly largely a reality, though my reading of specs for various mobile devices suggests otherwise.

The biggest challenges through all of this are not the technology itself, but the adoption, requirement, and enforcement of standards, including availability of tokens at low or no end-user price. Trust of the information ecosystem overall might be a suitable incentive for this to happen.

<comment><USER29> So, someone steals the NFC ring and then own the phone? Ring + heat detection of PIN tap pattern will end up giving a false sense of 2FA. (not sure how the ring auths on being worn, didnt see it on the website).

<comment><USER30> Or cutting off a finger or hand?

<comment><USER28> Difficult to arrange by a phishing email, website, or trojan.

Possible to countermeasure as well.

</comment></comment></comment></comment><comment><USER31> It appears that FaceId only supports a single face (unlike TouchId, which supports multiple fingers).

Maybe this use case isn't common, but my wife frequently needs access to my phone. Usually while driving, to change GPS routing, or playlist, or respond to SMS. With TouchId, she can do so without my PIN. With FaceId, she needs my PIN.

This strikes me as both less secure and quite annoying. Now, I have to repeat my PIN out loud while she types it into the device. Or, force her to memorize it (in addition to her own PIN, and I have to remember hers for the reverse situation).

</comment><comment><USER32> For me it's not so much the paranoia or the degree of security (which is an arguable point in itself) but the commodity of it. Touch ID lets me unlock my devices without having to re-position my upper body or move them in (practically) any way, and Face ID feels awkward (I'm typing this on the device that is likely an exception to that - a Microsoft Surface Pro - <AUTHOR> Windows Hello's face recognition works beautifully, but I am _always_ facing it when I need it to unlock, so...)

<comment><USER33> > without having to re-position my upper body

why would you unlock your phone if you're not going to look at it? I don't understand this argument.

<comment><USER34> my phone is currently sat on my desk, about 10 inches from my right arm. I can, and do, check messages on it, by only repositioning my arm to unlock it.

I easily read any messages by glancing at the phone, never coming into any decent imaging range.

<comment><USER35> Turn on the front camera, lay the phone on your desk. Can you see your face in the image? Then you can unlock your phone by glancing over at it.

<comment><USER36> My phone is on my desk next to my laptop in the same place where I've been texting my wife for the past five minutes. I have turned on the front facing camera.

My phone can see the very corner of my head and about half of my eyebrow. I do not want that to be enough to unlock my phone.

</comment></comment></comment></comment></comment><comment><USER37> Good, balanced, pragmatic discussion.

</comment><comment><USER38> Honestly, the only downside I can see vs. TouchID is that you can in theory point the phone at the person and unlock it. However this is balanced out by not working while unconcious.

PINs as discused are not directly comparable.

<comment><USER39> How does it not work while unconscious? Eyes need to be open?

<comment><USER40> That and looking at the device.

</comment></comment></comment><comment><USER41> What I want to know is what face data is shared with 3rd parties like snapchat. That seems like the bigger threat, and no one is really discussing that.

<comment><USER42> Unless Apple provides only an API to interact with the model, not actually use it. Which, considering it's Apple, I'm sure they did.

</comment></comment><comment><USER43> So, with Face ID, can you prevent someone trying to compel you to unlock your device by simply closing your eyes or looking away?

<comment><USER44> That was the way it was described in the Keynote

<comment><USER45> How do you know when to open your eyes again?

<comment><USER46> You can open your eyes but not look at the phone.

</comment></comment></comment></comment><comment><USER47> What if users were able to disable FaceID by configuring blinking x times or by having their eyes closed for a certain time period? Maybe requiring FaceID + a different PIN after recognizing that locking over the lock.

</comment><comment><USER48> what about FaceID + pin? that would mean someone would have to know your pin as well as have access to your face.

you also wouldn't have to look so paranoid while entering the pin. and pin by itself would be of little value.

<comment><USER49> For phone-based biometrics, the PIN has always been a backup for the fingerprint/face recognition, because these things aren't 100% reliable. Not even considering any security aspects here, just practicalities, like your hands are dirty or your face isn't being recognised (perhaps you've got bandages on your face or whatever). Having the PIN as a replacement is a _good_ thing in these cases, otherwise you could be locked out of your device when you actually want to use it.

For 'extreme' security situations, you might as well just have a long secret PIN and no biometrics.

<comment><USER48> FaceID + shortpin = unlock

longpin = unlock

<comment><USER50> Yes! I'd love this.

<comment><USER39> Too complicated

<comment><USER48> it can just be a setting you either enable or don't

</comment></comment></comment></comment></comment></comment><comment><USER23> Stolen iPhones should be worthless.

Apple need to create a system where stolen phones can be reported to them, Apple can then contact the owner/verify they are stolen. And then add them to a stolen list and disable calling/apps on those phones. And display an overlay on the screen THIS PHONE IS STOLEN.

Every iphone would come with an validate phone feature that is accessible even when locked that can authenticate the iPhone for anyone thinking of buying it.

The potential buyer can check if the iPhone is stolen by using the feature that is allowed to connect to the internet and validate the phone.

They need to make it where stolen iPhones are worthless so when you are getting mugged criminals won't even want it.

Obviously have an option setup where you can transfer ownership of your phone. Maybe with a 7 day waiting period.

<comment><USER51> Find My iPhone + iCloud is what you're describing.

Even a DFU restore of the device won't help a thief, as the activation process will simply ask for your iCloud login and will display a "Message From Owner" that you can set at icloud.com indicating the device was stolen, making it much harder for someone to purchase and claim ignorance about the origins.

<comment><USER19> Can confirm. We ran into this problem in my company as we had contractors setup phones and turn on Find my iPhone. We ended having to do some not so great things to make it so we could use the devices again.

<comment><USER52> What not-so-great things?

</comment></comment></comment></comment><comment><USER53> The complete business model is taking the p*ss imho. I am seeing more than a number of people reverting to simple €20 nokias for basic telephone + sms usage on top of a gadget / secondary device for consumption or mobile business.

<comment><USER54> Apple sold over 200 million iPhones last year, and they make up a relatively small proportion of the overall smartphone market. I don't think there are very many people like you describe.

</comment></comment><comment><USER55> Free "rein".

</comment><comment><USER56> Nice article. However:

> It's alarming not just because the number is so low, but because Dropbox > holds such valuable information for so many people.

I'd suggest that Dropbox users somewhat self select for those not as concerned about security as others. And more concerned about availability.

Dropbox does not encrypt your data server side (or at the very least, can easily decrypt it). And they have proponents of warrantless surveillance on their board:

[http://www.drop-dropbox.com](http://www.drop-dropbox.com)

<comment><USER57> > Dropbox does not encrypt your data server side (or at the very least, can > easily decrypt it).

I think claims like this need to be backed up.

Now, obviously a biased source, but Dropbox itself says this:

"Each file is split into discrete blocks, which are encrypted using a strong cipher. Only blocks that have been modified are synced. Each individual encrypted file block is retrieved based on its hash value, and an additional layer of encryption is provided for all file blocks at rest using a strong cipher. Both dedicated internal security teams and third-party security specialists protect these services through the identification and mitigation of risks and vulnerabilities. These groups conduct regular application, network, and other security testing and auditing to ensure the security of our back-end network. In addition, our responsible disclosure policy promotes the discovery and reporting of security vulnerabilities." [0]

So we have files that are broken apart, each part encrypted, then the whole combination encrypted again, then lots of security auditing in-house and outside, and with incentives for people that discover flaws to report them. That seems pretty industry-standard to me, but I'd like to know more.

I really have some difficulty imagining a company like Dropbox, which knows how important the documents it stores are, being careless with security. Not saying they may not be, but it's going to take more than an HN comment that includes some politicized perspective about the Bush administration to convince me.

Furthermore, this article [1] claims that Dropbox encrypts files on the server even stronger than Google does. It also points out that user behavior is usually the main security hole, which will always be true with any service.

[0] [https://www.dropbox.com/security](https://www.dropbox.com/security) [1] [https://www.virtru.com/blog/dropbox- encryption/](https://www.virtru.com/blog/dropbox-encryption/)

<comment><USER58> Yes, Dropbox uses encryption in transit and at rest, and security would certainly a top priority for any custodian of that much data. Dropbox is an industry leader, and in many ways sets the course for the entire industry to follow in this regard.

The issue with Dropbox is that they also have access to your encryption keys, which means they can easily decrypt and access your files, at their discretion.

According to Drew Houston (Dropbox CEO), they need access to your files to offer features like search, to be able to better understand how you're using the service, ability to integrate with third-parties, and for law enforcement. Some of these "trade-offs" are mentioned by Mr. Houston himself in this interview when responding to criticism from Edward Snowden a few years ago: [https://techcrunch.com/2014/11/04/dropboxs-drew-houston- resp...](https://techcrunch.com/2014/11/04/dropboxs-drew-houston-responds-to- snowdens-privacy-criticism-its-a-trade-off/)

More to the point, giving Dropbox (and their affiliates and trusted third- parties) permission to access to your files is a key provision of the Dropbox terms of service:

 _Our Services also provide you with features like photo thumbnails, document previews, commenting, easy sorting, editing, sharing and searching. These and other features may require our systems to access, store and scan Your Stuff. You give us permission to do those things, and this permission extends to our affiliates and trusted third parties we work with._

[https://www.dropbox.com/terms](https://www.dropbox.com/terms)

As Mr. Houston said in the article referenced above, if you want better encryption there are alternatives.

Disclaimer: I work at Sync.com

</comment></comment></comment><comment><USER59> you can change your pin. you can't change your face.

<comment><USER4> Which is why it's nice that none of the biometric auths can be used without also having a PIN for backup auth. And also why it's nice that you can disable biometrics entirely.

<comment><USER59> The comment was aimed at the Snowden example. If Snowden thought his pin was compromised he could always change his pin, but once his face is compromised what does he doe?

<comment><USER60> This entire article was explicitly written to address this line of thinking, and IMO does so very well.

</comment></comment></comment></comment><comment><USER61> Repeat after me.

iPhone X is less secure than the iPhone 8.

Why?

iPhone X: Chances of someone unlocking while you are asleep is 1 in 1

iPhone 8: Chances of someone unlocking while you are asleep is 1 in 200,000

I certainly prefer the latter odds.

<comment><USER62> Your eyes need to be open for it to unlock. Also someone can't touch your fingertips when you are asleep?

<comment><USER61> Some people sleep with their eyes open.

</comment></comment></comment><comment><USER63> The only secure thing is a thing that only you know and only you can verify even if you are freely observed.

That is, shared secrets between you and your trusted device (meaning passwords) are the singular thing that provide authentication securely. Your password cannot be extracted from your head (yet).

That being said, if your risks are mundane then the benefits of biometric authentication far outweigh constant password input, not to mention that constantly entering your password exposes you to other side-channel attacks.

Biometrics for simple access, passwords for changes, modifies and access to sensitive information.

<comment><USER39> I wonder if you could hack a person's password from their mind by forcing them to go through the alphabet and monitoring their heart rate / brain activity for each letter of their password. There must be a way to detect based on their reaction when you're on the right character, like a lie detector.

I mean, I guess at that point you could just torture it out of them, but I wonder if this could work as a method that wouldn't count as torture.

<comment><USER64> I severely doubt that anything like that is feasible. Lie detectors don't really work so well too, afaik.

</comment></comment></comment><comment><USER65> All I know is that I will avoid any system that can work if I am not conscious.

<comment><USER66> According to the article, the phone won't unlock if you aren't attentive, i.e., looking at the phone with your eyes open with tiny imperceptible eye movements.

<comment><USER67> Not looking forward to the video services that demand that you pay attention to ads before they let you view their content, now that they have the ability to check.

<comment><USER68> Do they actually have that ability, though? There's a big difference between "the authentication mechanism has access to this API when you're authenticating" and "everything always has access to this API at all times". I haven't seen any indication that this will be generally available on-demand to applications, and Apple's track record on this stuff isn't terrible (largely because Apple isn't existentially dependent on advertising like some other vendors of mobile tech).

<comment><USER69> The camera and the sensors can be available but I'm certain the auth mechanism itself won't be accessible. AFAIK they have a dedicated chip for this like Touch ID and what software can is limited.

</comment></comment></comment></comment></comment><comment><USER70> For me it's a simple question of cost vs. reward: do I care enough about the security of whatever data is stored with a company, that I'm willing to give the company personal information, when their terms of service almost assuredly give them complete license with it?

This, of course, starts with the question: do I even want to put this in the cloud to begin with?

Edit: I was talking about two factor auth.

<comment><USER4> From the OP: _" the data is stored in the iPhone's secure enclave and never leaves the device"_. It appears that this has nothing at all to do with the cloud. And if you don't trust Apple's word here, then you also have no reason to trust that they (or any other handset maker) haven't programmed the camera to surreptitiously take and transmit photos at all times.

<comment><USER70> I'm talking about two factor auth.

</comment></comment></comment><comment><USER71> This article doesn't really say much of anything. Troy pretty much just summarized a few slides from the Apple event and then ended the article saying he was going to buy an iPhone X and is interested to see how Face ID turns out. I really gained nothing from reading this.

<comment><USER72> The point of the article is that many people are complaining about FaceID's security in abstract. The alternatives, like the relatively common 'no password' or '123456 pin' are much LESS secure than FaceID.

The other arguments people are making tend to be very fanciful scenarios that don't apply to normal people (state actors, high quality makeup shops with a perfect face mold of your face, etc).

It may not be perfect but like TouchID it's probably way better than the alternative.

</comment></comment><comment><USER73> There is an opposite use case which will make me consider getting an iPhone X for a long time.

Every so often, I leave my phone at home and I need my wife to get some info from it. Or my phone runs out of batteries and my wife's phone is there, and I use to to make a phone call.

With Face ID, these possibilities go away.

<comment><USER74> If it's implemented in the same way as TouchID, you can always fall back to PIN.

<comment><USER73> Oh. Thank you for pointing this out. It was not clear to me that this is the case. From a quick look at their initial marketing material, it seemed like the way to unlock it was to wave it in front of your face.

</comment></comment></comment><comment><USER75> 1 in 1 million FAR (false acceptance rate) vs 1 in 50,000 is pretty misleading (as is Apple tradition).

Do you think someone trying to hack into your phone would shoot 1 million _random_ pictures/3D profiles made from Facebook pictures at your phone, or do you think it's far more likely they will already start with _your_ profile made from online pictures?

That will likely make the success rate even higher than with fingerprints, as it's significantly easier to get someone's photos than it is to get their fingerprints.

> Laughs were had, jokes were made but the underlying message was that Face ID > isn't foolproof. Just like Touch ID. And PINs.

No, not "just like". There is a huge difference between most fingerprint authentication mechanisms and most face unlock mechanisms (at least so far). Most of them could be tricked with a 2D picture - including Samsung's latest. It's very annoying to see such a statement from someone like Troy Hunt. Plus, I have a hunch he'll be eating many of the words he wrote in a few weeks when Face ID will prove much easier to hack than Apple made everyone believe it will be.

<comment><USER76> Per Apple Face ID doesn't work with photos; TBD in real world.

<comment><USER77> If they created photorealistic masks to defeat the 3D mapping and those didn't work, I feel pretty confident in saying that photos won't work.

<comment><USER72> I think it would be really cool if it turned out that it could tell the difference between some pairs of identical twins due to seemingly imperceptible differences.

<comment><USER77> I'm sure it's not 100%, but I'd bet it's close. Certainly by young adulthood the identical twins I've been around have been relatively easy to distinguish.

<comment><USER72> That's sort of my theory. But I wonder how much of people's ability to distinguish identical twins is based on physical differences vs more subtle things like how they carry themselves/interact with the world.

<comment><USER78> Some twins I've known deliberately create physical differences like different hairstyle so other people can recognize them easily without interactions.</comment></comment></comment></comment></comment></comment></comment>


When It Comes to Age Bias, Tech Companies Don't Even Bother to Lie - <AUTHOR> https://www.linkedin.com/pulse/when-comes-age-bias-tech-companies-dont-even-bother-lie-dan-lyons <comment><USER4> So I started reading this book, and the immediate thing that strikes me is the obvious age bias (against young people) of the author. It's full of phrases like "just out of high school," (about a director:) "looked like an intern." If you're going to throw rocks, etc.

And for the record, I'm 55, work in tech, and yes, ageism is a problem, but this book doesn't seem like its going to help.

<comment><USER5> Or the implication that young founders are somehow in need of "adult supervision".

This idea is alive and well in Canada (a more conservative culture generally); their tech scene hasn't exactly exploded as a result.

This is a pet peeve of mine, and exactly the same ageism the author is complaining about. All of these things mean that you're not getting the best people for the job, both ways.

<comment><USER6> Adult supervision doens't necessarily mean grey hairs it means having common sense and Emotional Inteligence - look at the new MS CEO badly screwing up answering a softball q at an internal company meeting.

I bet after that MS share holders though damn we should have hired Mulally.

<comment><USER7> What are you referencing, out of interest? Link?

<comment><USER6> The new Microsoft CEO Satya Nadella when he said "women shouldn't ask for raises, but should instead have "faith that the system will give you the right raise."

Some on at his level should not make that sort of mistake evver.

<comment><USER8> Oh dear. I get what he was trying (I hope) to say, but that is such a horrible way to put it.

For reference - Netflix said it best in that masterpiece of an HR document - <USER2> pay rise should never come up as a topic, because you should already be paying your people close to the top of what the market thinks they are worth .

</comment></comment></comment></comment></comment></comment><comment><USER9> I'm approaching 40 and this is something I think about a lot. In fact this is something that everyone should think about. Everyone, assuming you are lucky enough, will get older.

The person you reject because they are over 40 today will be you in 10 years. If you pass on someone due to their age you can't turn around and get mad when some other 20 year old does the same.

Whenever I interview someone I always ask myself, if I was the person across the table from me would I think I got a fair shot during this interview.

Having said that, this is a two way street. You need to be aware of what your skill set is. I took the Scott Adams career advice [0] to try and be in the top 25% in two areas. In my case its Math and programming. If your skill set is FoxPro DB support then, as the kids say these days, you're going to have a bad time.

[0] [http://dilbertblog.typepad.com/the_dilbert_blog/2007/07/care...](http://dilbertblog.typepad.com/the_dilbert_blog/2007/07/career- advice.html)

<comment><USER10> I'm early 50s, and I've "learned and discarded" several decades of skills: 8/16-bit assemblers, the entire DEC range of computers, MUMPS and the VA ecosystem, the Perl craze of the early 2000s; I'm in an Oracle/Ruby shop now, and I suspect I'll be learning something new in a few years. Only way to keep up in this field, throw out the details, keep the concepts, gird the loins and hit the books. Well google, no one uses dead trees anymore. I have almost 100 lbs of "replaced by google" books sitting under my carport waiting to be recycled, becuse even schools don't want them.

<comment><USER11> I have been programming since the late 70s. I will say, some folks my age should be discarded, not because they're old, but because they've refused to keep up their skill sets. Many of my friends, whom I worked with in the 80s, are still scrounging around for whatever RPG AS/400 jobs are left. I shake my head. I'm having more fun than ever developing these days. Angular and Typescript of late. And it'll be some new framework in a year and a half. Other folks I talk to complain that they've been replaced by outsourced Indians. A little bit further probing reveals that "well they moved it to Java, and I'm a Cobal programmer, I don't want to learn Java". I shake my head some more. I'm not helping the cause here, I guess. Just some random observations.

<comment><USER12> I'm a fairly young programmer, but I have almost the opposite perspective. Tools should be chosen because they offer pragmatic benefit for a particular purpose (usually for servicing a desired business outcome). But in the majority of jobs, tools are chosen for reasons of status and affiliation. Even two of the tools you mentioned, Angular and Typescript, are often derided by proponents of newer, trendier tools.

There's also an issue between the experience / what a person can accomplish for you vs. insistence on integration with a particular framework. If someone is a COBOL programmer and can demonstrably solve my problem more expediently with COBOL than by slowly plugging into my pre-existing Java system, then I should want them to work in COBOL and I should solve the problem of integrating disparate systems instead of effectively removing the comparative advantage that the COBOL expert brought to the table by forcing them to do things in my Java system for reasons of uniformity and standardization.

Obviously this is a simplification. For example, I enjoy programming in Haskell, but it's hard for employers to locate good Haskell programmers and so there is some extra hiring risk if you agree to bring Haskell into your family of tools. That's not trivial, but it is often deeply over stated. And the actual specifics of that kind of risk are rarely analyzed or considered -- as opposed to just rattling off a glib dismissal based solely on the mere fact that a risk, in principle, even exists at all, because dismissing for this reason is probably convenient to someone else's political power play to re-org around Java or something.

Many enterprise technology investment decisions are very bad decisions that are made by non-technical people for purposes of nepotism, status signalling, and creating bonus fuel for middle management and executives. The newer and sexier the technology, the better. Or, if new and sexy doesn't work, then buy a brand, like IBM, regardless of whether it actually fits your needs.

I find that most programmers are very happy to learn new things and are even motivated to do it and find it pleasant. But most programmers also cannot deal with being forced to learn _clearly and unequivocally inferior tools that don 't have redeeming engineering trade-off pragmatism to support their adoption_ \-- which is the majority of modern frameworks, new languages, and libraries.

You can say "get with the times" but it's just the wrong diagnosis. "Getting with the times" generally means being underpaid and overworked in order to take poorly designed tools and use them to cram square pegs into round holes. Some people call it "gainful employment" and if it doesn't make you feel soul- crushingly miserable, that's great for you. But other people call it "talent wasting graveyard that will cause me to die early from a life of absurdly needless stress" and they seek other careers.

I wouldn't judge those COBOL programmers the way you are. They have a comparative advantage with COBOL and know its pragmatic use. If they recognize ways of solving a problem better without dealing with enterprise Java inanity, and their economic preferences imply that it's just not worth it for them to be overworked and underpaid if they are also forced to use an inferior tool, then they are being perfectly rational.

You are trying to characterize it as "adapt or die" but the reality is that many modern software shops are just graveyards, so it is "adapt _and_ die" \-- at least by refusing to adapt, you might find some more pleasing way to spend your time before you die.

(I'd argue the same goes for other trends too -- like the way start-up jobs are becoming cult-like lifestyle communes, and how basic human needs like privacy are required to be sublimated away in awful open-plan surveillance offices. "Adapting" to "tolerate" these things is a _bad_ outcome -- and for many it's a far worse outcome than being unemployed or having a very hard time with job searching).

<comment><USER13> _" I enjoy programming in Haskell, but it's hard for employers to locate good Haskell programmers and so there is some extra hiring risk if you agree to bring Haskell into your family of tools."_

@p4wnc6 what are you using Haskell for?

<comment><USER12> The only job experience I have with Haskell was in education technology, and part of that was focused on prototyping some things with Elm and PureScript for some boring business web tooling.

What I _like_ working on in Haskell is numerical linear algebra / machine learning / data analytics toolkits.

But I also know Python pretty well (much more experience than with Haskell) and Python has the advantage of actually having a decent-paying job market, so I mostly stick to that. The few times I've interviewed for possibly decent- paying Haskell roles, they have been with large banks whose tech dysfunction was so large that it destroyed any credibility that may have been assumed due to the usage of Haskell.

One of the most eye opening things in my working experience has been that when someone says they use "functional programming" in a business setting, it generally means they don't follow any of the established practices or ideas that make functional programming worthwhile in the first place. So for jobs, seeking functional programming perhaps makes me overly skeptical.

I have heard of a few start-ups that really do functional programming, and one or two even using Haskell. But the pay and work environment are just too poor to consider it.

<comment><USER13> _" The only job experience I have with Haskell was in education technology, and part of that was focused on prototyping some things with Elm and PureScript for some boring business web tooling."_

Elm is written in Haskell, and you can only build the latest Elm with a late Haskell install. Found this out the hard way trying to install Elm on debian/Raspberrypi. [0]

I ask, because I'm curious to see what applications haskell are used for. I see Haskell being used, but limited to specific roles. [1] One thing I have noticed is Haskell to build you require a low level tool chain, like C. HS also is a moving target. Latest development should be via Stack yet a lot of documentation and code relies on Cabal. This is a pain installing some things.

All I want to use Haskell is for building a new language. I could use the "C tool chain" and I will do this if I can't grok Haskell. But to tell you the truth the learning hump and pain is worth the advantages of the advanced compiler, types and the clean code.

Builds and implementation is a hurdle I'm looking at.

[0] Unless you cross-compile or re-compile Haskell which is a PIA.

[1] [https://en.wikipedia.org/wiki/Haskell_%28programming_languag...](https://en.wikipedia.org/wiki/Haskell_%28programming_language%29#Applications)

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Let's take this in context? Here's what he said in the interview.

 _I have a lot of confidence in young people, and I have a lot of confidence in everyone's ability to do more than they think they can do. I have very high expectations for people, and I push people to reach even higher._

 _I take these young kids at HubSpot and I give them huge responsibility. Sometimes they mess it up, but more often than not they get it right. I think, at least in the tech world, gray hair and experience are really overrated. I think my gray hair is overrated._

[http://www.nytimes.com/2013/12/06/business/brian-halligan- ch...](http://www.nytimes.com/2013/12/06/business/brian-halligan-chief-of- hubspot-on-the-value-of-naps.html)

Maybe I'll have a different perspective when I'm older, but this doesn't sound like outrageous age bias to me. He's saying that these "kids" are capable of more than others give them credit for, and that experience is "really overrated". That's not the same thing as saying that he won't hire "old" people, or that given an "old" person whom he thinks will perform better than a young person at the same salary, he'd prefer the young person.

Maybe this CEO really is biased against older people, but the evidence provided is pretty slim.

Reading TFA, the author comes across as pretty entitled. His argument is that older people are better than younger people, and he's upset that this CEO doesn't get it.

 _Over time, most people get better at what they do. They become wiser, calmer, more self-aware. They've also put in the 10,000 hours of practice that Malcolm Gladwell says are required to become expert in a skill. Why would companies not want employees who have gained that expertise?_

I dunno why, maybe this CEO is an idiot. Sounds like a great opportunity to start your own company, hire the people the market is overlooking, and make a fortune.

<comment><USER15> I literally just finished reading an article on Hubspot by Dan Lyons: My Year In Startup Hell

" Another reason to hire young people is that they're cheap. HubSpot runs at a loss, but it is labor-intensive. How can you get hundreds of people to work in sales and marketing for the lowest possible wages? One way is to hire people who are right out of college and make work seem fun. You give them free beer and foosball tables. You decorate the place like a cross between a kindergarten and a frat house. You throw parties. Do that, and you can find an endless supply of bros who will toil away in the spider monkey room for $35,000 a year. "

[http://fortune.com/disrupted-excerpt-hubspot-startup-dan- lyo...](http://fortune.com/disrupted-excerpt-hubspot-startup-dan-lyons/)

<comment><USER16> I used to work at HubSpot. The company isn't perfect, for instance the lack of diversity is a huge problem. Taken in isolation, there's nothing in the article that's wrong, but the overall picture he paints here is wildly inaccurate. HubSpot is full of incredibly intelligent and capable people, including some of the most talented engineers I've ever worked with. I had the opportunity to meet and speak with every executive during my time there, I've even been to Halligan's apartment. The fact that he managed to find something negative to say about Dave, one of the most genuine people I've ever met, tells me all I need to know- the reason Lyons didn't fit in at HubSpot has nothing to do with his age, it's because he's an asshole.

<comment><USER8> Valuable input...but if you say that there is nothing written in the article that is wrong, I am not sure how you can say that the article is wrong.

<comment><USER17> Maybe the author wasn't wrong in the facts presented. But maybe he wasn't giving the another perspective that would alter your perception or understanding of whatever picture he was trying to paint. If you aren't given the full context, then you haven't fully understood the situation.

If partial truths always lead to the correct conclusion, we would never have wrong convictions in courts caused by incomplete evidence.

Or to bring the analogy closer to home, if we know only some (but not all) of the use cases, we can't know if our solution truly and completely solves whatever problem we're trying to solve. Maybe Floegipoky knows of another "use case" (insight) here that Dan Lyons happened to leave out.

</comment></comment></comment></comment></comment><comment><USER18> It's wrong that a CEO would make such a statement, and it's downright tragic no one would call him on it. Age is not a hiring factor that is good for your company, you miss out on a lot of people who have energy, are curious and creative, and can get things done. I've had the pleasure of working with 50+ who are as energetic as 22 year olds but 100x more effective.

Good work knows no age.

<comment><USER19> Energetic. Productive. Cheap. They want all three. Easier to get that when you target college students.

<comment><USER20> Indeed. The cheapness comes from inexperience, though. These fresh graduates have also not learned the dangers of overworking themselves (both to themselves and their employers), so everyone is very willing to continue this grand delusion.

<comment><USER21> Seriously. If you bet on one company with a dozen kids writing in whatever framework has the most blog posts this week, vs three seasoned lispers, I'm betting on the lispers every time.

With experience, you also learn better ways to express your intent in the languages and frameworks you know well. Inexperienced, high energy devs will just be fast at writing boilerplate.

<comment><USER22> With experience, you learn how to be able to spot the latest fads that will likely be waning or gone in a few years once they're no longer shiny things. This can make you very unpopular with those people who take it for granted that shiny things and new things are almost certainly better than non-shiny, non-new things.

Remember when MongoDB, for example, was widely assumed (by the inexperienced, mostly) to be the obvious data storage tech for building virtually any web- facing application? Now, after wide experience with formerly-shiny Mongo, it's viewed as just one among many alternatives for reaching "web scale".

</comment></comment></comment></comment></comment><comment><USER23> At 33 I think we definitely have an age problem, but not just in tech. I think all of America has an age problem in wanting to hire younger people who will work harder, longer hours, cost less, potentially use less resources such as health care, and can be disposed of for even younger workers down the line. Older workers are perceived as wanting more money, and will not meld with a younger workforce. I've seen this constantly. Six years with a major defense contractor. Any time my group manager would hire, he would shred anyone who graduated from college before 2000. I think the tech industry exacerbates the perception of younger over better, but it's a nationwide problem.

</comment><comment><USER24> One issue, at least at my company, is that we just don't need as many experienced people. We have some uber-experienced developers who do architecture and coding for everything "hard", and then a mostly- interchangeable pool of young people who do the easy—but bulky and non- automatable (yet)—stuff.

Honestly, when you look at a lot of startups, nothing they do is even remotely difficult. And they're filled with young people that can build on the hard work done by (now older) people on cloud platforms, with frameworks, tooling, etc.

So on the one hand, yeah, we (seemingly) don't need as many older developers. OTOH, when we _do_ need them, young people aren't even an option.

<comment><USER25> > So on the one hand, yeah, we (seemingly) don't need as many older > developers. OTOH, when we do need them, young people aren't even an option.

That's an interesting bifurcation that mirrors what's happening in broader society (plenty of both low and high end jobs, and a hollowing out of the middle).

I wrote an essay a decade ago about how you get senior folks if you outsource all the junior work. I wonder the same thing in this situation--if you don't have a middle tier of developers, how do senior developers develop out of junior/entry level devs?

<comment><USER26> In the context of the larger society, those lower-end programming jobs pretty obviously _are_ the middle

</comment></comment></comment><comment><USER27> Young people are easier to control. (When the "charge of the light brigade" was first written is was seen as a beautiful thing that soldiers would match obediently to their deaths; maybe in software we will accept how tragic it is in 2050 or something.)

<comment><USER28> younger people are also more likely to work more hours for a lot less pay.

<comment><USER29> ...and, due to inexperience, to do less effective work. Not saying this is a given; we are just talking about likelihoods here.

<comment><USER27> Ideally you put together a team of young and old where you get something more than the sum of the parts.

</comment></comment></comment></comment><comment><USER30> I worked as a manager of a group of 10-15 software engineers at a major semiconductor company for about ten years. I interviewed over a thousand candidates and gave out about 60 full-time job offers over that time. I hired engineers aged from 21 to about 60. Of course, I also worked with lots of engineers from other groups.

My conclusion on this topic is that there is no problem with age itself. The problem is that some older people lose interest and just coast on their skill set which becomes stale over time.

Not all older people are like that. I had engineers in their 40s and 50s who read programming blogs, learned new languages in their spare time, tinkered with their pet projects in the lab, etc. They were passionate about engineering. THOSE guys were never a problem. They were awesome. I mean, if Bob Pease [1] were still alive, I'd hire him in a minute.

The mistake is to jump from "some fraction of older engineers are in the former group" to thinking all older engineers are like that.

[1] [https://en.wikipedia.org/wiki/Bob_Pease](https://en.wikipedia.org/wiki/Bob_Pease)

</comment><comment><USER31> When I was 26, I'm sure I would have said "grey hair and experience are over- rated". Now, at 42, I realize how much more effective I am now, compared to when I was younger - due to the additional knowledge and experience I have. The thing is, "you don't know what you don't know".

All of that said, I agree with the sentiment that a good team should be made up of a mixture of people of different ages and experience levels.

</comment><comment><USER32> _According to the FBI, which investigated, these executives tried to hack into computers to steal the manuscript, and also tried to prevent publication of the book by engaging in extortion. No criminal charges have been filed, but the hacking, extortion, and ensuing cover-up raised questions about HubSpot's culture and the trustworthiness of its leadership. HubSpot 's board fired the CMO, and sanctioned Halligan, the CEO. A vice president resigned before the board could decide whether to terminate him. The board still won't tell me what happened._

That's some HP board level disfunction and paranoia. I think there is bit more wrong then their age bias, as they lack a moral compass.

<comment><USER33> > I think there is bit more wrong then their age bias, as they lack a moral > compass.

Like completely lacking a useful product and halfway down the road grasping that fact? 22 grands ea month for a little SEO and marketing-analytics of the shelf. Is there anybody who wants to work with professionals left today?

</comment></comment><comment><USER34> You don't need a PhD to understand that young people (what we call millennials this generation) are easy to manipulate. Their lack of experience makes then ripe to work for startups. Hiring 'older' workers will only bring more challenges since they are more likely to question and challenge false idols. There are exceptions of course, having older folks who also believe the hype and feed it to the younger kids works great to produce the startup echo chamber. Once the leadership is in place you want to recruit people who are more likely to drink the Kool aid. This is not rocket science. A prime example is the military.

<comment><USER35> FWIW, most of my lance corporals when I was a platoon commander in the Marines (average age ~20) were more inquisitive and freer thinkers than the engineers at the tech unicorn where I used to work (average age ~25).

That's just one data point though. YMMV.

<comment><USER36> Makes sense. These days the inquisitive hacker stereotype is no longer relevant, diluted by the masses flocking to the tech fad ("hacker" now redefined to replace "code monkey", so cool) which in turn results in the tech industry having more fads as it comprises mostly people with a tendency to jump on a fad.

</comment></comment></comment><comment><USER37> An alternative view on Lyons and Hubspot

[http://fortune.com/2016/03/30/hubspot-startup-dan- lyons/](http://fortune.com/2016/03/30/hubspot-startup-dan-lyons/)

<comment><USER38> I'm just now trying to figure out what HubSpot does, and what 'inbound marketing' even is, but from my naive and ignorant perspective on a new subject: isn't this post the same as their product?

<comment><USER39> You're too old to understand: she calls herself an "idea generator" (sic).

</comment></comment></comment><comment><USER40> I think this happens in more subtle ways too. For instance, workplace perks for many companies seem to be happy hours, socializing, and workdays that start at 10am. In my single days, all that stuff would have sounded great. In my married-with-children days, I am much more interested in perks like flextime (come in early, leave early) and good family health insurance.

</comment><comment><USER41> Some of the comments here are missing the goals of the organization, I believe. What is the 'end-game' for HubSpot and companies like them? What do they hope to accomplish? Tear away all the fuzzball tables and kindergarten colors[0], does the business have solvency without the VC ecosystem? I don't know the interior of those business, but they all seem to be angling for 1 thing: a buy-out.[1]

Commenters here, rightfully, say that experience matters in producing a good product that sells and makes a gross profit. That 3 greybeards are worth 10 fuzzfaces. I think they are right. But that is not the objective for so many of these places. The idea is to 'grow', show this to other VCs or the NASDAQ (maybe) so that they will want to buy your company. Then the board and c-suite get something of a return on the time and money, while the employees get less of a return than having worked at Boeing for those years.

Again, ageism is fine, because the point is not to have a sustainable business with a good product, the point is to grow and sell. This is slash-and-burn ranching not sustainable farming.

[0] Those are VERY important to signal to the outside world and to potential employees though. It makes the company seem 'techy' and 'googlish', which is thought to translate into dollars. Still the decor means nothing in the end.

[1] Do you feel like you have no idea what is going on? That you sometimes have imposter syndrome? Most people, including VCs and C __*Os have this too. No-one know what the hell is going on, and if they say they do, they are ignorant or lying. Mostly.

</comment><comment><USER42> Relatedly, I'm curious if Mark Zuckerberg still believes his comments about young people being smarter:

[http://www.cnet.com/news/say-what-young-people-are-just- smar...](http://www.cnet.com/news/say-what-young-people-are-just-smarter/)

which were made 9 years ago.

<comment><USER43> I doubt it, given the average age of the ML team at FB.

</comment></comment><comment><USER44> Are there any really hard technology companies that have the same problem?

My guess is no.

Our company is almost completely people with background in computer vision, AI and 3D rendering and our youngest employee is 31.

My guess is that "trendy" startups have this problem, not ones building hard technology.

<comment><USER45> I believe you are correct. Where I work, basic webapp crud and ui-type stuff are handled by younger, inexperienced people because these are easy things. For the more complicated problems, ones that tend to require deep knowledge of eg service provider networks, the teams are almost uniformly 35-50+.

</comment></comment><comment><USER24> tl;dr; Hiring young people increase headcount faster because they are cheaper and less productive, and headcount is an important metric in SV that correlates strongly with the ability to raise funding, and the ability to have a successful exit later on.

\----

One unmentioned thing, which is weird until you've seen it first hand, is that it's easier to sell and finance a bigger startup, and by "bigger", I mean: higher headcount.

Obviously, in general, older people are more experienced and cost more, and also do more. However, _this is a net-negative_ because you have a (potentially much) lower headcount. Another poster commented on how he'd take proverbial three LISPers over 20 NOOBS. (I have no doubt he's telling the truth.)

Quick test: If I tell you startup A has 8 developers, and start up B has 80 developers, which startup seems "more successful" to you? Which seems likely to have had more funding? More market share? Is more stable? Better managed? Which seems likely to have an exit (esp. acquisition) in the future?

It's little comfort knowing that startup A has 8 LISPers coding circles around the 80 devs at startup B struggling to make Grunt work and keep MongoDB from crashing. _Politically_ , startup B is a much bigger success—at least in SV today.

Startup B is what SV optimizes for and funds, and that leads very naturally to hiring young people—all else being equal.

<comment><USER46> Whatsapp is often held up as example of a very successful company that has a handful of developers.

<comment><USER24> Yes, _because they 're the exception that proves the rule_. That's why people talk about it so much. :)

</comment></comment></comment><comment><USER47> Wow -- the author, Dan Lyons, has quite a background including Senior Editor at Forbes magazine, "Fake Steve Jobs", and writing an episode of Silicon Valley. He also wrote strongly in favor of SCO in its legal battle against IBM, only to admit later that he had been "profoundly wrong."

[https://en.wikipedia.org/wiki/Daniel_Lyons](https://en.wikipedia.org/wiki/Daniel_Lyons)

</comment><comment><USER48> I suspect that ageism in tech also contributes to higher levels of risk taking - if we know or believe we will be put out to pasture at 40, it makes it more urgent to get a big payout at some point along the way.

<comment><USER49> I would have thought the opposite. The more attempts I can make, the more I can play the odds, regardless of risk. If I only have a few tries, I'm going to want to take a less risky position.

<comment><USER50> My guess is that the original poster's point is: Take two workers whose goal is a comfortable retirement. One of them knows their career will be 20 years long, the other one knows their career will be 50 years long. The one with the longer career can take a less risky path and "milk it" for half a century, whereas the one with only a few chances needs to take a risk and go for the higher payout since he has 30 fewer years to save.

I look at it this way. Everyone's career is a baseball game. Most workers get 5 or 6 at-bats throughout their lives, and can afford to just go for base hits. A tech worker gets 1 or 2 at-bats so he has to swing for the home run if he wants to score.

<comment><USER48> Pretty much exactly what I was intending (except I'd have used a hockey analogy instead of baseball :)

Notice that many of the arguments presented here about why younger workers are favored would equally apply in more conservative professional fields, like law - it's certainly not the 50y old partners doing all-nighters on a regular basis. But there does seem to be a certain level of inter-generational respect among lawyers that is absent in tech. Why, I don't know.

</comment></comment></comment></comment><comment><USER51> Let's not kid ourselves. This is not about energy, creativity, flexibility and all that shit. It's about two things, young people are a) cheap and b) gullible and easy to manipulate.

The latter is probably the most important. I'm in a situation that is a typical example of how that gets abused: company needs to downsize (funding dried up), and wants most of the team to sign a piece of paper and go away. The salespitch is that it's for mutual benefit, but in reality it's 100% for the company's benefit. The employees would sign away their rights, including at least 2 months pay and in some cases get screwed on their visa. Also, be complicit in forgery, since the dates on the paperwork are false. The younger employees would probably have been railroaded and screwed hard if it wasn't for the more experienced members of the team.

Tech companies want young people as cheap guinea pigs, to try out all kinds of "entrepreneurial" ideas without having to pay the price. Pure and simple.

</comment><comment><USER52> What I found is that startups have different requirements to big established companies. As the business is not yet stable enough, it's better to write lots of hacked together lower quality code to get to product-market fit. Experienced programmers can't help too much with that part.

But experience helps tremendously when you are working with complex system that needs to be scaled and maintained efficiently. Also as an older person: why work for cheaper in a startup when you can have a higher salary at a big company? You should already know that it's not worth the effort for the stock options for an employee.

<comment><USER53> You shouldn't be writing a bunch of crap demoware to find "product-market fit" _after_ you've already setup the business.

That never seems to stop anybody from doing it, nor feckless funds from throwing money at those ventures. But you don't start a business and then hung for a product. You start a business because you have a product you intend to try to sell.

</comment></comment><comment><USER13> Reading this article is a bit lopsided. An excerpt from the book gives a clearer picture. [0] Firstly the company is in tech-marketing space and the company appears to be less about engineering than selling. The observations in this extract appear to be about company culture and selling.

 _" Arriving here feels like landing on some remote island where a bunch of people have been living for years, in isolation, making up their own rules and rituals and religion and language"_ [0]

A reference to Lord of the Flies. If you read Lord of the Flies, the disfunction runs along the lines of "insider" and "outsiders" resulting in the ritual killing of the outsiders.

The observations of bias against certain outsiders in this context are valid. The bigger question is why and who is driving this behaviour, the VC/finance industry seeking to maximise profit regardless of the externalities?

[0] "My Year in Startup Hell" ~ [http://fortune.com/disrupted-excerpt-hubspot- startup-dan-lyo...](http://fortune.com/disrupted-excerpt-hubspot-startup-dan- lyons/)

</comment><comment><USER25> "I suspect the truth is that tech startups prefer young workers because they will work longer hours and can be paid less."

Really? What capitalist wouldn't want this, especially if the quality of the work wasn't "good enough"?

I'm no fan of age discrimination, but I don't think it is an crime to choose the cheapest labor (for a given level of quality).

<comment><USER32> The capitalist who knows that those hours (particularly the ones over 40 and especially over 60) are not as productive and will actually cost money in the long run.

> I don't think it is an crime to choose the cheapest labor (for a given level > of quality)

I agree with this, but I think they are not making a wise choice on the level of quality. It is factory thinking where they need to be thinking like a film producer. This is a creative endeavor and not a widget factory. You need youth and you need age and you need people who think differently.

<comment><USER54> > agree with this, but I think they are not making a wise choice on the level > of quality

The entire premise of the article is about illegal age discrimination- a criminal act, not one of poor judgement. Making bad decisions is not necessarily a crime.

<comment><USER32> Makings poor decisions that lead to illegal acts make you a criminal.

</comment></comment></comment></comment><comment><USER55> If you're not interested in management, don't have a four year degree, and not good on-the-spot/whiteboard etc, you're in for a hard time getting hired as an aging developer, even if up to date technically.

Don't let it happen to you. Choose one or two of those to focus on and change.

</comment><comment><USER56> Perhaps what's significant about the age bias in the tech industry is that its the first time the age bias has worked in favour of younger employee's. I suspect age bias' exists in many industries that prefer more 'mature' employees.

>> these executives tried to hack into computers to steal the manuscript, and also tried to prevent publication of the book by engaging in extortion.

The problems of this company, if the allegations are true, stem more from a lack of character, which can be found across the entire age spectrum.

 __I 'm playing devil's advocate a bit here. In general, I think that age brings experience and wisdom.

<comment><USER24> > _Perhaps what 's significant about the age bias in the tech industry is that > its the first time the age bias has worked in favour of younger employee's._

Maybe you don't consider the military "industry", but they tend to recruit primarily from the young (and AFAICT, always have).

</comment></comment><comment><USER57> I think this stereotype comes from an earlier (and slower moving) era where programmers expected to learn COBOL or 4/GL and retire doing the same sort of work they learned in the beginning.

I grew up when the Internet became a thing. I've never had that expectation. I'm still learning new languages and frameworks at 34 and have no intention of slowing down.

Oh and pro tip to founders out there: if your competitors aren't recruiting middle age or older people (or black people or women), that's an untapped market! Take advantage of the things your less hungry competitors won't!

</comment><comment><USER58> HA. Excuse my language: but what the fuck? They literally tried to hack his computer to get his manuscript? Like what were they thinking??

Hopefully that was the craziest story or else that book is gonna wreck them.

</comment><comment><USER59> From a personal standpoint I can honestly say that I am far more competent at what I do now then when I was younger. That's not to say that younger people aren't as capable, it's just that through many years of working in different market sectors and with diverse companies and groups of people, the breadth of understanding that it imparts truly helps to fine tune one's business acumen, something that is hard to replicate if one is just out of university or college.

</comment><comment><USER60> If a company looks like it would hire based on age, best to look elsewhere and put it down to "their loss."

There are, I believe, many companies that do hire responsibly.

Disclosure. [mid 40s; with children;]

</comment><comment><USER61> I think the stereotypical thinking is that younger people tend to buy into the culture. Older people tend to not drink the kool-aid. Does the expertise/experience of older people win over younger people who are willing to work 80 hour weeks? I don't know if there are really any data to say one way or another. But I think the expectation that hiring younger people mean you can get more productivity out of them due to their non-jaded enthusiasm is awful.

</comment><comment><USER62> Saying something is overrated isn't necessarily saying it's inferior to alternatives, just that it has too much importance placed on it relatively speaking.

Seems like his ego got hurt and he's out for revenge. He also seems to be blind to the fact that ageism works both ways. Some of his comments, and those on the linkedin post in question, are far more worrying than those of HubSpot's CEO.

</comment><comment> trevor-e Somehow I knew this would be about Hubspot.

</comment><comment><USER63> _"in the tech world, gray hair and experience are really overrated," Halligan said._

I guess once Halligan gets a little gray hair and experience, he'll realize how absurd this statement is and will regret ever saying it.

<comment><USER64> I'm pretty sure he's quoted as saying " _my_ gray hair is overrated", or something like that.

</comment></comment><comment><USER65> I think that the younger workers in their 20's to 30's, especially the new tech workers, are really doing it because it's fun. So, working 12 hours a day 6-7 days a week isn't a big deal. Whereas the older crowd, the 40+'ers, want the same pay (or more) for 'work-life balance'. I've been told 'work-life balance' means up to 8 hours a day and up to 5 days a week, and after hours is for spending time with family and friends.

I've encountered plently of 40+'ers who discourage learning new skills during free time, programming on the weekends, hackathons, and the like. Simply because that stuff goes against work-life balance.

It's hard for me to believe that the 40+'ers are as ambitious as younger tech workers.

<comment><USER50> Why does ambition somehow now mean you have to WANT to do your job for 12 hours a day, 6-7 days a week? Do you think surgeons spend their days off at home practicing surgery on their pets as a hobby? Don't get me wrong--everyone should always be learning. But in what other profession is it expected that you continue doing your work "for fun" after hours?

<comment><USER65> I'm just saying that I think a lot of young people in the tech industry don't care about work-life balance. And those same young people wouldn't have a problem working 12 hours a day to complete a project.

Secondly, highly talented professionals do spend free time practicing their skills. Idk anything about surgeons.

I'm in tech because I think the work is fun. I'm typically on my computers up to 18 hours a day. As you can imagine I would have no problem doing some r&d after hours for fun.

Who cares what other professions are doing? I'm in tech because I'm a builder and that's what I care about.

</comment></comment></comment><comment><USER66> This guy is just promoting his book. Second time it's on hackernews. Can you please stop upvoting this garbage?

</comment><comment><USER67> > One excuse for pushing out older workers is that technology changes so fast > that older people simply can't keep up. Veteran coders don't know the latest > programming languages, but young ones do. This is bunk. There's no reason > why a 50-year-old engineer can't learn a new programming language. And > frankly, most coding work isn't rocket science.

There's plenty of reason why it'd be more difficult for a 50-year to learn a new programming language, here's a big one: time

As people get older they have more time constraints and generally have "better ( _or just other_ ) things to do". This is true for 30 vs 20, 40 vs 30, and probably 50 vs 40 (you could argue that as your kids get older you have more free time but then again people have kids at an older age now). A young person is more likely to be able to forgo those other things and learn the latest transpile-to-js-lang-of-the-week (v2.x).

Sure, people need to be evaluated individually but if I interview 100 people I'd bet dollars to donuts that the older crowd would have less free time than the youngins.

<comment><USER68> Let's concede that older programmers in their 50s may have less free time to learn new technologies than a 20-something. Shouldn't we also consider how much less time it will take an experienced dev (who has perhaps already learned several new languages and frameworks over their career) to learn something new when compared to the 20-something who is learning their first or second one?

The number of hours required to learn a second language or framework - <USER3> may rely on entirely unfamiliar paradigms and principles - may be much higher than the time required by someone who has already learned several over many years.

When considering the learning ability of any developer, free time is only one consideration. Past experience learning has to be another.

</comment></comment><comment><USER69> Lots of polarised views here. I think of it this way: if I am young and fresh from studying the latest woodworking theory from university, degree in hand, I probably think I am the shit compared to all the grandads out there who older than 35, why some even have kids! How can they keep abreast of the latest wood trends - us younger pups publish our one or two line theories on wood-npm! But.... My hands would be soft, inexperienced, and have no knowledge of actually working with real wood. If you bet your company on me, alone with other soft handed individuals, without older individuals whose hands show and have the real experience, you are screwed.

Rights of passage, and all that.</comment>


Netflix cancels Evangelion Italian dub due to fans backlash - <AUTHOR> https://www.reddit.com/r/evangelion/comments/c6it4l/netflix_italy_removes_italian_dub_after/ <comment><USER2> Some background: Netflix contacted the one that adapted the first version back in the 90s and the man has quite the reputation to create some insane (Really Bad) dialogues while translating. While he had been long excusing the stale quality with the limited time given to complete the workload, he is the responsible of the Italian adaptation of the Studio Ghibli's movies and he has received quite the critics for the use of certain terms that are either unused in common instances or even outright obscene to the people. His name is Gualtiero Cannarsi, by the way.

</comment><comment><USER3> That controversial new _English subs_ seemed much more accurate to me than the old baseline, though I can't speak for _Italian dub_.

After all it's about a language that up until the last century "being rather unhateful" meant a girl's stuck to a guy like a magnet, so...

</comment><comment><USER4> Probably need the backstory to understand what this is all about.</comment>


Great Developers Don't Need to Be "Passionate" - <AUTHOR> http://blog.qualified.io/great-developers-dont-need-to-be-passionate <comment><USER2> I would add continual development of new skills to the list. Not meaning that they have to jump on the latest trend with two-feet, but I expect some active participation in the development of new skills as being on the path to greatness.</comment>


The Freedom Box Alternative to Facebook - <AUTHOR> http://spectrum.ieee.org/podcast/at-work/innovation/the-freedom-box-alternative-to-facebook

<comment><USER2> One fundamental problem, I just don't understand in these distributed social network systems is what happens when youur "social box" goes down, electricity cut, or in the case where someone doesn't want their PC running a power bill all day long. In houses where people don't use a local server or don't need anything on all the time (this is a realistic scenario in my experience), how does this work in the context of the freedom box.

Does that mean my social presence is offline when I am ??

Seems fundamentally flawed.

<comment><USER3> As far as I can tell, the Freedom Box _is_ the server, so you would only go offline if you unplugged the wall wart containing the software. It also seems like there's a chance that you wouldn't go down if your internet went down, as long as you had enough of a concentration of Freedom Boxes nearby that your packets could be delivered via mesh to someone whose internet had not gone down, or directly.

This Freedom Box stuff is new to me, and I'm finding Moglen talking about it very difficult to parse. I'm going to try the speech at [http://freedomboxfndn.mirocommunity.org/video/4/freedom- in-t...](http://freedomboxfndn.mirocommunity.org/video/4/freedom-in-the-cloud)

If this allows my friends to get off facebook, and allows me to get back the sort of community of distant friends that I had when I was on facebook without the middlemen and any ominous privacy implications, I'm all for it. Also, I'd love to directly share content with non-technical people I know without the overhead of domain names and webhosting.

At the price point of <= $100 dollars in return for an actual physical product, I'm sure I could get most to all of my friends to use it. Myself, I'll just install the software to my HTPC (which has evolved into the central server for my house) for free, but I think that with a price point that low, my non computer-savvy friends would pay to get off of facebook in return for something they could touch, wasn't complicated, and couldn't be shut down at the whim of some corporate board.

Just my thoughts though. If you require a presence on the social web regardless of power cuts, then I guess it's a dealbreaker for you.

<comment><USER2> Please don't get me wrong, I really like the idea, I just think that my non tech savvy friends will immediately dismiss the idea of "normality" we have come to assume with the facebook pages always being on.

The hard truth is many of the people I talk to use facebook primarily to look at other peoples pages, if you look at facebook chat now and see exactly how many are online, it at best makes about half of your friends invisible.

I think this is a better solution than facebook if feasible to implement

<comment><USER3> If all of that facebook-page-type-stuff was saved on the wart, then we wouldn't be prevented from browsing through it while they were personally offline with their computer powered down. I assume that would be the plan - but if I'm wrong, I would share your doubts about this catching on as a drop- in facebook replacement.

-edit-

To be clear, I'm imagining pictures, an activity stream, a presence server, and maybe a calendar and a blog sitting directly on the wart - independent of a separate computer to such an extent that a person wouldn't even have to own an actual desktop or laptop to use the appliance to its full extent, maybe just a cell phone app to update these things, or even updating them through public or other people's computers over the internet. If friendly neighbors left their freedomboxes open to your through traffic, it might not even necessitate a local internet connection.

<comment><USER2> Ok, sorry my original comment was incorrect, I meant "by me being offline" by the physical device being unplugged or say electricity lost. And yes the wall plug idea is nice and really I would love this to be a reality, but there will have to be some sort of breakthrough in this distributed nature.

Some sort of p2p hosting solution, not sure how it would work exactly.

<comment><USER3> Noticed from the Kickstarter page:

"Such boxes exist in the form of plug computers and mesh routers, tiny, inexpensive machines that can take the place of other electronics in your life, that draw so little power (often as little as 5W) that they can be run off of batteries or solar panels."

[http://www.kickstarter.com/projects/721744279/push-the- freed...](http://www.kickstarter.com/projects/721744279/push-the-freedombox- foundation-from-0-to-60-in-30/)

</comment></comment></comment></comment></comment></comment><comment><USER4> To replace the firewall/router AND host all my private personal data in one box, I'm going to need a ton of convincing about security. This appliance will be a hot target for exploits, and they're going to have to do an incredible amount of ongoing testing and updates. I can't imagine this is feasible for the $100 price tag they are quoting.

</comment><comment><USER5> There is an inordinate amount of philosophising in the freedombox camp. Really it's just a distro project, and nearly all of the packages required already exist. What remains is just an easy installation procedure such that you can enter some details and are then ready to go. They should put the philosophy and speculation about alternative platforms to one side and make a serious effort to start releasing early, because there are folks out there who could really benefit from these devices.

<comment><USER6> If the amount was ordinate, they wouldn't have come up with the idea and work on the implementation in the first place. So the issue is what you think about their philosophy and implementation.

<comment><USER5> <http://youtu.be/T-CkD98FJ24>

<comment><USER6> Do you have a tl;dr? The title is bad already, "freedom or tyranny". I think there is more to this than good vs. evil. But looking at RMS, you can see that black/white thinking can produce licenses that work great in the hands of people who think more colorful (the free software scene).

</comment></comment></comment></comment><comment><USER7> Why can't this be a software application instead?

<comment><USER7> Oh pardon me. It was answered. Although the answer doesn't make any sense, atleast to me.

<comment><USER8> That was my first question too. Why not just make it out of a modified software firewall? That way you can run it on your wireless mobile devices as well, and not be vulnerable when connecting from Starbucks or wherever.

It looks like they have plans for that too. The physical box part is apparently for Apple-ish, plug-and-play ease of use, while software will also be available:

 _> James Vasile: Well right now we've convened a technical advisory committee. These are people who have deep expertise in the various difficult things that the Freedom Box is going to have to do extremely well. And those people are right now coming up with a road map for development that will lead us to actual software that can be loaded onto boxes, not just Freedom Boxes, I mean, if you want to load this onto your PC that will be an option although you'll need somewhat more technical knowledge than simply plugging in a box. But we're at the road-map stage right now. People are planning the architecture and figuring out what existing free and open source software we can pick off the shelf and put in the box to do most of the things that we're planning on accomplishing._</comment></comment></comment>


Ask HN: What should I do before building a MVP? - <AUTHOR> I have a rough idea about a product finder website I want to build as a side project, but I don't really know how to measure market interest.
I heard about strategies that include building a nonfunctional landing page and running a Google ad campaign for that, but I would like to learn about other options.
Are there any good resources on this topic? <comment><USER2> A great writeup is the No-BS Approach by Clifford Oravec. It's a splitted in 4 major parts. Check out [https://medium.com/@cliffordoravec/the-epic-guide-to- bootstr...](https://medium.com/@cliffordoravec/the-epic-guide-to- bootstrapping-a-saas-startup-from-scratch-by-yourself-part-1-4d834e1df8c1)

<comment><AUTHOR> Thanks, I will check it out!

</comment></comment><comment><USER3> I'd suggest this resource: [https://blog.ycombinator.com/minimum-viable- product-process/](https://blog.ycombinator.com/minimum-viable-product- process/)

<comment><AUTHOR> Didn't know about this one, thanks!

</comment></comment><comment><USER4> you should do as much customer research as possible and describe a solution for their common problems before building an MVP to validate it</comment>


Samsung Galaxy S now #1 in Japan, displacing iPhone 4 - <AUTHOR> http://www.bgr.com/2010/11/04/samsung-galaxy-s-now-1-in-japan-displacing-iphone-4/

<comment><USER2> "the Galaxy S managed to take the top spot, though only when considering the 32GB and 16GB iPhone models individually."

Bit of a link-bait headline.

</comment><comment><USER3> Also not news since the iPhone 4 has been out FOREVER when compared to the Galaxy S</comment>


Show HN: PDFlower – Reflow PDF papers for small-screen reading - <AUTHOR> https://pdflower.com <comment><AUTHOR> The majority of scientific and technical papers are delivered by the PDF file for portable presentation. However, it difficult to read the PDF paper on small screen devices, such as tablets and eBook readers.

So I wrote PDFlower to reflow PDF papers for small-screen reading.

Compared with plain-text extraction based tools, PDFlower reconstructs the object level - columns, formulas, tables and figures - layout using some smart heuristics, and then renders them for new page size.

<comment><USER2> Example pictures are kind of small, hard to see the quality of the result. Also, I'd use this for a Kindle device, not an iPad, so it'd be also good to see how it looks in a Kindle.

<comment><AUTHOR> \- The output is a reflowed PDF. It keeps 'PDF quality'. \- Any PDF reader/device could display new version paper technically. \- Kindle has supported.

</comment></comment></comment><comment><USER3> Does anyone know an open-source solution for this? What I read is no one's business and I would never used a web-hosted service for something like this.

<comment><USER4> k2pdfopt works ok for me.

(bash function)

        tokindle () {
          ~/Software/k2pdfopt $* -dev kpw -mode fw -wrap -hy -ws 0.375 -ls-
        }

<comment><USER5> There's also koreader, which just uses k2pdfopt on the fly.

<comment><USER4> koreader looks fabulous! Last time I checked, the Paperwhite could not be jailbroken. But it no longer seems true. Thanks for the link.

<comment><USER6> Yes! All versions can now be easily jailbroken. The main features (to me) are installing KOReader to view epubs and pdf files, and hacking the screen saver display. The process only takes about an hour, mostly because you are reading, doublechecking, and downloading the right files. This guide[0] is a very good overview. I find mobileread's site to be too wordy and difficult to follow.

[0] [http://lifehacker.com/how-to-jailbreak-your- kindle-178386407...](http://lifehacker.com/how-to-jailbreak-your- kindle-1783864074)

<comment><USER7> Which version would you buy if you were buying a Kindle today? I only owned the one before the DX... managed to crack the screen in an unfortunate elbow- related incident.

<comment><USER4> Paperwhite has been really good to me. Both Oasis and Voyage look great as well - they have higher resolution than the Paperwhite. And they have real buttons to move between pages, so if I were buying a Kindle today I'd buy one of them depending on my budget (Oasis is more expensive, but slimmer).

<comment><USER8> Current (and previous) generation Paperwhites have the same resolution as the Voyage and Oasis. I have a Paperwhite and the screen is fantastic. I'd love hardware buttons for page turning, though.

While the Oasis is expensive, if you add a nice cover to the Voyage you're close in pricing. Either go solidly midline with the Paperwhite or go all out with the Oasis, depending on your budget.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I would like a "pricing" and a "privacy policy" link on the front page. Probably won't spend time trying it out due to the omission.

Luckily there are interesting self-hosted / local options mentioned in this thread.

<comment><USER10> Exactly the same here. I won't go through the [maybe] lengthy process of creating a new account to get a paywall then. Same goes with the privacy policy, I don't want to use it with my own PDFs and lose their rights or with other people's and screw things legally.

</comment></comment><comment><USER11> Very cool. How hard would it be to go in the opposite direction? When I'm using a desktop or a laptop computer it's most annoying that almost all news sites, blogs, eg. optimize for a portrait orientation. I can only see a relatively small amount of text so I have to scroll constantly, despite the acres of available whitespace to either side. It's really annoying when reading anything complex where you'd want to refer back to previous sentences or paragraphs frequently to make sure you've understood the substance properly. I would love to be able to reflow into 3 or 4 columns though...

<comment><AUTHOR> Thanks for your comment.

The PDF format will ignore some structures of paper and `draw` contents on a fixed-layout flat document. For a char, e-readers cannot know it belongs a paragraph, a figure caption or a formula. Plus, publishers render original paper with the specific style. It is a problem. Some research concentrate to improve PDF format, extract infos for scholarly papers, like articles on DocEng - a compute science conference: [http://dl.acm.org/event.cfm?id=RE135](http://dl.acm.org/event.cfm?id=RE135). Then I read the spec of PDF format...

Anyway, that's hurt.

</comment></comment><comment><USER12> That's the feature Kindle PDF reader should have built in from beginning.

Waiting in the queue for my account.

<comment><USER13> Unfortunately the kindle is optimizing for users buying Amazon content, not for being the best general purpose eReader. This incentive mismatch between Amazon and the end users is probably why we will never see such a feature built in.

<comment> semi-extrinsic If you jailbreak your Kindle and install Koreader (mentioned upstream) you can have high quality PDF reflow, with support for two-column layouts as well as math and displayed equations, on your Kindle today.

Here are some example images:

[http://www.epubor.com/how-to-install-and-use-koreader-on- kin...](http://www.epubor.com/how-to-install-and-use-koreader-on-kindle.html)

<comment><USER14> Wow, that's quite the (both) useable and useful software - thank you for the link. I'm not normally part of the "x should buy this out" group, but in this case, Amazon really should.

<comment><USER15> No, they shouldn't - because if it goes against their business interest (having Amazon-bought books look better than manually uploaded content), they'll shut the project down.

</comment></comment></comment></comment></comment><comment><USER16> Interesting and I might have a use for this professionally. But there is no indication on the main page about how it works (web service? code library?). And it forced me to login on the second page, so I closed the tab.

</comment><comment><USER17> I thought I'd give it a try. But... Signup Queue? I had never seen anything like that.

Signup Queue

Hi, <my_email>

* You are on your way to PDFlower.

* 269 people in front of you.

* 0 people behind of you.

* Sharing this referral link may change your position in queue. Have a try. <referral_link>

<comment><USER18> I've seen that before. It's a pathetic attempt to force viral sharing. I never participate on principle.

</comment></comment><comment><USER19> This is something I haven't found an ideal solution for yet. There are existing iOS PDF readers with reflow, but each seems to have its own issues.

To echo what others have said, this is an actual pain point and I'm very willing to spend money on a solid solution. I've bought a few different PDF readers just on the chance their reflow would be better than what I've found elsewhere.

So I clicked on your link pretty ready to throw money at you, but I'm not sure what I'm looking at. Is this an iOS app? Android app? It seems like some kind of service, since it wants me to login, but I can't tell.

Consider working on the messaging and then reposting this. There's definitely a market.

<comment><USER20> Could you please name it?

</comment></comment><comment> saint-loup Adobe Reader has a little-known function similar to this. Go to Display > Zoom > distribute (the last entry). It works reasonably well with simple, clean documents. You can check wether the document is compatible in its property panel.

</comment><comment><USER21> If you're interested in doing this for sheet music (sort of a similar-ish problem), check out my product soundslice.com. Auto-reflowed sheet music depending on your device width.

</comment><comment><USER22> I'm also working on this PDF reflow and posted a video demonstration on my twitter. Ping me if you would like to test: [https://twitter.com/ldenoue/status/785142066665971713](https://twitter.com/ldenoue/status/785142066665971713)

</comment><comment><USER23> Cool concept. This should be built into all smartphones and tablets and automatically run when they open PDFs.

</comment><comment><USER24> I just want something that'll collapse 2 columns into 1.

</comment><comment><USER25> would be great, if you could provide a guest account to try it out. I closed the window as soon as I saw the signup form..

</comment><comment><USER26> Ah, reminds me of the Celery tool Flower, pronounced flow-er rather than flour. How is this one supposed to be pronounced?

</comment><comment><USER27> Just want to comment that if this worked well I would pay for it. Probably up to ~5 or maybe even 10 dollars a month.

<comment><USER22> I'm working on a similar system. Would you like to test it? [https://twitter.com/ldenoue/status/785142066665971713](https://twitter.com/ldenoue/status/785142066665971713)</comment></comment>