Evolution of words frequencies in porn - <AUTHOR> http://porngram.sexualitics.org/ <comment><USER2> To speak of evolution when your time frame is 2008-2012 is somewhat far fetched. But I believe I see a reassuring trend here: [http://porngram.sexualitics.org/?q=erlang%2C+clojure%2C+Ada%...](http://porngram.sexualitics.org/?q=erlang%2C+clojure%2C+Ada%2C+scala%2C+rust)

<comment><USER3> I would be terrified if "brainfuck" had a nonzero frequency.

<comment><USER4> I wouldn't bet hard money that it doesn't exist, there is always Rule #34.

[http://xkcd.com/305/](http://xkcd.com/305/)

</comment></comment></comment><comment><USER5> 1\. It doesn't count word frequencies, but sub-string frequencies. Moreover, if a sub-string appears more than once-per-title, then it is counted more than once. I draw this conclusion by submitting "a,b,c". And from their paper [1]:

       our algorithm strips out dashes and catches any
       occurrence of the query in the title, for example,
       'blow' catches 'blowing', 'blowjobs'

This explains the results of these queries: "ada,erlang", "tea,beer". As an alternative they could have used a stemmer [2].

2\. The "slow,fast" and "love,hardcore" trends illustrate an interesting trend. Perhaps towards women or mainstream viewers.

[1] [http://sexualitics.org/wp- content/uploads/2014/01/PORNSTUDIE...](http://sexualitics.org/wp- content/uploads/2014/01/PORNSTUDIES_preprint.pdf)

[2] [http://nlp.stanford.edu/IR-book/html/htmledition/stemming- an...](http://nlp.stanford.edu/IR-book/html/htmledition/stemming-and- lemmatization-1.html)

<comment><USER6> > 2\. The "slow,fast" and "love,hardcore" trends illustrate an interesting > trend. Perhaps towards women or mainstream viewers.

I don't think so [1]

[1] [https://www.google.nl/search?q=teen+loves+to&oq=teen+loves+t...](https://www.google.nl/search?q=teen+loves+to&oq=teen+loves+to+fuck)

</comment></comment><comment><USER6> In my first 2 weeks of working at an adult company (as a dev yes, it's sad) one of my tasks was to watch/scan 200+ video's and describe them.. It's true, you run out of inspiration fast. Also I could hint you: the "love" in the titles is probably explained by "love(s) to <insert profanity> ". I don't think I ever used hardcore in a title.

<comment><USER7> I used to work with a guy who once worked as a dev at an adult company. He said it was the most soul-sucking experience of his career, and that the owners knew absolutely nothing about technology and treated their tech staff terribly.

Based on the fact that you had to spend your first two weeks doing data entry, it sounds like his experience wasn't unique.

<comment><USER6> I didn't quite learn if this was an industry thing. Never met other devs in the industry from other companies. He painted a perfect picture.

Just talking about it makes me unhappy :)

</comment></comment></comment><comment><USER8> Traditional professions are still on top:

[http://porngram.sexualitics.org/?q=pizza%2Cdelivery%2Cplumbe...](http://porngram.sexualitics.org/?q=pizza%2Cdelivery%2Cplumber%2C+programmer)

I sense a business opportunity there.

<comment><USER9> [http://porngram.sexualitics.org/?q=pizza%2Cdelivery%2Cplumbe...](http://porngram.sexualitics.org/?q=pizza%2Cdelivery%2Cplumber%2Cprogrammer%2Cteacher%2Cwhore)

Teaching and prostitution clearly dominate.

</comment></comment><comment><USER10> Quite fun!

Next: provide the porn industry a simple markov chain script to generate probabilistic porn movie titles, and save them all those incredibly tiresome brainstrom sessions they must have to create new titles :)

<comment><USER11> This reminds me of the first time I implemented a markov chain text generator. We were at a LAN party so we looked on the public network shares to find a corpus of text files to use as input.

The first thing we found was a copy of the bible and the second thing we found was someones collection of porn stories.

The start of the output was "He slipped his tongue into the lord..."

<comment><USER12> "... and Lord came unto him"?

<comment><USER13> Standard missionary work.

</comment></comment></comment></comment><comment><USER14> [http://porngram.sexualitics.org/?q=btc%2Cusd](http://porngram.sexualitics.org/?q=btc%2Cusd)

</comment><comment><USER15> [http://porngram.sexualitics.org/?q=iphone%2Candroid](http://porngram.sexualitics.org/?q=iphone%2Candroid)

<comment><USER16> I find the graph shapes amusing given the data source :)

</comment></comment><comment><USER17> [http://porngram.sexualitics.org/?q=hipster](http://porngram.sexualitics.org/?q=hipster)

<comment><USER18> I wonder how we survived before 2009 without hipster porn.

</comment></comment><comment><USER19> Strange: [http://porngram.sexualitics.org/?q=tea,wine,beer,coffee](http://porngram.sexualitics.org/?q=tea,wine,beer,coffee)

<comment><USER20> In a similar vein:

[http://porngram.sexualitics.org/?q=breakfast%2Clunch%2Cdinne...](http://porngram.sexualitics.org/?q=breakfast%2Clunch%2Cdinner%2Csnack)

</comment></comment><comment><USER21> I wonder if we'll soon see an Upworthy for Porn: "You will never believe what this girl did to pay her rent"

<comment><USER22> "He was just there to fix the cable. What happened next will shock you"

</comment></comment><comment><USER23> Very interesting to see the dataset being made available. Whenever I want to do this kind of analysis, I always stumble at 'how to get the data?'. In their paper, it is mentioned that "We created a dedicated computer program to carry out the navigation and data collection tasks required to gather the metadata for all available videos...". I would love to see this program. More broadly, can anyone help me with best resources (pref python) where one can learn to crawl/scrape this type of information?

<comment><AUTHOR> Hi, I didn't release the code of the crawler, first, because it was not well- crafted enough to be released (quick and dirty linear programming), and second, because any change in the site you crawl calls for recrafting your code.

I used python, sometimes with Beautifulsoup, sometimes with lxml, both are very good for crawling. I would say BS is easier, and LXML cleaner.

</comment></comment><comment><USER24> _words frequency_

Is the title a British thing? Like maths vs. math?

<comment><USER25> As a native Brit, looks like a mistake to me.

</comment></comment><comment><USER26> So I did gay vs lesbian and I was confused why there was a big spike in 2010 for gay that has since dropped off. Is this an anomaly in their sampling?

Also Obama's numbers have really dropped compared to Bush: [http://porngram.sexualitics.org/?q=bush%2Cobama](http://porngram.sexualitics.org/?q=bush%2Cobama)

</comment><comment><USER27> I suppose we may as well do the obvious ones

[http://porngram.sexualitics.org/?q=BDSM%2Ctorture%2Cpain%2Cr...](http://porngram.sexualitics.org/?q=BDSM%2Ctorture%2Cpain%2Crape)

:/

<comment><USER28> I dunno, the less obvious ones are more interesting.

[http://porngram.sexualitics.org/?q=twat%2Ccunt%2Cfist%2Cprol...](http://porngram.sexualitics.org/?q=twat%2Ccunt%2Cfist%2Cprolapse%2Cscrote%2Cbeast%2Cschlong)

</comment></comment><comment><USER29> Kind of interesting, but really needs statistical error bounds

</comment><comment><USER30> [http://porngram.sexualitics.org/?q=HIV%2CAIDS](http://porngram.sexualitics.org/?q=HIV%2CAIDS)

</comment><comment><USER31> [http://porngram.sexualitics.org/?q=cup](http://porngram.sexualitics.org/?q=cup)

</comment><comment><USER32> "sister" :-)</comment>


Ask HN: Books you plan to read in 2019? - <AUTHOR> Any books you cannot wait to read next year? Or is there something you really wish to learn? Curious about <i>all</i> kinds of great book suggestions for 2019. Thanks for sharing! <comment><USER2> Programming Rust. I've used it in the past and never quite felt great about a few aspects of it (lifetimes, for example). Now however a work situation is arising where Rust might be preferred, so deep into the pool I go.

It'll make me a better programming regardless, so it's good for me. I look forward to improvement :)

</comment><comment><USER3> Not quite book, but I would like to read all laws and regulations related to business, finance and taxation such as the Companies Act etc as applicable to India. I will be transitioning to becoming a businessman in 2019 and its pertinent that I make myself at home with these topics so that I am not swindled by lawyers and auditors, or even the government for that matter.

<comment> a-saleh From what I heard, best thing is to have a good lawyer and a good accountant recommended by somebody in business you can trust.

Not saying you should either learn on your own or have somebody recommended to deal with this for you, I thing you should one _and_ the other.

I do wish you luck, I am still gathering courage to venture into business on my own :)

<comment><USER3> Thanks for the wishes, and I hope you do it soon as well :)

I am one of those people who don't trust people easily. And given the increasing amount of white collared crimes being exposed, I am completely disillusioned with these professionals. Of course, I will have to avail the services of these people but I want to make myself bulletproof against their well established work ethics. Not only do I not want to get swindled, I also don't want to be led astray. I want to conduct business honorably.

</comment></comment></comment><comment><USER4> I've bought _the Critical Chain_ by E. Goldratt two weeks ago and I've been enjoying the anticipation of reading it. _The Goal_ was a real eye opener and I hope that the Critical Chain will bring me new insights on project management specifically (the Goal is a great introduction to lean methods but it is heavily geared towards manufacturing processes).

<comment><USER5> I really liked _The Goal_ (though the family side story was a bit strained at times, the experience with his kid and scouts in a "model" environment was useful though).

While it is geared towards manufacturing, I think pairing its concepts along with Mary Poppendieck's writings on Lean in software development is very helpful. A lot of her writing (especially the more introductory books) put in the effort to translate Lean Manufacturing ot Lean Software.

For instance, we don't have "inventory" in the physical sense. There's very little cost in the retaining of un-shipped code. But there is cost in that we don't get value from it. And our understanding of it goes stale over time (for the individual who wrote it and the organization who "owns" it, especially if the creator leaves or moves to other projects).

Pairing her work with writings from traditional Lean and Theory of Constraint sources (focused in manufacturing) is an excellent way to take those theories and apply them to our field.

<comment><USER4> Thanks for the pointer to Mary Poppendieck, I hadn't heard of her. Which book of hers would you suggest I pick up first ?

<comment><USER5> I think the first one I read was _Lean Software Development_ then I went through _Leading Lean Software Development_ and _Implementing Lean Software Development_.

It's been a while, but as I recall the latter two can be treated something like workbooks. How to go from "traditional" project management towards lean/agile. The former introduces many Lean concepts but within the software development world. So that's where I got the idea (maybe I'd seen it before I read that book?) about treating developed, but not integrated, code as "inventory". It has a cost because we have to eventually integrate it but it'll become "stale" over time as its interfaces or other features become further from the main branch.

If you have a Safari Books Online account they're probably in there. I found them to be fairly easy reads, perhaps spending 2-3 weeks on each. Applying it at work, of course, has taken a lot longer.

</comment></comment></comment></comment><comment><USER6> Sci-fi

\- Ready Player One

\- Pattern Recognition

\- Burning Chrome

\- Do Androids Dream of Electric Sheep?

\- Hyperion

\- A Fire Upon The Deep

Technical (backend development + security)

\- HTTP: The Definitive Guide

\- RESTful Web Services

\- Designing Data Intensive Applications

\- Web Scalability for Startup Engineers

\- The Art of Software Security Assessment

\- The Web Application Hacker's Handbook

\- A Philosophy of Software Design

\- Clean Architecture

\- The Go Programming Language

\- Refactoring (new 2nd edition)

\- Algorithm Design Manual

\- Cracking The Coding Interview

I'll definitely be able to get through all the sci-fi novels, but not the technical stuff. At minimum I need to go through the technical interview prep books, refactoring, and designing scalable applications.

<comment><USER7> Yay! Read Hyperion. Its a great book. I've literally read a couple hundred sci-fi novels and it's one of my favorites.

</comment></comment><comment><USER5> Several books by Jerry Weinberg (started last year) on systems and _Thinking in Systems: A Primer_ by Donella Meadows.

Alongside those, my current job has me programming less, so I'm enjoying it as a hobby again. I've decided to pick up Common Lisp again so I'm going through various texts on it as exercises to relearn the language and its extent.

</comment><comment><USER8> I've had a wonderful experience with all of the No Starch Press[0] books I've bought over the last few years. I recently got Absolute OpenBSD and Serious Cryptography. How Linux Works is also really good if you would like to brush up on your knowledge of the architecture of the average Linux system.

I'm not affiliated with them, I just haven't gotten a bad (or even mediocre) book from them.

[0]: [https://nostarch.com/](https://nostarch.com/)

<comment><USER9> Any thoughts on their humble bundle?

<comment><USER8> They've got a couple of different options (Linux and hacking are the ones I found with a quick DDG search). I have yet to read any of the books in the hacking bundle or most of the Linux ones but I would expect that they would be good considering my previous experiences.

</comment></comment></comment><comment><USER10> * The Bogleheads' Guide to Investing

* The Algorithm Design Manual

* Cracking the code interview

* Some Elixir books

</comment><comment><USER11> Not sure if this fits the criteria but I plan to read the Unbearable lightness of being this coming year.

So many people have recommended it that I cannot not ignore it any longer.

</comment><comment><USER12> Tech:

* Programming Phoenix, latest edition. I plan on launching a side project with Phoenix in 2019.

* The Rust Programming Language. I want to build simple CLIs in Rust as my gateway into the language - will use what I lean here to do it.

Non tech:

I have about 25 unread history, art history, and culture books in my bookshelf. My plan is to exercises self-restraint and not buy more books until I finish these!

</comment><comment><USER13> 95 Best Books for Smart Minds to Read & Re-read for a Refreshing Start in 2019:

[http://casualwalker.com/95-best-books-to-read- in-2019/](http://casualwalker.com/95-best-books-to-read-in-2019/)

</comment><comment><USER14> I'd love to begin the year with a book on Rust and another one on being a team manager/lead because I got promoted as a lead (a team of 8) but I totally feel I'm unprepared.

<comment><USER15> Congratulations on your promotion! Let me recommend the classics: _The Phoenix Project_ and _High Output Management_ by Andy Grove. The latter is from 1983, but the principles are in use in my company today, and it is the start of OKRs, used by Google and others to this day.

<comment><USER14> Thanks for the suggestions, these books have just been added to my shopping cart. I'm afraid to not have enough experience (5 years) and so I'm trying my best to overcome any lack of experience with study.

</comment></comment></comment><comment><USER16> Muqaddimah of Ibn Khaldun (Ibn Khaldun's Prolegomena)

</comment><comment><USER17> Mindset by Carol Dweck. I feel that I'm stuck in a fixed mindset in some areas, so I want to explore ways of dealing with that.

<comment><USER18> Terrible book. The concept is explained in two or three pages and repeated during the whole book without introducing anything new.

Watch a free YouTube review and go spend the money and time on something else.

</comment></comment><comment><USER19> 1\. Bad Blood, John Careyou

2\. Gödel, Escher, Bach by Douglas Hofstadter

3\. The Master Switch: The Rise and Fall of Information Empires

4\. Zero to one Peter Thiel

5\. The republic – Plato

6\. The Hard Thing About Hard Things, Ben Horowitz

7\. The 1-Page Marketing Plan: Get New Customers, Make More Money, And Stand Out From The Crowd Kindle Edition

8\. Shoe Dog: A Memoir by the Creator of Nike

9\. Never split the difference

10\. The Lean Startup: How Today's Entrepreneurs Use Continuous Innovation to Create Radically Successful Businesses Hardcover

11\. The Four Steps to the Epiphany: Successful Strategies for Products that Win

12\. Economy course: [https://www.core-econ.org/](https://www.core-econ.org/)

<comment><USER20> I actually was part of the CORE team. It's nice to see people actually reading it!

In my (biased) opinion, it is a very good introduction to the _economy_, though it is perhaps too light on _economics_ [0]. That is to say, it is much, much better than other introduction-to-economics textbook at presenting the relevant facts about the economy but is a bit light on analytical tools. If one wants to go beyond this textbook, they would have to learn them. If I were to offer a comparison, CORE econ is to traditional econ textbook what a natural history of the universe book might be to a physics textbook: many more topics covered including those that would not be addressed in an intro textbook but less studying of models.

Hopefully, if it catches on, we will hear fewer people arguing "Well, it is just basic economics that X" where X is something that it true in the toy model of econ 101 that is useful for learning but not really in real life.

I would suggest completing this book with some econometrics - since it is those tools that allow us to (try to) see which theories may be right and which may be wrong. The books by Pischke & Angrist are good: "Mastering Metrics", and at a higher level, "Mostly Harmless Econometrics".

The Journal of Economic Perspectives [1] is a great resource to learn more about a topic in economics. As it says: > The Journal of Economic Perspectives (JEP) fills the gap between the general interest press and academic economics journals.

The HN crowd would also most likely like the Quantitive Economics lectures [2] from Sargent & Stachurski.

[0] It is also a low density textbook, which seems to be common in American textbook

[1] [https://www.aeaweb.org/journals/jep](https://www.aeaweb.org/journals/jep)

[2] [https://lectures.quantecon.org/](https://lectures.quantecon.org/)

<comment><USER19> Thanks for this. I'll have a look at the books you mentioned.

</comment></comment></comment><comment><USER21> The Prime Number Conspiracy, Heretics of Dune, and Im looking for an investment book to read.

</comment><comment><USER22> Here's a few:

\- chapters 4 and 5 of SICP

\- Fowler: Refactoring, 2nd Edition

\- Gehl: Cities for People

\- Cohen: The Book of Numbers

\- Drnaso: Sabrina

</comment><comment><USER23> Finally reading Goedel Escher Bach.</comment>


Jerry Brown on a California Exodus: 'Tell Me: Where Are You Going to Go?' - <AUTHOR> https://www.nytimes.com/2020/09/14/us/politics/jerry-brown-on-a-california-exodus-tell-me-where-are-you-going-to-go.html <comment><USER2> "Tell me, where are you going to go?" threatened the abusive husband to the cowering wife.

That comment is a bit "let-them-eat-cakey" even for California royalty. And the other comments seemed to me more "après Jerry, le delugé"...pretty typical for guys like him of his age.

Consider the 1960s, probably the most formative decade for California as a US State. When the "death of the hippie" was announced in 1967, the heat-seekers were already leaving. Some stayed in California, but many went to small obscure places in the rest of the US. Under-appreciated places that were made the new cool places by the creative energies of the newcomers. They did not move to prepackaged hipness...there wasn't any, except for maybe NYC and they had just left there to go to SF and weren't coming back.

If the Bay Area or California is your place of the heart, then you should stay. But don't stay out of fear. There is a big wide wonderful country out there, and you have the golden ticket to go wherever you want. Keep your mind open, make a commitment when it's right, and build a good life wherever your heart tells you to stay. But don't be a self-important preachy idiot to the locals in the process, or your bodily remains will be discovered in some bayou, holler or arroyo.

</comment><comment><USER3> Somewhere with lower taxes. Somewhere with fewer homeless. Somewhere with a less ideologically-driven state government.

Somewhere that lets fires burn now and then, to keep them from turning into monsters when they do happen. Somewhere that has a power company that is able to maintain infrastructure, rather than having that infrastructure causing fires. And somewhere that allows a new power plant to be build every once in a while, so that they don't keep having rolling blackouts year after year.

To the degree that the fires are a product of global warming/climate change, and that's also causing worse tornadoes and worse hurricanes, to that degree there's kind of nowhere to really go. I mean, you can dodge the effects to some degree, but not really.

But to the degree that the fires are a result of bad decisions, going somewhere that competently makes such decisions does in fact make sense.

<comment><USER2> "You can dodge the effects to some degree, but not really."

Yes really (statistically really) you can. You personally. Not the county or the region, but you personally can. The likelihood of being affected by fires, floods, earthquakes, hurricanes, tornadoes and bad Mexican food can be reduced or eliminated by where you live and how you live in the US. Don't live on a fault line. Don't live on the Gulf Coast. Don't live in a fire-prone forested area. Or build your house to be robust to the regional risks...ask the locals. You absolutely have meaningful agency in this. Whether or not it's all just weather and the tzu-jan of Nature.

</comment></comment><comment><USER4> "Where Are You Going to Go?'

" ... We are causing this,"

Yes, we are causing this. And as an essential worker (trucker), who rents (not in California), all I can do is vote, converse, and post the occasional snarky comment.

If my rental and community burned to the ground, I would obviously move, and I'd give serious consideration to moving somewhere that is not doing ... this, _at the moment_ , since the moment is a renter's most relevant investment.

</comment><comment><USER5> Arizona. We've been seeing more and more California license plates since the pandemic started.</comment>


Mac to Surface Book: Making the Switch from Mac - <AUTHOR> http://www.microsoft.com/en-us/switch/mac-surface <comment><USER2> Make the transition? Maybe. Make it now? No.

Wait for version 2.0, at least.

Read Joanna Stern's review for the WSJ.

<comment><USER3> This is the fourth generation (fifth?) of the Surface. How many versions do you need?

<comment><USER4> SurfaceBook is 1.0, and the subject of this post. SurfacePro is I think what you are referring to, and is on its 4th iteration.

</comment></comment></comment><comment><USER5> Yea, right. Maybe if it had OS X or Linux on it? I'm sure the hardware is ok, but at least developers need a POSIX compliant environment, and Microsoft does not have anything much to offer these days. It's a new world.

<comment><USER6> Developers /need/ a POSIX compliant environment you say?

You speak for all of them?

<comment><USER7> For anything else other than .NET development a POSIX compliant environment is highly advantageous over a Windows environment.

I speak out of experience.

<comment><USER6> I think any devs making the very unlikely switch to Windows would know what they need to do get their POSIX fix.

In any case, this article seems to be rightly aimed at non devs.

<comment><USER5> Why would you go this route though? Unless you must do .NET professionally, there's no real reason for devs these days to use anything Windows. It just makes everything much more complicated, and many compromises because of platform readiness of many of the cutting edge projects (everything seems to start today on OSX/Linux).</comment></comment></comment></comment></comment>


Ask HN: What's the best place to find freelance Copywriters? - <AUTHOR>

Is there a certain online site/ platform where I could find a good copywriter to write and review some website copy & documentation?<p>Thank you. <comment><USER2> You could try <http://www.textbroker.com> and bid on their level 5 professionals. Typically excellent work as long as you provide excellent directions.

</comment><comment><USER3> boostctr.com

</comment><comment><USER4> At your service. Email is in my profile.</comment>


You sold 17M albums and you want to pay me nothing - <AUTHOR> http://www.theguardian.com/music/2015/apr/19/garbage-pat-pope-photography-you-sold-17-million-albums-and-you-want-to-pay-me-nothing

<comment><USER2> The linked Ellison interview is pretty good.

I have a similar feeling about open-source software and engineering and development. As michealochurch pointed out, we're quite good at _producing_ value, but shitty at _capturing_ it.

I love helping out my fellow engineers and folks starting out, but the fact that the majority of projects are just going to be used to line some fucking MBA's pocketbook in saved expenses kinda sickens me.

<comment><USER3> and you gotta realize the response from the 'band' was most definitely not from Manson et al. but from the same crap ass marketing douche that send the original request.</comment></comment>


Laurie Voss, NPM co-founder, resigns - <AUTHOR> https://www.theregister.co.uk/2019/07/18/npm_uninstall_cofounder_global/ <comment><USER2> Paul Krill @ InfoWorld reports npm disputes the rumors of the public registry's demise. [https://www.infoworld.com/article/3412143/npm-free-public- ja...](https://www.infoworld.com/article/3412143/npm-free-public-javascript- registry-will-continue.html)

</comment><comment><USER3> If it's true that they want to kill the public registry, that means I may need to seriously investigate Entropic as an alternative. I almost feel like migrating away from the normal registry is an ethical issue now. What percentage of popular packages are available in Entropic? If someone else's repo is not in there, can I add it for them?

<comment><USER4> The github registry may be another reasonable alternative... not to mention linking git hashes directly, but that has other issues.

</comment></comment><comment><USER5> How is a package manager for open source packages supposed to be profitable? This seems like a big risk for NPM Inc considering other languages, PyPi, CRAN, CPAN, don't have VC-backed startups running their sites and they seem to be fine.

<comment><USER6> They sell into large companies with an enterprise support contract and some additional features. A lot of companies want to run their own registries for private modules & such. Pretty much the same market/business model as other similar tools (particularly Java-oriented) like Nexus & Artifactory.</comment></comment>


Functional Programming Jobs in San Francisco? - <AUTHOR>

It seems to me that San Francisco is full of Rails/Ruby and NodeJS jobs. Is there any shops or companies hiring for Clojure, Haskell, Scala, Ocaml, Erlang, maybeee Scheme/Racket? <comment><USER2> Who is hiring (Oct) will be out in less than a week. Usually get a myriad of openings!

<comment><AUTHOR> Thanks

</comment></comment><comment><USER3> Factual, ClimateCorp are using Clojure.</comment>


Boolean Hair Logic - <AUTHOR> http://evilmartini.com/hairy-logic

<comment><USER2> I'd like to see this adapted to express many facial hair styles.

<comment><USER3> You know, I really wanted to beat someone to the punch and create a canvas toy to do just that. Given two images of the same dimensions, render a bin-op of their pixels, where "bin-op" is a boolean operation.

Fucked if I know what I am doing wrong, but I just can't modify the data array of the canvas element's graphics context.imageData.

      var canvas, ctx;
      var image1, image2;
      var img_data1, img_data2;

      function load_images () {
          image1 = document.getElementById("image1");
          image2= document.getElementById("image2");
      }

      function load() {
          load_images();

          canvas = document.getElementById("cv");
          canvas.height = Math.max(image1.height, image2.height);
          canvas.width =  Math.max(image1.width, image2.width);
          ctx = canvas.getContext("2d");

          var tmp_canvas = document.createElement('CANVAS');
          tmp_canvas.height = canvas.height;
          tmp_canvas.width = canvas.width;
          var tmp_ctx = tmp_canvas.getContext("2d");

          img_data1 = ctx.getImageData(0, 0, canvas.width, canvas.height);
          img_data2 = tmp_ctx.getImageData(0, 0, canvas.width, canvas.height);
          ctx.drawImage(image1, 0, 0);

          // seems like I just can't modify the array data and see it updated on the display
          for(var i = 0; i <= img_data1.width; i++) {
          	for (var j = 0; j <= img_data1.height; j++) {
          	    var idx = 4 * (j * img_data1.width + i);
      	    img_data1.data[idx] = 0;
          	    img_data1.data[idx+1] = 0;
          	    img_data1.data[idx+2] = 0;
      	    img_data1.data[idx+3] = 0;
          	}
          }
      }

<comment><USER3> The call I am missing is canvas.putImageData(); and that seems like one of those HTML5 features that works in theory, but hardly in practice.</comment></comment></comment>


What are the most creative applications for blockchain that you've come across? - <AUTHOR> <comment><USER2> I'm quite excited about using blockchain for music licensing. A quick Google search shows that there quite a few that do that.

[https://noisey.vice.com/en_us/article/d37mez/these-7-blockch...](https://noisey.vice.com/en_us/article/d37mez/these-7-blockchain- apps-could-help-musicians-get-paid)

</comment><comment><USER3> I still like the proof of existence at a certain time.

Zip some files, get a hash, put it in the chain.

<comment><USER4> I agree, proof of existence enables a lot of interesting use cases. I recently created a project to explore one, an immutable audit history for invoice data (accounting records) [1]. The main advantage seems to be the independently verifiable nature of the audit data. I can just hand over the data, and point to the audit trail, and then it's up the auditor to do their job.

[1] [https://devblog.xero.com/creating-an-immutable-audit- trail-o...](https://devblog.xero.com/creating-an-immutable-audit-trail-on-the- blockchain-with-xero-tierion-be423d39380b)

<comment><USER3> I skimmed through your devlog post; I think you could make the use case a bit more clear. your service substitutes trust and provides versioning. but trust from whom to whom? I doubt an audit by the government will look in to crypto magic, no?

For an employer a simple log on a somewhat secured server might be enough.

I researched electronic cash registers a bit. here there is also the problem that a gamed system can transmit faked data to which ever system is meaned to provide immutablility.

<comment><USER4> As stated, it's a proof of concept. The trust element was between the user and the software provider. 'How does a user trust that the software provider doesn't make changes to user data without the knowledge of the user'. In this case, making changes to the audit history and/or invoice data.

While this is unlikely, it's possible. And the point of the blockchain in this case is to make it impossible, at least without being noticeable.

While that doesn't sound all that amazing by itself, it does enable some interesting use cases to be built on top. Now that the data has been made trustless, and verifiable by 3rd parties it could be provided to parties such as: Government, Accountants, Lenders, Banks, etc.

Regarding fake data, sure, you can submit fake data. But when an audit occurs, you need to submit your fake data to be audited. What you can't do, is go back and change the numbers.

<comment><USER3> Thanks for the reply! I see.

</comment></comment></comment></comment></comment><comment><USER5> Flight delay insurance: [https://etherisc.com/](https://etherisc.com/)</comment>


Github's new look: The Code Tab - <AUTHOR> https://github.com/blog/958-the-code-tab

<comment><AUTHOR> I like it. But...

The download button is a step backwards. First, I had to search (cmd-f) to find it. There's plenty of room under "stats & graph" for a more distinct button. Secondly, the tab it brings you to makes it look like there's nothing to download. Look at:

<https://github.com/mongodb/mongo/downloads>

The text makes it seem like an error almost..then I saw the buttons.

<comment><USER2> Note the new ZIP button next to the Git URLs.

<comment><USER3> The link placement is still a step backwards when there are actual files uploaded, e.g. binary builds. And I would argue that the new ZIP button doesn't make it easier for newcomers to find those ZIP builds. I wish there was a way to make downloads really obvious for those projects that rely on them, this is still something I miss from Google Code.

</comment></comment></comment><comment><USER4> Really happy that they've made branch switching easier. It was a pain in the previous version.

</comment><comment><USER5> I really like it. As a github newbie I think the new nav bar layout is much cleaner, especially the commits/branches section. Well done.

</comment><comment><USER6> Maybe I'm getting old, but could the numbers in that new nav bar be any smaller?

I used to be able to tell how many open issues there were without squinting.

</comment><comment><USER7> The new nav bar seems out of place with the rest of the design. This might just be me, since I've used GitHub for a few years now, and I'll get used to it but maybe this is leading to more changes in the future. I, for one, welcome our new cleaner design overlords.

<comment><USER8> No, I'm completely with you. I'm hoping for greater consistency soon, e.g., no more blue-on-hover buttons.

</comment></comment><comment><USER9> Looks awesome! Does the "open in mac" button show up even if you don't have gh for mac installed?

<comment><USER10> I'm not sure if this is what you mean, but here's what I've found: If you install GH for Mac on any machine, the "Clone in Mac" button shows up afterwards on _all machines_ , no matter where you login from. So in that sense, you can see the button, even if you don't locally have the app installed. (I actually just sent a support request to see if this could change.)

</comment></comment><comment><USER11> Has that "Search source code..." input always been there? I sure needed it in the past, and somehow never saw it until now.

<comment><USER12> I assume you're basing this off the screenshot. The "Search source code" input is only available in private repos. Since kneath/resque is a public repo, apparently one benefit of working at Github is getting that input on all repos, whether public or private.

</comment></comment><comment><USER13> Where is the 'search this repo' button/field?

</comment><comment><USER14> As much of a fan of Github that I am, their UX has always been confusing and now that added yet another layer of complex navigation to the page.

They now have a total of seven horizontal navigation areas of which some are mixed in with actionable items, along with the independent actionable items spread within the navigation layers and content:

1\. User Nav 2\. Github nav and search 3\. Breadcrumbs and forking action/info 4\. The new code navigation bar 5\. Files/Commits/branches nav 6\. Main footer 7\. Informational footer

All of that in addition to the actual project content blocks, message display and project byline.

imo, they could benefit from cutting back from all navigation that is not pertinent to the project, merge the Github nav with the main and informational footers, consolidate actionable items and non-code content (that new embedded message bar) and lose some of the cruft. Yes, it's a tool for engineers, but it's also a platform for learning and many people don't really need every single url/action in the Github universe manifested on every single project page.

<comment><USER15> Have you guys used the new interface? It sounds like you're coming up with imaginary solutions that are already deployed. The nav does shrink up on many pages, and every single update we've pushed out over the past 2 years has brought the administrative chrome _smaller_ and the source code _up_

I'm happy to provide older screenshots for reference if you don't believe me :) In a way it makes me really happy — people see more white space and assume they've lost useful real estate. But the truth is they got more space and more real estate.

<comment><USER14> (I'm talking without any real analytics here; hopefully you took them into consideration. Also, I'm not comparing the cli or the GitHub for Mac app. And one more thing: I wasn't there when this app was a blank slate and I'm not trying to beat you up on the UX, but it's time to count clicks and reassess what needs to really be there.)

I think you're talking about the visual design and layout of the page. That's a different ball of wax from the overall UX and doesn't carry equal weight, so white space is not so much a concern of mine as I don't fixate on pixel spacing enough to throw a fit about it. The design and the layout have always evoked an immediate mental map based on the three or four everyday functions that I need in order to complete my tasks on the page, and I'm usually competent enough to complete my actions and end my interaction on the main project page in short order. The basics are there, which is a good thing, and the visual design itself is competent.

What bothers me is the multitude of mostly unrelated navigation systems that are dispersed about the page with what appears to be a need to display all, along with repetitive links strewn about. It suggests an underlying logic that if an entity exists, it must be displayed. And displayed it all is in a very unorganized fashion.

I would suggest trimming the fat and displaying only what the user needs in order to complete their tasks and establishing a clear hierarchical visual representation of global, project and in-page navigation and actions. There are currently five different types of visual displays for navigation in the top third of the main project pages alone: semi tabs, text links, breadcrumbs, full tab buttons, folder tabs. The footers are equally disparate. Not all of the seven nav menus need to be displayed in their entirety nor do they all carry the same weight or deserve their own section of the page. That really needs to be looked at and simplified before it grows even further.

The action buttons are all in a similar recognizable visual format, but they too are also dispersed about the page without any obvious relation to the content or navigation menus around them. For someone who's been using the app for a couple of years, accumulated knowledge would overcome any new layout changes (stop playing with the button placement, please) but to a new user, you're basically throwing the kitchen sink at them and hoping that it all makes sense. It's easy to transition a seasoned developer to Git, but Github is another story.

Again, mine was not a critique of the visual design, but an honest assessment of where the [creeping] overall UX is. Out of simplicity I didn't delve into any of the project subsections or other sections of the website, but my immediate thoughts are to migrate into simplicity and uniformity.

<comment><USER15> Yes, please use the interface. Again, you're describing solutions that already exist.

This version of the navigation has the least amount of chrome out of any of them, less buttons, less navigation all around.

<comment><USER14> After reading the comments on the blog post and your inability to address even the most basic of my concerns without invoking my imagination and your chrome, both of which have absolutely nothing to do with what I've written, I think today's improvement was not.

Also, you don't deserve to carry the brunt of the UX discussion on your shoulders in a public forum, as you're obviously not the only party responsible, but your enthusiasm is palpable and I commend you for it.</comment></comment></comment></comment></comment>


Against Brexit, by Scott Sumner - <AUTHOR> http://econlog.econlib.org/archives/2016/05/against_brexit.html <comment><USER2> Sorry, but the rejection of "Boaty McBoatface" seals the deal for Brexit. You ask people's opinion and then won't accept the result -- that's the "democratic deficit".</comment>


Ask HN: Are there tools for start up your commercial VPN Service? - <AUTHOR> For a few days, I'm planning to start up my own VPN service to earn money. But I can't find any software to do this. I also don't have time to write code for this. <comment><USER2> Think about what you're asking for: low-effort tooling that can make you money short-term.

Why would that exist?

That said, you can use Algo to setup a WireGuard server on a VPS (it'll even provision the VPS for you). I don't know how you'll sell access that you can actually be bothered to do though, and the user list won't be dynamic, it'll be a fixed list of N users that are irrevocable and not reusable. (Without re- running, which I assume you can't be bothered to do or automate.)

<comment><AUTHOR> I actually know how to automate, but as I said I don't have enough time to do this. So for now, It looks like I should cancel project for now.

</comment></comment><comment><USER3> You can use a reseller program of a VPN service. It gives a web app, mobile app and IPs to sell. Think its a great if you don't have the time to code. [https://www.ivacy.com/business-vpn/reseller- program/](https://www.ivacy.com/business-vpn/reseller-program/)</comment>


Show HN: Monique.io – a new kind of monitoring system (AI + Unix + Javascript) - <AUTHOR> https://monique.io?ref=hn <comment><USER2> This is pretty awesome-looking. I was thinking today about how to create a dashboard to which I could send data and easily add new widgets on it: graphs or lists or urgent notices.

The examples for sending from django, python, rails, etc are really neat! I wouldn't have thought of directly sending querysets, but the simple example made it seem obvious.

I hope you find the right paying niche for it. I personally wouldn't pay $20/month for it unless I had an active startup project. For me, a couple dollars a month maybe since my use would be pretty limited and occasional.

<comment><AUTHOR> Actually a free plan will be announced in a day or two. This should capture your needs without paying a dollar :).

<comment><USER2> Neat, I'm setting a reminder to check back. I'm not opposed to paying. I just have to calibrate it against other things I am used to paying for. Cheers

</comment></comment></comment><comment><USER3> That is amazing.

See also [http://mondash.org/](http://mondash.org/), which is much simpler, but similar in some aspects.

<comment><AUTHOR> Isn't mondash a "traditional" monitoring system? I see that you have to submit metrics individually, as JSON with a "value" attribute.

<comment><USER3> Is it? I didn't know it. I thought it was interesting because it didn't required installing anything, or even signing up for an account. I wasn't aware that traditionally monitoring systems worked by submitting JSON data.

Consider my comment invalid from now.

<comment><AUTHOR> I think you are right that the "really traditional" monitoring system like Nagios or Munin only work through agents and plugins. Some of the hosted systems have centralized APIs. But, to my knowledge, they all use the metric concept ((name, value) pairs) and it's why I called it "traditional".

<comment><USER3> Oh, right. I don't like that. Mondash does it and it is not good.

</comment></comment></comment></comment></comment><comment><USER4> This looks great! Are there any plans for self hosted setups?

<comment><AUTHOR> Do you mean an "enterprise" self-hosted plan with a price of >= $1k / mo?

Generally everything is possible, since we are now learning how the users would like to use the service. But the SaaS model is easier to manage, and there are successful monitoring services that use this model (www.stathat.com).</comment></comment>


Ask HN: What are absolute best posts on HN so far? - <AUTHOR> <comment><USER2> It's interesting you ask, because that implies that the search feature and the most popular submissions do not reflect the "best" submissions.

In my opinion that's a flaw in the feedback loop of the upvoting system and should be improved.</comment>


Finally, Private Unemployment Insurance. But Will Anyone Buy It? - <AUTHOR> http://www.nytimes.com/2016/05/28/your-money/finally-private-unemployment-insurance-but-will-anyone-buy-it.html?_r=0 <comment><USER2> Assuming insurance companies are profitable, insurance is a -EV bet for the consumer. The only reason to ever buy insurance is if the potential loss would be ruinously large. Gaps in unemployment simply don't generate that kind of huge loss the way a house fire, extended illness or million-dollar lawsuit would.

According to numbers earlier in the article, this pays out $536.50 * 24, about 6.7 weeks of pretax wages or 12.9% of your annual income.

If you put 10% of your income into an emergency fund, you can build it to the level of the payout from this insurance in a little over a year.

<comment><USER3> I was about to post but saw yours, so I'll reply with basically the same position.

\----

This will be a contrarian opinion, but personal insurance, in general is a ripoff.

You are taking a monthly bet (ie an insurance policy) against another party that an event will occur. The other party must administer the insurance and also make a profit, so the overall expected return is negative. The only smart reason to get these types of insurance is if you know you can make a claim in the short term (in other words you have insider information that you will be laid off soon).

The smarter thing to do is save and build up your own "rainy day" fund, where once you have funded it properly, you no longer have to pay into it.

<comment><USER4> Insurance only makes sense for events so unlikely to occur but so catastrophic if they do that any rainy day fund will not be sufficient - where an insurance company _must_ , by nature of the costs, use the income from multiple people to cover the extremely rare instance of a claim.

As has been said, that is home and some health insurances are for. _Most_ people will never live in a house that is destroyed that prompts a home insurance payout, and if you _are_ someone who has their home destroyed, you will get back way more than you would put in in a lifetime because the average likelihood of it happening is so low. But not having the insurance would wipe out your wealth - you lose the house and writeoff the loss and have nothing left after the fact, and at best you spend an entire rainy day fund with a mortgage on the land to rebuild, and even then you are doing significantly more impactful damage than any rainy day fund could account for.

Same with catastrophic health insurance. _Most_ people do not get debilitating diseases that don't kill you but will require lifelong care like Parkinson's or Dementia, but if you _do_ get one of them you would be destroyed trying to pay the constant upkeep costs.

And strangely? enough, both are often best handled by the state. In some countries property owners are not insured privately but by the township to avoid problems where disasters wipe out multiple homes and some people do not have such a rainy day fund to afford to rebuild. And first world countries provide single payer healthcare to make up for the rare catastrophic conditions. If you want to have these costs borne out across the entire population to offset the individual costs when they happen to _you_ , having them be society wide is often the least expensive option.

<comment><USER5> > Most people will never live in a house that is destroyed that prompts a home > insurance payout, and if you are someone who has their home destroyed, you > will get back way more than you would put in in a lifetime because the > average likelihood of it happening is so low. But not having the insurance > would wipe out your wealth - you lose the house and writeoff the loss and > have nothing left after the fact, and at best you spend an entire rainy day > fund with a mortgage on the land to rebuild, and even then you are doing > significantly more impactful damage than any rainy day fund could account > for.

Homeowners insurance has broadened considerably from simple catastrophic fire coverage. Most claims are relatively small, and can involve things like pet bites, stolen property, guests being injured, wind damage, etc.

<comment><USER4> You _can_ insure for almost everything, but the simple things you insure for _with_ homeowners insurance are more food for the insurance racket than anything, because all those incidental costs are, like the superposter said, better covered with rainy day funds because you _will_ experience _several_ in your lifetime. In that case, better to manage your own money than give it to someone else just to give back to you after taking a cut. You would never have day to day homeowners insurance and _not_ get catastrophic coverage, but you would certainly (and probably should, unless all insurance providers available to you are racketeering on the small stuff for profit) consider the reverse.

<comment><USER5> Except, believe it or not, that is what people want and expect now from a homeowners policy.

Simple Fire (HO-0) or slightly broader coverage (HO-1) essentially don't exist anymore for individual homeowners. HO-2 (Where the company says "We insure you for the following (long list) of things).") is also somewhat unusual now. People don't buy them unless they are very price sensitive. The most common type sold is HO-3, where the the carrier says "We insure basically everything, with the following exclusions (like earthquake and flood)."

(Actual policies are much more complex, but that's the basic idea.)

And in fact, you do get the best of both worlds, because any carrier allows you to choose a high deductible, like $5,000 or more. So you can self insure the small stuff, (which the carrier doesn't want to deal with anyway, because of the overhead of settling a loss) and feel comfortable if say a pipe breaks during the winter while you are on vacation and causes $20k of damage, you are not going to have to come up with that money somehow.

</comment></comment></comment></comment></comment></comment><comment><USER6> This is interesting, but it seems like it would appeal to a different demographic than HN. If you're younger and have highly desired skills in the market, the numbers just don't add up for this. However if you're older and concerned that a layoff might leave you out of work for multiple months, it _could_ make sense.

Just playing with some numbers, if you work in "Information" in California and make $100k, you're looking at just over $100/month in payments according to their calculator. Say you get laid off two years from now, you would have paid $2,400 for the insurance. Payments don't kick in for two weeks, and only add $511/week over what normal unemployment would give you, so you would have to remain out of work for 7ish weeks to break even.

<comment><USER7> Meanwhile, you'll be paying for 24 weeks of coverage. And, so, 24 times $511 means, the maximum payout is $12,264 in taxable income, so maybe $8,000 in net cash.

So, at the 7 year mark (or maybe right now), just start questioning whether a simple, ordinary savings account would have been the better idea.

And, oh yeah, you don't get 24 weeks coverage until you've paid for coverage for 6 months. Otherwise, you just get back maybe $600 at best, and then The End. So you'd better have six months living expenses (or a solid job), AND $600 to pay into the policy, before even bothering, otherwise you're still screwed.

<comment><USER5> > Meanwhile, you'll be paying for 24 weeks of coverage.

Actually, premium payments are waived while on claim.

<comment><USER7> No, I just meant in general. Under the circumstances that you're fully employed for 7 or 8 years, and never need to make a claim, the maximum payout is always 24 weeks of unemployment supplements. Therefore, after 8 years, you might have paid more than you'll ever get back, even with incremental raises during that lengthier period of time.

<comment><USER5> You can lose your job more than once.

<comment><USER7> Welly, welly, welly, welly, well.

<comment><USER5> I see your point.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > Those who work in public administration would pay the least: $34.75.

That tells you everything you need to know about which jobs are relatively unrelated to merit.

> But many people can't or don't save enough to add up to the $12,875 or so > that IncomeAssure may pay out to a $100,000 earner in New York

I don't care who you are: you need to have more than 1½ months' salary saved up. If you don't, your life is going to suck, badly, at some point.

Honestly, this seems like a product best used by folks in their first few years of work. If you've been working longer than that, you sure better have better savings.

<comment><USER9> In your first few years of work, you should be structuring your life so that major expenses like car & housing are minimized (you're not used to better, and you likely don't have a family to drive around & frolic in green space) & you can build up a cash cushion. It just seems like there is just no frontier for which this makes sense, other than "person who knows their job is going away at 6mo+1day".

</comment></comment><comment><USER10> This should be a fringe benefit with startups. After all, the odds are that they will fail.

<comment><USER11> That would be a great idea. Everyone is saying that you should have an emergency fund - and I agree - but I would rather not have the gap in income that would cause me to use my emergency fund.

</comment></comment><comment><USER12> They should really offer this through employers directly (like medical insurance). That can reduce the cost for insurance company as well as employers to offer severances if something goes bad. The key here is events like layoffs at many companies is rare enough that it might make sense to turn this in to severance coverage as opposed to unemployment coverage.

</comment><comment><USER9> It's really odd that their examples are people in the 100K+ range, for whom the benefits are absolutely minimal after you account for the 6 month initial required period & the benefit cap. This is the demographic likely to have both savings to draw on, access to loans (eg a HELoC like the author), family support, ability to fight an eviction or foreclosure... Even in lower income brackets, it's so unlikely to be worthwhile compared to simply saving for the initial 6 months that I'm not surprised that "IncomeAssure has existed for five years, [and] there are about 1,000 active policyholders".

"It has been disappointing that we haven't been able to find a cost-effective way to get the word out that this exists," Mr. Sterling, SterlingRisk's chief, said.

And here we are; they found their cost-effective marketing campaign for their crappy product. I hope the author got lunch paid for at least.

<comment><USER5> You should not be so cynical. The insurance kicks in to supplement state benefits, for people who would otherwise max out on them (most states give at most around $400/w). So it only makes sense for people at middle or higher incomes.

The benefits are not "absolutely minimal". The premiums might be, say $800/y, and the benefits $10,000 if you are unemployed 24 weeks. Is it a lotto ticket? No. But for people afraid of job loss without that amount saved up, do you have a better suggestion?

<comment><USER9> Yes; take the premiums you would've paid for 6 months (effectively without coverage during that time regardless), save them, and reduce your living expenses to allow you to build up the cash cushion from there. If you're in that income bracket you really should be able to structure your expenses so you can save a decent amount, even in a high-cost city (there are minor exceptions to this, for instance child support obligations, but moving to a shittier apartment or not going out to eat for N months to build up savings is a valid alternative to incurring an extra recurring expense like this if you're living on the margin of insolvency anyway).

Unlike these benefits, depleting savings isn't taxable income, and again, in that bracket you might even be able to wrangle in tax-advantaged savings (eg saving in a Roth account that gives you extra option value, converting to a Roth at your now-lower income bracket & withdrawing the principal, withdrawing home equity, etc). Once you figure in the fact that it's paying out effectively 1/4 of your income, after taxes, for 6 months max, minus the state unemployment benefits, it really does look to be a minimal payoff.

<comment><USER5> > Yes; take the premiums you would've paid for 6 months (effectively without > coverage during that time regardless), save them,

Well, that gets you about 5% of the way there.

> save them, and reduce your living expenses to allow you to build up the cash > cushion from there. If you're in that income bracket you really should be > able to structure your expenses so you can save a decent amount, even in a > high-cost city (there are minor exceptions to this, for instance child > support obligations, but moving to a shittier apartment or not going out to > eat for N months to build up savings is a valid alternative to incurring an > extra recurring expense like this if you're living on the margin of > insolvency anyway).

Not so easy for many people.

> Unlike these benefits, depleting savings isn't taxable income, and again, in > that bracket you might even be able to wrangle in tax-advantaged savings (eg > saving in a Roth account that gives you extra option value, converting to a > Roth at your now-lower income bracket & withdrawing the principal, > withdrawing home equity, etc).

There can be tax benefits for this insurance product as well (See PLR-112680-11 for example). There can be penalties for withdrawing savings from tax-advantaged accounts.

> Once you figure in the fact that it's paying out effectively 1/4 of your > income, after taxes, for 6 months max, minus the state unemployment > benefits, it really does look to be a minimal payoff.

Your math is iffy. You double counted the State benefit. It's State benefits + Insured benefits = 50% of your former salary for up to 24 weeks. In states (like Florida) where State benefits don't last 24 weeks, the insured benefit would be an initial supplemental benefit, and then a full 50% replacement.

So for say someone in NY previously making about $2,000/w, the state will pay ~$420/w and this insurance would pay around $580/w, for up to 24 weeks. Again, not a bonanza, but still very helpful for people who don't have (or don't have _enough_ ) significant savings they can easily access. If the benefits were much higher, the premiums would be much higher as well (TANSTAAFL). It's a trade-off to make an affordable product that is sufficiently useful.

<comment><USER9> It's really difficult to reason about rigorously without the expense side of the calculation as well to calculate the potential for self-insurance.

<comment><USER5> There is a premium calculator on the site. For some people this policy is useful and necessary, for others, maybe not. You can lecture all you want about how people should have a significant emergency fund always available, but unfortunately, many people find that too difficult. So this is an alternative.

</comment></comment></comment></comment></comment></comment><comment><USER13> Wait, what? There has long been a kind of private UI: those credit cards that defer interest if you lose your job, for example.

<comment><USER5> Not quite the same thing as getting a check in the mail, is it?

</comment></comment><comment><USER14> Why should we? The state seems to be handling that one pretty well.

Of course, now that it exists, I live in one of those states which will likely make it mandatory to purchase, because someone, somewhere in the legislature or one of their cronies, will make obscene amounts of money off of it.

</comment><comment><USER15> The title makes or look like this was recently released, but or says right in the article that the product has been around for 5 years.

</comment><comment><USER16> Or you know California could just up unemployment to actually cover your lost wages for a few months. 60% is a joke.

<comment><USER5> Actually, the issue the insurance most directly addresses in that case is that CA unemployment benefits max out at $450/w. So people making more, or much more, than ~$50k year would have a very significant income shortfall, as a percentage of income.

</comment></comment><comment><USER17> "Let's say you live in New York and earn $100,000 annually."

wtf ?

I didn't read the rest of the article after that statement.Too divorced from reality.

How about you start with "Let's say you work at a part-time temp agency doing manual labor for $8 an hour and your hours are restricted to 30 hours a week.You are socially trapped at the moment and see no way out"

Then the article would be more realistic.

<comment><USER18> Whatever the typical demographic is for an nyt reader, it's not a manual worker making $8/hr.

<comment><USER17> Ok, you're right. Those people should not be considered. Only "normal people" who make $100,000 a year should be.....and the down votes to this post agree!

The real answer to this absurd nonsense is that all this can be done via algorithms to determine who is the biggest liability, which helps these "insurance companies" to choose who to accept and not to accept. This benefits the companies but defeats the purpose of insurance in the first place.</comment></comment></comment>


Ways to protect an alpha site - <AUTHOR>

Hi,
  I am currently working on a website but now, it is currently in pre-alpha stage and so I do not want people to sign up. Is there any way to avoid people accidentally signing other than obscuring the sign up button/link?<p>Thanks <comment><USER2> As aheilbut stated you can use .htaccess to rewrite the destination if the request matches /signup. This question is highly dependent on your backend. If you're using a framework that allows you to explicitly define the URLs in your app then you can just comment that line out. You could also try triggering a 3xx to redirect them to the homepage upon requesting that page.

Really though, if your site is pre-alpha and if you don't want people to be on it to begin with you should have your entire site blocked by at least basic authentication. <http://httpd.apache.org/docs/2.0/programs/htpasswd.html>

Any host worth paying will have some kind of option for "password protecting a directory."

</comment><comment><USER3> You could just let them sign up, but do not activate their account. Say something like 'only select/random accounts' will be activated, if they're not activated you could keep their emails and send them a reminder when you are ready for them to use your site.

</comment><comment><USER4> Charge them $100 for a sign-up or make it look like that.

<comment><AUTHOR> :D

</comment></comment><comment><USER5> .htaccess?</comment>


Google Offers: Google goes Groupon - <AUTHOR> https://www.google.com/offers/home

<comment><USER2> This launched late May in Portland Oregon: [http://googleblog.blogspot.com/2011/05/google-offers-beta- st...](http://googleblog.blogspot.com/2011/05/google-offers-beta-starts-in- portland.html)

And it launched in NYC and the SF Bay Area over a month ago: [http://googleblog.blogspot.com/2011/07/google-offers-beta- la...](http://googleblog.blogspot.com/2011/07/google-offers-beta-launching-in- new.html)

So what's new today?

<comment><USER3> Apparently nothing... Though they did have my city listed... But it just said 'coming soon' when I clicked on it. Bleh.

<comment><USER3> And they just sent me a deal for today... So I guess my city (Orlando) isn't 'coming soon' after all. How silly.</comment></comment></comment>


How Dropbox sacrifices user privacy for cost savings  - <AUTHOR> http://paranoia.dubfire.net/2011/04/how-dropbox-sacrifices-user-privacy-for.html <comment><USER2> Hi all, Arash from Dropbox here. We understand the concern that the government could try to guess whether a particular file has been uploaded to Dropbox based on processing times and then request that Dropbox identify a user who has access to that file. However, to seek user content information, the government needs to comply with the provisions of the Electronic Communications Privacy Act by obtaining a warrant supported by probable cause (or in some cases a court order from a judge). Those safeguards protect user privacy. De-duplication does not make users any more vulnerable to intrusive government actions. Today, a government agency could ask any online service to provide the names of all users who have a particular file, whether or not the service employs de-duplication. And in that case, the government would also need to support its request with a warrant or court order. The rules that provide a check against unwarranted government snooping apply to online services equally, regardless of their back-end architecture.

<comment><USER3> If you don't mind my asking, what is the percentage savings achieved by de- duplication across all of Dropbox? Some others here have wondered if it was premature optimization.

<comment><USER2> It wasn't a premature optimization. It was both a better experience for the user (saves bw/reuploads for the user) and was simpler to implement (can keep things in one global bucket) given we didn't want things like renames to trigger reuploads and had to use checksums as a result.

<comment><USER3> But you could prevent reuploads with per-user de-duplication, while avoiding the privacy issue of cross-user de-duplication.

I could see why this would be more work to implement (you have to key on user+contenthash), but it would still be interesting to know how much Dropbox and its users actually benefit from cross-user de-duplication.

<comment><USER4> I have a hard time understanding this line of argument.

Per-user deduplication will mean, I need not upload the same file twice into my own account? What's the use of this?

I keep some of my 'paid for' software installables backed up in my Dropbox, and they tot up to ~1.5 GB (the Humble Indie Bundle games). When I started the upload however, it took maybe 5 seconds because of cross-user deduplication, and I am super grateful to them for this feature.

I imagine this feature saves users tons of bandwidth, as most of the people I know use Dropbox for backing up important software, rare music and videos.

<comment><USER3> > I have a hard time understanding this line of argument.

It's not a line of argument. It's a line of inquiry. You've given anecdotal evidence that cross-user deduplication benefits you and people you know, but what about some actual numbers from Dropbox?

Producing actual numbers -- "eg cross-user deduplication saves our users 30% of their upload time and bandwidth, on average" -- seems like a great way for Dropbox to counter this issue.

> I imagine this feature saves users tons of bandwidth, as most of the people > I know use Dropbox for backing up important software, rare music and videos.

We don't have to imagine! Let there be numbers!

Also -- "rare" music and videos that everyone's uploading duplicates of? ;)

</comment></comment></comment></comment></comment></comment><comment><USER5> I think most of us, if we were developing Dropbox, would have made the same decisions. De-duping at the cost of complete privacy, even in the face of law, is a sound technical and business decision for a service such as Dropbox.

When I think Dropbox, I think sharing, I think convenience, I don't think backup and security. For backup I need more space, for security I need to use my own private key (not a password that one can change/recover). Neither of these things is offered by Dropbox. And this is the reason why I never confused Dropbox with, say, CrashPlan. One is a way to share and collaborate, the other is a place to send my private key encrypted bits to.

My individual privacy is not compromised by somebody being able to say if a certain file is stored by the entirety of Dropbox user base. The other claim, that, given a court order, Dropbox can be forced to turn over your files or tell the court if you store a certain file _may_ be true, but I don't think Dropbox, the company, has ever promised that level of security.

<comment><USER6> It's far from obvious that some crusading DA can pick files and force dropbox to tell him or her who has copies of that file.

<comment><USER7> Dropbox can certainly get that information - remember, they can access all accounts.

<comment><USER6> sorry, that was my point. I use dropbox, and I knew they hashed files, but I didn't think through the implications.

</comment></comment></comment></comment><comment><USER8> My take-away is this:

"What this means, is that from the comfort of their desks, law enforcement agencies or copyright trolls can upload contraband files to Dropbox, watch the amount of bandwidth consumed, and then obtain a court order if the amount of data transferred is smaller than the size of the file."

This, I think is significant, especially if Dropbox is advertising security, privacy and encryption. As the author mentions, the ToS are being updated to reflect the above possibility ("if Dropbox receives a warrant, it has the ability to remove its own encryption to provide data to law enforcement").

<comment><USER9> On the face of it, the security of DropBox encryption seems comparable to that of a padlocked room - where the key to the padlock is kept hidden in a safe place.

Except the key is actually kept under the doormat, because people keep going in and out and keeping it elsewhere is just too inconvenient.

If you told someone a room like that had military grade security, you would be called a liar. No matter how fancy the padlock. Without knowing the details of DropBox's setup I'm going to refrain from calling them liars, but this all seems pretty fishy to me.

<comment><USER10> The analogy you mention is not very good because the hole discovered in their security model is related to duplicate content identified via the same hash value. If you have unique content that's different than anything else, even by 1 bit, then you're secure until someone uploads exactly the same content (this is due to the way in which hash functions work); meanwhile, a key under the doormat would imply a totally different security threat model.

<comment><USER9> The downvotes I'm getting seem to indicate others agree I'm off the mark here. Perhaps I was too inflammatory, perhaps people just don't understand my analogy. Let me try again without the hyperbole. :-)

My point is, DropBox advertise proudly on their website that they use military grade encryption to protect their users' data. However, it has now been independently shown now that the keys to this data are in DropBox's direct possession and are in routine, daily use, decrypting one person's data so another can access it (this is what happens when deduping allows you to download something you never actually uploaded yourself).

To me, this implies that their claims of "military grade security" may be unjustified and just yet another example of security theater in the cloud.

Without knowing the exact architecture of their system it's hard to say for sure, of course. But think about what the encryption they claim to use is probably supposed to accomplish. Then think about whether it actually does that if a large proportion of DropBox's servers and employees have access to the decryption keys.

[edit: Amazon store data on S3, so it is in fact important that they encrypt it (even with relatively relaxed key management) as they have no direct control over the infrastructure. I still don't think this meets the bar of "military grade security", but I guess that's marketing for you.]

</comment></comment></comment></comment><comment><USER11> Bottom line - you should assume that you cannot trust ANY cloud-based service to keep what you upload safe from hackers (if they're determined enough), and especially from governments. I'm not sure why anyone would be under the illusion that this is the case. Even assuming that hosting such a service would be legally possible today (not sure if it is, IANAL), it could be illegal tomorrow and the service may be compelled to hand over any data.

If you want something to stay secret you MUST either:

a. Not put it on the internet/cloud.

b. Encrypt it yourself before uploading. Yes, there are trust issues with commodity encryption software as well, but these may be mitigated somewhat.

<comment><USER12> This really isn't an issue for legitimate users backing up or syncing original data. If you are paranoid about privacy, then you are probably doing something wrong. If for some reason some other user produces the same file that I have, then whats the big deal? They already arrived at that information themselves, so there is still no compromise of data. Of course the government can seize your data whether it is online or not. Don't sync copyrighted material. How many different ways do they have to tell you it's illegal?

<comment><USER13> "If you are paranoid about privacy, then you are probably doing something wrong."

That's a pretty slippery slope to presume that a desire for privacy is tantamount to an admission of guilt. Why would you presume that simply because I have information I want to keep secret, I must be doing something wrong?

Conversely, is it ok if we install webcams throughout your house, since apparently you have nothing you'd like to keep private for non-criminal reasons?

<comment><USER12> In this instance we are talking about data that is already encrypted. Now tell me why anyone would worry about their encrypted data being identifiable unless it's not their data. Not something I have to worry about and suspect majority of users don't need to worry about this either.

<comment><USER13> For the same reason lots of folks may not want their Netflix queue or Amazon purchase list put out in the public. Or their library lending list. All of those are lists of legal, publicly-available items, but that doesn't mean folks might not want and expect privacy when it comes to others knowing what content they are consuming / collecting, regardless of its legality.

</comment></comment></comment></comment></comment><comment><USER14> It's not clear to me why Dropbox would need your keys to de-dupe. He says so in the article, but doesn't say why.

Why not compute the file hash on your local machine before encryption, and check that hash against a master dupe list (hash, dupe_count) of all hashes from all users' pre-encrypted local files?

Secondly, I cannot see how this requires there to be an index of users hashes. Surely one could store hashes with reference count, increment when a user adds, decrement when a user deletes. The user ID isn't necessary for a reference counter.

Not saying Dropbox isn't doing what he says. But he says de-duping proves they can decrypt and proves they have a list of who has the same files. I don't see it from de-dupe alone.

<comment><USER15> The proof is indeed in the deduplication. If Dropbox can skip the upload process of some large file because another user has already uploaded it, they must also be able to decrypt that file in order to sync it with your other machines.

Or in order for you to download it through the web interface unencrypted.

<comment><USER16> I suspect that dropbox works the way you think it does, but your argument actually has a flaw. It could work like this:

\- A hash computed locally (on the clients with the large unencrypted file) and sent along to be used by dropbox to detect dupes.

\- The key used to encrypt the large file is some function of the file, but not of the hash. The important point is that it's not encrypted with a client specific key, but rather a file specific one. Thus if you have the file, you can compute it.

\- When a dupe is detected, the server requests that the uploading client send it a copy of the key, encrypted PGP so that only the other intended clients can decrypt it

I think that should work.

<comment><USER17> > \- The key used to encrypt the large file is some function of the file, but > not of the hash. The important point is that it's not encrypted with a > client specific key, but rather a file specific one. Thus if you have the > file, you can compute it.

That's actually an extremely interesting idea. I wonder if using some function of the data, f, to determine encryption keys, leaks information about the encrypted data? My armchair guess would be yes. Of course, the leaked amount (well, the slight-non random distribution by the key being a function of the data) might be small for large files/good function f, which would mean it's probably okay?

I've never heard of any research of a cryptosystem that works like that though, so I'd appreciate if anyone could provide some expert input (or maybe we should just email bruce schneier)

<comment><USER16> I don't see why it would need to leak much more information than you're already leaking with a hash. And I'm sure someone has investigated this idea.

</comment></comment></comment></comment></comment><comment><USER18> Without knowing the internals of how Dropbox operates, my empirical observations are that they employ block-level deduplication, i.e. when you change bits in the middle of the file, the whole thing doesn't get re- uploaded. Which means they keep pointers and have an algorithm that's similar to LBFS (and Rabin fingerprints)

This means it's theoretically possible for parts of the file to come from different sources, which means contraband files are 'built' from parts of otherwise legal files.

</comment><comment><USER19> With pure file encryption where the user's password serves as the key you lose...password recovery features, public links for files, shared folders, web access, mobile access (unless you want your phone doing the decryption)

All other syncing services do things a pretty similar way

<comment><USER17> This is wrong in several ways (as evidenced by other comments in the thread):

> public links for files easily done by creating an unencrypted copy

> shared folders you can do this by copying, encrypting with new keys for each > shared user, and then sending notification of those keys to the user (via > some side channel), and then deleting them on your end after they are > accessed (you can re-encrypt with the accessor's keys at this point). You > can do a bit better if you leave "half open" asymmetric channels (so you can > store encrypted messages/keys only the recipient can decrypt), but that > might be overkill.

> web access you probably will need to use java (or NaCl) to do this, as > javascript tends to be too slow to do asymmetric encryption (the the needed > bignum support just isn't there). If you're willing to wait, it can be done > in javascript in ~5 seconds on a desktop PC.

> mobile access Uh, all modern smart phones can do encryption fast enough > (well under a second).

> password recovery features This is the only salient point. You can kind-of > counter it by using the security questions to encrypt the actual encryption > key a second time, so that the data can be decrypted if you answer the > security questions. But that's obviously less secure.

</comment></comment><comment><USER20> Rather than avoid deduplication (which is technically sound and benefits everyone), perhaps the solution to this is to make it impossible for DropBox itself to know who owns which files.

E.g. right now I assume a dropbox user owns a list of file ids with some metadata (e.g. that user's name for those files). If follows that if the government decides file XYZ is illegal then anyone with XYZ in their list is in trouble.

The user account could keep track of the total size of all the user's files and use arithmetic to keep it up-to-date, but not actually store the size of individual files except when they are "looked at".

So then the user's password (say) which is not itself stored is used to unlock stuff in the user's file table on a per request basis -- i.e. the actual file ids are only computed as needed. The actual mechanism doesn't need to be terribly secure, it just needs to be _deniable_. In other words without the user's password we simply cannot unambiguously determine which files are his or hers.

</comment><comment><USER21> Of course Dropbox knows the keys. If they didn't, you wouldn't be able to access your files on so many platforms (web, desktop, iPhone) and you wouldn't be able to easily share folders with others.

Even though it isn't spelled out, I've always suspected that many actual backup services such as Backblaze don't know the key if I decide to encrypt my backups.

<comment><USER22> I don't think the "many clients" argument holds. If done properly, Dropbox would (deterministically) generate the keys from your username and password on the client every time you log in and encrypt/decrypt stuff there.

You're right that sharing folders between different accounts would require having a key shared between the clients and thus stored on the Dropbox servers as well.

However, they could generate the key for the shared folder, give it to you and your buddies and yet store it encrypted using your master key generated from your username and password. Then it would be accessible to you, but Drobox would not be able to decrypt it without getting your password.

It looks like they're not doing that, but hypothetically, they could. And the examples you cite would not be impossible to deal with.

Of course, this would require much more work, would be tricky to get right and they'd have Thomas Ptacek on their back for using JavaScript crypto in the browser.

<comment><USER21> You are absolutely right in terms of what is technically possible. My point was more that it's not really realistic to use crypto like that with a Dropbox-like service.

</comment></comment></comment><comment><USER23> Why doesn't DropBox just stop doing de-duplication? They must have the money for the storage? The bandwidth savings for users isn't that big of a deal in most cases. I expect that if I have a 2GB file that I'm uploading a 2GB file. I don't cross my fingers that you already have big chunks of it.

This just seems like the type of thing that someone much smarter than I can and will exploit in the future.

<comment><USER24> Dropbox provides lots of storage for free. Therefore they have a strong incentive to provide this free storage at the lowest possible cost, and deduplication definitely makes sense for themselves if not the users.

</comment></comment><comment><USER25> This makes me worried about hash collisions as well. The article implies that a file whose hash matches something they already have will never even reach their servers - so presumably I just have to keep my fingers crossed that the file they're synchronising to all my machines is the one I uploaded, and not some other user's completely different file that happens to have the same hash?

<comment><USER26> Deduping with hash _and_ filesize in bytes should make a collision unlikely enough.

<comment><USER27> This is a common sentiment, but not really sensible. If you want to store (for example) another 64 bits worth of information, you would always be better off with 64 more bits of some strong hash than 64 bits of filesize.

<comment><USER28> I think the point is that creating a collision when data + fileSize is hashed is much harder than just creating a collision when hashing data alone. Raymond explains it well: [http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/13493...](http://blogs.msdn.com/b/oldnewthing/archive/2004/05/19/134937.aspx)

<comment><USER29> And that was written before the md5 collisions were discovered. And no collision has yet been discovered for md5 for files of the same length, they are all extension attacks...

<comment><USER27> Absolutely false. Some MD5 collision-generators _specifically_ find pairs of equally-lengthed inputs with the same hash. See for example hit #2 for [MD5 collisions]:

<http://www.mscs.dal.ca/~selinger/md5collision/>

'Extension attacks' are something else, which let you turn one collision into more, or create valid hashes for combinations of unknown text plus a chosen extension – not find an initial collision. See:

[http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_con...](http://en.wikipedia.org/wiki/Merkle%E2%80%93Damg%C3%A5rd_construction#Security_characteristics)

The 'length extension' property can be helpful, once you find a collision based on 'random' nonsense, in extending that into two documents that are each meaningful-but-different and still colliding, as was done in this 2005 MD5 collision demonstration:

[http://replay.waybackmachine.org/20050612011328/http://www.c...](http://replay.waybackmachine.org/20050612011328/http://www.cits.rub.de/MD5Collisions/)

</comment></comment></comment></comment></comment></comment><comment><USER30> Early optimization is the root of all evil, so I understand that an up-and- coming company might do this, but Dropbox has the traction and userbase to make this a very relevant concern.

Popularity is also proportional to chance of being targeted by hackers and approached by government or corporation representing intellectual property owners.

</comment><comment><USER31> If you knew a target file's hash, it might be possible to modify the dropbox client to report that file as added, then dropbox would download that file onto your computer. Of course, 10^77 possible hashes makes it unlikely.

</comment><comment><USER32> Previous HN discussion of SpiderOak's (very different) approach to this same topic: <http://news.ycombinator.com/item?id=1640074>

<comment><USER24> SpiderOak definitely looks better from an end user's point of view. How is it going? All of PR love seems to be going to DropBox nowadays.

</comment></comment><comment><USER33> Dropbox has responded to this: <http://forums.dropbox.com/topic.php?id=36365>

</comment><comment><USER34> Could be worse. Last year when I tried ZumoDrive (a similar service), I noticed it marks the web-browser login cookies as safe for HTTP, and defaults to open session pages via HTTP. All it takes it checking your ZumoDrive once from an unsecured WiFi and your account may be compromised.

At least Dropbox gets the endpoint-to-server encryption right.

</comment><comment><USER35> Its not obvious to me this is a price based decision for Dropbox (although the benefit there is obvious).

Arguably the best feature of Dropbox for me is binary diffs. If you encrypt the Dropbox this goes out the window, or at least becomes significantly harder to pull off. Am I wrong?

</comment><comment><USER36> Uhm "(if it didn't, it wouldn't be able to detect duplicate data across different accounts"

How about comparing a hash of the encrypted data?

<comment><USER37> Encryption keys would be different for different users.

<comment><USER38> I don't think anyone suggested the keys were unique to users.

</comment></comment></comment><comment><USER39> tl;dr Dropbox use their own encryption keys to encrypt your data rather than encrypting each user's data using a user provided key. This helps them dedup files and save space/money. This implies that a court could ask to analyse your data. Dropbox will update their privacy policy to say this clearly.

</comment><comment><USER40> I've been traveling for most of the last six months, mostly dependent on slow & unreliable hotel wifi. Dropbox's implementation has saved me a ton of time backing up files that would have taken forever to upload in their entirety.

</comment><comment><USER41> Here's a startup idea: A background service that runs on a PC/IPad/Phone, checks for new media files (pictures/mp3s/videos) and automatically re-encodes them, such that the quality, etc. is preserved but the file hash changes and cloud services can no longer deduplicate it.

It will be quite valuable for users of services like Dropbox, Amazon Cloud Player, etc.

<comment><USER42> Here's another idea: a service that identifies hash values for popular-but- copyright-encumbered files, which you can feed into your (patched copy of) Dropbox client and pretend you're about to upload it. Bam, it appears in your Dropbox account!

And sneakier still, a remote hosted bit torrent client that automates that process for you in a way that can provably show you never downloaded the copyrighted file, you just had a number on your drive, which if interpreted as a SHA256 hash key happened to identify a duplicate of the copyright file on Dropbox... (I'd be spectacularly impressed if someone managed to make _that_ trick fly on court in a precedent setting manner!)

<comment><USER43> That's wonderfully devious. And probably quite straightforward to implement.

I hope it doesn't happen, because that'd be a bit of a nightmare for Dropbox. They could blacklist known pirate rips of movies and the like, but what do you do when you receive a takedown notice for DRM-free content that some users are legitimately storing, but Dropbox is now (accidentally) illegally distributing? Could be the end of global de-duping.

<comment><USER16> If this really became a problem for Dropbox, one response would be to have the server issue random challenges to clients that purport to have the file.</comment></comment></comment></comment>


OpenID is a Royal Pain  - <AUTHOR> http://www.markevanstech.com/2008/04/07/openid-is-a-royal-pain/ <comment><USER2> It doesn't sound like he's heard of clickpass.</comment>


Ask HN: Is this fair compensation for Lead Developer at a start-up? - <AUTHOR>

The company was founded by a friend of mine who is very passionate and driven, and has been working at it for ~5 years. They have approximately twenty employees working on content, all of whom are compensated through shares. They have significant traffic to their website, and are looking to have it redesigned from scratch. So far they don't have any revenue, but have recently secured investment on the condition of a working prototype.
I have an undergraduate degree in software engineering, and am currently working towards my master's. I have 5+ years of experience in building web applications. I will be the first real software engineer that they've had, since they've outsourced all of their development work so far.
My friend, the CEO, has offered me a trial run of three weeks, after which point we'll proceed based on the quality of my work. He said he'll offer around 5%/year, but it could be more or less, depending on the quality.
My question is: is this fair? Seeing as the product is a web application, I know that the actual execution is the key to whether the company fails or succeeds, and I feel like 5%/year isn't really reflective of that. On the other hand, I realize there's a lot more to running a company, such as finding the right people and building a reputation, and he's been at it for years.
From his perspective, I will just be another employee. From my perspective, it'll essentially be my job to make this thing work.
What does HN think? Any input would be appreciated :) <comment><USER2> I've been in a similar situation before.

I joined a startup that had limped along for years just as it was launching a new product. I slowly realized that this new product _was_ the company. Everything else was water under the bridge.

However, the company (and certainly its investors) didn't see it that way. They'd invested a lot of time and money. To them, the idea that I would have as much stock as someone who had been there for 7 years seemed unfair.

The company badly needed new funding, and it all fell apart for this very reason. Someone offered to put in a lot of dough. The existing investors and stockholders figured, ok, you're offering about 10% of what we've put into this company, so you get 10%. Okay, 15%.

The investor figured, no, that's all water under the bridge. The money I invest now is almost a brand new investment. I need way more than that. They couldn't reach a deal and the startup folded.

You may be in a similar spot. Your buddy, and all his employees, figure they've been at it for 5 years. But does that 5 years have any meaning, or is it just dead weight?

You did say that they have "significant traffic", so maybe there is a lot of value already there, and you'll be building on top of something already successful. Or maybe there's nothing, and you're essentially starting a new company but with all the baggage of a failed company.

Hard to say, but this is what it all turns on, as far as I can see.

</comment><comment><USER3> _"From his perspective, I will just be another employee."_

Let's be optimistic and imagine the company going from $0 to $1,000,000 in revenue this year. Five percent of that is $50,000.

But you don't get paid off of revenue, you get paid off of profit. So you're looking at less than that. Probably much less even without the CEO creatively extracting money as expenses - let's say in the form of a $200,000 CEO bonus and/or leasing servers to the company.

Keep in mind that capital which is raised is not profit. You won't get 5% of it or any portion of it.

The deal smells like bullshit.

</comment><comment><USER4> Few red flags here as other pointed:

\- 5 years without any revenue and 20 employees? enough said.

\- 5 years of outsourced work? Doesn't seem like a startup could stretch that far if they had real work/potential.

\- "5%/year": 5% of what ? revenue ? equity ?

</comment><comment><USER5> 5 years with no revenue? Run in the opposite direction.

<comment><USER6> And without a working prototype? Wow.

</comment></comment><comment><USER7> So he's going to get 3 weeks of your work for free, then based on your work his company ---HIS company--- _might_ get investment money? In return, you get a promise of 5% of NOTHING for the foreseeable future?

No thanks.

</comment><comment><USER8> This is an absolute waste of time to even consider. First of all, you can't have a website with significant traffic and no revenue unless you explicitly make it that way, like Twitter. However, Twitter had lots of funding which made that possible, and even still, I'm sure they made _some_ money even though they weren't serving up sponsored tweets.

Why don't you tell your friend to put 3 AdSense units on the website and you'll take all of that revenue in exchange for your work + 5% of the option pool that vests in 1 year?

It seems like you have stars in your eyes and are being almost completely taken advantage of. Even the scrappiest of start-ups that are worth your while will pay you a salary + options.

</comment><comment><USER9> This sounds like your friend the CEO is taking advantage of your friendship. I'm sure he wasn't able to squeeze three weeks of free work out of the guys he outsourced to.

</comment><comment><USER10> He has content and traffic. Fine. But unless this is a media website or about branding, the actual "secret sauce" will be the functionality (yet to be coded). In that sense, your work will determine 100% the success of the company. As such, 5% doesn't sound fair to me. Also, if after 5 years, he's gotten no revenue, you're number one question as a potential share holder is: Why is this? and How will this change with my involvement?

</comment><comment> e-dard As Pete Doherty wrote - You know twice as much as nothing at all. It's still nothing at all....</comment>


Staging Servers Must Die - <AUTHOR> http://readwrite.com/2016/01/22/staging-servers <comment><USER2> Yes, for the life of me I could not see how every scenario you use staging for could simply be "wrapped" in a feature flag. That said, I do like the idea of feature flags and think it could be an extra tool for safe releases.

</comment><comment><USER3> The article is certainly biased (the author works for a company that does feature flags as a service). I don't see how feature flags help when there's breaking changes (like data migration). Also deploying to production directly makes features that destroy data even more dangerous.

</comment><comment><USER4> I think I disagree with this, but I'm not completely sure.

If everything is going to micro-services, don't we want to move staging from a monolith to staging the services? Than we test against a staged service and push to production.

With so many moving parts, it seems to me going straight from QA to production could still lead to problems.</comment>


Views less than likes? Is this a Youtube bug? - <AUTHOR> http://imgur.com/BMORwEB

<comment><USER2> Known issue: [https://support.google.com/youtube/troubleshooter/2991876?hl...](https://support.google.com/youtube/troubleshooter/2991876?hl=en)

Google freezes the views count as it crosses a threshold (typically ~300 views) to ensure accuracy, particularly against gaming other view manipulation.

"Likes" continue to increment, hence the discrepancy.</comment>


Microsoft SQL Server Developer Edition Is Now Free - <AUTHOR> https://blogs.technet.microsoft.com/dataplatforminsider/2016/03/31/microsoft-sql-server-developer-edition-is-now-free/ <comment><USER2> I really like this because even if you dont like MSFT tools, you can absolutely get a taste of them without paying 69 dollars (I think the cost for a dev license before) and do things like benchmarking/etc with ease.

Now let's just hope SSMS starts receiving pull requests at some point and someone writes other db adapters for SSMS and it becomes something you can use with other engines.

</comment><comment><USER3> psql already won.

<comment><USER4> Certainly in the open source community, but MS SQL server is a really nice DB and has been for a while.</comment></comment>