Hidden backdoor API to root privileges in Apple OS X - <AUTHOR> https://truesecdev.wordpress.com/2015/04/09/hidden-backdoor-api-to-root-privileges-in-apple-os-x/ <comment><USER2> > Apple indicated that this issue required a substantial amount of changes on > their side, and that they will not back port the fix to 10.9.x and older.

 _What_? So all OS X boxes are simply broken, privileges-wise, if they're not on 10.10?

<comment><USER3> Apple's model customer is one who upgrades often. If you want solid support for old products, stick with Microsoft, and accept that their products can be clunkier because of deliberate choices to maintain backwards-compatibility.

<comment><USER4> To be fair, OS X updates are free and usually run well even on 5+ years old hardware. OS X has kinda gone the way of Chrome, with most users on the newest version.

<comment><USER5> To be even more fair, there's been a number of issues with Yosemite that make some of us want to stick with Mavericks.

Just because something is free doesn't make it better.

<comment><USER6> Yep. JWZ used to say that Linux is only free if you don't value your time.

OS X has many merits on this front, but since 10.3 I've found that the first few dot releases of OS X have the same caveats often enough (both in terms of bugs/hazards and in terms of gratuitous UI "progress") that it usually seems better to wait past .x.4/5.

Now there's this, of course.

Since the problem showed up in 2011, maybe I should go back to Snow Leopard; I can't think of a single valuable change to OS X since then...

<comment><USER7> > JWZ used to say that Linux is only free if you don't value your time.

My reply to that has always been that Windows is only $300 if you don't value your time. (Preserving archaic cost of Windows to match JWZ quote.)

The implication that the one system is free and time-consuming and the other moderately in price but not time-consuming is entirely false. At the time, for many requirements, configuring and administering a Windows machine would have been more time-consuming than for Linux. It's also glossing over the fact that you can't horizontally scale your $-per-cpu/server solution once you do have the configuration worked out, without going back to the well for more money.

This amusing and glib quote also deliberately glosses over the "freedom" part of free software, which is essential. For example, I wonder if Google would exist today if not for a free unix workalike.

<comment><USER8> Linux desktop is and has been second rate for a long long time. Turns out unless there are corporate sponsors paying for development, open source software sucks. The OSS community is pretty much in denial about that.

<comment><USER9> That's funny, because I haven't managed to find a desktop OS that is up to par with Linux for me. Preferences may vary, but second rate in your book is the only viable contender in mine. Also turns out that Linux does in fact have corporate sponsors, like oracle, red hat, etc. so I'm not sure I follow. Is closed source software top notch without corporate sponsorship?

The sad truth is that _most_ software sucks, regardless of the license, there's just a lower barrier to entry, use, and discoverability with OSS so it's more visible. At least with OSS we can fix the issues instead of just accepting the suckage.

<comment><USER10> I'm probably biased.

After a year I find the only advantage of OSX are browser with touchpad gesture experience and windows edge handling. Haven't tried any distro ever since switching to MBP, wayland might have a better chance of replicating the experience. Hoping for the camera driver to be done.

In Linux everything else is better, fuller implementation of base tools, customizability, no crap like /var/folders..

<comment><USER11> "In Linux everything else is better"

This is entirely subjective; it is not a wise comment to make because it is better FOR YOU, not for everyone. For me, I liked the configurability in Linux desktop land but there comes a time when you want to sit in your office and get stuff done instead of spending all the time moving the furniture around and decorating; OSX doesn't let you do any decorating or move the furniture, so you're forced to do work (to some extent).

I daily use Linux, yet my day-job is to write software on OSX and Windows, so I get to use every system every day. They're all pretty much a muchness.

<comment><USER12> Is your comment saying 'linux is amazing, I just can't stop ricing it and get to work! OSX is better because it doesn't let me customize it'?

<comment><USER11> No, it's saying both are great but Linux constant desktop change and rewriting of underlying systems to break upgrades between OSes isn't for me at the moment (as a desktop system). It may be great for someone else though.

Great for servers.

Basically, each to their own. None is "better".

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Title is a little generous about "hidden", the exploit revolves around API & Framework used to power the parts of the control panel, and its authorization scheme being broken.

I do think its too bad that setuid binaries don't have additional restrictions, like 100% must be code-signed or must be run in a sandbox- exec[1] based on that signing.

[1] - [https://developer.apple.com/library/mac/documentation/Darwin...](https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/man7/sandbox.7.html#//apple_ref/doc/man/7/sandbox)

<comment><USER14> Code signing is not interesting. If normal people can get their code signed then so can the attacker and if they can't then it locks you out of your own computer. The only thing code signing is really good for is to verify that an update to a program the machine's owner installed was signed by the same author as the original program, and unfortunately it's rarely implemented that way.

But that's not really what you're asking for anyway. You can assign granular permissions to binaries regardless of code signing.

The real problem is there are so many things that aren't literally root but are effectively equivalent because if you can do them then you have easy privilege escalation. That's why the Windows security model is so silly. An administrator is not allowed to 'su' to another user without the user's password but any reasonable subset of the administrator's privileges can be used to silently cause any user to execute arbitrary code, e.g. by setting their login script or putting executables in the All Users startup folder or just loading a kernel driver that will let them do whatever they want.

<comment><USER15> > That's why the Windows security model is so silly. An administrator is not > allowed to 'su' to another user without the user's password but any > reasonable subset of the administrator's privileges can be used to silently > cause any user to execute arbitrary code

That's like saying kernel memory protection is silly when the user is an admin because he could just as well load a driver into the system to wreak whatever havoc he wants.

Yes, he could. No, it's not silly.

<comment><USER14> Memory protection is not silly. Not being able to bypass memory protection (and therefore prohibiting all manner of debugging tools) _is_ silly, and that is the appropriate analogy.

If a user correctly has permission to do a thing via a series of ugly hacks then there is no reason not to just let the user do the thing directly.

</comment></comment></comment></comment><comment><USER16> With physical access, one has been able to create admin accounts for as long as I can remember.

\- Start up the Mac whilst holding down ⌘-S. This boots the Mac into Single- User Mode and provides a method of interacting with OS X via the command-line, with full root privileges.

\- Then check the filesystem to ensure there are no problems: "/sbin/fsck -fy"

\- Then mount the filesystem for it to be accessible: "/sbin/mount -uw /"

\- Now remove this file so OS X will re-run Setup Assistant: "rm /var/db/.AppleSetupDone"

Now just restart, and enjoy the cool introduction animation as you create your admin account.

<comment><USER17> If I understood the article correctly, this can be exploited remotely by anybody who has managed to get a shell on the system.

<comment><USER18> Just to clarify, this is _not_ a remote vulnerability. If it was a means to create a remote shell, then it would be. An attacker would need to first find some way to gain remote access and then could use this bug to gain root privilege.

<comment><USER17> The parent comment and some of the child comments are implying you need to be physically near the system, which doesn't seem to be true.

You still need to find a way to execute code on the target system (also called "getting a shell"), but this can be done over the wire, too.

</comment></comment></comment></comment><comment><USER19> Of course this exploits XPC.

I really _hate_ all the desktop IPC bullshit. IPC frameworks are pure fucking evil. COM, D-Bus, XPC, everything SUCKS.

If you want completely separate programs on one machine to talk, use UNIX domain sockets (with something like ZeroMQ or HTTP), FIFOs (named pipes), anything that you can chmod and chown, not a daemon that reinvents access control, badly.

<comment><USER20> Hm? This wouldn't have been any better if implemented using sockets.

<comment><USER21> Indeed, it wouldn't. It's just another typical example of someone who doesn't understand why a complicated IPC system exists, and thus blames all possible problems on its mere existence.

It's like users who encounter a random problem in a program, and then blame it on the fact that the program is written in C++, simply because they do not like C++.

</comment></comment></comment><comment><USER22> While this is a significant vulnerability, I don't think the article is correct when it calls it a 'backdoor.' The term backdoor typically implies something that was intentionally left to allow illicit access, and while this is a significant bug, I don't see anything to indicate that's the case here.

<comment><USER23> There's no way to tell for sure if something like this is intentional or not. Also, waiting to fix it until a researcher makes it public may have been intentional.

<comment><USER22> > There's no way to tell for sure if something like this is intentional or > not.

Right, so the simplest explanation is that it's an unintentional bug. The absence of evidence that it was unintentional isn't evidence that it was intentional. If there were some magic string or default password or something, that'd be an obvious backdoor, but to me this looks like a pretty typical privesc bug, albeit in an undocumented api.

It was found through a chain of events that started with looking at the patch related to another privilege escalation vulnerability, one which no one seems to be claiming was a backdoor.

> Also, waiting to fix it until a researcher makes it public may have been > intentional.

I'm guessing it's more likely the the researcher waiting to go public until it was fixed.

This is evidenced both by the fact that it was patched alongside other vulns (ie. not a rushed out one-off patch) and from the article's disclosure timeline, which shows 'Full disclosure' occurring 04/09, while the 'Release of OS X 10.10.3' occurred 04/08\. This is a pretty typical disclosure timeline; they couldn't begin to fix it until it was tracked as a bug, after all.

<comment><USER24> _There 's no way to tell for sure if something like this is intentional or not._

Yes, there is. Sue Apple for willful negligence and subpoena the development logs.

<comment><USER25> Sigh. No _practical_ way…

</comment></comment></comment></comment></comment><comment><USER26> OT but I have to say that the amount of Apple apologists in these comments is mind blowing. HN reader of all people should be the ones urging Apple to issue a fix for a very serious bug such as this one. Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

<comment><USER27> >Yet many comments here are saying that people should just upgrade while it might solve the problem for some, there are ones who can't upgrade machines at will.

It's dumbfounding how people here are simply shrugging this off and posting "So what? Just upgrade. Simples" type comments. This _isn 't_ acceptable. I know many people in creative industries alone who _can 't_ just upgrade immediately any time something comes out as they've to wait for their products to support the newer version. Similarly there are many who are using Macs in work whose corporate policies won't let them simply update immediately.

Then there's many who don't immediately upgrade versions as a point while bugs/other issues in that new version are found and resolved.

It's not an acceptable answer whatsoever.

<comment><USER28> I have 3 macs. One of them is an older iMac. I can't put enough RAM in it to run Mavericks (which is a memory hog). It is a perfectly good computer, there is no reason to upgrade from Lion.

The next one is a 3 year old Mac Mini. I upgraded to Yosemite and it performs TERRIBLY. It has 16G of RAM. I've tried everything. Yosemite just sucks. The machine is now much slower than the 6 or 7 year old iMac with only 4G or RAM. If it was practical to back out to Mavericks I would.

The last one is a 2 year old Macbook. I rely on it for my job. There is no way I'm going to risk the crappy Yosemite performance to upgrade. I'll live with the security flaw.

Here is what I now know about Apple: They will not support you for the lifetime of the product. They consistently release buggy code these days. Unless you are willing to shell out more money for new hardware every time they come out with something new, you will be stuck "as-is (with bugs)" until you get rid of it.

No more Apple anything for me. I'm thinking I'll switch the Mac Mini to Ubuntu if I can get it to work there. I'll use the iMac until it doesn't work any more, and when my Macbook is ready for an upgrade (in another year or two), I'll be trading in that still-Mavericks based system for a Linux laptop or maybe I'll go back to Windows.

<comment><USER29> "I can't put enough RAM in it to run Mavericks (which is a memory hog)."

I'd upgrade to Yosemite today with the latest updates. They just freed up 4 GB of ram for me. Sadly if I had known all of this beforehand I wouldn't have gone out of the way to buy some old Mac Pro where I could upgrade the memory to 32 GB or more, so I just wasted about $1500 for the whole setup.

Then again like you, I transitioned my work to an Ubuntu box, but even for my personal stuff my Mac was just really slow unless you get an SSD drive which is time consuming to install on an iMac.

<comment><USER30> You can't run Yosemite on a lot of older hardware: [http://www.apple.com/osx/how-to-upgrade](http://www.apple.com/osx/how-to- upgrade).

<comment><USER29> 2007 is pretty old when it comes to Macs.

For 2009 and up Mac Pros, there are plenty of hardware options for upgrades; and firmware as well for 2009.

</comment></comment></comment></comment></comment></comment><comment><USER31> Are Apple glad it wasn't found by a "You have 90 days before disclosure" outfit? Look at that timeline...

<comment><USER11> Pretty lengthy time! Let's hope he got a bounty or a free device as a reward

</comment></comment><comment><USER32> I'm having a hard time understanding whether this is an intentional backdoor or just an accident.

<comment><USER33> Smells like an oversight to me. Some new developer got assigned to implement or tweak the SSH enabling switch (or whatever), and this was their solution, which never got reviewed.

<comment><USER32> In that case, I think "backdoor" is hyperbolic. That word is usually uses to indicate intentional secret security holes.

<comment><USER34> What do you call something that grants root access without authentication, but wasn't intended to let arbitrary people or programs use it?

"Backdoor" isn't quite right, since that implies that the intent was to allow unauthorized use.

"Security vulnerability" isn't quite right _either_ , since that usually implies getting code to exhibit some sort of behavior it was never supposed to have.

I can't think of any other term. Of the two, "backdoor" seems closer. Maybe "unintentional backdoor"?

<comment><USER35> > What do you call something that grants root access without authentication, > but wasn't intended to let arbitrary people or programs use it?

Local privilege escalation. In a huge number of established LPEs, the exploit is by leveraging a weakness in checking who makes the call that allows legitimate privilege escalation. This is a legitimate privilege escalation (sshd binds to port 22, among others tasks), that can be exploited through a weakness in checking who is making that request and if they can have that granted.

</comment></comment></comment></comment></comment><comment><USER36> As someone who _loathes_ Yosemite, I was hoping to find another fix for this. However, the exploit code when run in my console already returns "You need an administrator password" prompt. Huh? I'm running 10.9.5.

<comment><USER37> Run the python script at the end of the article as non admin/non root user. The script allows you to create a copy of a binary in say /usr/bin with "set user ID execution" bit set and owned by root! This should not be possible without root privileges.

This is pretty bad, and trivially exploitable. Basically anyone that has non- root access to your computer can trivially become root and take over the system.

</comment></comment><comment><USER38> I am really pissed they are only releasing a patch for 10.10, and forcing me to upgrade to 10.10.

</comment><comment><USER39> When Apple refuses to fix something that's good the public's interest, the best way to get Apple's attention is to make this a rootpipe gate by sending tips to all Apple focused media outlets like AppleInsider Macrumors etc. Talk about the power of press.

Case in point: Antenna gate, Bend-gate etc.

</comment><comment><USER40> Objective-C's "null pointer dereferences doesn't crash" behaviour rears its ugly horrible head again.

Programs crash for a reason! Crashing when faced with nonsense is a _good_ thing! Let us not forget this.

<comment><USER41> I'm kind of surprised there's not a means (to my knowledge, at least) to crash/throw an exception upon sending a message to nil for people who want to better ensure their code doesn't have lurking issues like this. I suppose it'd have to be smart enough to filter out system frameworks to be useful, but I'd imagine that to be do-able.

<comment><USER42> Why not just some old-fashioned input guarding?

        if (input == nil)
            haltAndCatchFire();

Or whatever the Objective-C syntax for that is.

<comment><USER41> To make a scheme like that work, you'd essentially need to check before every single method invocation in your entire program because the issue — such as it is — is with method invocations being made against nil references, not with nil parameters being passed in as arguments to method calls.

I was imagining something more like a modified version of the runtime's objc_msgSend() C function (which Obj-C method invocations get compiled into) that guarded against that, but you do make me realize that such checks could conceivably be automatically tacked on at build time.

Anyway, I'm not entirely sure how useful such a thing would be, but I am curious how often my code (unintentionally) makes calls against nil and I've just never noticed because it doesn't cause harm.

<comment><USER42> Ah, I see. I think that at some point you have to trust something. The only true way is to never trust any of your inputs. This is, after all, what the JVM does in order to throw out kindly NullPointerExceptions on null dereferences. But realistically that is extremely consuming and has little payoff in most cases. I typically do not trust arguments, but do trust the results of functions to be what the documentation says it will be.

Static analysis could potentially go a long way here to expose values that could be potentially "infected" with nil. (And, for all I know, the JVM JIT could do exactly this to skip checks on provably non-null values.)

</comment></comment></comment></comment></comment><comment><USER43> > Okay, so the systemsetup binary simply checks if we are running as the root > user?

>Philip tried patching that function (replacing sete with setne), with success:

How do you patch the binary without root or the admin user password anyway?

<comment><USER44> Pretty sure they did that as root, so they could get past that and explore how the program worked when being run as a non-root user. The final exploit doesn't depend on this program, though; it uses the same RPC interfaces this program does, from a separate program, so the patching was just part of their exploration, not part of the exploit.

</comment></comment><comment><USER45> So is _Snow Leopard_ (Mac OS X 10.6.8) not affected?

<comment><USER46> Still pretty much the best OSX.

<comment><USER11> Unless you want to resize windows from the left edge :-)

<comment><USER46> Preach.

</comment></comment></comment></comment><comment><USER47> Could anyone summarize the implications of this finding in plain English?

<comment><USER48> Any code running as any user on an unpatched version can become root (and do whatever it wants, E.g. install keyloggers)

Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure.

<comment><USER49> >Sandboxed apps (from the app storr) may be blocked from doing this, I'm not sure.

Just tried. Sandbox lets this through. (As long as you pass nil to authenticateUsingAuthorizationSync:).

<comment><USER11> Ouch.

</comment></comment></comment></comment><comment><USER11> [https://support.apple.com/en-us/HT204659](https://support.apple.com/en- us/HT204659) makes for depressing reading.

Impact: A local user may be able to cause a system denial of service

Impact: A local user may be able to cause unexpected system shutdown

These two made me laugh though.

</comment><comment><USER50> So who wants to sell a patch for the now unsupported users of OS X 10.9, 10.8, ...? It could be as simple as changing the permissions on System Preferences so that now you must enter your password before running them (so that they always run as root). Then patch out the backdoor.

</comment><comment><USER51> I also don't think this indicates malicious intent. It's as likely that some collection of junior engineers who were tasked with something other than system security, simply invented something that was both insecure and obscure. This happens all the time. It takes a lot of extra time and code to engineer security and it's historically been one of the first things that product managers and senior management will toss out the door when the schedule inevitably becomes the gating factor. Hey, they fixed it. And you know, some Day One bugs are simply very very hard to fix when you find out years later that there's all this other code that depends on it...

</comment><comment><USER52> Six months for a fix? I would have given them 90 days and released it.

</comment><comment><USER53> It does explicitly say that Security Update 2015-004 only updates Admin Framework on 10.10+ (it does not require 10.10.3) to fix CVE-2015-1130 : Emil Kvarnhammar at TrueSec [https://support.apple.com/en- us/HT204659](https://support.apple.com/en-us/HT204659)

Quite a few other security related things are fixed with this update that do apply to older versions of OS X.

</comment><comment><USER54> This article has a nice exploit code written in python down below for curious ones how works in code.

</comment><comment><USER55> I wonder how long before malware that uses this will appear, given this is trivial to exploit.

</comment><comment><USER56> so... Anyone preparing OpenBSD to work on newer macbooks?

</comment><comment><USER57> Couldn't they have made the update slightly smaller than 2GB? Apple sucks at distribution and their software update infrastructure is hosing.

</comment><comment><USER58> 10.10.3 came out 2 days ago. This counts as reasonable disclosure?

<comment><USER59> He discovered it 6 months ago. Maybe he gave Apple 6 months to fix it before disclosing?

<comment><USER58> I get that, but surely you have to provide a reasonable amount of time for patches to be installed. Perhaps a 2-part blog entry, where he gives general details (to instill urgency) and then release exploit code a month later?

<comment><USER59> If he published because Apple just patched, then I agree. If he published because he said he was going to disclose it at a certain time, then I think it's Apple's fault for dragging their feet. 6 months is an eternity.

</comment></comment></comment></comment><comment><USER60> > The Admin framework in Apple OS X contained a hidden backdoor API to root > access for several years (at least since 2011, when 10.7 was released).

Lion was cancer.

<comment><USER60> I see there's no love for Zodiac puns. Oh well, I still love you guys.

</comment></comment><comment><USER61> Related to this, how have people found running Yosemite compared to Mavericks, performance and compatibility-wise?

Are you sorry you upgraded? (I'm asking for a friend.)

<comment><USER62> I upgraded. I haven't had any problems that I wasn't already having in Mavericks (Anyone else have kernel panics when sleeping with a thunderbolt monitor attached?).

<comment><USER63> Yes! (although minus the thunderbolt monitor)

<comment><USER62> I also have a problem with a Dual-link DVI adapter. If I sleep with it connected, at some point it wakes up and "kernel_task" takes up 100% CPU (all 8 cores) until I put it to sleep and wake it up again. Sucks coming down in the morning and finding my Macbook burning a hole in the desk.

</comment></comment></comment></comment><comment><USER64> OT but does anyone know how OSX bluetooth keyboards work? I thought I had BT disabled and a prompt popped up on hotel wi-fi asking me to enter the code for (not my) keyboard

</comment><comment><USER65> I upgraded my 2014 15" rMBP and it killed the wifi, so now ping times have gone from about 12ms to several thousand or nothing. [https://medium.com/@mariociabarra/wifried-ios-8-wifi- perform...](https://medium.com/@mariociabarra/wifried-ios-8-wifi-performance- issues-3029a164ce94) no longer works. Depressing. I miss my chromebook.

<comment><USER66> You could sell your rMBP and use the proceeds to buy like 4-5 chromebooks.

</comment></comment><comment><USER67> wait, you expected to find people at a security conference that weren't aware of the fact that even OS X can have exploitable vulnerabilities?</comment>


Ask HN: 	Am I introverted, or just rude? - <AUTHOR> I'm always shy. I have trouble making small talk, and after I've been surrounded by people for too long, I need time alone. I am always making excuse to avoid meetings. Sometimes I feel I am coward.<p>Are there any introverts out there who have developed coping mechanisms for dealing with people when you're already peopled out, and are willing to chime in? <comment><USER3> Social interaction can be compared to a game of throwing a ball to each other. You throw the ball and see how they catch it and throw it back to you. In any game, if you don't have enough practice, you'll have to put all your attention to it, which is tiring. Basically, the more you enjoy throwing and catching a ball, the better you become and the less tiring it will be.

As for practical tips - remember that it is also not easy for most people. Make it easier for them by not throwing in an unexpected way, or too hard. Don't put all your attention on the ball or your partner, it is just as well about you.

After a few minutes of throwing a ball with a new partner, you will see how they catch it, how they throw it, what play style they have and what they like. After that you can use more complicated play styles, talk about complex topics without fear of being misunderstood.

Also, improvisational theatre and status games can be useful to practice being in different social positions.

</comment><comment><USER4> I've always looked at Introversion/Extroversion using the battery example. As an Introvert, we recharge our battery by being alone, and drain it in groups. An extrovert is the opposite... charge in groups, drain when alone.

Outside of "charging your battery", it's a matter of skills and preferences. You can learn to deal with groups better, and (when allowed) pick the events you want to deal with.

If those meetings are important, don't avoid them. But if they are "social gathers because someone wants you to go"... then you can think twice.

</comment><comment><USER5> I'm in the same boat as you so pardon me for not giving a sugar-coated response(since I am simultaneously criticizing myself).

Rude? What was your motive for behaving a certain way? If that motive did not include arrogance,selfishness,hatred or apathy then I don't think you were being rude at all. This doesn't change the fact that you are being perceived as rude. People simply cannot tell your motive without getting to know you on a personal level beforehand. I agonize endlessly over maybe having done something that will be misunderstood as rudness or unkindness.

Coward? This is a though one to admit. I hate and despise it but it is a truth I had to face. Even if your personality is an introvert,you should be able to forcibly tolerate discomforting situations. Avoiding them is acting out of fear (of awkward situations,discomfort,etc..). It is a personality fault. I have been trying to self-reflect and find the root cause of this behavior. I was much more tolerant towards it when I was younger but I am now starting to see all the things I missed out on (personally and professionally) as a result of introvertism and social anxieties.

I hope you find an answer that helps.

</comment><comment><USER6> I had somehow a similar experience.

At some point I identified it as a problem and learned to start and keep up conversations with new people. Slowly I started liking that and it became more or less natural.

I still have "recovery" periods when I am just too tired or have no interest to talk to people, so I simply don't.

But those are quite short (few days a month), and the rest I use for visiting meetups and networking with other people.

I can recommend a few books I appreciated the most:

1\. "How to win friends and influence people" by Dale Carnegie - <USER2> outdated but still gives a lot of basics.

2\. "How to Talk to Anyone: 92 Little Tricks for Big Success in Relationships" by Leil Lowndes - more modern but not necessarily perfect, although I found a few important things for myself.

3\. "How to Talk to Absolutely Anyone: Confident communication in every situation" by Mark Rhodes - same as above. Not perfect, but has some interesting ideas

</comment><comment><USER7> Me too, and I know lots of other people like this. In fact, I would say that most smart people I know are like this.

There are a bunch of solutions to the smalltalk problem. One is to have a stock of prefabricated responses to common situations. Another is to let the other person do the talking. Most people love to talk about themselves and their thoughts and feelings, if given a chance to.

</comment><comment><USER8> i dont think not interacting people is rude. being rude is rude. and i think expecting someone to small talk with u because you're not introverted is perhaps also rude. Don't have to doubt yourself or your interests because 'other people seem different' or 'people expect differently of you'. be who you are and realise who you are and where your interests lie. Perhaps you're just not interested in small talk and interacting a lot with other people, this is common for many people, though you often don't hear about it, because these people keep to themselves. :-)

i don't like interacting with people much unless there is a shared interest. and specific to my interests i don't find a lot of common ground between most people. It doesn't keep me up at night (anymore.)

Don't worry, be the person you want to be, and if you have doubts, let them be your own, which you can investigate and learn about with self reflection. you dont need to live up to everyone elses expectations, just your own. :)

</comment><comment><USER9> I'm introverted. It's very seldom my intention to be rude. Some extroverts do perceive me as rude, and have told me so. I don't believe that's the common case, though.</comment>


I am a compound word and a popular snack. - <AUTHOR>

I am a compound word and a popular snack.
My first word means bust or explode.
My second word is also edible.
What am I?
New game to android for kids from Planemo Studio, look here:  https://play.google.com/store/apps/details?id=com.planemo.bobbyPuzzlesEn <comment><USER2> The clues would lead me to believe you're popcorn. But I think the real answer is spam.</comment>


Tech giants should give away their money instead of their products - <AUTHOR> https://www.vox.com/recode/2020/3/31/21197652/coronavirus-philanthrophy-donations-google-cisco <comment><USER2> Let's follow the financial incentives of each choice.

Option 1: They give away money, earn some good pr, but loose money, and open up to potential securities fraud lawsuit if the amount given gets high enough to impact stocks. Good pr only goes so far towards getting new customers if you are an established player in the market. Conversely, medium and large players are the only ones in a position to give. Medium risk, low reward.

Option 2: Give away their product for free. Depending on the nature of the product, it could anywhere from zero to low cost to do so. No risk of securities fraud lawsuit. More people trying your product means more potential customers. Plus also good pr. Little to no cost. Low risk, Medium Reward.

As a company who is in the business to make money, as per the fiduciary duties outlined in their corporate bylaws, which option seems more appealing?

The problem here is that the common good is not incentivized.

Change the incentives, change the world.

</comment><comment><USER3> Media giants should give away their money instead of their opinions

<comment><USER4> It'd be fake either way.</comment></comment>


Why are all the 'cool' jobs no longer using .NET? - <AUTHOR> http://www.reddit.com/r/dotnet/comments/1rlamp/why_are_all_the_cool_jobs_no_longer_using_net/

<comment><USER2> I'm an unapologetic .NET lover, and the comments on the subreddit largely hold true. In the end, culture is the biggest differentiator. MS has excellent tooling and support, but nobody knows about it. They have Bizspark, which is one of the best startup-focused programs I've seen (literally tons of free stuff for your runway), but once again nobody knows about it. Azure is probably the most innovative, stable, clearly-priced cloud platform in the industry, but nobody knows about it. If you want to write Javascript/Node with full IDE support, Microsoft has you covered, but nobody knows about it. F# is probably the best FP language in existence, but nobody... well, the point is made.

The only people that know about the new things MS comes out with are the few of us .NET developers also with a foothold in the Startup scene, and old enterprise companies who bought into the stack back in VB5/C++/MVC days.

The other uphill battle is young people's view on technology. Most of them would rather platform-hop in the same way people change churches (and for much the same reasons). New = better, and Microsoft = old, so no need to even see what they have to offer. Young people with ample free time have always driven the software industry, and young people want to use things built by startuppy or nonsensical names. "Microsoft? They actually have software in the name? No thanks!"

Finally, it's an issue of evangelism and online/community presence. Because enterprise is the bread and butter of MS, MS tends to target those kind of people more. It's not that they don't try to capture new minds, but when you attend an event where you're the lone startup guy among 50 enterprise people, how do you think presentations are going to be focused? When your community seems to be centralized on your corporate domain, are you really going to attract someone who isn't willing to type in "microsoft"? New platforms get popular not because they're actually better, but because they're cooler. Either cooler sounding, there's a new type of tutorial (to-dos and 5-minute- blogs are played out, people), or it's got a guy with weird hair promoting it, using Jobs-esque language like "beautiful" or "elegant". Of course it's elegant at version 0.9 before it really does anything. Look at Rails now that it actually does stuff.

Anyway, mini-rant over. I think MS deserves more attention than they get, but ultimately they dig their own grave by not investing more in capturing that next generation.

<comment><USER3> I know about it, but licensing for 50 servers running IIS on Windows 2008 vs 50 servers running LAMP is a big price difference to even a medium-sized company, let alone a startup. I also wouldn't bet my company's success on whether mono is working correctly this version.

Oh and if you start building on that infrastructure using AD, Exchange, etc you're in CAL licensing hell. Next thing you know you've spend the wages of two really good engineers on just MS licensing. How is that cost efficient? I'd rather have a 5 man team running linux than a 3 man team running MS.

Not to mention, if I'm recruiting young talent, how many of them will have MS enterprise experience vs linux-based experience?

<comment><USER4> Not only that, its a pain in the ass to maintain Microsoft boxes compared to *nix. I dont understand how anybody has patience dealing with guis that just get in your way of getting shit done.

<comment><USER2> > patience dealing with _command lines_ that just get in your way of getting > shit done.

</comment></comment></comment></comment><comment><USER5> _I spent too much time with .NET I don 't want to learn ruby!_

It always pains me to hear such cries from someone who claims to be a software developer/engineer. I've used .NET (among several other) technologies for some years and had a few co-workers who would openly fret about Microsoft's direction and what horrible things they might have to endure if .NET went out of favor. Gosh, you mean you might actually have to learn a new technology? What a truly awful experience. I could never relate to that and I legitimately felt sorry for them. I hope to never become afraid or resistant to learning and am always ready to admit how little I really know.

The language/framework is but a means to an end. Each with strengths and weaknesses, but all of them suitable for a wide variety of uses. If you feel that your knowledge as a software developer is so language specific that you fear having to move away from it, you're doing it wrong.

<comment><USER6> It's less about learning a new language, and more about learning a new framework.

As of .net 3.5, the .net framework contained 98 Assemblies, 309 namespaces, and 11,417 types. The framework is gigantic, and after you've spent long enough in .net, your domain specific knowledge of the framework itself is gigantic as well.

As someone who has been building applications on .net since beta, I have no fear at all in learning a new language (bring it on!). I have a fear of losing over a decade of experience with the thousands of classes provided in the .net framework that I use, and rely on, on a daily basis. I know exactly what I'm looking for, how it works, and what the performance ramifications are of each component I choose to use. I know what needs to be replaced with something custom to scale. I know what's doing extra work I don't need. I know the ASP.net page and control life-cycle (intimately), how the view engine works (and how to add features to it), how to replace critical components for custom functionality and how to build custom controls. I know the WPF layout system. I know the quirks in windows forms and GDI+. I know programmatic drawing in both frameworks. I have done machine learning in .net. I have done massive file IO in .net. I know the .net multi-threading model. I know how to do code generation in .net. I know how to use raw sockets in .net. I know how to bend this massive framework to my will, and get all of the performance and power I want out of it. I have built reliable, predictable, massive scale applications in .net. Over my entire career I've invited product managers to give me their crazy ideas, and I have never had to push back.

Having said that, I also don't want to learn Ruby. I don't think it's mature enough to get my attention. I don't see how it is in any way better (that's not to say that it isn't, I just don't see it). Is it easier to learn? Maybe, but I've already crossed that hurdle; just like OP on reddit has. Is it a faster platform to blast out a simple website? Likely not for me. Is it a better platform for building and scaling massive applications? I doubt it.

Your language/framework defines the outer capabilities of your application, the performance of your application (read: scale), as well as what parts of your application can be reused from parts made available by others. They are things to be mastered. .Net takes a long time to master. The "jack of all trades master of none" attitude is what pains me. Show me that ruby is better for me in an area that .net is lacking and I'll learn it. Show me that it's better in all of the areas I care about and I'll master it. That will be a hard sell. .Net is a fantastic platform; well organized, discoverable, consistent in quality, exhaustive in scale, performant, and still growing.

Will .net last forever? I don't know. Older Microsoft technologies are still around and .net is still in active development. I don't see Microsoft giving up the massive investment they have made in .net any time soon. Whether or not Microsoft stays relevant in web programming is up to them, and up to those of us using it.

As to startups using .net, I've worked for two. One provided a product that allowed you to order print ads made for your franchise. It accepted photoshop PSD files from designers, took them apart and allowed the ordering party to swap layers and text to fit their business, all with a WYSIWYG live-previewing interface. I wrote the original system myself in 2004 and the company is still operating today. The second was an online ad distribution company. The system I helped build was capable of targeting, serving, and tracking over 500 million ads per second at peak (a major accomplishment in 2008). The company is still operating today. I was not told what the companies did until after the interviews and pay negotiation. There was no way to know before I accepted the jobs whether or not they were "cool" jobs. Before starting my own business I was invited to work on a high frequency trading system built in .net. I turned it down, but they are doing very well. I've worked more for large businesses and mega-corps who also wouldn't tell me the nature of the job they were hiring me for until I was hired. How do you know ahead of time if a .net job is cool when all you hear about it is "Senior .net developer needed"?

Is there a lack of marketing from MS extolling the values and virtues of .net on the server (especially for start-ups)? Yes. But that's always the case with Microsoft. They are terrible at marketing. They will always be terrible at marketing. Should you be using .net at your start-up? That's up to you. I'm using it for mine.

<comment><USER5> Thanks for such a well thought-out response. To be clear, I'm most comfortable working in the .NET framework (~5 years experience), but while I can see where you're coming from, I still disagree with the overall perspective.

 _The "jack of all trades master of none"_

To me, the trade in question is software development/engineering. If we are tradesmen, then .NET is one of the toolboxes available to us. Yes, it's a very advanced and developed toolkit, but I don't view it as an occupation. Now if you constrain yourself and simply call yourself a .NET developer and not a software developer, I suppose that would be an exception.

 _Will .net last forever? I don 't know. Older Microsoft technologies are still around and .net is still in active development. I don't see Microsoft giving up the massive investment they have made in .net any time soon._

My experience is mostly on the desktop side (application dev for medical devices) and it has been the opposite. Look at technologies like WPF and Silverlight for example. I don't think you can honestly say that Microsoft developed these to maturity and didn't to some extent abandon them.

 _Your language /framework defines the outer capabilities of your application, the performance of your application (read: scale), as well as what parts of your application can be reused from parts made available by others. They are things to be mastered. .Net takes a long time to master. The "jack of all trades master of none" attitude is what pains me. Show me that ruby is better for me in an area that .net is lacking and I'll learn it. Show me that it's better in all of the areas I care about and I'll master it. That will be a hard sell. .Net is a fantastic platform; well organized, discoverable, consistent in quality, exhaustive in scale, performant, and still growing._

I think it's a bit contradictory to say that you need to master a language to understand it's capabilities, yet you won't explore other languages unless it's proven to you that they have capabilities that .NET lacks. That said, I think your viewpoint is mostly valid _if_ you have full control over what technologies you work with (e.g. starting a startup, or only applying to .NET companies). However, that is true for very few developers and this is where the whole idea of fretting over the future of .NET comes from.

In my field (medical imaging and devices), I have used plenty of .NET, but I could never rely on it entirely. The foremost medical image processing and visualization frameworks and libraries still reside in C++ and although there are .NET wrappers, they are almost always limited, several releases behind, and with a much smaller community (there are a few exceptions).

To be clear, I love .NET and even moreso Visual Studio. However, if I'm asked to propose a technology for a product, I'm going to do my research and pick the one that I feel is best-suited for it and not let my .NET experience be a guiding force in that decision (unless this is an extremely time-sensitive project and I represent a significant amount of the developing team, then of course it needs to be considered).

<comment><USER6> Thank you for a well thought out response. One of your up-votes is me.

I understand where you're coming from and I don't see your viewpoint as wrong. Mine is different. I see programming as part of an art, the way applying paint is part of creating a painting. It is by-far not the only part.

I totally agree that a good programmer should branch out and gain a better understanding of the world, but I believe the branching out should happen in a different direction.

To call someone that writes books a writer is an oversimplification of their job. Writers, like programmers, specialize. One writer might write non-fiction books in English in the murder mystery genre for an adult audience. This writer has had to develop a solid experience in and handle of the English language. They have had to research and understand murderers, the law and police. They need a solid handle on psychology to be any good. They need to understand the implements of murder. They need to understand the standard plot points of their genre, and how far they can be bent (to interest readers) before they break (and turn readers away). They need to understand pacing, and how to capture an audience's attention consistently. How to keep their material accessible to expand their audience as much as possible, or how to narrow their focus to be a must read for a certain niche. They must know how to get published and avoid getting swindled. Putting words on paper is only a very small part of their job.

If our hypothetical writer is going to branch out into new areas, he's more likely to gain success writing a sci-fi novel (where he can reuse most of his skill) or starting his own publishing company than he is in learning French to write books for the French audience.

Learning basic French is not hard, but it is very hard to know French like a native French speaker (an expectation of your French readers). If he is thinking in English and writing in French, his efficacy is already compromised. If you are writing for the French audience, you will have to take French customs and the French psyche into account. French readers are likely very different from the ones he's used to, so he needs to understand the psychology and mind-set of his audience and his characters. Publishing a book in France is also likely completely different, with different ways to lose money in a book deal. Learning basic French will only help our writer when he needs to integrate a French character into one of his books.

It would be a little silly to tell a writer that he needs to identify as an English writer if he doesn't know French.

I make consumer products. I am a .net platform developer. I started my career as a designer 14 years ago; and soon realized that there is too much compromise in just graphic design. Every design I submitted at the company I worked for had to be changed (often dramatically) to fit within technical limitations. My designs were created to appeal to my audience, and due to technical limitations, that appeal was compromised. I had already been programming at home for a few years, and decided it was time to become a professional. The second month at my design job I asked to be put on the programming team as well. At the time, we were writing in legacy ASP. I never had a design compromised by technical limitation ever again. When .net was made available, I jumped on it immediately. I loved the ideas behind it and I couldn't wait to be a part of it.

A year or so later, I started realizing that the database design for a new product I was building was hampering my ability to write clean software (also due to "technical limitations"). I asked to be added to the Database team as well. I became a DBA. I was still a designer and developer. A year later, I became a PM as well, and so on.

At this point I have held the titles of senior .net architect, .net team lead, senior .net developer, senior MSSQL database architect, senior product manager, creative director, senior graphic designer, business analyst, and research scientist. I am always a .net developer, but in every job I've had at least two other titles as well. Each of these roles interface with the others, and knowing the others makes doing each of them much easier.

My job is to make quality consumer software. My job is to appeal to an audience. I learn whatever I need to in order to better appeal to that audience. As a whole my audience doesn't care what the software is written in. They care about whether or not it's easy and pleasurable to use, whether or not it's fast, intuitive, and solves their needs efficiently.

Now I have my own software company.

\</comment></comment></comment></comment><comment></comment><comment></comment><comment>-----

WPF works, has a number of great features and tricks, and it's fast if you're using it right. I assume the developers on WPF moved to the Metro dev team when that ramped up; I don't know. Maybe they'll be back. My only issue with WPF is its half-hearted 3D support. Silverlight was an experiment, and it showed. It's still possible to write great stuff on Silverlight, but the limited audience keeps it from being a solid solution unless you're doing something that can't be done as well using something different (DRM video for example) or you are creating an intranet application and have control over all of the machines that will be using your application. It's a shame, but that future was easily foretold when it was announced.

\</comment><comment></comment><comment></comment><comment>-----

I don't think you don't have to master a language to understand its capabilities, but woe to he that tries to exceed them without having a solid understanding of what's going on under the covers.

In my experience, .net shops are .net shops. Maybe I have been lucky.

In my experience it's pretty easy to write your own wrappers for C++.

What sort of projects (other than projects targeting non-windows machines) have you encountered where you suggested not using .net?

</comment><comment><USER7> I think the biggest problem .NET has in many areas that are considered "cool" is that Microsoft's license-oriented business model imposes lots of license- oriented friction around .NET that don't exist with open-source technologies. The actual _dollar cost_ of licenses is important but there is also a cost in the friction that licensing (and the associated product segregation into packages designed around tiers based on how to sell licenses rather than pick- what-bits-you-need-for-what-you-are-doing-today) creates.

</comment><comment><USER8> In game development .NET/Mono is becoming seriously cool now - look at Unity and MonoGame. It's hard to walk away from C# because it's one of the best languages combining most paradigms and both static and dynamic type systems. If you want to hack social start-ups using languages that don't do basic checks before run time in an editor without basic intellisense/autorefactoring then you are welcome to switch.

</comment><comment><USER9> I feel like this might have more to do with the poster living in DC. I'm in the DC area, and most of the job postings you see are for government contractors, which aren't exactly "cool". That's not to say that there aren't "cool" jobs here, but if you're looking at Dice or Monster, they aren't going to be the ones you see.

</comment><comment><USER10> Seriously question and not trolling, but was there ever? Has there been a change in culture or has it always been this tragically uncool?

</comment><comment><USER11> > I share their passion about coding

> I spent too much time with .NET I don't want to learn ruby!

Um. That answers that.

</comment><comment><USER12> _No longer?_ Were they ever?

</comment><comment><USER13> I like .NET pretty well, but I don't like working on Windows or being bound to it. (Maybe the Mono stuff has gotten better but when we used it at my company we had two problems: bugs in our code _and_ bugs in the platform.)

Also, after doing lots of things in JS and Python over the last couple years, going back to .NET just feels too "heavy" somehow. The changes in C# and .NET over the years have been very nice so it's hard to justify this feeling. One definite downside of the .NET ecosystem, I would say, is that they take forever to do completely sensible things that everyone else is doing. Things like MVC, package management, deployment tools.

BTW, I have found that in interviews my extensive past .NET experience is viewed negatively. There are assumptions out there about .NET devs and in fact I would say there is some basis for those assumptions. At the same time, I was hoping that smart people would be able to see through that and acknowledge that not everyone who works with a technology is "like that", but alas. So it is a bit of a liability, unfortunately.

</comment><comment><USER14> Back in the day, .NET was coherent, well-designed, well-implemented, and the tools performed well on PCs. This was circa 2001. NETCF was in beta, and you could literally drag-drop an object from the mobile endpoint to middleware to back-end. Visual debugging of on-device code, emulators, understandable errors and warnings... Brilliant!

At that time, attempting to run Linux, Eclipse, Forte, Java, etc. was difficult, buggy, and slow - sometimes too slow to be usable. Until Sun sued it off the market, Visual J++ was the only usable interactive Java toolchain/runtime/base-classes with UI base classes that resulted in applications that looked and acted polished and clean.

The big difference today is that you can take a laptop out of a box and within two hours have a Linux-based Android development toolchain up and running without any hitches, and have an even more coherent managed language runtime targeted by that toolchain running clean beautiful mobile touch apps.

Open tools and OSs have been completely transformed. I don't really see the 13 years of comparable progress in VS and Windows.

<comment><USER15> I didn't work with .NET around 2000 much; I had it installed on a Windows machine and played around with it, but not for anything serious as it usually just sucked quite a bit. Anyway; we ran everything open source besides some Windows machines for development at that time; our development server machines first were 15 very old IBM machines we picked up for a few 100 euros installed with Linux (no X) and after that 15 VMs running on VMware on one bigger machine. All ran smoothly and we actually hosted clients on those machines; everything written in 'enterprise Java'. One of those systems is still running actually, on the same old hardware without changes to the software. No problems with that 'Linux, Eclipse, Java, etc. was difficult, buggy, and slow' => it all worked fine and was fast enough to be productive, have happy clients and make tons of money. Quite different from _any_ Windows experience I had around that same time and after that.

This experience has not much to do with .NET per se; I really like C# and F# and sometimes wish I could use it all the time (not a big fan of Mono yet...). Maybe I'm just weird or set in my ways, but I don't really find the MS toolchain to be very productive. I'll retry it again when I get my hands on a Windows laptop (we're running only Linux and Mac OS X besides for WP8 dev and i'm not doing that at the moment).</comment></comment>


Proposed law allows federal government to lie about public records' existence - <AUTHOR> http://www.propublica.org/article/government-could-hide-existence-of-records-under-foia-rule-proposal <comment><USER2> Sounds like they're already doing this. This would just make it official.

Also interesting is that the change is just a "rule change," not a proposed law. That means that if the rule change takes effect, information could be restricted further without the legislative branch having anything to do with it. It's just the executive alone, completely deciding what to release and what not to -- and now being able to lie about it to boot.

I find it amazing that such a proposed rule change could even be suggested. The inmates are truly running the asylum.

Just to recap, if a federal official asks _you_ a question, it's a felony to lie to them. But if you ask _them_ a question, they want the ability to lie to you as a matter of course.

Amazing.

<comment><USER3> It's not just lying to the public - in one case, they lied to a judge handling a FOIA request case (to be clear, the article does not suggest that this would be legal under the new rule):

> In a recent case brought by the ACLU (...) the FBI denied the existence of > documents. But the court later discovered that the documents did exist. > (...) [the] Judge (...) wrote that the "Government cannot, under any > circumstance, affirmatively mislead the Court."

It's pretty clear that a select few documents should not be released. It's much less clear that they should not even be released to the judge.

</comment></comment><comment><USER4> And, what appears to be the context ProPublica (a source I generally like; I'm a civil libertarian) and more especially the submitter has stripped out:

        (2) When a component applies an exclusion to exclude records from
        the requirements of the FOIA pursuant to 5 U.S.C. 552(c), the
        component utilizing the exclusion will respond to the request as if
        the excluded records did not exist. This response should not differ
        in wording from any other response given by the component.

And so now you're wondering what 5 USC 552(c) is:

        (1) Whenever a request is made which involves access to records
        described in subsection (b)(7)(A) and -
          (A) the investigation or proceeding involves a possible violation
          of criminal law; and
          (B) there is reason to believe that
            (i) the subject of the investigation or proceeding is not aware
            of its pendency, and
            (ii) disclosure of the existence of the records could reasonably
            be expected to interfere with enforcement proceedings,
        the agency may, during only such time as that circumstance continues,
        treat the records as not subject to the requirements of this section.

        (2) Whenever informant records maintained by a criminal law enforcement
        agency under an informant's name or personal identifier are requested
        by a third party according to the informant's name or personal identifier,
        the agency may treat the records as not subject to the requirements of
        this section unless the informant's status as an informant has been
        officially confirmed.

        (3) Whenever a request is made which involves access to records maintained
        by the Federal Bureau of Investigation pertaining to foreign intelligence
        or counterintelligence, or international terrorism, and the existence of
        the records is classified information as provided in subsection (b)(1),
        the Bureau may, as long as the existence of the records remains classified
        information, treat the records as not subject to the requirements of
        this section.

By my reading, the three cases are:

(1) Ongoing criminal investigations that could be disrupted by disclosure

(2) Criminal records pertaining to confidential informants

(3) Formally classified counterintelligence documents.

<comment><USER2> Thanks for the context and the extra detail. It was so interesting I thought I'd poke around a bit more on my own.

As for (3), please note that this involves intelligence, counterintelligence, _or international terrorism_.

So now we're back to FISA, the PATRIOT act, NSA doing SIGINT on domestic/foreign internet traffic, etc. [insert long discussion here about the necessity of having intelligence and counterintelligence and the conflict with an also-necessary open society]

More to the point, there's no way to determine that the process would be followed correctly. (This is the same problem the FBI is having with warrantless wiretaps: the law's wording and the actual practice is much different, and there are no independent outsiders monitoring what's going on)

This is a good link to chase down. It directly relates to both FOIA and national security. In this case, you can't even ask about _the general interpretation of a law by the government_. [http://www.zdnet.com/blog/btl/newspaper-sues-government- to-r...](http://www.zdnet.com/blog/btl/newspaper-sues-government-to-reveal- secret-patriot-act-interpretation/60407)

"...The New York Times is suing the U.S. government for refusing to divulge how its law enforcement interprets the Patriot Act...."

Note that this isn't the detail of any particular record. This is simply explaining what the law is. If you can't go there, good luck trying to chase down the actual application of the law in any specific circumstance.

I'm not getting into the overuse of "national security" to cover all sorts of things, or how you can target the FBI with the statute and end up pulling in all of DHS with the application. These are old discussions and probably best left for another day. Just wanted to point out that you could drive a Mack truck through the holes in that statute. It sounds very limited in theory. In practice, based on past experience, it doesn't look that way at all to me.

<comment><USER4> To simplify this conversation:

I don't think we should have secret laws under any circumstances.

I do think it's legitimate for the federal government to set up countermeasures to attempts to fish for the identities of confidential informants.

I think there is some information relevant to counterintelligence and counterterrorism that should be classified and some that shouldn't, and I think more stuff is classified that shouldn't be than the other way around.

I think that it's wholly reasonable for the federal government not to have to confirm the existence of heavily classified documents.

I think there are many classified documents whose contents are not appropriate for disclosure, but whose existence is.

<comment><USER2> We don't disagree at all.

The only thing I would add is that for every system of control there should be a counterbalancing system of inspection and audit. Congress surely isn't up to the job, there is no IG that I'm aware of that works at the National Security cross-agency level, and even if there was the results couldn't be made public anyway.

For all of those needs that we agree on, you can't leave the government an open-ended blank check. It just doesn't work. FOIA is supposed to be part of the control process, but if we can't even learn what the policies are for documents that we then are asking about, FOIA is not working.

Constitutionally, there are supposed to be hard limits to the amount of control the government has. If, for instance, J. Edgar Hoover was keeping files on Elvis Presley, sooner or later we'd get access to them and institute laws constraining the application of domestic counterintelligence operations. Laws and rule changes that prevent this "sooner or later" process from happening are bad. Really bad. At the very least there should be a firm time limit on whether or not to admit documents exist -- perhaps 10 or 20 years. That's not optimal, but it would at least allow for the system to self-inspect and adapt and evolve ever so slowly. (I still remain _very_ concerned that the theory we are talking about and the actual application are two completely different things, but I guess the point of this rule change is that we'll never know.)

</comment></comment></comment></comment><comment><USER5> They can already hide information despite the freedom-of-information act.

The way they do it is to charge an absolute fortune for the records.

Happens all the time:

[http://pogoblog.typepad.com/pogo/2011/10/gsa- wants-113k-to-t...](http://pogoblog.typepad.com/pogo/2011/10/gsa- wants-113k-to-tell-you-what-it-think-of-ipads.html)

<comment><AUTHOR> Yeah...but at least in that case, you can argue with the agency and publicize the outrageous request. I've done that in one instance where a city agency argued that it would take 40 hours and thousands of dollars to run a query to generate a simple payroll listing. After we threatened to write about how their payroll system was in such a sorry state that it takes thousands of taxpayer dollars to run queries against it, they handed over the data for a couple hundred dollars.

This avenue of inquiry does not exist if an agency is allowed to just say: "Sorry, that doesn't exist."

<comment><USER5> Here's the thing though - all the data should already be available as a free database, just like all NASA photos are public domain.

Then let people mine it on their own dime for waste.

The problem is they'd react to this by finding ways to make more and more stuff "classified" to claim it cannot be released.

<comment><USER6> NYC would appear to be a shining example of this: <http://www.nyc.gov/data>

</comment></comment></comment></comment><comment><USER7> The scary thing to me really is that I no longer find stuff like this astonishing.

<comment><USER4> What are the rules about this in the Netherlands? Are they better than our current FOIA rules?

<comment><USER7> [http://en.wikipedia.org/wiki/Freedom_of_information_legislat...](http://en.wikipedia.org/wiki/Freedom_of_information_legislation#Europe)

<comment><USER4>
        Section 10

        1. Disclosure of information pursuant to this Act
        shall not take place insofar as:

            a. this might endanger the unity of the Crown;

            b. this might damage the security of the State;

            c. the data concerned relate to companies and
            manufacturing processes and were furnished to
            the government in confidence by natural or legal
            persons.

        2. Nor shall disclosure of information take place
        insofar as its importance does not outweigh one of the
        following:

            a. relations between the Netherlands and other
            states or international organisations;

            b. the economic and financial interests of the
            State, other bodies constituted under public law
            or the administrative authorities referred to in
            section 1a, subsection 1 (c and d) and
            subsection 2;

            c. the investigation of criminal offences and
            the prosecution of offenders;

            d. inspection, control and oversight by
            administrative authorities;

            e. respect for personal privacy;

            f. the importance to the addressee of being the
            first to note the information;

            g. the prevention of disproportionate advantage
            or disadvantage to the natural or legal persons
            concerned or to third parties.

<comment><USER8> So basically just as large an opening as in US law. The specific notion of "deny the documents exist" isn't covered here, though I'd guess that would be the spirit of the law as you quote it.</comment></comment></comment></comment></comment>


Need a 50% builder/co-founder for web2.0 prod w/ 60b+ domestic market. Ask?s. - <AUTHOR> http://hackersports.posterous.com/36164010

<comment><USER2> To any developer considering this. Here's a list of red flags from someone who's worked with too many guys that fit this mold.

List of red flags:

-No funding. A bedroom in missouri is not compensation. There is absolutely nothing in there about you being able to pay your bills during this. By moving and not having a salary, you will be responsible for assuming the risk of the venture. He however has no skin in the game except a spare bedroom.

-Salesman + lawyer + finance guy. _Deadly_ combo. Can he sell you on the project? Sure. Can he also figure out how to screw you out of your equity stake when there's real cash involved? You bet. Can he twist his words to get you to go along with whatever misguided product pivot floats into his head in the shower? Yup. Can he manipulate all the legal paperwork to favor him? Oh yea. Can he sell the company without telling you? Sure. Can he make up out of scope features in a meeting with advertisers and then freak out when you tell him you can't deliver by the arbitrary deadline he set? Lets just say its happened before. He hustles for a living. He WILL hustle you.

\- Self-proclaimed nerd. Literally knows enough to be dangerous. He's a self- professed 'net junkie'. He thinks that makes him qualified to make social media product decisions. What does that say?

\- He is not 'a builder'. When building a business, if you can't 'build' you're pretty useless.

\- He uses words like "dominate". Alpha male.

\- Social bookmarking meets sports. I've never heard of that one before.

\- "I want someone that works with me not for me." Word of wisdom - you're actually better off working _for_ this guy than _with_ him.

\- Can you make this without him? Absolutely.

\- Doesn't live anywhere near a major market. Yea I'm sure KC is a big sports city. Not big enough. Is he committed enough to the tech industry move to a proper market? No. Is he committed enough to stay in it when the going gets rough? We'll see.

\- He has the delusion that he thinks this is such a great opportunity he needs an application form with test questions. Its not. Its a great opportunity to learn all the ways NOT to do a startup.

I created a throwaway account just to respond to this. Normally, I wouldn't want to sound this cynical but reading this is the equivalent of listening to the sound of nails scraping on a chalkboard.

<comment><AUTHOR> Jablookey, Thanks for your comment. I'm trying to respond to everything, but let me say first, I apologize if I managed to do or say things that irritated you so much you had to get a throw away account and write 400 words about how much I pissed you off. Wasn't my intent.

J - To any developer considering this. Here's a list of red flags from someone who's worked with too many guys that fit this mold. List of red flags:

No funding. A bedroom in Missouri is not compensation. There is absolutely nothing in there about you being able to pay your bills during this. By moving and not having a salary, you will be responsible for assuming the risk of the venture. He however has no skin in the game except a spare bedroom.

Me – You're right, I didn't make myself clear. The 13 slide deck and 100+ pages of research I've culled from thousands of pages don't mean much to Angels without someone that can build the damn thing. As soon as I am able to find a legit builder, I'd be parking out on Kauffman's lawn and/or where else I had to go to get some seed money. Worst case scenario, I put some of my own cash into the project, but it's not like I'm asking someone to join w/ for 10% equity. I want a full partner who shares the risk. I'd quit my job and focus on this full time too.

J - Salesman + lawyer + finance guy. Deadly combo. Can he sell you on the project? Sure. Can he also figure out how to screw you out of your equity stake when there's real cash involved? You bet. Can he twist his words to get you to go along with whatever misguided product pivot floats into his head in the shower? Yup. Can he manipulate all the legal paperwork to favor him? Oh yea. Can he sell the company without telling you? Sure. Can he make up out of scope features in a meeting with advertisers and then freak out when you tell him you can't deliver by the arbitrary deadline he set? Lets just say its happened before. He hustles for a living. He WILL hustle you.

Me – Anyone jumping into a partnership or corporation should have their OWN attorney look at it. No offense, but it's a problem if you just "trust" just about anyone. I'm not looking for an Eduardo Saverin. I'm looking for a partner. The pivots aren't in me head, they're on paper. I realize you're trying to be funny, but wouldn't you rather have someone who's comfortable marketing and selling a product? Do you want to work with a guy that looked as nervous as Zuckerberg used to or as awkward as some others in tech? I have a massive amount of respect for anyone that can code, but selling a product is a different game. Hell read Venture Hacks for ten minutes, I guaranty you'll come across the concept of having a "builder" and a "seller." Hell I'd pay for someone else's attorney to look at any sort of vesting / share transaction / future dilution agreement.

J - Self-proclaimed nerd. Literally knows enough to be dangerous. He's a self- professed 'net junkie'. He thinks that makes him qualified to make social media product decisions. What does that say?

Me – I was one of the first 1,000,000 users of Facebook and I've been posting on message boards and IMing for over a decade. I may not understand all of the nuts and bolts of building one, but I understand how most of them are unusable. I can also design in HTML, CSS, some PHP, and jQuery. I don't know how to do the backend.

J - He is not 'a builder'. When building a business, if you can't 'build' you're pretty useless.

Me - I can build capital, build users, build a team, build an office. You assume because I can't build a backend or speak in code I'm useless. I truly don't feel like you gave my post or any of my comments any thought what so ever.

J - He uses words like "dominate". Alpha male.

Me – Touche. I didn't realize that speaking like an alpha male ever made one so. I'm enthusiastic and gregarious, and yes—loud, but I've never had anyone call me an alpha male. I think I do have some "alpha" qualities, however. I don't quit. I work hard. I fight like hell for my friends and family —I'm very protective. And I guess I'm probably a bit alpha male in that I answer 400 word flame posts from throwaway accounts on message boards.

J - Social bookmarking meets sports. I've never heard of that one before.

Me – You're right. If you've ever been to BallHype/d, SportsAg, ChatSports, etc., you'll realize the concept has been completely fucking mutilated. The sites are terrible. 1. Loadspeeds are shit. 2. Comment systems suck. 3. Almost Unusable UI's. 4. No Marketing. I have 50 pages just on how to fix most of those problems. It's also worth noting that if I just wanted to emulate what those sites do I could recreate it in a couple of days. It needs to a be a more technologically sophisticated product.

J - "I want someone that works with me not for me." Word of wisdom - you're actually better off working for this guy than with him.

Me – I don't understand this. If I think the idea has real potential, wouldn't it be better to work with someone who has as much vested interest as I do to see it succeed. If I pay someone, which I could feasibly do, then I can end up with someone who just collects a check and doesn't want to see the business grow. I want someone who can eventually be a CTO, help hire people underneath her, who benefits from the business' growth as much as I do. You ever taken any economics? Your solution misaligns our incentives greatly.

J - Can you make this without him? Absolutely.

Me – Sure, but don't you need someone to help attract investment, build capital, hire, etc. All mentioned above. And it's not like I put up the deck and the research online. I have plenty to bring to the table.

J - Doesn't live anywhere near a major market. Yea I'm sure KC is a big sports city. Not big enough. Is he committed enough to the tech industry move to a proper market? No. Is he committed enough to stay in it when the going gets rough? We'll see.

Me – You're right. The growth strategy has little to do with pro sports markets though. It's most about colleges first and the craziest sports schools are a hell of lot closer to KC than the Valley. I also feel a loyalty to my city and want to see businesses started here. I've seen enough really bright awesome people leave this are to go to either coast or Chicago. However, I'd be the first one to pack up my entire life and move to Silicon Valley tomorrow if someone funded the project. For the purposes of rent and everything else though, it would be remarkably cheap to start here. As far as picking up and moving a long distance on short notice I've done it. In 2006, I applied for a job almost a 1,000 miles away on a whim and moved there a few days later.

J - He has the delusion that he thinks this is such a great opportunity he needs an application form with test questions. Its not. Its a great opportunity to learn all the ways NOT to do a startup.

Me – Some actually filled it out. I'd be perfectly fine without that just wanted to chat as well, truthfully. The "test" form, which includes such terrible questions as "Describe your worst professional fuck up" and "What have you built" was meant to prevent me from getting people who weren't truly interested from sending me spam or other bullshit.

I'm more than willing to listen to an alternative approach to help me find a kick ass builder.

J - I created a throwaway account just to respond to this. Normally, I wouldn't want to sound this cynical but reading this is the equivalent of listening to the sound of nails scraping on a chalkboard.

Me - <http://bit.ly/exn54R>

Thanks for your comment.

</comment></comment><comment><USER3> In the article, they start with:

"TL:DR. Jump off a cliff and create an awesome fucking company."

Even for a tl;dr, I do not find that enticing. I expect a tl;dr to be short, probably just 1 sentence, but is that the best they could do? Nothing in that 1 sentence makes me want to commit to the project. And, really, the tone is a red flag.

I've got a ton of non-technical friends who have ideas for websites. I probably get asked to commit some time to websites once or twice a month. I say no 99% of the time. I say no unless the time commitment is small and I owe the person a favor, or I actually believe in the idea - which happens about once every 2 years.

A lot of people want my help with websites. If someone wants me to commit my time to them, they need to do a lot to win me over.

Also, I worry about this:

"^I'm looking for one person to be a 50% co-founder"

I think it is usually best if someone is in charge. 50/50 can lead to uncertainty about who is making the decisions.

<comment><AUTHOR> 50/50 is just in relation to equity distribution. Nearly all of the Angels and VCs I've read about suggest 50/50 that way there is equal stake and interest.

That doesn't necessarily mean that I don't lead and take charge on some things. As far as I'm concerned, once I get someone skilled enough to help me build it's my job to go pitch, hustle, market and work my ass off while the cofounder builds a team, outsources small projects and puts things together.

What's the tonal problem? I'm enthusiastic. Sorry if I offended you the Fbomb, but that's just my personality. I've certainly read (and often been called, lol) more offensive things.

Thanks for your comment.

</comment></comment><comment><USER4> I'm looking for an awesome person (people) interested in social, dynamic curation, mobile, near-field communication, qr codes, augmented reality, search, rich-media, minimalist design, gaming, and world domination. Don't worry, the MVP (minimum viable product) incorporates only some of those elements, but the vision extends in to all of those areas. Some of these ideas I've had for a decade or more, this isn't a knee-jerk proposition. This is an opportunity to take ownership and give your own vision. I'm willing to listen to just about anything and use whatever tools best execute the vision. HTML5 / CSS3, whatever back-end language you want. We dream it, pivot, build it, dominate.

hmmmm, Anything else you want to add in there? Not enough current buzzworthy technologies mentioned.

<comment><AUTHOR> Lol, touche.

The mvp focuses on social aspects and minimal design. I want to build a company. I'm looking down the road, many of those ideas are pet projects that would be many months or years down the road.

I'd like to teleport you into the game from anywhere on earth and have Eva Longoria teleport with you. I'd also like to allow you to take over the control of your favorite athletes and play in the game.

Thank you for your comment. :-)

</comment></comment><comment><USER5> Some questions:

What's the most interesting thing you've created on your own or with a small team before?

What kind of alcohol do you prefer to drink?

When I type <http://news.ycombinator.com> into my browser's address bar and press enter, what happens to make the HN front page show up on the screen? Be as detailed as you can.

<comment><AUTHOR> 1\. The most interesting thing I created was one of the best college debate teams in the country. At Mizzou we didn't have a team, I started one, raised tens of thousands of dollars and my partner and I made it to a final four. The squad placed 12th in the nation despite not having a coach and being underfunded. We beat ivies and all sorts of super well funded and coached schools. We were mostly farm boys. After graduation, I was hired as the youngest coach in the country at Colorado College, one of my teams that year made it to a final four. I'm one of a hand full of people to debate in a final four and coach a team to a final four. Code-wise, nothing that interesting, like I've mentioned elsewhere, I've never really taken a class. I've created websites, blogs and stuff, but never with a team.

2\. Maker's Mark is my drink of choice.

3\. Front page is 1. Threshold of 100 points, 2. Gawker Hacked, 3. HN Reading Level, 4. No evidence of time b4 big bang, 5. Building Generaion in Unreal 3, 6. Atlantic Turns a profit, 7. NY Struggles to find enough tech people.

How much more detail would prefer?

<comment><USER5> #1 is impressive.

With #3 I was hoping to gauge your understanding of "how the internet works," but I clearly asked it the wrong way. I assume you have some notion of computers talking to each other in a network. But I thought it would be useful to see how much you've thought about it or read about it or fooled with getting stuff up and running on the internet.

<comment><AUTHOR> Jesus that was dense, I'm sorry.

You type an address in, the browser locates the data via an IP addy. The information requested from a database is recalled, packeted, transmitted, formatted and displayed in the way the front end code requests it. In my case it went to my cable modem with piece of shit comcast and then through my router and it's 192.168.1.1 IP addy.

I'm sure I could make that answer better with a simple google search, but I don't cheat. If you're trying to gauge me, it'd be disingenuous. I hope I didn't flunk miserably, maybe just a C?

<comment><USER5> I appreciate your integrity. I suppose it would have been fairly easy to cheat on that question.

It's pretty much impossible to flunk miserably at this question unless you say something horribly wrong. It's meant to figure out whether you're familiar with DNS, HTTP, client/server stuff, etc, and how deeply.

It's relevant since the product you want to build is entirely an HTTP-based application, and there are a lot of layers to understand to even be able to make credibly intelligent suggestions about what that product might do or look like.

<comment><AUTHOR> Sweet. Thanks for the interaction this evening. Truth be told, I had no expectation what so ever for people on HN to even really comment / consider what I'm putting out there (that's why I put it on posterous and not as an Ask HN).

I had no karma and I'm not a programmer. I live 1,836 miles from Palo Alto. This post served two purposes, 1. hail mary that I found someone kick ass who was interested in getting involved for a random reason (they liked sports or bbq maybe) 2. help me figure out how get buy in from developers. By looking at the feedback, "over the top," "not enough information," etc., I can get a sense of how I have to change my pitch to an engineer. It's not that I think all engineers are the same, but that I don't know many engineers, so I wanted to hypo-test.

I'd love nothing more than to learn Python, Ruby, erlang, etc., and crank it out myself, but if I've learned anything in life it's that I should concentrate what I'm best at and learn new things incrementally along the way.

Thanks for not just making fun of me and moving along.

<comment><USER5> I'm not one to make fun of someone who puts himself out there like you have. I've been there before.

I think you'll find that engineers are a critical and skeptical bunch. You're right that you should get in front of as many of them as you can. You need to learn as much from them as possible, even the ones who aren't working with you. Listen to them. They will help you in subtle ways that you might not notice at first.

At this point your most important goal must be to gain credibility. I don't think you should learn Python or anything like that. We both agree that's probably not a great use of your time. What you do need to do is understand enough about how web-based products are built and how they work to talk competently about specifics.

That's going to be hard. One way to do it is to try to build something yourself, which we've kind of ruled out. One way to do it is to read a lot. One way to do it is to find someone you know who's an engineer and watch what he/she does while asking questions.

Credibility is everything. And you can't substitute it with passion.

I wish you the best of luck. Keep us updated.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> Some folks requested a more elaborate explanation of the mvp.

In short the idea is to create a truly interactive sports site.

It's simple and allows users to curate a link board (like Reddit), it gets more nuanced to the person as they vote and interact more. Add in comment and voting systems that look and respond like Quora. Very fast, built in editorial controls, extra stuff like formatting and bulleting. This is the minimum viable product.

After you get enough users and enough content being curated, you can start scraping the information. Make a truly personalized sports application. Flipboard, but more bad ass.

People use facebook and such for flipboard, which looks at their ENTIRE network. I have 500+ friends, most don't like sports, many don't like MY teams. I want the best content on my teams from all sources in one place. I also want to be able to interact and game with other sports fans from my teams.

That's a more elaborate version of the idea. -Chris

</comment><comment><USER6> I have to say, this is one of the best "I need a tech guy" post I have seen and for two simple reason, you can see the authors passion, and he clearly explains what he is going to do, how he is going to chip in to make the company succeed and what he has to offer to make a go at it. He shows his value and realizes that the tech guy is an important part of the equation not just an after thought.

<comment><USER5> Really? You thought he clearly explained what he is going to do? I can appreciate his passion, but I wouldn't say he was particularly clear about anything.

<comment><AUTHOR> EDIT: Check out the response to waterside81's comment above.

What would you like to know?

The post is quite frankly too long already, but I figured folks would want a decent amount of information. Like I said, Ask ?'s.

Thanks for your comment.

<comment><USER5> I mean no offense, but this line stands out:

"I'm looking for an awesome person (people) interested in social, dynamic curation, mobile, near-field communication, qr codes, augmented reality, search, rich-media, minimalist design, gaming, and world domination."

That's the kind of buzzword-ridden sentence that scares me and is not clear at all.

But your willingness to answer questions and start a conversation is admirable. I will start another top-level thread with some questions for you.

<comment><USER6> When I read it, I did not pay too much attention to the fact that the idea was not clear, I think people matter more and for me personally if it had peaked my interest I would still have inquired as to what his ideas where.

I guess like a lot of people, I reason from my perspective and if I have an idea that I am interested in, I could write a novel on it. I would assume if people are interested that we could get into the gory details after the initial contact. And I would be afraid of information overloading my initial letter.

I still think it was a great post, because I think it was one of the few that I have ever seen where the poster said here is what I am going to do and here is what I have to offer. Most as I said act as if, I have done all the hard work coming up with this idea now I just need someone to build it.

<comment><AUTHOR> thanks kls.

That was my exact thinking when I posted. Most of the people I interact respond to enthusiasm and bullishness. Of course that works much better in person. It's clear that in this sort of forum with really bright and capable people that reads as naivety. That's ok, learn something new every day.

I'm going to try to get in front of some local engineers and see what I can do. It just takes one who's crazy enough and smart enough to get started.

<comment><USER6> Yeah, I have been around enterprise sales guys for too long for buzz words to bother me, I know it's the lingo of sales in the enterprise space, so I have a filter for it, where some have a radar for it. I read right past that and really liked that you said what you where going to do (as far as role). This gets omitted on a good deal of posts like this and worse yet there are a good deal that act like "hey I had the idea, what more do you want". I wish you the best and hope you do well. I part of a start-up back in 97 that tried to do an amateur sports social network / handicap matchup / scorecard site. We where in way too early and burned out in flames. The market is probably far more ready for it than it was in 97. While you idea is not the same, I do see some overlap in what we did.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Anyone else assume this was satire before reading the comments here?

<comment><AUTHOR> Burn. If the worst thing that ever happens to me is I get made fun of on a board then I'd certainly be going no where with running a company, eh?

:-).

<comment><USER7> Well it's not your fault, just the fault of the many less genuine people they have gone before you with similar messages. :)

Good luck with your venture.

</comment></comment></comment><comment><USER8> Normally, I hate reading about these. Web dev has become easy enough that anyone should be able to prototype their idea.

Nevertheless, two words in article make this worth reading.

"I hustle"

That's something I really respect (assuming you truthfully hustle). You write well, you probably sell well. Good luck with your venture.

<comment><AUTHOR> Thanks for your comment. I kind of mentioned it before, but I'm not some silver spooned trustafarian with nothing better to do. I'm a blue collar guy that's worked since I was 13. Retail, food service, whatever to get by. My first "real" job was teaching and coaching debate at a top 30 liberal arts school at 22 without a masters or phd, which were job "requirements." I called the dean of students, who was hiring for this specific job, and basically said "you're crazy if you don't consider me." In retrospect probably seemed insane, lol.

I applied on a Tuesday, called his office half a dozen times on Wednesday, flew out Sunday, was offered the job Monday and packed all of shit and drove nearly a 1,000 miles to a place I'd never been just a few days before.

He gave me a shot and I coached a team to final four and it was the school's second best finish in its debate teams 110+ history of debating. Some of my students were essentially my age.

My students were really bright, but I'd like to think I had something to do with it too, :-).</comment></comment>