Editor's note: Reader comments in the age of social media - <AUTHOR> http://blogs.reuters.com/great-debate/2014/11/07/editors-note-reader-comments-in-the-age-of-social-media/ <comment><USER2> Comments on major news sites are horrendous. They tend to be either astroturfers, trolls, or people trying in vain to talk sense to one of the above. Good riddance.

<comment><USER3> Really depends on the community. Comments sections generally work if the readership has something uniting it: a common topical interest; socioeconomic demography; regularity; intra-group reputations (and cognizance thereof); etc. Commenters actually put in some effort when they feel they have skin in the game, and when they believe they're going to encounter the same peer- commenters on a regular basis.

This was a lot more possible years back, before the rise of social sharing and syndication. Your typical comments section on any given blog -- especially interest-based or topic-based blogs -- could be reasonably intelligent and informative. This is one of the big tradeoffs we've made, inadvertently, by making sharing and distribution so much easier.

In the present day, audiences are much more heterogeneous, having come across any given article through dozens of different channels. They have nothing in common. They probably have no particular affiliation with, or respect for, the publication or blog they've stumbled across. Likewise, they don't know, respect, or care about their fellow commenters. Many don't even see themselves as commenters on a particular site, so much as drive-by taggers. They don't expect to stick around, so much as to shout something out and hope people see it. (Or to astroturf a particular link).

Reuters probably made the right call here. I don't know anybody who regularly reads Reuters in and of itself. Most of its readership is distributed and ad hoc, as its articles are widely syndicated across print and the web. That's a perfect recipe for a terrible comments section.

Note: some people think real identities vs. anonymity plays a big role in comment quality. I haven't yet seen this to be the case. Some of the smartest boards, comments sections, etc., are full of users with anonymous handles. (Though it's key that the handles be permanent, and that the users behind them feel a sense of identity attached to them). Conversely, I've seen "real people" make some downright spammy, idiotic, racist, and generally useless comments on major sites and networks. Identity matters, but it's about more than the name.

</comment></comment><comment><AUTHOR> There's a new design trend that has been popular on news websites such as The Verge and FiveThirtyEight: the comments section is _hidden_ , and you explicitly have to click "open comments" for them to appear.

The motivation for this trend is to _hide_ the comments, as blog comment sections tend to be of low value for controversial stories, despite algorithms that can correct for low value comments (e.g. upvoting/downvoting). The fact that Reuters is removing comments from news stories _completely_ indicates that Reuters is lazy and doesn't want to deal with negative comments at all or find a more practical solution for user interaction. Note that the Reuters Facebook page has just as many _if not more_ low-quality comments. (example: [https://www.facebook.com/Reuters/posts/837804776239880](https://www.facebook.com/Reuters/posts/837804776239880))

The "everyone is talking about it on social media anyways" rationale is a terrible excuse.

NB/Disclosure: I received most of my internet fame/infamy through my comments in the comments section on TechCrunch articles.

<comment><USER4> Lazy? No way. They are right. Comments on news stories never added anything, and publishers only provided comment sections because they thought they "should."

It provided a veneer of user engagement, but how often did reporters or editors participate in comments? How often did reporters change their reporting based on comments? How often did they credit comments in their reporting?

Newspaper comments have been a ghetto for years.

BTW, the same criticisms apply to the comments of most newspaper Facebook pages. Facebook for most publishers is simply a distribution channel--post your stories to your page, hope EdgeRank pushes them into enough user news feeds, and then wait for the traffic to land back on your site. The comments don't matter at all.

The real conversation happens on Facebook when users share the news content-- either by re-sharing what Reuters posts, or by sharing it themselves from the website. Then they talk about it with their friends. That's what Reuters is referring to when they say that the best discussion is now in social media. And they are right.

<comment><USER5> > _Comments on news stories never added anything, and publishers only provided > comment sections because they thought they "should."_

Many news sites do include comment sections on purpose, and from what I heard sometimes even seed them with controversial statements, because they're an excellent way to drive pageviews, and through them, ad money.

</comment></comment></comment><comment><USER6> The comments on the post really drive the point home, don't they?

</comment><comment><USER7> Discussions can be great, but I'm not sure that putting an article and a forum together (which is what most blogs tend to do) is a wise thing.

Think of it in the context of say someone giving a speech or presentation. In many cases the comments act like someone yelling "YOU SUCK!" in the middle or end of a speech. People tend not to do that in real life, but online the rules are different I guess.

There are so many places to leave comments, I just don't know that every article needs a comments section. The negative side of blog comments usually outweighs the positives. Leave commenting to more dedicated communities like HN, Reddit, LinkedIn, etc.

</comment><comment><USER8> There are some useful discussion about online comments on [http://www.abc.net.au/radionational/programs/futuretense/](http://www.abc.net.au/radionational/programs/futuretense/)

Online comments a view from the trenches (Podcast, 30 min) Online comments a wicked problem (Podcast, 30 min)

Both podcast, try to frame the problems, suggest some possible solutions and estimate the costs associated with dealing with online comments. I think they give a useful perspective from a multitude of points of view (also I use it to learn English).

<comment><USER9> Off topic. Hey! Thanks for mentioning Radio National. I'm Australian (3rd generation) and feel an immense sense of pride that our tax-payer funded Australian Broadcasting Corporation produces what I consider some of the highest quality radio shows / podcasts I know of. Definitely worth a look.

</comment></comment><comment><USER10> I was one of the developers of Huffington Post's homegrown comment system before the decision was made to shut it down early this year. It was a decision that wasn't taken lightly, as "social news" was how the site began (rather presciently), and there was still a very real online community for whom our comments section was really meaningful.

We looked at many ways to preserve it, such as real names, interface innovations, better algorithms for surfacing the best comments, personalization features, and so forth. At the end of the day, it just didn't make business sense to keep it going. Along with all of the positive discussion that went on in the forums, there was also _a lot_ of negativity that frankly didn't jive with the editorial voice of the site. And it's surprisingly expensive it is to run a homegrown comment system of that size.

It was sad to see the comments go, as an avid commenter myself and as someone who had put a lot of energy into developing the software. But I came to realize that there's no fundamental logical reason a company that specializes in content production should also provide a forum for commentary. This is especially so with the rise of social networks and news aggregators. Maybe one day, a content producer will find a way to make comments a part of their core business, but until then, a lot of firms are coming to the same conclusion.

</comment><comment><USER11> Based on Reuters's past technological problems with the Web, I'd have to say this is more based on inability rather than principle.

Example: the Reuters Next project, a redesign that took several years before they abruptly killed it because of being unable "to meet delivery deadlines and stay within its budget":

[http://www.buzzfeed.com/matthewzeitlin/why-reuters- ditched-i...](http://www.buzzfeed.com/matthewzeitlin/why-reuters-ditched-its- big-web-push)

Among the revelations of that fiasco was that Reuters Next was necessitated out of a failure to iterate on their web platform, such that _" even putting in a hyperlink, one Reuters source said, was "a very complex issue." Reuters had to put its blogs and opinion columns on a Wordpress platform so they could easily link to outside sources and embed videos."_

</comment><comment><USER12> I just have a dorky personal blog, but the comments moved from the blog to Facebook on their own. I didn't do anything different, but my friends sort of decided they preferred to discuss the blog posts on Facebook. I didn't see any reason to fight it. It's not like I have ad revenue on the line.

</comment><comment><USER13> IMO a question all blogs and media sites need to ask is kind of like: "Am I creating a community or a television channel?"

I grew up on the web, and the multi-directionality of it as a medium (including blog comments) has set my standards for the way I want to consume information (and interact with it). I don't trust information flowing to me that can't be annotated, corrected, and augmented by the wisdom of the crowd it's reaching.

It's Reuters' perogative to do this, but I think it just makes Reuters.com exactly like Reuters TV, it gives them a lot more control, but they're leaving a lot of opportunity on the table. That's usually what I expect from $30b companies though.

I look forward to having plenty of interactive communities to learn the same stuff on for the rest of humanity, even if Reuters is no longer one of them.

</comment><comment><USER14> Yahoo did this first. They weren't keen on the peanut gallery making inappropriate comments on serious articles.

I have a peanut gallery, I mean Comments button on my website for my mobile apps. It sends me an email and sits in a moderation bin. They are always support oriented so it works out great. This way spam is also directed to my email instead of the website.

</comment><comment><USER15> This is probably a dumb question; but, does this mean they're going to facilitate some easy way to find where the comment stream will be for their articles? For example, will technology be written to find out if an article has been posted on Reddit and automatically have a link to the Reddit discussion around it?

I would find this useful, possibly.

</comment><comment><USER16> There should be an aggregation of the best high quality public comments gathered across social media per article instead.

<comment><USER17> Could, definitely. Like Letters to the Editor, but immediate and topical. But requires moderation and thus legal ownership.

</comment></comment><comment><USER18> I wonder if this will start a trend, where major sites will stop accepting/editing/suffering comments, and will just push their headache to Facebook. RIP comments 1994-2014.

</comment><comment><USER19> With so many people out of work in the United States, it strikes me as selfishly ignorant to simply can the comments section instead of 1) using an industry standard platform, 2) moderating that platform, and 3) cultivating a culture of utility.

I don't call this move "smart" in the grand sense. I'd go with "lazy" and/or "cheap" in this context. I mean, ask me how I know Disqus has the ability to ban users from specific sites...

<comment><USER20> You really think Reuters should ignore the fact that their comment sections are essentially worthless just to create busy work for maybe one person?</comment></comment>


OpenBazaar Is Entering a New Phase with Funding - <AUTHOR> https://blog.openbazaar.org/openbazaar-is-entering-a-new-phase-with-funding/

<comment><USER2> Hey everyone, Sam Patterson from OpenBazaar and OB1 here. We're excited about this funding, and I'm happy to take any questions you might have.

We're always looking for developers on the project as well. It's open source, and primarily python. Here's the repo:

[https://github.com/OpenBazaar/OpenBazaar](https://github.com/OpenBazaar/OpenBazaar)

We have a particular interest in folks with p2p networking knowledge, but welcome devs with any background.

<comment><USER3> what was the incentive for donating 1m if it's basically free, doesn't collect data, and is not centrally controlled?

<comment><USER2> The platform isn't centrally controlled, but that doesn't mean that companies can't offer services to users on the network.

It's similar to Bitcoin, which has no central control, but now has an ecosystem of businesses that support Bitcoin users.

Our goal with OB1 is to build the OpenBazaar network and gain large adoption, and then offer those users services (such as dispute resolution, store hosting, search).

<comment><USER4> >> OB1 will aid decentralized commerce by offering services such as dispute resolution ...

Help me OB1, you're my only hope.

</comment></comment></comment></comment><comment><USER5> So, does this mean enough resources now to get OpenBazaar working on Tor ?? (an open network that helps defend against network surveillance that harms personal freedom and privacy, confidential business activities and associations)

Or, does this money mean that is never going to happen and those of us who care should fork off the MIT license and/or watch other projects?

</comment><comment><USER6> Not sure why anyone would invest in this which is strange because if Andreeson is investing you would think it would be obvious as to why, but this one I just dont get. After all the drama with SR, sure you can piggy back off of that hype and user base, but your biggest problem is going to be getting away from the stigma of being an underground marketplace. I would be staying as far away from the "police-free" marketing terms as possible, seems like startup suicide if you ask me. Maybe im not seeing something though, as the founders and investors are clearly smart people.

<comment><USER2> We are absolutely not using terms like "police-free". Others have labelled us as such. We view this as an agnostic protocol that people can use to trade goods and services online with each other, with no fees, and it's coupled with a marketplace that no one centrally controls. It's not Silk Road 3.0, it's ecommerce 2.0.

For more information on what investors are thinking, reach USV's Brad Burnham discussing why they invested in us:

[https://www.usv.com/post/5579998c8711930003901f5f/introducin...](https://www.usv.com/post/5579998c8711930003901f5f/introducing- ob1)

<comment><USER6> Call it however you like, agnostic protocal etc, the fact still remains your going to have ALOT of work to do differentiating yourself from SR and the stigma that comes along with using bitcoin as a currency, especially when media are already using phrases like "police-free" and "sell ANYTHING"...

Maybe brainstorm around:

-"We are like Amazon (or maybe craigslist?), but for bitcoins!" -Require social login. If you truly arent an anonymous marketplace using an untrackable cryptocurrency as method of payment, then requiring social login will be a good way to show the government that you mean it.

Point im making, OpenBazaar definitely has its work cut out for them. Exciting nonetheless, keep us posted!!!

-Jami Frazier

<comment><USER7> The phrases "decentralized" and "require social login" are mutually exclusive.

<comment><USER8> Not necessarily. The network itself can be decentralized and anonymous, but the company could use identity services as a monetization technique on top of (as a subset of transactions on) the network.

</comment></comment></comment></comment></comment><comment><USER4> Given the wait time for BTC confirmation, could it be feasible to use the OpenBazaar network for "Download Now" type transactions, where the buyer's expectation is for more or less _immediate_ gratification?</comment>


Effect of Particle Orientation during Thermal Processing of Canned Peach Halves - <AUTHOR> http://www.mdpi.com/2304-8158/3/2/304

<comment><USER2> I didn't realize, though it's perhaps obvious in retrospect, that CFD is used for things like that. Other CDF studies "include thermal processing studies on pineapple slices in juice [10], solid particles in water [11], peas in water [12] and asparagus in brine [13]. The use of CFD for microbial destruction calculations during thermal processing (for table olives in brine) has been also reported [14]."

Neat!</comment>


New Book: Learning Robotics Using Python - <AUTHOR> http://robohub.org/learning-robotics-using-python/

<comment><USER2> I am glad to review this book,Its an amazing book for robotics beginners as well as researchers :-)

<comment><USER3> Thanks Alex for the comment and review !!!

</comment></comment><comment><USER4> Awesome book, deals with all aspects of robotics, mechanical, electrical and software

<comment><USER3> Thanks Achu for the comment and review !!!

</comment></comment><comment><USER5> Good work !!!</comment>


CSS3 toggle-button without JavaScript - <AUTHOR> http://lab.simurai.com/css/toggle/#

<comment><USER2> Probably goes without saying:

This is pretty cool and fun to inspect & maybe draw inspiration from, but please don't ever use code like this in production. Cool code ≠ reliably cross-browser, accessible, or maintainable code.

 _Dear downvoters, I'm not criticizing the experiment or the visual appearance of this trick. I love following simurai._

<comment><USER3> It is too clever for its own good, but the "reliable cross-browser reliable" critic is way too MSIE friendly: The code is all standards based. There are no vendor-specific prefixes such as -webkit or -moz.

The best method of obtaining maintainable code is to avoid buggy browsers that need tons of workarounds and hacks.

<comment><USER2> Actually if you read the source code he explicitly says:

    	   /* AFAIK, not supported in moz/o[pera] yet */

and :target has incomplete browser support still. Nested <a> tags are a bit unusual, too, even if they are legal (is this valid? I don't even know, because come on!)

But I'd like to make a slightly broader point that, on the web, if you want something to work on as many clients (and that means on hundreds of different mobile browsers as well, these days) then sticking to the mainstream is your best bet, if perhaps boring :)

<comment><USER4> "Nested <a> tags are a bit unusual, too, even if they are legal (is this valid? I don't even know, because come on!)"

As it happens I've been fiddling with the HTML 4.01 DTDs in a project the past couple of weeks, and I can answer this for at least HTML 4.01: No. An A element may contain any inline element except for another A tag, which is explicitly denied.

(It isn't entirely clear to me whether the standard permits something like <a><b><a> or if the exclusions apply to all children, but the latter interpretation makes more sense.)

</comment></comment></comment></comment><comment><USER5> His code uses an invalid technique that go against the spec[1]. You cannot add generated content to a replaced element IE8 and Mozilla follow the spec, webkit and Opera don't. It's a shame that this is the case.

[1]<http://www.w3.org/TR/css3-content/#replacedContent>

</comment><comment><USER6> This doesn't work in Opera.

A better approach in my opinion is to use a checkbox (hidden) with a label pointing to it, then the styling can be applied with the CSS '+' selector, though this won't work with IE6, at least it's using sensible markup.

</comment><comment><USER7> I've been using a more efficient and portable approach for a while. It looks something like this: <http://www.autoplay.org/content/object-icon- checkbox.gif>

</comment><comment><USER8> This fails on chrome on os x. The background windows flashed when toggling.

<comment><USER9> Works fine for me on Chrome OS X. :)

</comment></comment><comment><USER10> I added items to my back button history. Really annoying.

<comment><USER11> Yeah, that's the horrible curse of the anchor tag.</comment></comment>


Ask HN: How to teach a business person to program - <AUTHOR>

I hear a lot of advice that if you want to start a company, but you don't know how to code, either don't bother at all or learn to code first. I used to fight this notion, mostly because I really wanted to start a company but was too worried that I wouldn't be able to learn to program even if I tried.
Yet now that I have a start-up (web-based), I feel the need to know how program more intensely than ever. I have a technical person on the team, but just delegating everything is starting to feel very limiting. I wish I could do what he does, and help out more.
So my question is, is it realistic for me to think I can learn, and how do I start? My undergrad background is in math so I have some familiarity with algorithms and thinking in that way. But I've never written a line of code.
Any books / courses you might recommend? What language to start with if my objective is ultimately to program for the web? Any advice would be awesome.
I know I open myself up to criticism by posting this, and maybe I sound like I don't have a clue, but really I just want to learn.
Thank you so much! <comment><USER2> The big thing to consider is that programming, like any other art or skill, takes a lot of time to be good at. Even more time to be "great" at. Most will agree that in order to be an "expert" in something, you'll have to dedicate about 10 years to it. Obviously, you can achieve that in a shorter time-span if you work harder/longer but just keep that in the back of your mind.

That being said, a guy with a background in math hanging around Hacker News could very well easily learn programming.

I would start with general web markup: HTML & CSS, as they're (relatively) easier to pick up and much easier to teach yourself (as you can look at source code and what not).

If you want to learn programming, I say don't worry about the language that much. What you'll find is that you don't really learn too much about a specific language; rather, you will want to learn about overarching concepts in Computer Science (iteration, algorithm, conditions, objects, functions, etc). So, pick a language just knowing it's simply a tool for you to get that material.

PHP's popular. So is Ruby on Rails or Python. After learning one and excelling at it, it's not that hard to pick up the semantics of another language. I started with PHP.

\----

Edit: Forgot book recommendations. For an absolute beginner, I think these books are awesome. They assume you're starting out at the very beginning and take you step-by-step, rather than just being a "language manual/catalog" like most books out there:

\- PHP for the Absolute Beginner or Python for the Absolute Beginner

<comment><AUTHOR> Thank you. That's awesome advice. Yes, I know it will be difficult and I shouldn't kid myself into thinking I can learn in a short period of time what really takes a decade to learn, but thanks for giving me somewhere to start!

</comment></comment><comment><USER3> I also wanted to learn to program and some friends recommended Ruby and Rails. I can't tell you if it's the best but it definitely does have a few things going for it.

1\. A robust online community. This is not to be underestimated, 98% of problems I run into are solved by a quick Google search. 2\. A number of strong tutorials and books, many of which are free online. I would link to them but there are already good lists out there for the googling. 3\. Fairly easy to understand. I came from literally no programming experience. I've had a number of different jobs, but none was really computer related. My last job was managing a bakery.

With all that said there are a few things I'm glad I did. First and foremost you've got to have somebody willing to take the time to help you through when you get stuck. Fortunately geeks love to geek out. If you find a friend that will geek out and explain stuff to you, buy his beer as often as possible and ask away. Second, realize that it is going take a lot longer to do what you want to do than you wish.

</comment><comment><AUTHOR> Thanks for the advice, guys. I'll start with the HTML and CSS then... And then Ruby on Rails?</comment>


Ask HN: which mattress for best sleep? - <AUTHOR> Since we spend 1/3 of our lives sleeping, and sleeping is so important for learning and health, I think this is an important topic.
I'm moving and looking for a new bed to sleep in, but can't find much information on the benefits of different types of mattresses. For example Ikea offers sprung, latex, foam mattresses, and there are also air and water beds. Which mattress offers better sleep?
Another consideration is price, obviously there maybe more spring or better material for the more expensive ones, but is it worth the extra cost? <comment><USER2> Little mattress rant (i have a suggestion if you want to skip to the bottom)...

In Canada, no two different chain sells the same mattress. So Sleep Country might sell the Sealy xNight 3487 while MattressMart sells the Sealy Cloud 4.3. The specs are always slightly different. It makes comparison shopping impossible, it is clearly intentional, and I can't believe its legal.

In Hong Kong, within department stores, each brand is sold by its own sales staff. So when you get to the mattress floor, there's a billion sales people (which isn't unusual in HK) and they each have 3 or so mattress for you to try out...they don't know/wont' tell you anything about any other mattress. They aren't interested in helping you find the best mattress in the huge choice, they are interested in selling you one of their mattress.

Someone needs to break the Mattress Cartel and its diabolic ways!

As for suggestions, my last mattress was an all-latex mattress. It was more expensive, but I loved it. Unlike those foam mattress which are (a) hot and (b) feel like ur sinking, these feel a lot more like a normal mattress with a couple key points. The most important being that they are [supposedly] more dust-mite resistant and they last much longer..so in 4 years you don't start to feel a spring (because their is no springs!) and the thing still has its original shape, more or less.

edit:

Also worth pointing out that you can negotiate the hell out of this...especially if you go to a national chain. Their markup has got to be over 50%...The mattress I speak of was priced at something like $3800CAD and I think we got it down to $1650 with some extra covers or pillows or something....and I still felt like there was room to go.

</comment><comment><USER3> I don't think expensive mattresses are worth the cost. I am from USA but spent 10 years in India sleeping on the ground with a blanket for cushioning. 1/3 of your time is sleeping, but 90% of the world sleeps on simple bedding. The mattress industry IMHO is a big fraud, like so many things in the USA. Selling non-necessities as if they are necessities. I have a $180 8" memory foam mattress from Walmart which I think is great.

</comment><comment><USER4> It depends a lot on your sleep position. A lot of the more complicated foam/latex mattresses have different zones, so e.g. your protruding shoulder and hip bones can sink in deeper in the softer material at that position. Now, if you're not sleeping on your side, you might not need material with a huge difference in softness. Never mind your general body shape or weight (mattresses come in different degrees of hardness).

If you're a side sleeper, healthy and fit, don't toss about too much, buy a reasonably expensive foam mattress. In the tests I've seen, the mid- range/expensive IKEA mattresses usually get C to B- marks. Which is a lot better than the average... (And at least where I live they have a great return policy, so it's easy to get something and sleep on it for a month)

If it's not too expensive for your health plan, consulting a doctor might be a good idea. They usually know their stuff a lot better than your usual mattress salespeople.

Which reminds me: Do a bit of research before buying the more exotic systems. As with anything related to health (and especially back pain), this field is ripe with quacks and snakeoil.

</comment><comment><USER5> I bought a tempur-pedic earlier this year and I have to say it's the best sleep I've ever had. I used to toss and turn during the night and I usually had back pain in the mornings, but not with the tempur-pedic. I get uninterrupted sleep and no morning back pain.

My previous mattresses were decent spring types and they were comfortable, but nothing compared to the tempur-pedic.

<comment><USER6> I have chronic back pain (torn muscles, annual lumbar tear, now bulging, etc). It worked great for several years, but, for some with back pain a more stiff matress (or a very light foam cover on the floor) seems to be the most beneficial. This is what I am transitioning too.

Also, Tempure Pedics (and most foams) tend to retain heat, person dependant, a lot. So much that I'll wake in hot-sweats and uncomfortable. I am now also seeking alternatives because 1) Tempur is too hot, 2) Tempur has become too soft for my needs.

A foam "cover" on the floor is working much better at the moment.

Also in the interim, for cooling down the foam, I have ordered: <http://coolingmattress.com/> from Amazon to give that a whirl.

</comment></comment><comment><USER7> Tempurpedic. With that said let me add my story.

I'm a 30 year old male, and consider myself in good shape. We had a generic $600 mattress before we got our expensive tempurpedic and I had constant back pain after a few years of sleeping on it, often times I found myself waking up at 2-3AM to head down to our couch for the rest of the night because my back hurt so much. The nights I did make it through the night in the bed I could barely walk in the morning because my back was so far out of alignment.

In comes the Tempurpedic and pillows... After the first nights sleep on the new bed %90 of the pain was gone.. by the second night I felt like a new person, no pain to be found. Since then I have yet to have any back pain.

The tempurpedic's are expensive, but when you consider what most people spend on a car relative to what they spend on a bed they are nothing, and besides they improve quality of life far more then any car could. You only get one set of joints and muscles in your life, treat them right.

<comment><USER6> Though I dumped on a earlier comment above <http://goo.gl/5GeaM> on the Tempur Pedic, it did serve me very well the last 7 years when I first purchased it. Thats 7 years of brilliant sleep, and worth the money.

</comment></comment><comment><USER8> I got a relatively hard foam mattress after I realized that I needed better support for my back (I won't get into how I found that out).

As far as I can tell, it's the best mattress that I've ever slept on. It's hard enough so that it doesn't bend inwards when I put my weight on it, and that keeps my spine straight when I sleep sideways. I tried "memory foam" at the store, but it didn't really seem like it work for that purpose.

The foam mattress has to be hard enough so it supports you without "caving in" too much, yet sufficiently soft so that it doesn't hurt you. The ideal hardness (for me) falls somewhere in the spectrum between a Japanese tatami mat (too hard) and a big sponge (too soft).

</comment><comment><USER9> How about no mattress: <http://www.zafu.net/sleepergonomics.html>

<comment><AUTHOR> Nice article! Will try this.

</comment></comment><comment><USER10> You should try them out. When I bought myself one I lay for a couple of minutes on each of 4 models to see if it's comfy for me.

But don't buy too soft mattress. It could seem really cool at first time but your back will hurt like hell next morning. Beside it's more healthy to sleep on a hard mattress.

Anyway all of mattresses I saw are two sided. One side is little softer then other. Test the harder side at the store (it should be comfy for you) and if after several nights your back will hurt - flip to the soft side. You need to sleep a several nights on the mattress as your back needs a time to get used to it.

<comment><USER11> Warning though: laying on a mattress for a few minutes in a shop != sleeping well on it all night for months.

</comment></comment><comment><USER12> Tempurpedic all the way. We've had one for 8 years, and it's the only mattress my wife, who has a chronic back condition, sleeps well on.

Your choice of pillow is important as well, and Tempurpedic's pillow is also top notch. Also, a lot cheaper than the mattress, if you want to start there.

</comment><comment><USER13> Ergonomics of Sleep: Sweet Dreams on a Hard Surface at www.zafu.net/sleepergonomics.html Profound experience and research debunking the bedding industry's sales gimmics. I am the author of the article. I designed a firm sleep surface with slatted platform frame and organic kapok/wool futon. Also contains infrar red calming effect. Trying to get back to simple and introduce the idea that the body benefits from resistance (in this case, something reletively firm like we had before modern bedding.) Also regulates body temp and respiration better than any other material I could find.

</comment><comment><USER14> I think foam is the way to go. It's especially great if there are two people in the bed, since it doesn't bounce/move as much, so you don't disturb each other.

I sleep on this: [http://www.amazon.com/Sleep-Innovations-12-inch-Memory- Mattr...](http://www.amazon.com/Sleep-Innovations-12-inch-Memory- Mattress/dp/B003CT37L0)

Very happy with it. I don't believe there's anything special about a Tempur- Pedic to warrant the ridiculous price tag. Something like this mattress is much, much cheaper, and in my opinion just s good.

</comment><comment><USER15> I just sleep on the floor. It's cheap and works just fine. I find that exercise helps the quality of my sleep more than anything else.

</comment><comment><USER11> Ikea has pretty good guides about how to choose a mattress in their shops. (ie. it depends a lot on your body weight, etc.)

</comment><comment><USER16> W hotel beds are sweet. When I found out you can buy them I was really excited, but then decided to pass on a $1000(ish) mattress...its a recession. My girlfriend told me ruelala was selling them yesterday for 7-800. I would seriously consider investigating these beds if you are in the market.

</comment><comment><USER17> Buy a stiff spring mattress then put a thick memory foam topper on it. You won't notice the difference between it and the $3k+ Tempurpedic mattresses and you'll spend a lot less.

</comment><comment><USER18> The Dux bed costs a fortune, and is worth every penny.

<http://www.duxiana.com/>

<comment><USER3> I have a VERY difficult time believing that a person owning a Dux bed gets better sleep than a farmer sleeping on some blankets in some corner of the world. Lets face it, if you have money, someone will figure out a way to take it from you and put a smile on your face. Another so called necessity.</comment></comment>


Former employees say Lyft staffers spied on passengers - <AUTHOR> https://techcrunch.com/2018/01/25/lyft-god-view/ <comment><USER2> Having seen this at too many companies, we at fair.com decided to adopt stronger policies to prevent this, viz:

\- all inbound API requests first go to our API proxy in the secure layer.

\- the API proxy encrypts all PII using the encryption service in the secure layer

\- then API proxy sends the request on to the appropriate service, having swapped all PII for tokens.

\- all services in the general layer are not able to talk to the encryption service to decrypt data.

\- thus all data that would normally be considered very sensitive (e.g. credit reports) can be stored or passed around the services because values like SSN and others are tokenized.

\- our services with UI's like our CRM, wherein the customer service rep needs so see the data unencrypted, works perfectly bc the response from the API proxy outbound decrypts the data, but selectively so based on the person's permissions through our abstracted auth layer.

Thus in the Lyft example, the majority of employees could have access to "God view" but with all the PII encrypted (so they couldn't search their friend's account by email, for example) but they can still look at rides and transactions, while just those who need to see the decrypted PII could be given those permissions.

Of course, this assumes that the encrypted PII is sufficient for anonymization. If you can look for all rides within a block of an address in their God view, then you could quickly figure out which person was your friend by narrowing down to rides originating from his house and his work. But again that comes down to properly limiting certain search capabilities in the UI.

I don't get why more companies don't follow our approach. I've seen way too much personally sensitive data in plaintext in databases over the years.

<comment><USER3> While I like that, and is a cool approach, what is really the difference between just storing PII encrypted in the same database and then keeping your keys locked down based on permission levels?

The API proxy would be great if you have a trusted 3rd party in charge of it or something. But abstracting it out to a separate layer doesn't seem necessary since it's all within the same company anyway, and developers will need access anyway

<comment><USER2> There is a big difference.

\- Logs: we can log all params within the general layer without worrying about leaking PII to the logs

\- Monitoring Network traffic. If I need to use wireshark or something similar in the general layer, all the data there is already encrypted/tokenized so it is safe to do so.

\- If you let each service encrypt the data itself, then all of those services are in scope from a security perspective. Access to those services from engineering's perspective would have to be considerably more locked down, potentially preventing engineers from access to their ENV variables, memory dumps, sshing into those boxes/containers, etc, for fear you could get the encryption keys (of course while many of those things should be locked down anyway).

\- Further, having each service do the encryption itself means you are duplicating that solution over and over again and introducing more opportunities for error. Having a single encryption service within the secure layer allows us to change our approach more cleaning than it being spread out everywhere.

And the list goes on and on...

</comment></comment></comment><comment><USER4> When I did an internship at a national lab, a lot of the hard rules about security relied on the fact that you had gone though their hiring process and would follow the rules. There were different access levels, for sure, but only like 2 or 3. You might have "had access" but you shouldn't be anywhere you didn't have a good reason for being.

Lyft should be checking on this, running audits and whatnot, but they also should be setting good policy and culture to not abuse access.

Basically, I think its reasonable to both allow many people access and expect them to not abuse it.

<comment><USER5> This was how it worked when I worked in admissions during college. You had access to every applicants' information, grades, essays, etc., as well as counselor feedback. But you were told that if you looked up yourself, someone you knew, or any celebrities, then you could be fired.

I don't know if there were automated checks for that kind of thing, but everyone knew there was a line you didn't cross.

<comment><USER6> At Lyft people _did_ think there were automated checks, _did_ know there was a line that shouldn't be crossed, and yet there was rampant abuse. Don't you suspect that many of the students in your position abused their access?

I think companies should be responsible for implementing effective security, whether that means preventing improper access or at least detecting it and punishing it after the fact, not just establishing a "culture." The most dangerous people, the ones who commit violent crimes, aren't limited by culture anyway, because they despise norms and have very different perceptions of risk compared to most people.

In your case, your fellow student workers might simply have not felt safe sharing their crimes with you. "Naughty" behavior can be taboo yet widespread.

<comment><USER7> If you have rules but don't enforce any consequences for breaking them, the rules pretty quickly get ignored.

If Lyft had fired a few rulebreakers early on, everyone else would know they were serious.

</comment></comment></comment></comment><comment><USER8> _Lyft tells TechCrunch that staffers in several departments that might need access to this data for their job have the ability to look up this information_

See, that's a complete lie and that's the attitude that needs to sop.

No-one _needed_ access.

Analytics definitely didn't. Engineers _never_ did. Customer services should have to request permission _from the customer_ before accessing sensitive data, with a valid reason. Insurance definitely did not. And "trust and safety", just like customer service, should have had to get customer permission first.

What's the _need_?

These are the laws that need to come into place, if your company is bigger than X, safeguards on personal data must be in place to stop anyone accessing a customer's personal data without explicit permission from the customer/senior (legally culpable) manager or as needed to fulfil an order.

<comment><USER9> [https://danluu.com/wat/](https://danluu.com/wat/) apparently this is normal: Facebook famously let all employees access everyone's profile for a long time, and you can even find HN comments indicating that some recruiters would explicitly mention that as a perk of working for Facebook. And I can think of more than one well-regarded unicorn where everyone still has access to basically everything, even after their first or second bad security breach. It's hard to get the political capital to restrict people's access to what they believe they need, or are entitled, to know. A lot of trendy startups have core values like "trust" and "transparency" which make it difficult to argue against universal access.

<comment><USER10> It doesn't need to be normal. There's no reason companies couldn't build a system that required approval from your manager before being able to access customer data. Any time a manager granted access, that could be audited by some second tier.

<comment><USER11> "Okay, stay on the line. My manager went to the bathroom 15 minutes ago, he should be back any minute, and then we can proceed with..."

After-the-fact accounting for all 'sensitive' actions would probably be more practical for most business needs.

I'd put a wizard in front of the thing that grants the access token to figure out the purpose and scope of the token needed.

Information request: "Rider History"

User: current caller

Scope: Between 9 AM and 11AM today

Reason: Lost an item this morning, need to lookup driver

If you were fancy you might even be able to convert the wizard's contained information into a request against the backend. Select trip.driver, trip.time from trips where user_id={caller_user_id} and time={9:00-11:00 today}

</comment></comment></comment></comment><comment><USER12> Someone I know was just commenting that from convos w/ people in other companies, it seems many startups have benefitted from not being under the limelight, and thus had the chance to quietly clean up their own messes while Uber was taking all the heat from the media.

<comment><USER13> I always suspected that uber flames were fanned by its many competitors.

<comment><USER14> Uber's dumpster fire didn't need any fanning.

</comment></comment></comment><comment><USER15> I worked there. I was an engineer and definitely needed access to these data. Fraud and abuse is constantly evolving and touches every part of the business. Everything was audited and I never saw or heard of a single abuse of access. Privacy was talked about seriously at onboarding and other trainings. I have no doubt if somebody was caught abusing this they'd be fired.

<comment><USER16> The article is indicating that what you are saying is at least not universally true in Lyft

<comment><USER17> It's really difficult to audit all this stuff. I was at a health insurance company where someone used su to go to a different user on a box they had root on and it did get picked up by the security team, but only a few weeks after it happened.

I was offered a security job at one shop and turned it down, keeping my development role. They had 3 security people for the company (total IT size was 500) and it involved a ton of log parsing, DDoS work, and they were starting to develop an internal white listing application tool. They wanted to bring me on because the desperately needed a developer to add some automation parsing the important from the chaff. (A younger me would have probably done this back when I wanted to be a Pen-tester. I only got interviewed/offered the position because I made the mistake about talking about going to Defcon on a company Slack channel and the security guy insisted I interview).

</comment></comment></comment><comment><USER18> Whether it's Uber or the NSA stories of staff spying on people for a variety of reasons... it always comes down to people who seem to have access to things that they probably shouldnt have gotten access to in the first place. Users should be protected by having their data encrypted and anonymized so no other human being (staffers, governments or hackers) can connect an ID to the data. This way they can still access the data and use it for what ever work related purpose, with less risk of these things happening

<comment><USER19> (I work at Google, but these views are my own):

This works until you need some kind of ombudsperson. At some level the data needs to be accessible and audit-able, otherwise what am I to do if my driver just drops me off at a different place than where I asked, or doesn't pick me up.

You need to know that I was in their vehicle, otherwise how can they charge me if I ruin their car. You need to know they were my driver.

There absolutely should be data privacy guarantees that are as strong as possible. But "encrypt and anonymize everything" doesn't work. (edit: and note, I think this is an unfortunate truth, but still a truth).

<comment><USER20> What do you do when you pay with 20$ for something, but get change for 10$? Why are "argue with them", "accept the loss and move on", "karate chop" and infinite other things not among the options?

> You need to know that I was in their vehicle, otherwise how can they charge > me if I ruin their car. You need to know they were my driver.

How did taxi drivers handle that for the last nearing 100 years? People before us managed sticky situations without destroying human civilization, so can we.

<comment><USER21> Well, back in the old days if we wanted to complain we'd write it down on a piece of paper, wrap that piece of paper inside another piece of paper, and then put that in an unlocked box out in our yard.

That's similarly how we'd order products, out of magazines. Only in that case on the paper we'd include things like our bank account information that we'd put in the unlocked box in our yard.

I'm not suggesting that things can't or shouldn't be better. I think it's just important to have a realistic perspective on where we are in this continuum of service vs privacy.

<comment><USER22> I generally agree with you, but I think it should be pointed out that unauthorized access to that unlocked box carries severe punishment. A big part of the problem with things like this is that not only are there no controls preventing access to private info, but there are also few if any consequences.

<comment><USER21> How much control do you think there was in the businesses that got those wrapped pieces of paper with your banking account information? Sure, there are penalties while it's in the box in your yard, but not really once it was at its destination. I bet it's much more strict today than it was a few decades ago.

<comment><USER23> I'm not so sure. There was a lot less surface area then to secure vs today's "collect all the data" ethos

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> The screenshots from the leaker mention that they are using "redshift", which is the name of Amazon's RDB product. Which means this is about people who have access to the database. This is unsurprising that they could access customer data given access to their database. I'm not sure how you prevent this without preventing access to the db (and there are legitimate reasons people within the company would have access -- DBAs, Engineers who are writing direct queries, etc).

Not defending people accessing PII, but just saying there are legitimate reasons why someone _could_ have access.

<comment><USER25> You can't prevent access but you can log all access and require a written reason for access. That, followed up by routine audits of access logs will reduce and discourage abuse as described in the article.

<comment><USER26> This is about Redshift, Amazon's cloud-based data warehousing tool. Auditing and logging every individual access made by data analysts, engineers, and others making use of Redshift would make their jobs impossible. One day of queries would take weeks to audit and validate a legitimate use case for all the individual data that got touched, and if you're just going to say "oh they needed everyone's PII because it was a big analytical query like they do all day", you're back at square one.

The reality is that some people are going to need wide-reaching access. You could monitor for certain problematic access patterns, like someone who is supposed to be doing primarily aggregate queries doing a lot of specific ones, and I'm sure that'd be a good thing to do, but to be honest there are probably much higher priorities since employees who need sensitive access are probably going to be able to avoid that type of detection.

</comment></comment></comment><comment><USER27> I can't even imagine how much PII is sitting in AWS Redshift from various startups... It's brutally slow if you don't tune the encoding types _extremely carefully_, which no one ever does. One has to wonder, if this is such a big deal, what the access rights from AWS' perspective looks like xD

Imagine the data team convincing the rest of the company that they're doing anything to make their redshift _slower_. Encryption? People want their graphs, damnit!

</comment><comment><USER28> What circumstance would be needed to have a view where an employee can find riders by name and look at their whole history? If there is a complaint it should allow the customer service agent to see the ride and perhaps some history (ratings make sense, but including full locations/times seems unwise), but I can't think of a reason why this would ever need to be a process _started_ by a Lyft agent and not the customer or driver.

<comment><USER29> I used to be in the habit of taking my cat to the vet in a regular taxi, with a local company. I always got the same guy and the same car as they always 'knew' where I was going. The guy I got liked cats, didn't mind waiting around and made sure everything was looked after. Others were allergic to cats or only doing airport trips, so I had no problem with them looking at my history and doing their best for me.

<comment><USER28> That's great for you, not great for say someone who's being stalked by an abusive ex. It's such an obvious and foreseeable problem, they need to own it.

<comment><USER30> Most male employees wouldn't forsee that problem.

</comment></comment></comment></comment><comment><USER31> That sure changes the Uber vs. Lyft media narrative.

<comment><USER17> Not really. Uber created the Hell Map, Greyball, and had the two harassment memos. This just seems to be a failure to actively monitor their audits and do permissions correctly .. something that Uber got hit with and fixed too.

Lyft just needs to deal with this issue now that it's public, not it's not specific to Lyft. It's really difficult to effectively scan for abuse, even when you audit everything. I've seen similar issues at many companies.

This Lyft situation might be more oversight where Uber seems to be more malice.

</comment></comment><comment><USER32> I was talking about this with my girlfriend at dinner tonight.

While we were eating, I noticed a few cameras that got a view of the whole restaurant, and wondered: of course filming the restaurant might be useful in case of a robbery (?) or for insurance, etc., but what are the chances the minimum-wage employees that checks those DON'T use it to check out hot women or embarassing stuff that happens from time to time..?

With us being tracked with data and video all the time nowadays we are safer-- or the companies that have the footage are safer--but of course there is a lot of room for abuse and improper usage.

<comment><USER33> "the minimum-wage employees that checks those"

Does anyone even look at them? I just assume most video gets recorded and then recorded over or somehow discarded.

Outside of situations like say an airport or casino I doubt anyone is actively watching most of the cameras unless something happens after the fact.

<comment><USER32> Perhaps not actively, but I bet in case of a hot woman or something weird going on they'll know where the monitors are.

I also have two separate family members that have businesses with cameras, and they both look at what's going from an app on their iPads while they watch TV in the evening (actually, having seen them do it is probably why I know videos at businesses are not handled properly).

<comment><USER34> Don't public places like shops have to have a sign saying there's CCTV? So customers know they're watched just like in the street.

<comment><USER32> Not in Italy nor Poland.

Also, what difference would that make? I already know I'm being filmed, the problem is that there is no control over how that video is used.

<comment><USER35> >Not in Italy nor Poland.

Which does not mean that there isn't a Law (in Italy) mandating it.

[Italian] Articolo 13 del Decreto Legislativo n.196/2003 e Videosorveglianza - Provvedimento generale - 29 aprile 2004:

[http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-...](http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb- display/docweb/1003482) [/Italian]

In a nutshell: [http://www.garanteprivacy.it/Garante-Home- theme/images/origi...](http://www.garanteprivacy.it/Garante-Home- theme/images/original/CartelloVideosorveglianza.gif)

Surely it makes no difference whatsoever.

</comment></comment></comment></comment></comment></comment><comment><USER36> Since when a Blind post is a credible source for news?

<comment><USER37> Heh, were you around for the Secret days? So much "news" came from that app.

</comment></comment><comment><USER38> Protection of PII has, for a long time, been a central tenet of USA-based health care IT (due to the HIPAA / ARRA-2009) regulations.

It's possible to do that fairly well, and still leave need-to-know exceptions. (The subsititute nurse on the intensive care unit needs to know if a particular patient has Crohns disease, for example).

My point is, PII CAN be protected reasonably well. It takes executive will to do so, and training, and monitoring.

I worked in a hospital for a while. They had good training on how to avoid misusing PII. It starts with "don't look up your ex or your senator" and goes into ways to keep patient data safe.

When there IS a leak HIPAA-covered operations are obliged to disclose it. See here for the catalog of recent disclosures.

       https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf

Doing privacy right is systemically possible. But it's a systemwide task, not just a one-off training or audit.

(Now, we can talk about whether HIPAA's main point--preventing insurers from abusing patient data--is working or not. Your doc makes you sign a permission slip letting insurers see your information, so you waive that protection in return for reimbursement. But that's a different issue.)

<comment><USER39> > _PII CAN be protected reasonably well. It takes executive will to do so_

These is where the EU's new data protection law (GDPR) could help. It has large fines, and the ability for NGOs to sue you on behalf of users. When the alternative is a big fine, it's easier to find the will.

</comment></comment><comment><USER40> I can completely see this happening. I have interned at small startups in the past where practice like this was rampant.

<comment><USER41> Yeah, and it's usually called "data science" and "personalized targeting".

</comment></comment><comment><USER42> I happen to know that the former country manager of Uber in Malaysia used driver personal information to bully and then swindle a gig worker at another (but not competing) gig-economy startup.

Long story short, he pressured the worker into doing a gig for free if he could guess his birthday. Not quite a fair gamble considering he knew the guy's birthday from when he'd signed up as a driver for Uber.

This would still be a terrible misuse of confidential information if he'd stopped at the poorly executed joke, but the highest ranked Uber employee in Malaysia instead insisted the marginally employed freelancer hold to the agreement.

<comment><USER43> What does this have to do with lyft?

<comment><USER42> \- The linked article alleges employees at Lyft abused information.

\- Lyft is a direct competitor of Uber.

I think my account of an employee at Uber, and not just any employee, but a country manager, committing a worse abuse is fairly relevant to the topic.

</comment></comment></comment><comment><USER44> Can unfortunately confirm that friends at both Lyft and Uber have in the past known my ride history. I admittedly had to push a bit jokingly for either to look it up, but the fact that it is even possible for insiders to access internal production databases makes me suspect this problem is far more widespread than just at ridesharing companies.

I wonder who at Fastmail can read user emails? Who at Heroku can access my code or ENV secrets? Can bank employees see recent transactions, bypassing ACH verification deposits' "Security"?

Sad how rare end to end encryption is as a feature in 2018.

<comment><USER45> Many companies have userdata access heavily restricted and audit every access. It's not that hard to log all queries to production that don't come from the system. And if a developer runs queries against the production database that should pop up somewhere immediately.

Not different in banks, any lookup of customer accounts is monitored and checked. Looking up a friend's account will get you fired immediately (or worse).

<comment><USER44> What I worry about is whether the logging is at the application level or database level.

Would not be surprised if my banker's crusty windows XP teller software's auditing could be bypassed by an unexpectedly-savvy insider.

<comment><USER45> Logging is done at every level. OS, network and multiple times on a db level (access log plus execution log).

</comment></comment></comment></comment><comment><USER46> I thought 'staffer' was only used when talking about people working in government or for a political party. Aren't 'staff' or 'employees' just as good for the headline?

<comment><USER47> > I thought 'staffer' was only used when talking about people working in > government or for a political party.

Nope.

> Aren't 'staff' or 'employees' just as good for the headline?

No. Staff has a different connotation; as a mass noun, it implies things that are true generally* of the staff. "Employees" would be about as good as "staffers"; the latter is shorter, though, which often is preferable in headlines.

<comment><USER46> Employees is already used in the headline, so the editor would have been looking for a different word to use anyway.

</comment></comment></comment><comment><USER48> Who honestly finds this surprising?

<comment><USER49> Very very few people I hope. There is no economic incentive for companies to invest in secure design/architecture. The costs of building it right almost always lose to other product owner features and timelines.

Until we can actually get incentives aligned, companies will continue to build leaky, poorly designed apps with no layered controls. Yes, someone will jump on me and say "but my company does is right!". Great for you! Share your knowledge! You are a snowflake, and probably fortunate to have ethical leadership! The rest of us are doomed.

</comment></comment><comment><USER50> Just a reminder: "The Kinder Gentler XXXX" or "XXXX but more Ethical" is no the same as "Kind and Gentle" or "Ethical"

</comment><comment><USER51> The sixth word in this article is 'scandal'—is it just me or is a cab company knowing your pick up and drop off locations really not that outrageous?

</comment><comment><USER52> Form TFA: "I have tried to change that from within"

Uh oh. This will probably narrow down enough so that they can have a pretty good idea of who posted this...

</comment><comment><USER53> Strange coincidence that this headline shares the top spot with an announcement of a new Waze Carpool service... which seems to compete with Lyft?

</comment><comment><USER54> None of the data that was available sounds like sensitive PII so I'm not sure why anyone would be surprised by this. I would probably think that rider/driver feedback isn't PII at all.

I suppose it might be a bit questionable if Lyft was creating and providing tools to make it easy to look this stuff up and promoting it within the company but that doesn't sound like the case either.

<comment><USER55> > None of the data that was available sounds like sensitive PII so I'm not > sure why anyone would be surprised by this.

The first sentence says employees would "view the personal contact info and ride history of the startup's passengers."

I would consider contact info and exact physical movements to absolutely be PII and information that is sensitive. If not that, then what?

<comment><USER54> Not all PII is inherently "sensitive" though. Meaning not everything that can be used to actually identify you needs to be encrypted and protected. I don't know for sure but I don't think names or addresses qualify as that.

<comment><USER56> I absolutely would say it would, especially where there's a very good chance that the home and work addresses are part of that list, and the idea that someone would use a database like that to spy on an ex and harass and/or assault them is an actual thing that happens.

</comment></comment></comment></comment><comment><USER57> This is a shame for obvious reasons but I don't like the comparison to "god view". Uber designed a UI around accessing PII for their employees to use wanton, Lyft sounds like they need to get their data access under control, stop making excuses for why anyone "needs" real user data, and actually run audits.

</comment><comment><USER58> requiring a second person to verify/supervise access to confidential data solves a lot of this problem (at a cost though). like it doesn't prevent a strong adversary from getting access to data they shouldn't but it prevents normal people from abusing power they have stumbled upon. require two logins + audit and a lot of the abuse goes away. people are less inclined to lose their job because their colleague wants to check up on their girlfriend.

</comment><comment><USER59> And here we go. Hopefully people will finally understand that there's nothing uniquely evil with Uber and that all players in this sector are rotten.

</comment><comment><USER60> A tangent, but why "staffers" and not "staff"?

</comment><comment><USER61> I don't know if I blame the company for this. Anecdotal queries are useful debugging tools. Or makes more sense for employees to just have some sense of decency.

</comment><comment><USER62> Organisational data protection is no data protection at all.

</comment><comment><USER63> I hate that word "Staffers", immediately makes me think of politics.

<comment><USER64> That's you. It's not particular to any industry.

</comment></comment><comment><USER65> You used to be able to get info like that by putting a scanner on taxicab radio channels. Few people bothered.

</comment><comment><USER66> This is the biggest point I've been making to all my friends. What they believe Uber is so evilly doing, it will probably show that companies like Lyft and Didi and Grab, etc are all engaged in the same sorts of actions. Uber is the whipping boy for ridesharing, but I'm willing to bet that they are do basically the same thing.

My question for Steve Yegge is:

He seems to somehow believe that Grab has the moral high ground over Uber and Lyft. What is he going to do when he finds out that Grab behaves in exactly the same manner as Uber?</comment>


Eric Schmidt, Ex-Google CEO, Predicts Internet Bifurcation with China - <AUTHOR> https://www.cnbc.com/2018/09/20/eric-schmidt-ex-google-ceo-predicts-internet-split-china.html?__source=sharebar|linkedin&par=sharebar <comment><USER2> It won't just be China.

The Internet was, initially, a terra incognita for governments. (Which is ironic given its origins.) At first any wilderness is home only to pioneers, explorers, and other kinds of people who love the freedom that a frontier (Wild West) region gives.

But inevitably (as is the way of humans) more humans appear, business pops up, government follows, laws are made, property is titled, walls go up, and freedom goes down. All valuable wilderness inevitably becomes civilized.

Eventually governments will simply cut the cables (so to speak) to make the digital borders match the geographical borders, only allowing international traffic via heavily supervised data-ports for registered and licensed data- traders. The Big Companies will love and encourage this, as it means even less possible competition for them. A cyber-war might speed up things as well, but it seems inevitable anyway. (GDPR has already added a new row of bricks for the wall, with some sites just refusing to serve my EU-based browser at all.)

<comment><USER3> This depresses me greatly. Is this inevitable?

<comment><USER4> At this point it feels like a race between getting a global government vs. splitting up the Internet. Sadly, the latter is much more likely.

<comment><USER5> I guess it depends how far in the future we're looking.

Seems like, long term, the formation of a global government is inevitable if we take in consideration global resource management, climate change and environmental degradation.

<comment><USER6> If you look at what is going on in the EU and the Euro problems it seems people don't have much of an appetite for it. Even the US struggles with reconciling the different requirements of local and federal government.

Unless we have WW3 and somebody wins.

<comment><USER5> Today is one thing, but in 2050, 2080, things could be vastly different.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> Some interesting comments on this (from fb) from Grahame Lynch who produces CommsDay:

'''

I am inclined to agree with this. Looking at various tendencies in internet governance and national security legislation around the world right now there is more pulling the internet apart than pushing it together. This has been fairly likely ever since the world split 90-50 on how to/whether to regulate the net at a global level via the UN/ITU at WCIT a few years ago. In a sense, the Chinese internet already is its own thing, given how "separated" it is from the rest of the world by firewalls, deliberately constrained bandwidth connections and so on.

You will also see the same trend in telecom supply chains. There will be one for America, Australia, India, Taiwan, Korea and other nations in their sphere of influence which will resist China-sourced kit and one dominated by China for the rest of the world. The moves against Huawei in various countries is the forerunner of what is an articulated but little publicised US-drive to favour non-Chinese actors in the network technology supply chain. Samsung will be a big winner from this (as will Ericsson, Nokia, Cisco).

[https://www.cnbc.com/…/eric-schmidt-ex-google-ceo- predicts-…...](https://www.cnbc.com/…/eric-schmidt-ex-google-ceo- predicts-…|linkedin&par=sharebar)

I've reported on this for a quarter of a century and, to be frank, I am surprised that the net and global supply chains have remained as open as they have for all this time. The next few years are going to be very interesting - or disturbing, depending on your POV.

'''

EDIT to reflect CommsDay which I think is the correct short title for Communications Day newsletter.

</comment><comment><USER7> I read this in another article and thought Schmidt's prediction sounded very plausible. It parallels the ebb and flow of trade between large economies, which has shifted considerably over the last few centuries. In retrospect it seems somewhat naive to think that this would not apply to information.

</comment><comment><USER8> After living in Beijing for 5 weeks earlier this year, I can say, not only the internet, just all of China. It's very tough to run a business in China as an outsider. Eventually, the government will sponsor a domestic company to replace your business and push you out with regulation and licensure.

This is a double-edged sword for Chinese companies. They are assured a domestic monopoly, and given the population of China, that's a very big one. However, when said companies try to compete in a global marketplace, they struggle without their government-sponsored monopoly.

</comment><comment><USER9> He's already off by an order of magnitude.

</comment><comment><USER10> Great article here from Foreign Affairs on the same topic

[https://www.foreignaffairs.com/articles/china/2018-08-13/whe...](https://www.foreignaffairs.com/articles/china/2018-08-13/when- china-rules-web)

</comment><comment><USER11> how about 3 internets:

* censored * "uncensored" but monitored by the DC-alphabet soup & Co * the dark web

</comment><comment><USER12> I posted a suggestion a few days ago ( [https://news.ycombinator.com/item?id=18022586](https://news.ycombinator.com/item?id=18022586) ) that cloudflare start to do this in order to protect itself and it's users.

With so many censoring rules popping up in different countries, a centralized service could easily be forced to eliminate tons of information.

right to be forgotten, not just from host country, but whole planet. GDPR. dmca, things that are fobidden in Asia, things that are to be blocked in and around Indonesia and such.

When a small group of trolls uses other people's policies to harass and deplatform women because they have issues with cleavage ( [https://www.engadget.com/2018/09/14/paypal-ban-asmr-sound- ar...](https://www.engadget.com/2018/09/14/paypal-ban-asmr-sound-art-therapy/) ) - it should be obvious that more and more of these kinds of censor those you don't like by using the policies of others is only going to grow.

Especially as more and more places are developing more censoring policies, and people are sharing methods for removing / de-platforming.

(they came for Alex Jones, and we kept using paypal, then they came for girls not dressed in Burkas and most still used payal, then they came for..)

The big internet companies are being used against the smaller groups of people all over the world.

Cloudflare ordered to give customer location data recently: [https://news.ycombinator.com/item?id=18039208](https://news.ycombinator.com/item?id=18039208)

Google and others have been forced to do the same, and even though some big G and Fbook occasionally try to deny some of the data sharing, they did not stop SESTA, instead looking to use these things as excuses / pass the blame.

What was the case where Msoft had to drop the appeals about sharing data from computers in other countries with the US?, as a new law was made, cloud- sharing or something like that?

Big G working on tracking and auto censoring for China and other places. Facebook, Instagram having to rush censoring in areas around the world.

Canada and the US have some of these things in the bargaining for the NAFTA re-agreement I think as well.

This is all happening much faster then most people realize I think, the ramifications have yet to understood.

Bifurcation, or divarication - it's getting split up much more than just in two.

Sadly the giants like Google and Cloudflare are being used as the largest hammers, or may be biggest saws to cut up and split up the worlds knowledge.

These are interesting times indeed.

<comment><USER12> and now articles are being published in the UK asking govs to use cloudflare, google and others to stop the transmission of information in just this way -> [https://news.ycombinator.com/item?id=18107919](https://news.ycombinator.com/item?id=18107919)</comment></comment>


Ask HN: How to find a creative idea for new project? - <AUTHOR> I am third year CS student but I can say that I start programming one year ago. Before that I was coding only for my homworks. I started coding with my friend in a project. But we are seperated and I will not continue to developing that project. I learnt about web frameworks thanks to this project. Now I want to start a new project but I can not find any idea for what to do. I think I am not only person in this situation. Can you give me advice? <comment><USER2> The most important thing to remember: you're not a programmer, you're a creator. It would be like a carpenter thinking of themselves as a wood cutter. Instead a carpenter will realize a need for something specific and make it. So my question for you, what do you need? Figure it out, sketch out the UI, data structure etc in a notebook, figure out what tech you need to build, and then start coding.

</comment><comment><USER3> Yeah I can. Find a problem that has not yet had a software solution for it yet. For example the people that made medical software systems that turns patent and medical records electronic and do electronic refills over the Internet, etc, made a lot of money. But that has been solved.

If you can't find a problem that has not yet been solved, you might not be looking hard enough or in the right areas.

You also can write an alternative to an existing software program but make it for the web or in a mobile app, etc.

Start out simple like use data from the baseball website to calculate baseball stats, and show you can customize it for a Little League or armature team.

</comment><comment><USER4> If you can't think of a new project to work on right now, consider contributing to an open source project that needs help. Simply getting started on _something_ will usually get your creativity flowing and ideas will come.

<comment><AUTHOR> I am thinking to contribute to open source project for a long time but I can not find courage to do that because contribute to open source project is look like very difficult to me, I can start to read and understand the toy projects but I can not find the way for understanding and contributing big projects like mozilla firefox or pyton.</comment></comment>


Ask HN: How to deal with managers who encourage shippability over quality? - <AUTHOR> I understand shipping the product should be the primary focus, but how do you deal with managers who always say things like "Let's just ship first and come back later to refactor/clean up"? Of course, we never come back to fix things because there are always features to work on. It's almost like I'm being actively discouraged to spend time thinking and designing in the interest of expediency. I feel this is hampering my ability to learn to write good code from scratch as we are always looking to "making things work first".<p>Aside from the obvious (changing jobs), what can I do as an engineer to discourage this type of thinking? <comment><USER2> You are not alone - in fact: its the norm. Double all your estimates. Don't push/show POC code. Do some design work before you code (write it down /draw a diagram or two). Don't ask/involve your manager unless you want him/her to make the decision (which will always be: if it works - ship it)

</comment><comment><USER3> I've seen this go two ways. Become convincing and try to use experience to persuade. Or, document for the experience, do your best and use any failures as an example later to tactfully persuade in the future.</comment>


Why Engineers build crappy products - <AUTHOR> http://willschenk.com/why-engineers-build-crappy-products/

<comment><USER2> It's weird to criticise engineers for bad UIs by writing an article and then designing your website to allow only about 25 words on screen at a time.

[http://imgur.com/dAM2RT6](http://imgur.com/dAM2RT6)

<comment><USER3> I never claimed I was anything other than an engineer.

</comment></comment><comment><USER4> Alan Cooper wrote a well-known book on the topic, titled "The Inmates Are Running the Asylum: Why High Tech Products Drive Us Crazy and How to Restore the Sanity".</comment>


The Fountainhead and Software Engineering - <AUTHOR> https://medium.com/@ard_adam/the-fountainhead-and-software-engineering-d991b269af2e <comment><USER2> I can't tell if this was satire or serious.</comment>


Best Books on Personal Finance - <AUTHOR> https://www.bamboost.com/best-personal-finance-books <comment><USER2> > "an expert-written guide"

What expert? It's just a list of the top and recommended books from Amazon in the Personal Finance category with a near-0 effort of summarizing outside of telling me what rating it has on Amazon.

> "You're a "millenial" looking for a step-by-step practical handbook for > achieving financial success"

Expert opinion...

Why not tell me about the book itself, specifically _why_ Personal Finance Book 1 is better than Personal Finance Book 457 or Personal Finance Book 205,249</comment>


Are event driven IO systems faster ? - <AUTHOR>

http://hal.archives-ouvertes.fr/docs/00/43/43/74/PDF/are-events-fast.pdf <comment><USER2> Using interrupts on an AVR chip, I managed to get almost 100% utilization of the ADCs and UART, rather than each waiting on the other. The throughput was increased by something like 1200%.

</comment><comment><USER3> Clicky link: [http://hal.archives-ouvertes.fr/docs/00/43/43/74/PDF/are- eve...](http://hal.archives-ouvertes.fr/docs/00/43/43/74/PDF/are-events- fast.pdf)

</comment><comment><AUTHOR> Oops. I confused URL and text field. Sorry. For those interested in this type of problem, I signal the existence of libev which might be of interest too. State-threads documentation seems very good.</comment>


CodeTriage: Help out your favorite open-source projects - <AUTHOR> https://www.codetriage.com/ <comment><USER3> It's somewhat more important to me (because I'm experienced) to find the right project vs a random issue in one of many projects... I don't have trouble thinking of open source projects to contribute to, but I work in a big co and not super interested in trying to edit something like firefox because the community is too large.

I would prefer something like who's hiring but for volunteer work where projects say look, I have this kind of side project, or we have this smaller company, we use this stuff, we'd love to have a competent C++ person (sub your language of choice) to fix this (Windows build/annoying bug/move us to an awesomer version of a third party/rewrite the docs), in exchange, we're ready to have a short like 10mn 1:1 over IRC or email or something to help you get started. And then I'd feel like I can really bring something to the table, I suppose.

Most projects say "come hang out in our channel" or "just start with one of the beginner issues"... but it's a little intimidating to go to a new channel and not know what to say and walk in on people being already friendly insiders just to get a task. And I never know if it's socially OK to pick an issue in the tracker and post and say I'll fix it... what if I hit a problem or it turns out to be more than I could chew at this point in time, etc.

<comment><USER4> It's tough. Supporting someone through their first contribution is a lot of work and there's a lot of falloff with new contributors. It's easier to say "just do the work yourself if you're actually interested" and it can be exhausting to go through the initial hand holding time and time again.

As someone who is interested in growing a medium sized open source project, it's difficult to find the people who are interested in contributing without feeling too pushy. You want to give people the best information and tools to go forward, but you also want to let them learn independently (since scratching _your_ itch is typically an adage within FOSS).

I do push the "just pop into the IRC channel" approach because it's hard to give better recommendations before knowing who the other individual is and what they want to get out of volunteering. I don't know if any particular thread could accomplish the negotiation of "who want's to help whom" due to the vast differences of all the different specializations, project sizes, project collaboration styles, etc. It would be nice if it did though.

<comment><USER3> I'd consider myself a "senior" developer and I have volunteered before (not as a dev)... In most other large-ish structures there are volunteer coordinators that introduce themselves & the project to new people, give out links, set up volunteer events when growing the project is needed, that sort of thing. My understanding is open source actually makes quite a lot of money, so I'm not sure how come spending what amounts to a few hours a month doing outreach is a much bigger problem than it is for the local community garden.

And of course, as a more experienced dev, really all I need is some kind of human touch so I know that if I start working my efforts won't fall into a big black void... devs tend to call that hand-holding because most devs think all socializing is a waste of time, but for most people volunteering is at least a little social.

As far as actionable advice goes, I think having virtual "volunteer days" (on the 1st Saturday of the month, beginners can join the channel and get matched with somebody more experienced if they have questions for their first pull request) may work. Also appealing is publishing "openings" showing an example of what skills developers in your project commonly tend to have (working independently, obsessive about coding standards, super-problem-solver, an eye for usability, great communication skills, ability to use valgrind, whatever) so people can self-select into it.

<comment><USER4> Interesting perspective. My own domain is within linux-audio which does not involve all that much cash (I've investigated various funding models for my projects as well as observed them for others and it is a hard game). Most of the projects are on the smaller side, so when you have a few people shift gears to spend time on volunteer events/activities it frequently slows down or pauses development.

I do try to put in community outreach time as it scratches a different itch than the more development focused day-job, however it does frequently seem to not lead too far. There are many cases where people interested in contributing are very junior individuals who need some assisting along the way due more to a lack of experience rather than lack of familiarity with the project in question. Linux audio in particular is challenging since it involves the intersection of several different domains (low-latency programming, DSP, C/C++, user interface coding/design, audio/speech processing backgrounds, technical writing, etc). So, people do end up being more green than I would expect compared to other open source domains.

Thanks for the specific suggestions. I've considered doing a specific hack day/weekend/etc event for a while, though I've never acted upon it since I don't really want to deal with the possibility that I end up spending a day or more and there is no activity in response.

I do like the idea of openings though. It's a clever way of presenting what the project has to offer as well as presenting specific enough profiles of people that it might get someone over the initial hump of "perhaps I should ask about contributing".

<comment><USER3> You seemed to have a very specific domain so I looked it up -- I think you're right, there's an inherently higher barrier to entry in your case. If you eventually do do a hack day, post it to HN, I'd give it a try! (I'm a very very beginner music maker and my own domain is graphics, not audio... but I do do fiddly low-level math in C++...)

</comment></comment></comment></comment></comment><comment><USER4> I don't understand how a site like this really helps people find something that they're interested in, which has a good community, and is something that they would specifically want to be involved in. It just looks like data overload to me and it biases everything towards the ultra-large projects which for new contributors can be overwhelming (unless said project has a lot of effort in mentoring/on-boarding/etc).

I'm not sure how you would present the information on this site in a way which would better lead to quality interactions between newcomers and existing projects, but as it stands it comes off to me as a jumbled list.

</comment><comment> ur-whale Will non-github open-source projects be able to participate?

</comment><comment><USER5> What I'm trying to do to get experience working on other people's code is get the people I know who are trying to build their portfolios to farm issues and so on out to each other. I know a guy who's working on an RSS feed reader and ran into a bug he doesn't feel like fixing, I have a Rails app that needs styling, we work on each other's projects.

It's probably worse than finding big open-source projects to contribute to, but that's intimidating enough that none of us have done it.

</comment><comment><USER6> Not affiliated (nor previously familiar) with CodeTriage, but I see a number of "I wish it did X" responses already and thought it was worth pointing out that their About page links to the repo for CodeTriage itself: [https://github.com/codetriage/codetriage](https://github.com/codetriage/codetriage)

They have over 100 contributors, so it seems likely they'd appreciate your issue or pull request.

</comment><comment><USER7> After trying to help a project on the triage site... there needs to be a troll or toxicity level indicating which github projects should be avoided for obvious reasons.

<comment><USER4> I would imagine that such a system would be hard to cultivate. For many projects I'd say that two people would be a very bad fit together due to a clash of personalities, but on their own there's nothing troll-ish or toxic about either individuals. It would be hard to really quantify such problems with a project rating score and since so few people would be using the rating system (for many project), then it would be possible for a incorrect outlook on a project to be given based upon a single misunderstanding with one individual.

<comment><USER8> > I would imagine that such a system would be hard to cultivate.

Yes, matchmaking/recommenders can be hard... but I wonder if there is a different cluster of low-hanging fruit here?

Given a project on github, and desire to know its status, culture, players, etc, there's what I call the "github dance". Exploring commits and forks and pull requests and issues and wiki. Struggling to pull together a picture of n unfamiliar people from scattered comments. It's painful. It's very not what the github information display UI is optimized for. The exploratory dance seems far more often bounded by exhaustion than coverage confidence. There's almost no automation, for a task which seemingly permits a lot of it.

So apropos GP and toxicity: Signals like lots of wontfix prs, or an ecology of unmerged forks, have to be gathered by eye. Rather than a more automated/clearly-presented "well, that's a bit odd...". Absent a standard way of presenting goals and scope and roadmap and culture, everyone is winging it, some inevitably more opaquely than others. One can figure out a lot about projects using github data, but it requires having surfed a lot of projects, and the gh ui is seriously fighting you. Heck, one of the times when you most want to explore the ecology of forks, large dissatisfied communities in need of a new nucleation point... does gh provide a nice tailored display? Ha - <USER2> says 'too many forks to tell anything about them'. There seems a lot of untapped potential value. And at least some of it seems relatively unchallenging to implement. And _then_ there's all the many extra nifty things one could do with rich bulk analysis and ML - shoemaker's children.

<comment><USER4> That sounds like an interesting starting point for an academic paper on community interaction. Many of those metrics could be gamed if they were the 'goal' of a particular site, though before they're gamified they do sound like an interesting way of filtering through repos to find examples to talk about how communities function (or not).

</comment></comment></comment></comment><comment><USER9> It would have been great if they had search box or some sort of filter (like in DataTables js plugin).

<comment><USER10> Agreed. I'd be more inclined to help if I could filter at a bit more of a granular level than just language.

There are certain things that I "specialize" in that I feel could be of more merit to some projects than others.</comment></comment>


Apple sapphire crystal supplier GT Advanced files for bankruptcy - <AUTHOR> http://9to5mac.com/2014/10/06/gtat-sapphire-apple-bankrupt/

<comment><USER2> Does this present the opportunity for Apple to take a significant stake at a greatly reduced valuation?</comment>


Refactoring code that accesses external services - <AUTHOR> http://martinfowler.com/articles/refactoring-external-service.html

<comment><USER2> I like the goal of the article, I think it does a great job of refactoring a typical-looking method with too many responsibilities into a reasonably decomposed system. I also really like Fowler's technique of strict refactoring augmented with tests.

However, I don't think his articles (like this one) do a very good job of teaching that technique. While reading, I don't know where the code is headed (maybe I need to read the end first?), so I don't have a good frame of reference to understand each intermediate step, or the rationale for choosing it. He presents a refactoring (complete with link), but doesn't explain what leads him to choose that refactoring at this particular stage.

On Blooms Taxonomy, I don't feel like this article even gets me to the Applicative stage, at least for the intermediate refactoring steps.

On a different note, I was surprised that the YoutubeConnection still contained the fields to retrieve (the 'part' parameter). Once he color coded the initial state, I expected to see that list of response fields to be extracted into a parameter. On the other hand, the way the final code is structured, it would be provided by the VideoService, which doesn't seem right either.

<comment><USER3> Yeah, there is a whole host of things that are left unsaid. He does a lot with TDD, and other principles like SOLID, refactoring methodology, and testing patterns that are normally associated with clean code. This topic could easily be expanded into a whole book for beginners. This is just barely scratching the surface, probably more like just wiping the dust off.

</comment></comment><comment><USER4> These kinds of articles often tend to annoy me because the end-result code doesn't necessarily look any better, just convoluted for the sake of perceived modularity/maintain ability. However, I thought this article was excellent, and Martin did a bang-up job of illustrating the kinds of decisions experienced OO programmers make when they're writing or refactoring code. I also thought Martin's suggestion to use pattern names in class names was interesting. I'm not sure how I feel about that -- maybe for beginner/intermediate programmers it's a good habit to have.

<comment><USER5> Personally, when I'm refactoring code, it'll go through a phase where the classes are named for the patterns they're using, but eventually, they all get single names and get put under modules that usually only hold other classes with that pattern. Like, I'll have a "Gateways" module for the YouTubeGateway to go into, and then it'll just get renamed "Gateways::Youtube".

I used to do "Youtube::Gateway", but I find that grouping by functionality allows me to DRY up code a lot better and winds up being cleaner. Actually, with Gateways, I maintain an internal gem that I use just to manage them. I got tired of reimplementing FTP gateways every single time I needed one. So I just include the gem, it's called Orchestra, and just call Orchestra::Server[server_name].ftp_get(path). The gem has all the URIs to connect to, all the code managed with its own DSL.

</comment></comment><comment><USER6> Learned a lot, hopefully Martin's curiosity leads him to follow through with the same codebase refactored in a functional style.</comment>


Why have American weddings gotten so ridiculously expensive? Blame inequality - <AUTHOR> http://www.vox.com/2015/1/16/7545509/inequality-waste

<comment><USER2> I'd prefer a flat tax over a consumption tax.</comment>