Confidential VMs - <AUTHOR> https://cloud.google.com/blog/products/identity-security/introducing-google-cloud-confidential-computing-with-confidential-vms <comment><USER2> Does anyone know what mode of AES that SEV (or SME) uses?

I have been reading though all of AMD's documents, and I cannot find what mode of AES that SEV (or SME) uses. I find it extremely odd that this is not called out in any of AMD's documents, and frankly a bit worrisome.

For the record, "A Comparison Study of Intel SGX and AMD Memory Encryption" [1] claims a modified version of AES-ECB is what SEV uses, BUT their reference links to AMD's whitepaper [2], which does NOT say anything about their mode, so I do not consider [1] to be a trustworty resouce.

[1] [https://caslab.csl.yale.edu/workshops/hasp2018/HASP18_a9-mof...](https://caslab.csl.yale.edu/workshops/hasp2018/HASP18_a9-mofrad_slides.pdf)

[2] [https://developer.amd.com/wordpress/media/2013/12/AMD_Memory...](https://developer.amd.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf)

<comment><USER3> They document a "physical address based tweak". My understanding is that this is xoring a function of the physical address with each 128bit block before going into AES-ECB (and that function is that same for every VM on your system).

<comment><USER2> I only saw that in "A Comparison Study of Intel SGX and AMD Memory Encryption", which per my grandparent comment, is not a trustworthy source (they reference the whitepaper, and the whitepaper doesn't say anything about it).

Is that documented in an actual AMD source, or even talk?

<comment><USER3> As far as I know, the whitepaper is all you will find publicly. It does mention the tweak (on page 4), only if you want the details and don't trust the third-party papers, you will have to reverse-engineer that yourself =]

<comment><USER2> Fair enough. That's what I assumed, but the HN crowd is pretty resourceful too.

</comment></comment></comment></comment></comment><comment><USER4> What is the attack Vector that this solution prevent ?

Am I missing something obvious ?

Will it prevent Google from being able to have a Root access to the VM?

From my understanding it does not seem to protect from Google. If they are still able to have a Root Access to the VM it does not matter if the memory is encrypted or not.

The only thing that I see, is in case of a spectre/meltdown vulnerabilty where the isolation of the RAM fails...

<comment><USER5> GCP does not have root access to the customers VMs. Confidential VMs with AMD SEV create an additional cryptographic isolation layer (in addition to virtualization one) between tenants and Google infra, mitigate 0days guest escapes, make observability attacks less possible, protect against some set of DMA attacks, and mitigate memory physical access attacks. To add to this not all spectre variants are applicable to AMD SEV, e.g. L1TF or foreshadow is not.

<comment><USER6> > GCP does not have root access to the customers VMs

I mean, they have physical access to the hypervisor host machines, where they could do anything they like to them, e.g. tap the JTAG pins of the CPU.

Insofar as you assume that the attack here is "the NSA compels Google to gather evidence against you", the lack of just being able to _log into_ the VM doesn't really change much.

<comment><USER7> > Insofar as you assume that the attack here is "the NSA compels Google to > gather evidence against you", the lack of just being able to log into the VM > doesn't really change much.

For most people (and especially businesses) this is a totally unrealistic security aim. If what you're worried about is the government using it's legal ability to compel people and businesses to provide evidence then there's ~no product or service from that country that you could realistically use.

<comment><USER6> I mean, yes, there's no service where the security/privacy is _contractual_ , that is safe from the state overriding the contract.

But the promise of things like homeomorphic encryption, is that you can do a computation on a truly _untrusted substrate_ , i.e. you can trust computations performed by an untrusted adversary, and also know that they didn't learn anything about those computations. It's a _technical_ solution to security/privacy, not a contractual one.

The ideal that everyone's hoping for, is that there's a way to get that same kind of _technical_ guarantee from cloud compute providers, without needing a layer of maths that makes Monte Carlo quantum simulation look fast.

<comment><USER8> All commercial activities are at the core protected by contractural protections and good faith. Cloud is not as different as you may think.

Any other expectation of protection from the state are a limited based on probability, seriousness of the matter, and your potential culpability. Your employees, service providers and others can be required to provide information without informing you. In extreme cases, agents will pose as utility, security or building management.

<comment><USER6> > Your employees, service providers and others can be required to provide > information without informing you. In extreme cases, agents will pose as > utility, security or building management.

...and homeomorphic encryption would stop all of those attacks. Presuming it's a homeomorphically-encrypted substrate for an autonomous agent, making its own "evaluations" of the data it can perceive from the outside world (ala a smart contract with access to an oracle) rather than simply trusting data from the insecure domain that happens to be signed with the right key.

This is also, y'know, the security architecture that allows nuclear submarines to avoid being subverted by an enemy nation that has temporarily gained control of the White House. The sub's commander needs to know not only that they've received the order, but also that the world really _looks like_ one where such an order would be legitimately given. The isolated secure agent, speaking to an insecure principal, needs not only proof of their credentials, but also needs to _independently_ verify their _claims_ about the state of the world. (And, if they can do that, the system is often architected such that the principal won't even communicate in the moment, but instead has just left flowchart-like orders in advance, involving various dead-man's-switch timers and so forth.)

<comment><USER8> > ...and homeomorphic encryption would stop all of those attacks.

It may, but how many business processes are as well thought out as nuclear missile submarines?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Technology, technology, blah blah blah.

Tell me this: will Google indemnify you against all your losses proportional to the amount they are to blame?

i.e. if you lose $50 million because you relied on Google's "confidential VM" and an investigation shows it's 100% because Google didn't protect the VM, do you get a year's worth of fees back or $50MM?

<comment><USER10> You raise a very, very important (and debated) point.

(disclosure: I was at AWS 2008-2014, and VMware's cloud business 2014-2016; opinions my own, no disclosure of secrets, etc etc)

Most SLAs only indemnify you for the paltry infrastructure costs in relation to the downtime or accident.

Few SLAs are more extensive, covering for example data loss.

AFAIK, no SLA exists that extensively cover such type of loss. (perhaps with the exception of heavily customized contracts, sometimes part of a military contractor deal, where numbers are out of this world and there's huge margins for clauses and exceptions everywhere).

They don't exist for two reasons, IMHO:

1) it's very complicated to define metrics related to the amount to be indemnified, and

2) it's hard to keep that amount current, based on how the data changes, or the architecture changes.

It would be interesting to see an "insurance" for these kind of things. I once thought of such a product, just after I left AWS, and for a little while I entertained the idea of launching a startup to go after that market.

<comment><USER11> I have long felt that almost all SLAs are completely toothless and thus _certainly_ not worth paying extra for.

A few comments on this topic from 44 days ago: [https://news.ycombinator.com/item?id=23362073](https://news.ycombinator.com/item?id=23362073)

Now insurance, that sounds like a much more promising facet for protection. But still I wonder about the incentives: SLAs are offered by the original company and mean that they have skin in the game. (Well, they _already_ have skin in the game as you're a customer and if they mess things up you will look less favourably upon them as a provider, but the SLAs should in theory provide more direct financial incentive to avoid breaking things.) Insurance would be offered by by a disinterested third party¹, and thus lose that SLA incentive.

¹ Insurance in general relies upon this for scale and safety; I can't imagine trusting any provider offering first-party insurance: they'd likely go bankrupt the first time anything went wrong.

<comment><USER12> The SLA you mentioned there was problematic because it didn't actually cover how much you were losing if the service went down. A SLA that _would_ cover that would certainly not be useless, and likely not be toothless either, even if insurance was involved.

<comment><USER11> I wasn't speaking about any one SLA; I was speaking about the contents of pretty much _every_ SLA I've ever looked at. Seriously. Coincidentally, that very day, I happened to find what is I think the best SLA I've found, which went as far as refunding 5× what you paid them for the month after a certain amount of downtime, and _almost_ added it to that comment as the first decent one I'd come across, but as I read further, the amount of downtime it took to get to any meaningful refund still seemed unreasonably long, so I ended up deciding it was still mostly toothless, though perhaps its gums were just a mite tougher than most.

 _Negotiated_ SLAs may be able to take into account customer business losses (I don't know, I've never seen a negotiated one), but standard SLAs _never_ include that.

</comment></comment></comment></comment></comment><comment><USER13> May as well note: SEV relies on AMD-signed vendor firmware blobs. This means that AMD, or anyone who can get their keys, can compromise the security of SEV.

<comment><USER5> Actually, the integrity of the AMD microcode can be verified using Google stackdriver as part of VM audit logs, together with the integrity of the VM kernel.

</comment></comment><comment><USER14> They state in the press release:

> With the beta launch of Confidential VMs, we're the first major cloud > provider to offer this level of security and isolation while giving > customers a simple, easy-to-use option for newly built as well as "lift and > shift" applications.

How is Google's offering different from the Confidential Compute Microsoft already offers?[1]

[1] [https://azure.microsoft.com/en-us/solutions/confidential- com...](https://azure.microsoft.com/en-us/solutions/confidential-compute/)

<comment><USER12> This uses AMD's SVE, which as I understand is more akin to Intel's MPX than SGX (which is what Microsoft is using).

<comment><USER15> The equivalent Intel technology is TME, which is not present in any commercially-available processor yet.

MPX was an instruction extension that was never widely adopted and that Intel has deprecated.

</comment></comment></comment><comment><USER16> If your data is sensitive you should not be sharing resources (cores/memory) with other users, IMO.

<comment><USER17> I am the first person to agree with you, without hesitation.

But it's worth looking at exactly what it means to attempt isolation of programs on shared hardware. SEV is an interesting way of working on it.

It seems pretty clear that your data could never be modified or read, but there's nothing preventing starvation of resources or side-channel attacks to leak encrypted values.

Of course I also always argue against using the cloud for anything sensitive as "the cloud is really, just someone else's computers". Albeit with a fancy provisioning api and some proprietary services adjoining it.

<comment><USER18> > Of course I also always argue against using the cloud for anything sensitive > as "the cloud is really, just someone else's computers".

This is too simplistic: employing that argument obligates you to show how you're mitigating the same threats on your own, especially with regards to ops and security staffing. I have considerably more confidence in any major cloud provider having robust internal monitoring than the typical corporate VMware deployment, and that even extends to bare metal unless you can air-gap it — if you get a bare metal server from AWS, Azure, Google, etc. they've still put more work into the firmware, management interfaces, etc. than most IT groups do and those are very juicy attack surfaces.

<comment><USER17> This conversation will become quickly fruitless because everyone is different levels of risk averse.

For me, I can say plainly: "this piece of equipment has these access controls, both physical and virtual and we have various radio frequency dampening systems" etc;

For you, you can think about outsourcing that responsibility.

There's no "right" answer, some cloud providers may indeed have much stricter access controls than I could ever have (for instance, budgets may require my servers to exist in a physically shared space, albeit in my own racks; those racks being porous to allow airflow). But ultimately you will never have more control than if you have complete ownership and audit capability of all systems.

I'm sure many people have lived in the same regulatory hell that I have; and I wouldn't argue that the regulatory hell is easier in the cloud or otherwise; I would instead argue that if I was the CIO; I would sleep better knowing I had done my job and not attempted to outsource the responsibility and wash my hands of it, which is what you're effectively doing, even if you trust the cloud provider, even if they've shown good faith- it's no longer your eminent domain to oversee.

<comment><USER18> Right: my point is simply that you have to start with a threat model and make reasoned decisions based on that and your budget. "always argue" is the same as "wrong for a significant number of people" even if it's right for your particular circumstances.

<comment><USER17> "Always argue against" does not equal "never give in".

But I can see how you read it that way.

I would definitely challenge you on 'wrong for a significant number of people' because if you're focusing on security then it's likely a core principle; and therefore you need to understand and be able to effectively argue your case.

And that doesn't matter if you agree with my position or not for that last point to be true.

</comment></comment></comment></comment></comment></comment><comment><USER19> > Confidential VMs leverage the Secure Encrypted Virtualization (SEV) feature > of 2nd Gen AMD EPYC™ CPUs

Powered by AMD. I wonder who will leverage this next.

</comment><comment><USER20> So what does SEV actually protect against?

Something like heartbleed would still happily decrypt and transmit confidential data.

Something like speculative side channel attacks would still speculate on the unencrypted memory right?

Rowhammer would still flip bits, but now one bit flipping would turn an entire 128 bit block into garbage when decrypted? It seems like that would at least make rowhammer a lot harder to exploit into a privilege escalation. ECC memory already gave some limited protection here.

<comment><USER15> > Something like speculative side channel attacks would still speculate on the > unencrypted memory right?

This wouldn't prevent a Spectre attack or similar cache-based attack, as the memory would be decrypted at that point. However, it would mitigate attacks like Meltdown or Rowhammer.

<comment><USER20> I don't see how it protects against meltdown, wouldn't the memory still get decrypted by the escalated access?

Edit: If each VM has it's own key, then they couldn't read each other's memory with meltdown. I think that must be the angle.

<comment><USER15> > I don't see how it protects against meltdown, wouldn't the memory still get > decrypted by the escalated access?

No. A particular VM's memory is decrypted by that VM's key.

Assuming that AMD's CPUs were vulnerable to a hypothetical attack similar to Meltdown, either a VM or a guest would be able to dump the machine's memory, but the memory contents belonging to other VMs would be encrypted and unintelligible.

<comment><USER20> I think my edit and your comment passed each other on the wire.

That makes sense, it gives hardware protection from privilege escalation between VMs on the same host. Be it through a hardware exploit or hypervisor vulnerability.

</comment></comment></comment></comment></comment><comment><USER21> This seems a move to make people handling sensitive data (E.g. healthcare and insurance) make sure they have peace of mind and can tick the box "security and privacy" off? Even neutralising the potential issue of being linked with the omniscient google? How will MS and AWS respond will be interesting.

<comment><USER15> Confidential VM is essentially productizing AMD SEV technology. Intel will have something similar on the market in the (hopefully near) future.

Given that AWS and Azure also use AMD and Intel equipment, I'd expect them to introduce similar functionality. (AWS is probably closer as SEV support is built into Linux, whereas Windows has no support for it as far as I can tell.)

</comment></comment><comment><USER22> This is a terrible name. Assume everything else is not confidential!

<comment><USER5> But everything else is not actually confidential... Confidentiality means limited visibility, when you process your data, the memory is in clear without this tech, or Intel SGX that offer confidentiality and integrity.

</comment></comment><comment><USER23> This is using SEV-ES (SEV2) which is vulnerable to the severe attack described last year in [1], and unfixable due to the lack of antirollback functionality.

Only SEV-SNP [2] is supposed to address it, but only on new silicon which doesn't exist yet, and that probably not even Google has.

So why is Google releasing this feature if it is so flawed?

[1] [https://arxiv.org/pdf/1908.11680.pdf](https://arxiv.org/pdf/1908.11680.pdf)

[2] [https://www.amd.com/system/files/TechDocs/SEV-SNP- strengthen...](https://www.amd.com/system/files/TechDocs/SEV-SNP- strengthening-vm-isolation-with-integrity-protection-and-more.pdf)

<comment><USER23> Even worse: according to a source of The Register [1], it is based on simple SEV (SEV1), not even SEV-ES.

If true, it is even more disappointing.

[1] [https://www.theregister.com/2020/07/14/google_amd_secure_vm/](https://www.theregister.com/2020/07/14/google_amd_secure_vm/)

</comment></comment><comment><USER24> Is SEV really a "breakthrough technology"? AMD was far from the first to do this, and you have to trust AMD to have implemented this correctly and not be backdoored or cooperating with the US government to believe it's really secure.

<comment><USER15> > Is SEV really a "breakthrough technology"?

SEV is a breakthrough in the sense that it's essentially transparent to the guest environment. Earlier technologies like Intel SGX or ARM TrustZone have a lot of performance limitations, and application needs to be explicitly developed to support it.

Intel is working on a similar technology -- Total Memory Encryption (TME) -- but they haven't released it to market yet.

<comment><USER25> Intel actually had a similar tech without the RAM encryption some time ago, called TXT.

TXT never really took off. There were a few problems, but, I don't think SEV has actually solved these problems, beyond the lack of the memory encryption.

One is that the hypervisor is ... well it's still a hypervisor. It can play a _lot_ of games on the operating system, and hardware is limited in what it can do to stop that. TXT's solution was to "measure" the hypervisor, so you could audit it. That doesn't work for google/aws/azure who all use proprietary hypervisors, so you need to place a _lot_ of trust in your chip and kernel that they can resist arbitrary malicious behaviour by the most privileged piece of software on the system - one that controls all hardware access. That's very difficult. For instance, the hypervisor controls access to the system clock.

Another is that it was very hard to make the operating system secure. Heartbleed being just one example of what can go wrong. So the trusted computing community concluded around this time that placing an entire operating system into your 'trusted computing base' doesn't really work. It's trying to run before you can walk. If you can't make the operating system reliably secure against remote attackers then trying to make it secure against the far harder adversary of someone who controls your hardware stack seems futile.

That's why Intel's equivalent isn't transparent. It's not _very_ opaque, it's basically like loading a shared library and the library gets encrypted RAM. But when you try to write an enclave that's really secure, you realise that there's a lot the host machine can do to make a mess of things. I don't think that changes much if it's "just" the hypervisor that's malicious instead of the hypervisor and kernel. The solutions end up looking the same - you want to minimise your attack surface, you need to think carefully about clocks and time sequencing, side channel attacks, etc.

<comment><USER15> > Intel actually had a similar tech without the RAM encryption some time ago, > called TXT.

Given that RAM encryption is literally the core function of SEV, any functionality that lacks it is by definition dissimilar.

<comment><USER25> TXT had RAM protection, as in, other software or hardware devices couldn't read the protected memory areas. RAM encryption itself is primarily about stopping bus sniffing or cold boot attacks. Useful, but by no means the only kind of protection you need. Especially because combining encryption with authentication is very hard. It is easy to forget that encryption doesn't stop someone flipping bits and you can corrupt the plaintext in ways useful to an attacker by doing so, hence the rise of AES/GCM. But I don't think SEV uses AEAD?

But the core technology is basically the same concept. You get a protected memory space (to some degree of protection), you can derive keys linked to the loaded code hash, and you can do remote attestation to set up a Diffie-Hellman handshake with the remote protected domain. All that stuff is identical between TXT and SEV.

</comment></comment></comment></comment></comment><comment><USER26> I kind of assumed all my cloud computing resources were already private and confidential.

Not so?

<comment><USER5> You are right, data is private and confidential when it is ingested to the cloud and/or stored in the cloud, not when processed. Encryption of "data-in- use" is the 3rd leg in data protection of sensitive data, and it became possible with hw capabilities in new CPU chipsets, from AMD and Intel, as it has to be hardware based (better security and performance).

<comment><USER25> As storage and ingestion requires processing, that's the same as saying it's not private at any point when in the cloud.

And that's not necessarily a big deal. If you trust Google or AWS to hold all your business and customer data, no problem (and if your customers transitively have that trust). But I think there's a lot of denial about this fact: the cloud has all your data and all your customers data. Fixing that is really, really hard. It's not anywhere near as simple as Google are claiming in this announcement, certainly not "tick a box and it's switched on".

</comment></comment></comment><comment><USER27> _Confidential Computing environments keep data encrypted in memory and elsewhere outside the central processing unit (CPU)._

Aren't Amazon's Graviton 2 processors specified to do this too?

<comment><USER15> My knowledge of Graviton is limited, but based on Amazon's description of Graviton 2's encryption capabilities, it seems more like an equivalent to AMD's Secure Memory Encryption (SME), rather than SEV.

<comment><USER28> It's a lot more than just a SME equivalent. They've designed the management plane in a really clever way that makes it more similar to SGX/SEV than at first glance. I recommend watching this video [https://www.youtube.com/watch?v=kN9XcFp5vUM](https://www.youtube.com/watch?v=kN9XcFp5vUM)

</comment></comment></comment><comment><USER29> Is this homomorphic encryption or something else?

<comment><USER5> Homomorphic encryption enables computation to be performed on encrypted data without the need to decrypt it on the CPU. Compared to Confidential Computing approaches, the processing complexity of FHE is quite high, especially for tasks that require execution of complicated algorithms, making it hard to scale with this approach. Confidential VMs with AMD SEV decrypt data within VMs and keep it encrypted "in-use" by encrypting memory with a key generated by AMD secure processor (non-extractable) per VM. After processing data and code can be encrypted back to keep it protected at-rest.

<comment><USER30> I don't understand, and couldn't get any information from the article either. If the data are decrypted within the VM, then it is still decrypted at that point, and the host machine can read it.

<comment><USER15> The data is transparently encrypted and decrypted specifically within the processor. The OS kernel on the host machine doesn't have access to the unencrypted contents of the guest VM's memory.

> I don't understand, and couldn't get any information from the article > either.

See this wiki article for more info on this class of technology: [https://en.wikipedia.org/wiki/Data_in_use](https://en.wikipedia.org/wiki/Data_in_use)

</comment></comment></comment></comment><comment><USER31> How is SEV compared to SGX?

<comment><USER32> SEV is atm considered 'secure' SGX is not:

[https://arstechnica.com/information- technology/2020/03/hacke...](https://arstechnica.com/information- technology/2020/03/hackers-can-steal-secret-data-stored-in-intels-sgx-secure- enclave/)

<comment><USER33> Not at all. SEV has been broken many times and by more trivial means [1-3]

[1] [https://arxiv.org/pdf/1805.09604.pdf](https://arxiv.org/pdf/1805.09604.pdf)

[2] [https://regmedia.co.uk/2019/07/10/amd.pdf](https://regmedia.co.uk/2019/07/10/amd.pdf)

[3] [https://www.theregister.com/2019/06/26/amd_epyc_key_security...](https://www.theregister.com/2019/06/26/amd_epyc_key_security_flaw/)

<comment><USER34> The two attack vectors are page table integrity and unencrypted VM state.

Modifying the page tables to establish a cryptographic merkle tree would fix the first attack, and SEV-ES fixes the secrecy attack from the second paper. Unfortunately a change to page table structure may make it impossible to run unmodified kernels in the VM.

I think it as impossible to prevent a hypervisor from fingerprinting what's running on a child VM; there are too many timing and power attacks to ever mitigate that, which was the attack vector on SEV-ES

</comment></comment></comment></comment><comment><USER35> I guess a database as a service instance at Google will still be accessible for Google in a decrypted way?

<comment><USER5> Unless you run a database in the Confidential VM, can run mySQL, postgresql, MariaDB. Google managed db service, say GCP CloudSQL is not supported...

</comment></comment><comment><USER36> It is funny that Kubernetes,Istio, Asylo etc are transliteration of greek words and Google has trademarks on them.

</comment><comment><USER33> It's interesting that there's no mention of Intel SGX in this blog post.

<comment><USER15> It doesn't use Intel SGX, nor would SGX work with such a service.

Intel is working on a competing technology -- Total Memory Encryption -- but AMD beat them to market by quite a bit.

</comment></comment><comment><USER37> Is there demand for such a thing? I mean what is the use case where one would want this level of security.

<comment><USER5> Quite a few: protect sensitive data in the cloud from the tenants and cloud providers, protect my clients sensitive data, address some requirements of the regulated markets, mitigate some privacy regulations, and a few new: collaborative computing with untrusted parties?

</comment></comment><comment><USER38> I don't like this technology. If it works as claimed, it could be used for almost unbreakable DRM.

<comment><USER15> It already has been in a sense, as the underlying technology for SEV was developed by AMD to protect the DRM running on game consoles.

That being said, AMD SEV is transparent to the underlying applications and users, so anyone with an interest in protecting memory from certain classes of attacks (e.g., Meltdown, Rowhammer) can benefit.

Other technology in this space (e.g., Intel SGX, Arm TrustZone) requires the application to explicitly support the secure enclave, so their usefulness to a typical end-user is much more limited, and as such, they aren't really used much other than to enable DRM.</comment></comment>


How to Build Content That Converts Into Users  - <AUTHOR> http://b.lesseverything.com/2011/1/26/how-to-build-content-that-converts-into-users

<comment><USER2> When the author wrote:

 _"User" - Stop using this word. They are people. Customers. Writing for a person might make your copy more clear and pointed._

... and then proceeded to use the word "user" repeatedly throughout the article, I found his advice less useful. Almost hypocritical. It's almost like he wasn't taking his own advice.

Meta-comment: I'm not sure I understand the hatred towards the word "user." I think people have come to accept that it literally means people who use your software. Sort of like when we call people "drivers", "runners", "workers", etc.

Thoughts?

</comment><comment><USER3> You can't turn content into users. You can, however, create content that attracts or keeps users.

As for the word 'User', it's more correct than the alternatives. 'Customers' are where you get your revenue from. Free and/or ad-supported? You users aren't your customers. Sure, they're 'people' too, but so is everyone who doesn't use your product.

And despite Ty's triple post about video, I think videos are almost always horrible. Don't do a video if you can't adequately show your product with it... And don't rely on JUST a video. You'll miss everyone who doesn't have 10 minutes of time to waste. (And for the love of money, don't make it longer than 10 minutes!)

<comment><USER4> Videos are great as a supplement but they should be kept to 1 minute. Mine is 1:30 and it's still longer than I'd like.

<comment><USER3> I went with '10' because some things really can't be done in 1, and 10 minutes is the absolute most I would ever consider watching for something to sell me on something. It's pretty hard to get me to watch advertisements in the first place.

</comment></comment></comment><comment><USER5> One key perhaps is not to link to articles that say "Sorry, couldn't find what you were looking for!", but maybe that's just me. :)

<comment><USER6> fixed

</comment></comment><comment><USER7> Writing effective copy is hard, the section "Place keywords" was pretty interesting, although I guess some people would say it's common sense.

</comment><comment><USER8> Great article.What I like most is that for each point there are quality examples."Seeing" it done right was the most helpful part for me.

</comment><comment><USER9> Nice article with great links! Added bonus: have any data/conversion #s you can share from things that you guys have tried? :)

<comment><USER6> My next couple articles will go into A/B testing and conversion numbers. Stay tuned.

<comment><USER9> awesome!

</comment></comment></comment><comment><USER10> Saying "content converts into users" is like saying "meat converts into flies".

</comment><comment><USER11> Awesome article Allan. Excellent insight into many of the problems with app sites today.

</comment><comment><USER12> I always enjoy your posts, due to the fact that they typically provide insightful points of view that often go against conventional wisdom.</comment>


The 10,000 Hour Rule Is Not Real - <AUTHOR> http://www.smithsonianmag.com/smart-news/10000-hour-rule-not-real-180952410/ <comment><USER3> I'd speculate that the 10,000 hour rule is a product of an American obsession with the idea of hard work being the most important factor in success, with the idea that everyone's abilities are reasonably equal, and determination and diligence is what differentiates them. This satisfies a certain sense of fairness and justice in life. I also think it's just not true, more the product of wishful thinking than any evidence.

People have differing levels of talent in different areas, and this _does_ have significant effects on success and ability. There _are_ "super-brilliant slackers," and there are very hard working failures. Talent, too, does not necessarily correspond with interest and enjoyment. None of this is fair, but life is not inherently fair.

The important thing here, more than practice, is figuring out what one is good at doing, and what one enjoys doing, and coming up with things that are in both sets.

<comment><USER4> 10K hours is about 3 years of training.

<comment><USER5> That would be 9 hours per day, every single day of those three years. How many people have even had just one day where they spent nine hours on the same thing? That's not including breaks, and periods where you mind wanders or you're not focused.

<comment><USER4> Most people I know did it in college

<comment><USER6> clearly you had a remarkable college class...

</comment></comment></comment></comment></comment><comment><USER7> The reason that the 10,000 hour does not exist are: (1) different fields require different amount of training and dedication, (2) it is difficult to measure what "mastery" is because it is so hard to quantify, (3) some fields are more competitive than others and therefore requires more practice to get really good, (4) the way that one learns and practice can have a significant effect on one's skill level, (5) at the highest level there is always a factor of talent and luck. Overall, the 10,000 hour rule just means that it takes a really really long time and dedication to be a world class at something. For some it may take only 1,000 hours while others will not reach it no matter how much they try. I think that this meme has gotten out of control and perhaps people have focused more on the long hours than the joy of improving or understanding what improvement means. It is not always better to spend more time on something and in some sense the feeling that we should be working all the time has lead people to become less productive.

<comment><USER8> I think the problem is more (6) deliberate practice is hard to define. Some people believe that just sitting and doing problem sets is deliberate practice. Some people believe that hacking on a side project is deliberate practice of programming skills. I don't think that any of those two examples would qualify as deliberate practice.

<comment><USER9> How would you define deliberate practice, then? I would agree that deliberate practice may be hard to define across all skills, but it could be defined for a specific skill.

For example in programing, I would consider problem sets and side projects with functions and goals that are aligned but still outside of one's normal scope of work to be deliberate practice. Working on Project Euler problem sets could be considered deliberate practice. They are problems that can be done in most any programming language, are known to be great for learning a new one, but generally fall outside the usual work of handling data, transforming content, etc.

I would consider Project Euler to be akin to practicing scales on a musical instrument: playing scales is not necessarily music in a "having popular appeal" sense, but it does enable new skills and depth of knowledge of the instrument.

<comment><USER10> Taking the Project Euler example, consistently doing the exercises, if they go in difficulty for each done, is deliberate practise in (probably) algorithm design, but does nothing for architecture. But redoing the same exercises over and over, always improving the design of it in each iteration (examples: reduce number of lines, apply DDD or hexagonal, etc, though the solutions in Project Euler probably not the best for this kind of practise) improves architecture skills.

The idea of deliberate practise is to always be improving in the tasks you are doing, usually by taking more and more difficult tasks in progression, but also analysing the past actions to identify where to improve. For example, I always liked to play tennis (and have many years of competitive table tennis behind me). Before I started working with a coach, my practises were mostly playing the game, maybe having a few swings against a wall when I didn't have a partner. When I started working with a coach, we practises my service over and over and over again, changing targets in the field, the kind of spin, and analysing most of the services to see what went right and wrong with my service. I can only say my skills improved at more than 10x the speed than when I was just having matches with other people.

</comment></comment></comment></comment><comment><USER11> The 10,000 hour rule is a cultural meme that has spread and found believers not because it is grounded in reality but because it is cognitively seductive. In the first place it should seem highly suspect that something as poorly- defined and multidimensional as "mastering" (how do you measure mastery?) a "field" (as if every field had the same complexity and breadth) could always be done by anyone (independently of the obvious issue of individual variations in intelligence and talent) under a constant, conveniently round figure of 10,000 hours of practice.

As a cultural meme it works in a similar way to the myth that "humans are only using 10% of their brains". I expect it to die a slow death over the next 50 years.

<comment><USER12> I think its popular because 10,000 hours seems nicely out of reach for most people, so it lets you off the hook for not being good at stuff. It's not my fault I can't play the piano: my lifestyle precludes it. If only I didn't have a job/kids/whatever, then people could see how creative I really am. Gladwell allows one to continue doing nothing while still imagining oneself as a thwarted hero. A great deal for just $16.99.

</comment></comment><comment><USER13> Does this really contradict that 10000-hour rule? (Well, apart from the fact that 10000 hours may well be an arbitrary number, and not as magical as Gladwell made it out to be)

From what I remember from reading Outliers, the claim about the 10000 hours was formulated more precisely than is posed here: it only said that _above a certain level of innate talent_ (IIRC the particular level wasn't made a big deal of), differences in talent were less significant than differences in practice hours.

That's a much weaker claim, but a more credible one: if you're already blessed with eg a high IQ, then it pays off to work hard on your homework, and you can overtake the super-brilliant slacker in your class. But if you didn't have a very high IQ to begin with, the rule doesn't promise you anything.

The data in the article just says there's a lot of other stuff that determines the variance in performance - probably that includes "talent". It doesn't try to find if such a "talent threshold" above which talent is less important exists.

<comment><USER14> > Does this really contradict that 10000-hour rule?

No, it contradicts the premise that there could be such a number with the meaning attached to it. It's not about the value the number has, the issue is the number itself -- the idea that the thing under discussion could be assigned a specific value.

But the deeper problem is that it assigns a quantity to something no one understands well enough to quantify. Scientists avoid attaching a number to something until there's an explanation, a theory, that makes the number both compelling and testable (i.e. falsifiable).

<comment><USER15> > _Scientists avoid attaching a number to something until there 's an > explanation, a theory, that makes the number both compelling and testable > (i.e. falsifiable)._ //

Hubble seemingly ignored the outliers and drew a straight line through his data to create his eponymous "constant". Making a mark to work from isn't really unscientific it's just loose hypothesising - [http://www.pnas.org/content/15/3/168.full.pdf+html](http://www.pnas.org/content/15/3/168.full.pdf+html).

Surely the fact that this meta-analysis has falsified the former claim [hypothesis] shows that it was scientific [at least under a Popperian formulation].

<comment><USER14> > Hubble seemingly ignored the outliers and drew a straight line through his > data to create his eponymous "constant".

That's a perfectly reasonable use of statistics in reducing observations. The same method was used extensively in the recent hunt for the Higgs Boson, until the uncertainties in the process fell below 5 sigma, at which point a discovery was announced.

> Making a mark to work from isn't really unscientific it's just loose > hypothesising ...

If it's not either derived from empirical observation or a reasonable extrapolation from established theory, it's ipso facto unscientific.

> Surely the fact that this meta-analysis has falsified the former claim > [hypothesis] shows that it was scientific ...

No, it only shows that one unscientific claim (based on no theory and no evidence) can appear to unseat another. And it's not a "falsification", because the original claim is unfalsifiable on the ground that it's not based on a testable theory.

Group A says, "It takes 10,000 hours ..." without any basis. Group B says, "Utter nonsense." This happens in astrology all the time. Does that mean astrology is science? The difference between astrology and science is that scientists won't make a prediction without an empirical basis and a theory about _why_ it's so.

<comment><USER15> Based on your formulation it seems all new "scientific" [null] hypotheses are "ipso facto unscientific"?

For example c being constant is an axiomatic part of relativity. Ergo to you it seems, as this is not empirical nor an extrapolation but a new hypothesis that when postulated contradicts established science, this suggestion - <USER2> presumably the ensuing formulation - was, um, unscientific?

Now I'm happy to go with that, call it a philosophical treatise and recognise the axiomatic nature of relativity but at this point I think your definition of science is too tight; theoretical physics to me is a part of science. Indeed I'd say wild hypothesising can be (and is called) science depending really on what you do with those hypotheses.

</comment></comment></comment></comment></comment><comment><USER16> There's a really interesting episode of the _You Are Not So Smart_ podcast that delves into this in some depth, particularly relating to sports, where the idea has really taken off, and where there is good evidence the specialisation it encourages actively harms performance: [http://youarenotsosmart.com/2014/08/14/yanss- podcast-030-how...](http://youarenotsosmart.com/2014/08/14/yanss- podcast-030-how-practice-changes-the-brain-with-david-epstein/)

<comment><USER17> Nice talk, I wish to see more advanced idea on the same topic.

</comment></comment><comment><USER18> The article states that only 12% of success is determined by practice, thus the hypothesis of it taking 10,000 hours of practice to master a skill is false.

Somehow that doesn't make any sense. >D

The author should maybe have read up more on the 10,000 hour rule, because the rule means that if someone is extremely talented in a certain skill already, it still takes them 10,000 hours to master that skill, such as Beethoven, Gates etc.

</comment><comment><USER19> A few weeks ago, the You Are Not So Smart podcast talked about this. I really recommend it to anyone interested in this 10K hour thing

[http://youarenotsosmart.com/2014/08/14/yanss- podcast-030-how...](http://youarenotsosmart.com/2014/08/14/yanss- podcast-030-how-practice-changes-the-brain-with-david-epstein/)

</comment><comment><USER20> I observed Escher. I love Basquiat. I watched Keith Haring, you see I study art. The greats weren't great because at birth they could paint, the greats were great cause they paint a lot.

<comment><AUTHOR> Doing a lot is not enough. Being critical towards yourself, striving to do better, _understand_ what is better, looking for and listening to feedback, those are as necessary.

<comment><USER21> In what appears to be the original paper on the 10,000 hour rule (The Role of Deliberate Practice in the Acquisition of Expert Performance: [http://graphics8.nytimes.com/images/blogs/freakonomics/pdf/D...](http://graphics8.nytimes.com/images/blogs/freakonomics/pdf/DeliberatePractice%28PsychologicalReview%29.pdf)), even the Authors state:

"It is important to note that our study shows only that the amount and distribution of practice is related to the level of performance of adult musicians. In fact, many additional factors consistent with the skill- acquisition framework could attenuate the differences among our three groups. Sosniak (1985) found that international-level pianists had spent considerable efforts to seek out the very best musical teachers during their musical development. Furthermore, it is likely that an analysis of the detailed activities during practice alone would reveal qualitative differences between violinists at different advanced levels of performance (Gruson, 1988; Miklaszewski, 1989)."

But more recent research has demonstrated (though I don't know to what degree, nor how many other papers have validated the following findings) that "individual differences in accumulated amount of deliberate practice accounted for about one-third of the reliable variance in performance in chess and music, leaving the majority of the reliable variance unexplained and potentially explainable by other factors". From [http://www.sciencedirect.com/science/article/pii/S0160289614...](http://www.sciencedirect.com/science/article/pii/S0160289614000087), sorry for the paywall.

In the end, I think it's important to spend time searching and finding something you will be happy to do for the majority of your life. If you want to progress at your chosen field, thought out and well planned studying/practise is necessary, and will make you better, whether or not you end up becoming the accepted world best. And if you enjoy it, it won't matter how high you go.

</comment></comment></comment><comment><USER22> Turns out, Malcolm Gladwell is wrong about pretty much everything he writes about.

<comment><USER23> I wonder how many hours he's spent practising, too!

</comment></comment><comment><USER24> This is the only person I know who is testing it empirically: [http://thedanplan.com/](http://thedanplan.com/)

<comment><USER13> Not sure if that's a properly thought through n=1 study :)

</comment></comment><comment><USER25> "So greatness is within virtually any person's grasp, so long as they can put in the time to master their skill of choice."

Gladwell did not say that. It is an over simplification of his argument. He concedes innate talent plays a role.

"For almost a generation, psychologists around the world have been engaged in a spirited debate over a question that most of us would consider to have been settled years ago. The question is this: is there such a thing as innate talent? The obvious answer is yes. Not every hockey player born in January ends up playing at the professional level. Only some do—the innately talented ones."

[http://hardsci.wordpress.com/2014/03/25/what-did-malcolm- gla...](http://hardsci.wordpress.com/2014/03/25/what-did-malcolm-gladwell- actually-say-about-the-10000-hour-rule/)

</comment><comment><USER26> I just returned from a jazz workshop where we talked a lot about practising. The drum teacher said that it's not necessarily the amount of hours you put into it, but also the frequency and how focussed you work on it.

<comment><USER27> I remember reading once that best musicians actually worked less than the average ones. But, the difference was that the best had 2 highly focused 1.5-2hrs practice sessions per day (deliberate practice) and rest for the remaining of the day, while average had several shorter practice sessions throughout the day.

</comment></comment><comment><USER28> I'm skeptical about a specific number of 10,000 hours claimed to be valid across multitude of skills and domains, but I think the spirit of the rule makes a lot of sense.

I think the value of innate talents compared to training and exercise is highly overstated given that almost all skills (hunting and archery possibly being exceptions) are so new in evolutionary time scale that there could not possibly have been any selection for them and so they must lack any specific support in our hardware.

Somehow, nobody doubts the importance of exercise in physical fitness. Not sure why mental fitness should be different.

<comment><USER13>
        ... given that almost all skills (hunting and archery
        possibly being exceptions) are so new in evolutionary
        time scale that there could not possibly have been any
        selection for them ...

Couldn't you turn that evolutionary argument around, and say that exactly _because_ there hasn't been any selection until recently, you'd expect a larger population variance in those innate talents?

</comment></comment><comment><USER29> The latest episode of the awesome You Are Not So Smart podcast is all about exceptions to the 10,000 hour rule;

[http://youarenotsosmart.com/2014/08/14/yanss- podcast-030-how...](http://youarenotsosmart.com/2014/08/14/yanss- podcast-030-how-practice-changes-the-brain-with-david-epstein/)

</comment><comment><USER30> IIRC, the 10,000 hour rule is for becoming "expert" at a skill, not for becoming an Outlier, or for gaining "success". Those "best musicians" with an average of 10,000 hours by age 20 are, by any reasonable definition, experts at their craft.

<comment><USER31> But not those chumps who only have 9999 hours! They're not experts ~yet~!

Even if you redefine it not as 'mastery' but as 'expert(ise)', it's still absurd.

</comment></comment><comment><USER32> The conclusion, imho, remains the same: "put more work in what you love and someday, it will pay". As I see it, the 10000h rule is about patience and dedication.

The "10 times rule" is also interesting: it will take 10x more efforts than you think...

<comment><USER33> > The "10 times rule" is also interesting: it will take 10x more efforts than > you think...

You see this one all over the place:

90-90 law: the first 90% of the project takes 90% of the development time. The last 10% of the project takes the other 90% of the development time.

Hofstadter's law: It always takes longer than you expect, even after accounting for Hofstadter's law.

<comment><USER34> First time I see 90-90 law, looks like someone made it up from Pareto principle which is 80% - 20%. Besides I don't see application in this topic for it.

<comment><USER32> If I'm correct, there's more humour in the 90-90 law than in the Pareto principle!

The 90-90 law predicts a 180% work load...

</comment></comment></comment></comment><comment><USER35> Sure it might not be real. I believe, though, if you spend 10,000 hrs on something, you'll have a higher chance of being better than someone who has only spent 1000 hrs on that thing. Is this not a correct assumption or belief?

<comment><USER36> I think such things depend on what exactly you are practicing. Chances are if you deliberately practice a language that long, you'll likely be overly fluent. That said, if your body is such that you cannot physically pronounce that 'r' correctly, you'll never speak without some sort of lisp or accent. Art and music are just as much luck as they are talent: Talent can very easily overtake practice. People that practice art learn techniques, but after some time, tend to become very good at emulating. Some people just _get_ art, though, and intuitively know where to place things, where to shadow, what marks to leave out. When the talented practice, they create and manipulate and take whatever they've learned and they become more awesome. Alternatively, formal and deliberate practice in art actually kills some natural talent with overt rules. I've seen all things. Who actually makes it and is regarded as an expert by society? Whoever gets lucky. Music is similar: Some practice and become experts in a symphony, some practice and create symphonies, and others yet, regardless of practice, still struggle to keep on beat.

In any case, though, I do think any person spending so many deliberate (or even not so deliberate) hours on one subject winds up with a pretty amazing knowledge base and probably knowledge of quite a few branches of knowledge. Even if the original goal wasn't actually mastered, still worth it for knowledge.

</comment></comment><comment><USER37> I propose a new study: The half-life of the 10000 hour rule, i.e., how many years before belief in the 10000 rule among the general population (or among certain specialized populations) is reduced to half of its present level.

</comment><comment><USER38> For anyone interested in the innate talent vs practice in sports I recommend the book 'The Sports Gene' (spoiler: genes play a huge role).

</comment><comment><USER39> So it's necessary but not sufficent? Or neither necessary nor sufficent?

</comment><comment><USER40> This is silly attack.

The 10,000 Hour Rule says you need 10,000 Hour practice to master a field. It does not say 10,000 Hour practice is the only/most important factor in performance. It has nothing to do with explanation of variances in performance. It does not say 10,000 Hour practice will guarantee your success. It does not say gene is irrelevant to learning. It only says, as a normal person (not genius, not mentally disabled), you need 10,000 Hour practice to master a field.

Straw-man attack.

</comment><comment><USER14> This is just another example of psychologists trying to sound like scientists. Scientists quantify their claims, put forth physical rules and associated mathematics, after which measurements confirm or refute the quantified predictions.

Psychologists express opinions, most of which don't lead to empirical or quantifiable predictions, but occasionally a psychologist, jealous of real scientists, will try to quantify an opinion, as in this case where 10,000 hours was attached to someone's viewpoint. Then, later, inevitably, other psychologists will argue against the earlier opinion, as thought the refutation was anything more than another opinion.

What psychologists don't do is try to offer explanations, craft testable theories, about their observations, then subject the theories to empirical test. That would actually be science.

> The 10,000 Hour Rule Is Not Real

On the contrary! It is exactly as real as psychology is.

<comment><USER41> Exactly. It's cargo-cult science. Attaching numbers and equations and quantifying things to look more credible. Math is supposed to be used to help focus and constrain thinking, not to make opinions sound More Serious.

Sadly, I know a lot of people (mostly wanna-be-rich entrepreneurs, whose only skill seems to be the want to become rich) who buy into such psychology BS without second thought. Things like "cone of learning" or 7-38-55 rule, which sounds absurd if you think about it for more than a second.

(then there's another part of the equation, i.e. "journalists" and business consultants stumbling over a paper with some numbers and specific claims, who then throw out constrains, exaggerate the conclusions and make a run for it)

<comment><USER14> > It's cargo-cult science.

Yep. Some younger readers may not know what this refers to, so here's a quote from the original Feynman paper "Cargo Cult Science":

"I think the educational and psychological studies I mentioned are examples of what I would like to call cargo cult science. In the South Seas there is a cargo cult of people. During the war they saw airplanes land with lots of good materials, and they want the same thing to happen now. So they've arranged to imitate things like runways, to put fires along the sides of the runways, to make a wooden hut for a man to sit in, with two wooden pieces on his head like headphones and bars of bamboo sticking out like antennas — he's the controller — and they wait for the airplanes to land. They're doing everything right. The form is perfect. It looks exactly the way it looked before. But it doesn't work. No airplanes land. So I call these things cargo cult science, because they follow all the apparent precepts and forms of scientific investigation, but they're missing something essential, because the planes don't land."

Full text:

[http://www.lhup.edu/~DSIMANEK/cargocul.htm](http://www.lhup.edu/~DSIMANEK/cargocul.htm)

<comment><USER42> If you loathe psychology so much, why do you hang around on a site where (until fairly recently) about a third of articles were about psychology in some form? A/B testing, effective advertising, staff morale, avoiding burnout... all these sorts of things are psychology, and plenty of them have metrics.

<comment><USER41> I guess he (like myself) cares more about the other two thirds of articles. Also good you mention that, because there's a lot of cargo-culting and serious-sounding nonsense in the A/B testing/advertisement/metrics articles.

The point is, one has to be precise in what one's claiming. There's a lot of good psychology out there; you can recognize it by being littered with caveats, "maybes", and definitely _not_ full of numbers. My personal opinion on the field (based on articles I read, books citing many a psychological paper, and on talking and observing psychologists and psychology students I know) is that there's _a lot_ of hard work being done to run in circles, thanks mostly to not grokking statistics and not caring about rigour.

And pop-psychology industry, business consultants repeating everything they read without giving it a second thought, and journalists overexaggerating claims are not helping.

<comment><USER42> There is a definite irony in demanding that one has to be precise in what one's claiming... right after dismissing an entire, very broad field as cargo- culting. _" Exactly. It's cargo-cult science"_ in reference to a comment that classifies psychology as just the poorly-done parts of psychiatry? Terrible precision.

<comment><USER14> > ... in reference to a comment that classifies psychology as just the poorly- > done parts of psychiatry?

In sciences, because of the unifying nature of theory, there are no poorly done parts. Both cosmology and particle physics would be independently weak were it not for the other, and what unites them is ... scientific theory.

Psychiatrists don't listen to psychologists, who don't listen to clinical psychologists, who don't listed to social psychologists. They're independent entities. If psychology were a science, that would all change, as physics is changed, as biology is changed -- all by tested, falsifiable, scientific theories.</comment></comment></comment></comment></comment></comment></comment>


Instacart's gig workers are planning a nationwide strike - <AUTHOR> https://www.vice.com/en_us/article/4agmvd/instacarts-gig-workers-are-planning-a-massive-nationwide-strike <comment><USER2> I would rather pay a higher delivery fee and (1) have enough workers to deliver my goods (2) Have them (and me) protected adequately.

The whole way delivery works is broken right now.

<comment><USER3> > _I would rather pay a higher delivery fee_

In New York, we have Caviar [1][2], a mid-tier to premium food-delivery company. They differentiated based on premium food. I haven't heard any complaints from their delivery staff, though this may be on account of their size.

Is there a premium player in the grocery delivery business? Something like FreshDirect, but with better service?

[1] [https://www.trycaviar.com](https://www.trycaviar.com)

[2] [https://en.wikipedia.org/wiki/Square,_Inc.#Caviar_restaurant...](https://en.wikipedia.org/wiki/Square,_Inc.#Caviar_restaurant_delivery_service)

<comment><USER4> > I haven't heard any complaints from their delivery staff, though this may be > on account of their size.

This is probably the key part. Does Caviar pay their drivers more than other sites? The cynic in me suggests that no, they don't. Maybe, maybe, they get better tips as a result of delivering premium food.

<comment><USER5> In my experience as a food courier, tipping amount do not correlate with the category of food delivered. You could get tipped more for a hamburger than a sushi.

In fact the only correlation I've noticed is when the recipient seems like a decent person, combined with you having to go trough an extraordinary amount of trouble, like getting on a hill at the edge of the city, or having to navigate trough a confusing maze in a giant office complex.

But then again sometimes you deliver in the night trough a thunderstorm an orbital amount of stuff for a party, and get nothing.

</comment></comment></comment></comment><comment><USER6> Unfortunately for these workers, with the unprecedented spike in unemployment [1] I suspect Instacart will be able to find a lot of desperate people willing to cross the picket line.

[1] [https://fred.stlouisfed.org/series/ICSA](https://fred.stlouisfed.org/series/ICSA)

<comment><USER7> The Instacart workers should encourage any scabs to instead join the strike so they can work together to demand better wages and conditions.

<comment><USER8> How do they find these new workers? Wait for them out at the grocery stores?

<comment><USER9> Picketing?

[https://en.wikipedia.org/wiki/Picketing](https://en.wikipedia.org/wiki/Picketing)

<comment><USER10> The workers that would be picketing don't work for the supermarkets. The people that own the supermarkets will tell the picketers to get lost.

</comment></comment></comment></comment></comment><comment><USER11> These workers would be dependent contractors in Germany or Canada, I think. Defining that in-between category in the US would allow for some useful compromises. Especially because full employee comes with so much baggage here, e.g. health insurance.

[https://www.wolfbaldwin.com/articles/small-business- articles...](https://www.wolfbaldwin.com/articles/small-business-articles/the- case-for-the-dependent-contractor/)

<comment><USER12> Instacart operates in Canada and from what I hear it's pretty much the same as in the US.

</comment></comment><comment><USER13> From the Instacart post linked in the article:

>"As we previously shared, we're offering up to 14 days of pay for any hourly employee or full-service shopper who is diagnosed with COVID-19 or placed in individual mandatory isolation or quarantine, as directed by a local, state, or public health authority."[1]

So there is no benefits for workers who develop symptoms and self isolate? This statement reads like you have to go a hospital and be fortunate enough to be able to get a test. In many hotspots there is a shortage of tests. There also seems to be any mention of providing hand sanitizer, gloves, masks etc to these workers.

If you read the "previously shared" link in the above it states:

>"All Instacart part-time employees now have access to sick pay, an accrued benefit that can be used as paid time off if you are absent from work due to illness or injury. We've previously offered sick pay in select states — now, all part-time employees across North America, including in-store shoppers, will be able to accrue sick time to use as needed in the event that they become ill. All sick pay accrual will be backdated from the start of the year, so all hours worked by our in-store shoppers since then will count towards their current, individual sick pay balance."

An "accrued" benefit that will be backdated to the beginning of the year(we're only in month 3 of the year.)I'm guessing this would yield maybe 2 or 3 days max. That barely puts a dent into two weeks of self-isolation and no work.

This all rings quite hollow.

[1] [https://medium.com/shopper-news/shopper-health-safety- update...](https://medium.com/shopper-news/shopper-health-safety-update- ec518ad3841c)

<comment><USER14> It's a joke. I know people who have been to the ER with severe symptoms who were turned away without testing (mostly because they're young and "expected" to recover).

Every company that's using testing as a precondition for benefits, when testing has been widely reported to be unavailable, is despicable.

<comment><USER15> I went to Stanford last weekend with a slight fever and sore throat and was tested and had results in about 16 hours. You could go right now and get tested there if you have symptoms. It's an anecdote, sure, but the idea that people can't get tested isn't completely true.

<comment><USER16> I'm in Boston, and AFAIK there's nowhere I can get a test without having severe symptoms that require hospitalization.

<comment><USER17> Work for a hospital system in Boston and can confirm - testing guidelines here remain quite strict.

<comment><USER16> I donated blood at MGH yesterday, which is how I checked. I'm just hoping to I don't fall down ill in two weeks' time from having set foot, even masked and hand-sanitized, in a hospital.

</comment></comment></comment></comment></comment></comment><comment><USER18> Other delivery services don't have the problems of Instacart. My CSA delivers me a custom food order once a week. They leave a box at my door, stand across the street, call me, and wait until I come out and grab it. And their workers are getting paid fairly. And they don't screw over local businesses. And they get me what I actually ordered. I just have to wait a whooole week for this amazing convenience, and pay less than Instacart charges for delivery.

Gig working will continue to exploit businesses, workers, and consumers until we solve the problem that made it a viable business model: income inequality.

If people didn't need multiple part time jobs to survive, they wouldn't be working these terrible conditions. And when that stops, businesses (like restaurants) will also stop being abused by predatory gig-fueled companies (like grubhub). And if people didn't need to make extra cash with Uber, there'd be enough tax money to fund better public transit, which further levels the economic playing field.

</comment><comment><USER19> It's great that gig workers were included in the CARE bill. Hopefully this starts a trend of more bills including protections for gig workers. I fully support these workers striking for basic rights.

<comment><USER20> > It's great that gig workers were included in the CARE bill.

This was specifically advocated for by Senator Sanders. He threatened to tighten the restrictions even further on the $500 billion bailout of corporations if this condition was not met.

[https://twitter.com/RespectableLaw/status/124303461436252569...](https://twitter.com/RespectableLaw/status/1243034614362525696)

<comment><USER21> Is there a source for this that isn't random twitter accounts?

Looking at the Senate record[0] I can't see anything about the Senator and there doesn't seem to be any news coverage of his involvement in the bill other than the fact that he missed procedural votes for the initial draft.

[0] [https://www.congress.gov/bill/116th-congress/senate- bill/354...](https://www.congress.gov/bill/116th-congress/senate-bill/3548)

<comment><USER22> I'm sure a lot of negotiations are not done on the record—that's how it works—but here's a clip of Sanders advocating: [https://www.c-span.org/video/?c4863928/user-clip-corona- viru...](https://www.c-span.org/video/?c4863928/user-clip-corona-virus-bill)

<comment><USER21> The negotiations were certainly not on the record, but we know who was at the table from reporting and where many provisions came from.

* Senators Hoeven and Stabenow secured the $9.5 billion and other aid for the agricultural industry.

* Senators Thune and Warner pushed for the new tax benefit for employers helping employees pay off student loans.

* Senator Shelby got a cap on funds being used for dredging work on harbors removed.

* Senator Leahy ensured every state got a minimum of $1.5 billion in funds so small states weren't left out.

* Senator Booker got the Bureau of Prisons to making videoconferencing free for inmates.

Obviously Secretary Mnuchin and Senator Schumer did most of the heavy lifting.

I can't find anything about Senator Sanders, and that clip is from after the unemployment provisions were already in the bill. The Senator didn't mention anywhere in that speech that he pushed for the inclusion of the unemployment provisions. He actually said "this isn't the bill I would have written," which I personally would have followed up on with an explanation of what I did to make the bill better if I had worked on it.

</comment></comment></comment></comment></comment><comment><USER23> Everlane workers tried to form a union and they were all fired [https://twitter.com/EverlaneU/status/1243615472307695618](https://twitter.com/EverlaneU/status/1243615472307695618)

When there are a ton of people looking for work it is not really a good time to be striking

<comment><USER24> Speaking as a former employee with many friends on the front lines of this event, the lay-offs have very little to do with the team that (previously) wanted to unionize, and much more to do with COVID financial impact and the retail team, of which many many more are now out of a job (vs the team where some percentage of the members previously wanted to unionize).

Whoever the person running that account is, they are not interested in you knowing all of the facts. I assure you.

<comment><USER23> Interesting, did not know that. There is a reddit thread in malefashionadvice you may want to comment on as well as there is no contradicting perspective there.

<comment><USER24> The amount of vitriol directed at Everlane for this Union thing is astounding.

There never was a union. Some people on the team wanted to form one, but most did not. It caused huge cultural issues and tension across the team, and the pro-union employees were very loud and went to VICE pretty much any time they had any minor complaint about the company (which VICE would of course eat right up).

Now Everlane is being framed as union-busting... when it was their own employees that couldn't form or didn't want a union. Everlane has always been fine with it, if that's what the team wanted.

</comment></comment></comment></comment><comment><USER14> Sending these people into work, in the middle of a pandemic, without appropriate protective gear, health benefits, or paid time off is criminal and I'm glad they're organizing to protect themselves. Hopefully other frontline employees in grocery and delivery services will follow suit.

<comment><USER25> Many grocery stores already have strong unions.

Nobody is "sending in" gig workers. Isnt the whole point of gig work that the worker can choose whether to pick up a gig and go in or not?

<comment><USER26> Do you have any proof of "grocery stores already have strong unions"? Genuinely wondering how you've concluded this.

<comment><USER20> [http://www.ufcw.org/grocery/](http://www.ufcw.org/grocery/)

It's a strong grocers union, but does not cover Instacart and other gig workers.

<comment><USER26> Thanks for the example, looked into them a bit. Sounds like they're negotiating for some benefits amid the current pandemic: [http://www.ufcw.org/coronavirus/workers/](http://www.ufcw.org/coronavirus/workers/)

Wishing them the best of luck.

That's unfortunate that they don't cover gig workers. A good chunk of our employment is now in "gig work".

</comment></comment></comment></comment></comment><comment><USER27> The organization behind this, Gig Workers Collective, was only formed last month.

[https://techcrunch.com/2020/02/10/gig-workers- collective/](https://techcrunch.com/2020/02/10/gig-workers-collective/)

I have a hard time believing in such a short time they were able to organize anything resembling a majority.

<comment><USER28> From the article: "Vanessa and I have been organizing for four years," Clarke said.

</comment></comment><comment><USER29> America has created quite a lot of terrible, low paying and unsustainable jobs that also externalize a lot of risk to staffers.

It's great for consumers via low prices, and investors via returns.

But it's a problem on the whole.

Sadly, I feel if these people were paid a decent wage, the price would be high enough the market would be tiny.

I'm not sure if the long-run economics add up very well here.

</comment><comment><USER30> Imagine the capitalistic (!) opportunities that would exist if we had universal healthcare and basic safety-nets. "Gig economy" jobs could actually function as a reasonable and real system for working, instead of being something dystopian and abusive. As a society we've hung so many things off of this framework of "being an employee" (healthcare, retirement, the ability to _not_ work for a small part of the year), that there's no room for any other paradigm without having people forego fundamental needs. Unfortunately times are dire enough that people do so anyway, but that's a separate question.

</comment><comment><USER31> Should I be happy that I've never used one of these VC-driven delivery services?

I'm certainly not tempted to do so now.

</comment><comment><USER32> A prisoner's dilemma, and let me tell you, everyone is going to defect. My money is on the strike never happens.

</comment><comment><USER33> instacart.com and sameday.costco.com are "down" ("We're taking a lot of orders right now") - please check back soon. Good luck with your workers!

</comment><comment><USER34> Will they raise their pay as well?

I know I'll get downvoted for exposing my point of view, but I'm one of the many people who do not tip the delivery man, so I really hope that they obtain better wages from their employers.

<comment><USER35> Society might be better if tipping were not baked into the system, but there it is: wage scales, labor and tax codes have completed normalization of tipping, at least in the US.

Your principled act of rebellion will produce not reform of commercial culture, but only distress for those who serve you -- and for yourself.

<comment><USER34> that's your point of view, and obviously not mine. If everybody stopped tipping people would refuse to continue working in these conditions.

</comment></comment></comment><comment><USER36> I think it's awful what is happening to Instacart and many other workers.

I hope that eventually there will be successful push back. That may be part of what Bernie Sanders' movement is about.

But I think that within a decade or so the reality is that we will have more advanced robots (combined with warehouses designed for automation) that can do most of these jobs, including driving and delivery. Not saying it isn't incredibly challenging or that we are anywhere close, but there is progress and also massive, massive financial incentive.

At some point UBI will be the obvious option to everyone. It seems obvious to me that income should not start at absolute zero even now.

</comment><comment><USER33> Instacart's Web UI does not work. The search feature is completely broken and always shows a picture of the sad milk bottle, as is the update cart feature (before the shopper starts shopping) where you can search for an item and add it to your cart. I tried the same update cart feature in the app and while it is able to find items, tapping add to cart just shows the button depress animation and the item never gets added to the cart.

Not only that, they're using enterprise signed ios apps for their shoppers and deliverers which requires them to do the settings -> trust app thing to run the app. Seems similar to what made Apple revoke Google and FBs enterprise cert for a while, very sketchy. You're only supposed to use enterprise signed apps for actual employees. It seems these "gig workers" aren't considered actual employees by the company but when it comes to abusing the cert it's ok? Apple should revoke their cert until they get an actual deliverer/shopper app.

Edit: Seems I've angered some Instacart folks, care to respond about the issues on the web ui, app, and usage of the enterprise cert for signing your deliverer/shopper app?

<comment><USER37> I imagine you're being downvoted because your comment is incredibly irrelevant to the matter being discussed.

<comment><USER33> it's slightly relevant</comment></comment></comment>


Objective-Basic - <AUTHOR> http://www.objective-basic.com/ <comment><USER2> Sigh. Will Basic never die?

The problem with Objective-<anything> is that the language Objective-C(++) is so integrated with the Cocoa/Cocoa Touch class libraries that it's hard to use other languages and have the same effectiveness.

MacRuby, for example, had to extend their syntax to use the Smalltalk-like "inter-fix" method invocations normally provided by Objective-C.

PyObjC is really clunky in that it basically gives up the syntax interleaving and leaves you with obj.methodWithArg_andAnotherArg_(arg1, arg2), e.g., which is pretty ugly.

MacRuby seems like the only one of these projects to ever get (or maybe to get future) escape velocity, given how the Ruby implementation is completely based on/merged into the the Cocoa runtimes. Exceedingly clever, if you like Ruby. ;-)

</comment><comment><USER3> This is a kind of, uh, basic point, but who writes a web site to promote a new programming language and doesn't include any example code on the site? (Never mind a language tutorial or reference manual.)

I get that there's a forum, but the code examples there are posted without any way to tell which are correct or good examples, never mind explanations of the basics...</comment>


Ask HN: Reminders for long-running shell jobs? - <AUTHOR> You start a command in a shell and it takes more than a few minutes to finish, so you go work on something else and come back to it later. Any good advice for sending yourself a notice when it finishes?<p>In my case these jobs are usually run via SSH, so programs that rely on a GUI aren't useful. <comment><USER2> just add something like `&& echo "Subject: task completed" | sendmail -email@example.com`

if you are running it via ssh you can do 'ssh firstname.lastname@example.com bash -s' < local_script.sh` and then do whatever you want to do afterwards

running things locally like make or tests i like to put `&& say done` at the end so i don't lose track of it.

</comment><comment><USER3> I personally curl a slack webhook that sends me a message.

If the task is already running, ctrl + z and run bg. Then i run `wait <pid> && slack 'job done' `

</comment><comment><USER4> I use this little CLI utility that I wrote to send messages on Telegram via a Bot. [https://github.com/simonacca/TellTg](https://github.com/simonacca/TellTg)

All you have to do is `$ my_long_running_job; telltg "Done"` and you get a notification on all your devices. Very handy also for remote jobs.

The best use case so far has been piping the udev log into it when my laptop is locked in a public place and I'm away. I get a notification on my phone when someone open/closes the lid, unplugs the charger, sticks a USB drive in and so on.

<comment><USER3> Cool! May I ask how do you hook it up with opening / closing lid, sticking usb drive etc?

<comment><USER4> I simply do `udevadm monitor | telltg & i3lock`.

It's ugly to look at, but the idea is that you should never receive any logs, if you do, don't look at them but rather get your laptop in sight quickly because something is happening to it (I use it in the public library or such settings).

</comment></comment></comment><comment><USER5> If you happen to be on OS X, you can fire a notification into Notification Center from the terminal.

        osascript -e 'display notification "that thing is done" with title "my awesome title"'

iTerm2 has a similar feature called Triggers [1].

[1]: [https://www.iterm2.com/documentation- triggers.html](https://www.iterm2.com/documentation-triggers.html)

</comment><comment><USER6> If it's important, I've used [https://cronitor.io/](https://cronitor.io/) in the past to make sure that it finished successfully (single monitor is free).

If it's unimportant, I'd probably just use a Slack webhook like pigpigs mentioned or a growl notification.

</comment><comment><USER7> I would probably wrap the shell command in a file and at the end of the file either fire off an email to yourself, or send a text message, or call a notification API - whichever works best for you.

</comment><comment><USER8> I put the job in a separate tmux window. When something/a character changes in the window, its color changes and I know I can look what happened.

</comment><comment><USER9> I use zsh, it has a variable called REPORTTIME that will print a report after long running commands. I have a custom report that includes the bell special character.

This way any long running process will bell when it is done and also show the runtime and cpu time of the process.

</comment><comment><USER10> I use "; mail" too but if I forgot and need a notification after I've already launched the job "strace -f -p PID; mail" will email you once the job completes. You have to know the PID of the job.

</comment><comment><USER11> Sometimes I add a "; mail" at the end of long-running commands.

</comment><comment><USER12> The most unixy way is simply using the terminal 'bell':

sleep 10 ; echo -e \\\a

Don't forget to set your terminal to notify you on bell. For example putty can flash the task bar icon.

</comment><comment><USER13> Have a look at liquid prompt [https://github.com/nojhan/liquidprompt](https://github.com/nojhan/liquidprompt)

</comment><comment><USER14> This is an interesting problem :) For my local commands I have a small script called `b` which runs a command and shows a notification when it is done using notify-send.</comment>


Show HN: HN GeoIP Search: Find who and what on HN is near you - <AUTHOR> http://geoipsearch.jfriedly.dotcloud.com/

<comment><USER2> This is wonderful.I just found 4 or 5 other HN'ers here in Tucson I would like to touch base with.

</comment><comment><USER3> Still getting 404. Some browsers can share their GeoIP.

navigator.geolocation.getCurrentPosition(showMap);

<http://dev.w3.org/geo/api/spec-source.html>

<comment><AUTHOR> I didn't know about that but I think that would be a bit over my head. This is my first web app and it uses strictly IP's to get location. If you can tell me where you're located though, I might be able to help you with the 404 you're getting. A lot of the bugs are very specific cases that will only show up for one or two cities in the country.

</comment></comment><comment><USER4> Are there plans to allow users to choose their location? The site thinks I am in Easton, Pennsylvania, which is 150 miles away from my actual location.

<comment><AUTHOR> There's now a wrong location link at the top of the page. Thanks for the feedback!

</comment></comment><comment><USER5> Pensacola, FL is close to Mobile, AL. So, my page is full of comments regarding cellular phones (e.g. T-Mobile) that have nothing to do with location.

<comment><AUTHOR> I added an exception to fix this. You should see results from Pensacola now too :)

</comment></comment><comment><USER6> I was hoping to find more people in Canberra, Australia. The only thing that really came up was a meetup almost two years ago.

</comment><comment><USER7> Accessed from my mobile, didn't register for obvious reasons - I hoped it might use location services!

</comment><comment><USER8> For the UK do we put United Kingdom or England? E.g. "Slough, United Kingdom", or "Slough, England" ?

<comment><AUTHOR> You should be able to use any of "Slough, UK", "Slough, United Kingdom,", or "Slough, England" and the system will identify your country as everything after the comma. It should then search for your query exactly and for what it identified as your city, performing API calls on both users and items, for a minimum of four queries. Sorry about it not getting your correct location in the first place, the best GeoIP database available has only about 61% coverage in the UK.

</comment></comment><comment><USER9> Is there a way to sort results by date? All submissions for Sunnyvale, CA are >1000 days old

<comment><AUTHOR> Not yet, although I may be able to add that today. In the mean time, I added code to make it also search nearby suburbs and the greater San Francisco area. It should work for any of several other suburbs in SF too.

</comment></comment><comment><USER10> Nice - it's really fast - what are you using on the back end?

<comment><AUTHOR> It's Django with a postgresql database hosted by dotcloud (EC2 instance)

</comment></comment><comment><USER11> 404.

Edit: Nvm, back up.

</comment><comment><USER12> really cool.</comment>


Thought for Food: Imagined Consumption Reduces Actual Consumption (2010) - valiant-comma https://science.sciencemag.org/content/330/6010/1530.full <comment> valiant-comma PDF of the full Science Magazine article:

[http://www.indiana.edu/~abcwest/pmwiki/CAFE/thought%20for%20...](http://www.indiana.edu/~abcwest/pmwiki/CAFE/thought%20for%20food.pdf)</comment>


Eric Berlow: How complexity leads to simplicity - <AUTHOR> http://www.ted.com/talks/eric_berlow_how_complexity_leads_to_simplicity.html

<comment><AUTHOR> I found this concise talk (around 3 minutes) to be really insightful. In case you can't watch the movie, the main points of the talk were that visuals and the ability to properly filter information can help simplify complex problems.</comment>


Hypothesis for Computer Science Researchers - <AUTHOR> http://hypothesis.works/articles/hypothesis-for-researchers/ <comment><USER2> This reminds me of Test::LectroTest for Perl. A handy module that saves you from the monotony and unproductive slog of test-driven design.</comment>


Ask HN: Why are all major open source software tools in Java - <AUTHOR> Why are all the software projects like Apache Spark, Hadoop etc in Java ? <comment><USER2> Could you be more specific? None of Postgres, MySQL, CPython, Apache httpd, vim, or nginx are in Java.

<comment><AUTHOR> I meant the Big Data tools.

<comment><USER3> Because the JVM is available on big iron for vertical scaling and has robust well developed tooling for horizontal scaling. There isn't really an alternative at the big data end of the power law distribution as what constitutes big data continues to move to the right.

</comment></comment></comment><comment><USER4> Personal opinion: Because Java was all the rage when these people (the programmers) went to college, and so that is what was drilled into them.

Many universities, too, are working on out-dated development practices, because the supervising professors either have never worked in Industry, and so are stagnated in terms of tool selection (I'm working on a project right now that still uses SVN), so the students think that that is the correct approach.

People are slow to change.

Last possibility: perhaps Java is a good choice given the nature (cross- compatibility) and relatively fast speed of the modern JVM.

</comment><comment><USER5> From what I have seen, many people use the Eclipse IDE and with that Java is the "natural" choice.

Agree with @coreyp_1, far too many courses at university focus on Java. Years ago Java was seen as being more "portable" than C or C++ and better able to support OOP - so Java was chosen and taught widely. With all the books and supporting material it is easier to stick with it. Also industry seems to still favour Java. For example, IBM uses Java and Eclipse widely.

</comment><comment><USER6> Spark is written in Scala</comment>