Bitcoin ≈ MySpace - <AUTHOR> http://5nf5.blogspot.com/2013/06/bitcoins-are-dead-long-live-cryptocurrency.html

<comment><USER2> "...the security could be updated but I do not see how this can be done in practice without a central authority"

The same way the fork was fixed and how any upgrade happens with Bitcoin. An idea is proposed, a small group of developers work on it, the mining pool operators decide to implement it or not, then all the individual miners vote on it by deciding which mining pool to mine for. Basically any change has to have 51% agreement from the miners.

"Ironically, for what is suppose to be a highly decentralized currency, the collapse was avoided because the system was "controlled by the will of a very small number of people – particularly, the operators of mining pools" who effectively agreed which block chain to support."

The avoided collapse only appears to be a centralization of power because it was a good decision. I'm defining good decision here as one that increases the value of a bitcoin. The majority of miners were using the new software, the majority of businesses were using the old software. If nothing was done, bitcoin mining for everyone with the new version would have kept plugging along fine, but all the businesses that had to re-install or rewrite their old Bitcoin software would have had to shut down for many hours or days.

The majority of mining pool operators decided that it was better for the longterm growth of Bitcoin to give up the bitcoins that they mined on the new chain and minimize the downtime of Bitcoin businesses rather than keep the small amount of bitcoins and have Bitcoin suffer bad publicity in the coming week. This is a very important point. Every individual miner had a choice of what pool to use. When they found out about the change, they could have just as easily flipped a switch and started mining for a pool that decided to keep the bitcoins. That didn't happen. The Bitcoin miners/holders aren't reacting only to what gives them the most bitcoins today. They are thinking long term and are doing what they think will give their mined bitcoins the most value in the future.

Bitcoin is sort of like the federal government and the altcoin experiments are like state governments. If there's a really good idea that an altcoin comes up with, Bitcoin can integrate it by a 51% vote. If an altcoin experiment uses SHA-512 successfully and is gaining value over Bitcoin because of it, bitcoin can integrate that feature by a 51% vote. If an altcoin has a desirable feature, then bitcoin might be able to integrate it and enjoy the benefits of the feature + the network effect to stay relevant.

</comment><comment><USER3> To be fair, OP admits limited knowledge and possibility of being wrong. Also, he/she makes some relevant points, though the overall "Bitcoin is dead" argument is muddled. Most of the points of this post have been raised countless times on the btc forums in the past.

The primary issue with this post is that the author doesn't give any reason _WHY_ bitcoin will be supplanted by alternatives- In a similar way, I can say "Google stock is worthless because in a hundred years something better will have taken Google's place". No one would consider that to be a cogent argument.

Yes, currently the price of bitcoin shows that there is great pessimism among investors regarding its viability (i.e. a single bitcoin isn't worth $1000 or more right now, which would be the minimum rational value for a successful currency of this type).

This is because it is not lost on the bitcoin community that btc is a crazy idea and can still spectacularly fail for a multitude of reasons. I think any rational bitcoin user would agree that the chance of bitcoin's large-scale success within the next decade is less than 50%- This is why the reward for any investment in bitcoin right now is likely to pay of 10x-100x in the case it DOES succeed. However, if it doesn't succeed I believe it could only be because the concept of a wide-scale cryptocurrency is fundamentally flawed (I have yet to see any such flaw) not because it gets beaten by the competition.

As for the chances of another, similar, cryptocurrency supplanting bitcoin: I am almost 100% sure this won't happen. The reason for this is that bitcoin is the "javascript" of cryptocurrencies: Any deficiency that exists in bitcoin can be added as an extension to bitcoin and hence can't be a meaningful selling point for a competitor. At best, competing cryptocurrencies can fill niche roles within the bitcoin ecosystem. (For instance, a cryptocurrency with faster confirmations will probably eventually be grafted onto bitcoin payment services, but again only to fill a niche role, with bitcoin continuing as the leading currency.)

(The sole exception I think would be if the core bitcoin dev team were to screw up very very badly somehow, then another cryptocurrency might have a fighting chance.)

</comment><comment><USER4> The author is wrong in many points:

1\. Bitcoin is the open base for monetary innovation, you should compare it to internet protocols like IP or HTTP, Linux, not some privately-owned social networks.

2\. There's hardly any need to enhance anything in bitcoin itself, the security is enough, nobody has proven otherwise.

3\. Alternative cryptocurrencies are 99.9% copies of bitcoin with hardly any innovation. Only proof-of-stake(ppcoin) algorithm and scrypt hashing(litecoin) are real changes and it is questionable if they add any value.

4\. The slow speed of transactions (~10min), which other cryptocurrencies are trying to "fix", could be easily brought to instant with a help of third-party service, there are many way of doing it.

5\. Bitcoin developers and pool operators aren't some kind of "kings", they are merely leaders guiding the community.

</comment><comment><USER5> Interesting.

Personally I hope for a crypto-currency scheme that inflates with use and avoids the runaway "lets burn electricity as fast as we can" aspect of BTC mining.

<comment><USER6> The computational cost of Bitcoin mining not only serves to bootstrap the totality of the BTC into the ledger but also is designed to protect the network. It is also a teeny-tiny fraction of the power required by the legacy banking infrastructure all over the world. It is not a waste.

<comment><USER5> 1\. I don't care how much electricity the banks use. That's why I didn't say banks are awesome and bitcoin sucks because of power usage.

2\. The power of the network only really protects against the 51% attack. Why not have a crypto system that doesn't have such a ludicrous, energy burning arms race built in?

And of course it's a waste!

</comment></comment></comment><comment><USER7> how lame is that? " I do not profess to know what the startup-stage version of the Facebook equivalent is for cryptocurrencies but there are plenty of possibilities. To name a few with interesting prospects: YACoin, Litecoin, PPCoin, Freicoin." BTC is much better than these. The author has 0.0 knowledge of BTC.

<comment><USER8> Are you drawing the conclusion that all of his points are mistaken based on this statement?

If not, if you can point out the weaknesses in (the rest of) what he's saying, I'm sure a lot of us (myself included) would be interested to read your counterpoints. I for one don't know enough about the relevant topics to debate this piece, but it would be great to read what more informed HN'ers think about his assertions (and why).</comment></comment>


Taking template inheritance to the next level - <AUTHOR> http://tierratemplates.com/blog/2009/09/taking-template-inheritance-to-the-next-level/

<comment><USER2> I am 99% sure you can do all of this with Mako templates: <http://www.makotemplates.org/>

<comment><AUTHOR> This is for PHP though.

<comment><USER2> Ah, my mistake; I saw the reference to Django templates and assumed Python.

<troll>Try switching to a language that doesn't suck, okay?</troll></comment></comment></comment>


Ask HN: Asking for feedback on my CRM blog - <AUTHOR> https://topratedcrm.com/ <comment><USER2> If photos are to be the top of every post, I'd try hard to make the photo the width of that column. The few that aren't, it throws off the layout.

The title of the article and the links are black, as is the content. Maybe change to a dark grey or underline or both or a different color - something to differentiate a link from body copy.

Something about the font makes it hard for me to read - either to small or the color, but it's causing me not to want to read the content.

The actual blog post - I would either try to center it on the page horizontally or make it full width or place related articles on the right. Something to fill in the white space a bit.

I get not wanting to look like the other 50 million blogs out there, but your content should differentiate you from them, not necessarily layout IMO. Your content is what will make people come back and read. Going back to the font - if it's hard to read, people won't.

<comment><AUTHOR> Thanks a lot for your feedback. I will take notes from it and reconsider my design issues.</comment></comment>


Systemd's slowly but steadily increased idealism about the world - <AUTHOR> https://utcc.utoronto.ca/~cks/space/blog/linux/SystemdAndItsIdealism <comment><USER2> Good? I have gripes about systemd, but this is not one of them. Indeed, cleaning up the multi-decade Gordian knot of distro-specific crappy Sysvinit scripts was the entire point, as they made clear right from the beginning. If systemd compromised a little on that in the early years, that was probably just to get a foot in the door.

> These dependencies are predictably wrong in any number of cases, because > they've never been really used before.

Then fix them. Isn't that considered good software engineering in all other contexts? At least where I work, you're not allowed to merge until all the unit tests are green, and if someone writes a new unit test that reveals your component was broken all along, you fix it.

The comparison to security is not valid at all. I was on the side of pragmatism and the letter-writers, and against the Guardian and the purists, on the recent WhatsApp fracas, which you'd think would pit me against systemd here, but the analogy is flawed. We have to be pragmatic about security because it involves the choices of uninformed and uninterested users, and we have to maximize their security given that they frequently make bad choices and we have little hope of making that better. systemd is exposing problems that were created by developers and can be fixed by developers.

<comment><USER3> If I have code that is:

      executeStep1();
      //Step 2 requires step 3 to be run first
      executeStep2();
      executeStep3();

I don't expect my compiler to go ahead and run step 3 first. Systemd is choosing code comments over code organization. The tests _are_ green, until we run them under a compiler than prefers comments over procedural organization.

<comment><USER4> I don't mean to advocate for systemd's approach, but they are not the first compiler to give meaning to information in comments.

For example, there exists a Javascript compiler that puts static type annotations in the comments: [https://github.com/google/closure- compiler/wiki/Annotating-J...](https://github.com/google/closure- compiler/wiki/Annotating-JavaScript-for-the-Closure-Compiler)

<comment><USER5> For static analysis and linting in C information gets held in comments as well.

Unfortunatley, about the only thing everyone can agree on is:

      /* fallthrough */

For when you intentionally don't put a break in a case statement.

</comment></comment></comment></comment><comment><USER6> > we will assume that declared dependencies are correct, gain a minor speed > boost, and it things blow up it's not our fault'.

Wait that actually sounds pretty reasonable. What's wrong with systemd taking that position exactly?

<comment><USER7> Nothing, it's just it broke something this guy maintains/owns because his scripts where literally broken. And now that means Systemd is some horrible monster because it executes exactly what it is told to, and doesn't double guess the input because of some legacy crap.

Garbage in, garbage out folks.

<comment><USER8> His scripts were not broken, his _LSB headers_ were, which would be obvious to anyone considering they're _script comments_ which no tool had ever executed, which means they're 15 years of bitrot, I've seen examples in documentation bitrot in under 6 months.

The "garbage in" part is entirely systemd's fault, it was their decision to make the system's boot process rely unconditionally on LSB dependencies which were all but guaranteed to be broken.

<comment><USER9> I'm not defending systemd here, but in general, if your files have standardized headers that indicate the wrong information, how is that anyone else's problem?

<comment><USER10> Seeing that no one is apparently using the information until systemd decided to, it seems like systemd being pedantic and the problem.

<comment><USER11> And while i can't pull another example out of a hat right now, i am sure i have seen other examples of systemd being pedantic about information nobody else have relied on before, and in the process getting its panties in a twist.

<comment><USER9> Again, not defending systemd, but if you have a structured header in your file which is following a standard (even if no one is using your header or that standard yet), and your header is wrong, is it really anyone else's fault but yours?

Shouldn't the fix simply be to remove the header (if you don't want anyone using it) or fixing it (if you do)?

Why ask tools, which interpret the header according to the standard, to do something different because your header is wrong?

<comment><USER11> And once more we are myopically focusing on the technical when the root of the issue is historical and social (if not organizational).

While the headers have existed, they have historically been underutilized and thus poorly maintained. Thus a newcomer can't just walk in and suddenly make them massively important while claiming the breakages that come out of it is not their problem.

<comment><USER9> > While the headers have existed, they have historically been underutilized > and thus poorly maintained.

They are human-readable, so even if no tool used them, they still have an effect. Someone might read the header and incorrectly move the service in their sequential boot order, for example.

Would you recommend that the person reading the header also "fix themselves" instead of fixing the header or filing a bug against whomever owns the incorrect file?

> Thus a newcomer can't just walk in and suddenly make them massively > important while claiming the breakages that come out of it is not their > problem.

Someone decided to put the two things together, right? Someone combined this "newcomer" and these old files with the bad headers? The onus should be on that person to make things right, not the tool which is using the headers correctly. It could be a distribution, for example, but it isn't the tool.

Update them or remove them if they are wrong. Why campaign to leave them intact and incorrect?

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> As a former linux&bsd localhost admin and a seasoned programmer, I cannot understand all the fuss about systemd and init procedure in general. Is it really that hard to start and/or stop programs with arguments, given their dependency graph declared somewhere? Why do we need sqlite built in there? Why all that hardcore coding process involving furious coders? Seems like I'm doing things like that around every two months while solving yet another graph-related business problem.

Why such drama, anyone?

<comment><USER13> I'm not up to scratch on the history of this, but systemd is coming from the Freedesktop.org camp, which also game us GNOME 3 aka Unity. This group seems to have the biggest case of ivory-tower syndrome in all of OSS. :(

The infuriating part is that the whole thing is backed by Red Hat and very closely followed by Ubuntu. So basically you have emotionally immature "devewopers" with overinflated egos being given the keys to the Linux kingdom.

They've even made the kernel devs mad, but there's very little the kernel folks can do except shake their heads in stunned disbelief and repeatedly outline the concrete examples of where things have gone wrong.

I'm saddened to say this, but it looks like Linux has gotten so popular that its collective competency has taken a nosedive.

The problem is political. systemd is being looked at by enough people that issues like the one raised in this post eventually come to light. It's what happens next - the social/communicative stage - that is where the breakdown happens.

I honestly don't get why things are like this.

</comment></comment><comment><USER14> At this stage, I'm in the "systemd is in practice fairly bad, but there's not very much I can do about it" camp. It now seems unfortunate that its ideological opponents have behaved so poorly in so many cases; I'm pretty sure this drastically colored community evaluations of the technical merits of their arguments.

My hope has been that systemd will, over time, increase enough in quality and settle sufficiently into its existing scope to recede into the quiet background of the system administration experience. (Where init systems have for the most part lived while I've been paying attention.) Perspectives like the article here leave me kind of uneasy.

<comment><USER15> "behaved poorly"? Care to give an example?

</comment></comment><comment><USER16> Given the importance of Systemd, its better to follow idealistic principles. Pragmatism in central components leads to technical debt that is hard to remove because it would break all the lazy components that took the "pragmatic" (lazy) route.

On the one hand, we talk about bad software, too many bugs, bad architecture, messy init scripts. On the other hand, we are too lazy to follow idealistic principles that improve overall software quality.

</comment><comment><USER17> I recently ran into a similar case of idealism: in this case, systemd assuming that a laptop's lid "button" (and its S3 state) actually works correctly and assuming that the user wants the laptop to go to sleep if the lid is closed (regardless of power management settings).

For context, the laptop is an old one running openSUSE 13.2. User hands me the laptop to take care of routine updates. All of a sudden the screen goes blank, even in non-graphical modes. I was eventually able to read through 'dmesg' long enough to find out that the system was being told to go into standby exactly three minutes after boot.

After some WWW searching, I found out that systemd (or maybe logind specifically) does this as a "safety measure" (so that your laptop doesn't burn up in your backpack). Never mind that there are plenty of legitimate reasons for closing one's laptop lid besides putting it to sleep (for example, plugging into an external display). This wouldn't have normally been an issue if it weren't for the incorrect detection of the lid state; despite the laptop lid being wide open, it was mistakenly detected as closed. Further, the laptop has never really cooperated with Linux when it comes to standby, so instead of going to sleep, it'd end up just hanging at a blank screen entirely unresponsive, requiring a hard reboot.

Like, I appreciate that systemd wants to have my back, but I feel like they're overthinking things. I was thankfully able to edit some config file to tell systemd to ignore laptop lid events, but it's still rather silly.

<comment><USER18> That's really strange. I've run multiple laptops in clamshell mode, with the system on my desk, closed, with external devices for all human interface. Do they not support that workflow, or are they being smart, and only doing that when there are no external displays connected?

<comment><USER17> From what I gathered, they're trying to be "smart" about it by detecting if there are "docks", but I didn't really investigate much further (in particular, if "dock" means "external monitor is connected") beyond setting the relevant action to "ignore" in some config file (don't have the laptop in front of me at the moment, and my own machines don't use systemd, so hard to be more specific, unfortunately).

</comment></comment></comment><comment><USER19> Systemd is in the "extinguish" phase of its dominance. "Not my problem" is something you can only say once you're on top.

<comment><USER20> The extinguish phase will be when the submarine patents surface and you can either pay up or shut down or go to court.

</comment></comment><comment><USER21> In the projects I've used systemd in, it's been pretty smooth though most of my daemons are pretty straight-forward. As others have pointed out most of the issues the author seems to be running into are dev issues and not the fault of systemd itself.

I'll take systemd over supervisord any day.

</comment><comment><USER22> This conflict between idealism and pragmatism makes me think of the difference between Google and Microsoft's engineering cultures.

The attitude towards backward compatibility is a major difference between the engineering cultures at Google and Microsoft. Google relentlessly deprecates APIs while Microsoft supports things forever, warts and all.

Google's APIs are very idealistic. For example, Google Guice is a very idealistic dependency injection framework using and abusing the Java type system while Microsoft's APIs are very pragmatic and some are only slightly object oriented.

<comment><USER23> This is how I've largely seen the divide between these two companies as well. There's pros and cons to both approaches.

Personally I favor Google's approach to Microsoft's as I am not a fan of technical debt, but if I were an enterprise customer I might feel differently.

<comment><USER24> As a developer, I much prefer Microsoft's approach. That way I don't have APIs pulled out, products being abandoned and services axed whenever Google feels like it.

And let's not get started on the absolutely awful quality of APIs Google puts out.

</comment></comment></comment><comment><USER25> > _If you 're not solving problems in the real world, you're not really > solving problems; you are just being smug and 'clever'._

systemd is a project that wants to _change_ what the real world is. It makes no secret of this. See, for instance, the very small /etc/os-release file: [http://0pointer.de/blog/projects/os- release.html](http://0pointer.de/blog/projects/os-release.html)

" _It 's our hope that by dropping support for non-compliant distributions we gently put some pressure on the remaining hold-outs to adopt this scheme as well._"

Sometimes they aim too high and it just doesn't work (see, e.g., the stateless systems stuff that assumes that everyone is bought in completely and also loves btrfs). When that happens, they don't start dropping support for everyone, they just quietly give up. But I don't think that support for SysV init scripts or /etc/fstab is evidence of a changed view on pragmatism. The way to change the world was to start with compatibility the world as it is, and push steadily for improvements. Device naming _is_ unambiguously a place where the world needs to get better, and systemd is right to push for improvements (although I may disagree quite a bit with what specific improvements they're pushing for and how!).

Also note that Poettering is quite specifically is okay with /etc/fstab because he doesn't see anything he wants to change with them: the format is expressive enough for everything he envisions. [https://github.com/systemd/systemd/issues/4961](https://github.com/systemd/systemd/issues/4961)

<comment><USER19> The FAQ of that article is quintessential NIH, which I think summarizes the systemd project well.

<comment><USER25> Can you explain why you think it's NIH? As someone who's written a lot of code to parse lsb_release (including an installer script that starts with "apt-get install lsb-release", because you can't even depend on lsb-release being installed on Debian/Ubuntu), I certainly agree with just about all of the FAQ in substance, if not in tone.

<comment> yjftsjthsd-h Both LSB and whatever Fedora was doing before were one small patch away from working for their purposes... so they created an entirely new format instead of trying to cooperate with anybody else.

<comment><USER25> What would the small patch look like?

As a consumer, the requirements I have are 1. always available, 2. machine- parseable without running a script, and 3. cross-distro (like lsb_release already is).

I think any patch that gets you that causes you to end up with /etc/os- release, although possibly under a different name, no?

</comment></comment></comment></comment></comment><comment><USER26> Why should the open source world throw out one of its greatest strengths: allowing mere individuals to make updates to the whole stack without the world burning.

</comment><comment><USER27> Systemd's approach here is the kind of thinking that takes away 'on error resume next'.</comment>


SharknAT&To: Vulnerabilities in AT&T U-verse modems - <AUTHOR> https://www.nomotion.net/blog/sharknatto/ <comment><USER3> I think at a certain point someone needs to be held criminally liable for situations such as this one.

A VW engineer is likely going to jail over dieselgate.

We have already seen that such insecure internet connected devices can be easily and quickly assembled into a botnet. The operators of such a network can direct the attacks at healthcare institutions, national infrastructure, and other safety critical systems.

At some point, there has to be stricter consequences for companies than simply a fine. C-levels won't start paying attention to security until there's the real possibility that their ass will end up in jail for this kind of insecurity.

<comment><USER4> What laws would you propose to eliminate insecure software?

<comment><USER5> Bruce Schneier has speculated about creating mandatory legal liability for software vendors and service providers. Liability regimes are a major reason why physical products are so safe.

[https://www.schneier.com/essays/archives/2003/11/liability_c...](https://www.schneier.com/essays/archives/2003/11/liability_changes_ev.html)

<comment><USER6> Say goodbye to open source, then, unless he proposes a special carve-out for it.

<comment><USER5> He has some commentary on this well: [https://www.schneier.com/blog/archives/2008/07/software_liab...](https://www.schneier.com/blog/archives/2008/07/software_liabil.html)

In summary, there wouldn't be liability for open source developers because there is no business contract. But if you run a website with open source software, _you_ of course would still be liable for anything that happens to your customers' data. So you would probably want to buy that same open source software from someone (e.g. Red Hat), who would also be liable.

<comment><USER7> Which means, hosting/supporting open source would quickly become not worth it for any major company representing a large target for opportunistic lawyers. When you make millions from a product, you can afford a team of lawyers setting up contacts just right and fighting liability trolls. When you make zero profit, you cut the losses. Such law would spell very quick end to any corporate support of free and open source software, for liability reasons. There's a reason why all such software is accompanied with "NO WARRANTY" texts, and enforcing liability will make the corporate world to run from it. Nobody wants to be sued because they use OpenSSL and there was a vulnerability there, and that's exactly what would happen with any commercial vendor using OpenSSL if liability laws would be introduced. It doesn't matter the company didn't write OpenSSL - as soon as they use it, they are on the hook. IBM was sued not because they made Linux, but because they used it and had tons of money. And I do not see any business model that could allow companies to charge enough to cover such liabilities. Maybe for established powerhouses like Linux or for corporate foundational projects like Chrome and Darwin, but not for any lesser projects and surely not for any starting up open source with unclear revenue potential. It won't kill all open source, but it would severely hurt the ecosystem and turn it into two worlds - pure hobbyist geekery which nobody with money would touch, and formally open-source projects with strict corporate governance that has no ecosystem beyond the founding corporation.

One of the worst ideas I've heard lately, and I am genuinely baffled how a person as smart and experienced as Schneier could support it.

<comment><USER5> I'm not sure you're envisioning the same thing I am. You would only be liable for something that you sell or otherwise make money from. You would be free to publish software, open source or not, without incurring liability as long as you don't make money from it. Whoever then uses that software for a commercial product would be incurring the full liability, and would not be able to turn around and sue up the chain.

The currently widespread practice of trusting sensitive user data to open source code without an audit (either internally or via a third-party, e.g. Red Hat) is horrifying and incredibly negligent.

<comment><USER7> > You would only be liable for something that you sell or otherwise make money > from

If your business includes software in any meaningful function, you are making money from it. Any competent lawyer would be able to successfully argue that. Charging money for a license is not the only way, otherwise everybody would just switch to charging for "consultancy service", which coincidentally provides free software license, and avoid any liability.

> You would be free to publish software, open source or not, without incurring > liability as long as you don't make money from it.

You as a private person would be. That's my point - that would be the only way to do open source, any corporate support of open source projects would imply full liability, which would be impossible for a product the company gets to revenue from. It would be much harder for a business to justify supporting an open source project when liability costs are added to the equation.

> The currently widespread practice of trusting sensitive user data to open > source code without an audit (either internally or via a third-party, e.g. > Red Hat) is horrifying

Audits cost money. Tons of money. And they don't guarantee anything - bugs in OpenSSL have not been discovered for years despite thousands of people using the code, poring over it and billions depending on it. There's no magic in "audit" that allows code to be bug-free after it - if there was such a magical procedure people would already be using it, but there's no indication anybody has invented "audit" procedure that allows to eliminate all bugs. Existing flawed procedures are already being used - every company that produces software that I ever heard about uses them - and they are not enough. So what would happen is drastically raising the costs (to the point where having a website would no longer be affordable to an average person) while not significantly improving security.

<comment><USER8> _Audits cost money. Tons of money. And they don 't guarantee anything - <USER2> in OpenSSL have not been discovered for years despite thousands of people using the code, poring over it and billions depending on it._

Any reasonable audit of OpenSSL would have said, "Don't use it."

<comment><USER7> And instead use... what? Let's say you are creating a company that needs website to sell stuff. On that website, you need TLS implementation, to process user data & credit cards. After expensive security audit that consumed most of what your angel investors can give you, you decide that anything based on OpenSSL can't be safely used. Now what?

<comment><USER9> Forks of OpenSSL. After Heartbleed, dozens of forks were made. One I think is really promising is LibreSSL which is managed by the same people who work on OpenBSD.

<comment><USER7> So, the premise there is "we couldn't find the bugs by the whole community in twenty years, but if we split the community into a dozen independent projects which do not cooperate, surely then we'll find the bugs that eluded us for two decades". Right.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> It's always annoyed me that ISPs seem to like giving customers these horribly overcomplex modems as well as other "value-added features" like "inject advertisements into the user's unencrypted web traffic" \--- especially since customers are already paying them for the service.

My vision for an ideal modem is more like a dumb Ethernet to coax/fiber/etc. adapter, and is otherwise as unobtrusive as possible. Ditto for an ideal ISP: just sell access to the raw, unfiltered Internet, and nothing else.

<comment><USER11> > My vision for an ideal modem is more like a dumb Ethernet to coax/fiber/etc. > adapter

You'd like Europe then.

You know where we have competing ISPs and this is the standard.

<comment><USER12> In fairness, comcast (big US ISP) allows you to buy your own cable modem. However, they are terrible for multiple other reasons that would not fly in Europe (data caps, lobbying to resell browsing history, opaque pricing schemes, etc)

<comment><USER13> By which you mean that Comcast will let you buy an approved device to which (I believe) they fully control by design.

<comment><USER14> Pretty much, Cable Modem Hacking is extremely uncommon and even an owned modem is out of your control. Look at all the Intel PUMA cable modems with bufferbloat issues where the cable ISP refuses to update said modem to fix the software bug causing bufferbloat.

</comment></comment></comment></comment></comment><comment><USER15> Not nearly as large as ATT U-Verse but I found a similar vulnerability in the modem I was provided from a rural DSL provider a few years ago.

It all started when I called to get the admin credentials so that I could open a port. They refused, stating that they use the same PW on all of them so they couldn't provide it to me.

After a day or 2 I found a vulnerability in the WebUI that dumped the password to my browser. Did a shodan scan and found hundreds of these modems connected to the internet. What they said was true, that password worked on the 2-3 I tried just out of curiosity.

I tried reporting my findings to them but they didn't seem to care. So I just changed the password on the one provided to me and let it be.

Now I live elsewhere and use my own purchased modem/firewall/wap. Can't trust ISPs to care about your security.

<comment><USER16> Unfortunately, on Uverse you are required to use the ATT-provided CPE (due to 802.1X authentication).

<comment><USER17> Nah, all you have to do is redirect 802.1X traffic to their device and you can use whatever device you want.

I have my EdgeRouter performing this function currently.

<comment><USER18> How much bandwidth do you lose? I have AT&T fiber and I want as close to 1Gb as I can. Someone else else I saw online did something similar with an EdgeRouter and he lost a ton of speed.

<comment><USER17> So there are two ways to add your own equipment. I don't know what method the person you're talking about used.

The first you can put the modem in 'DMZ Plus' mode which is the closest you'll get to a bridge mode. This is where you'll lose bandwidth but it's easier to set up.

The second, which I recommend, is to connect your router to the ONT directly, and use their modem as a client on your network. You have to set up some rules to hook up the 802.1X traffic but otherwise the att modem is no longer in the picture. _I_ haven't lost any bandwidth and I can't imagine that att's provided cheapo box would be faster than an EdgeRouter.

<comment><USER19> The DMZ Plus mode doesn't really kill much bandwidth. I get pretty close to 1 Gbit through it. Maybe 960-980 Mbit. Good enough for me. The real problem with the DMZ Plus mode is that it basically sets up a NAT to your router and the state table of the modem is somewhat limited. I've never had any problems but supposedly it might choke if you have tons of open connections.

<comment><USER18> DMZ plus mode is now where near bringing your own hardware and plugging it into the ONT. Everything still has to go through the AT&T gateway.

Comcast will let you bring your own modem and plug it into the coaxial. I've heard google fiber will let your bring your own stuff.

DMZ plus is much different than setting up an EdgeRouter to forward the authentication to the gateway. You are in much more control of your network if you don't use DMZ plus.

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Here[1] is a 802.1x proxy you can use to hide your incredibly vulnerable residential gateway behind a firewall of your choosing. It allows the eap packets to pass through.

I honestly knew this was going to be a problem when I first port-scanned my residential gateway and saw exposed who-knows-what ports, but for symmetrical 1Gb internet for $79.99 a month what can you do?

[1] [https://github.com/ShadwDrgn/eap_proxy/blob/master/eap_proxy...](https://github.com/ShadwDrgn/eap_proxy/blob/master/eap_proxy.py)

<comment><USER21> I had the exact same thought after port scanning my own uverse gigapower connection - so seeing real exploits actually be found on it is not surprising in the slightest to me.

Though instead of going with the 802.1x proxy approach, it's also possible to spoof the mac address of the RG with your router and swap it in place after 802.1x authentication has occurred. (You have to swap without the link to the ONT going down however, the easiest way to do so being a switch with VLAN support. You put the RG and ONT on one vlan, and then once the connection is up, you swap your router in place of the RG.)

Then you can unplug the RG and put it in your closet (until you have a power outage and have to do it again, which is the main drawback to this approach. However since AT&T provides a UPS for the ONT, if you have a UPS for your router you should be good there too.)

</comment></comment><comment><USER22> > a kernel module whose sole purpose seems to be to inject advertisements into > the user's unencrypted web traffic

Ugh…why is this even a thing? Like who thought it would be okay to add this "feature" to a modem, let alone at the kernel level where it would be difficult to disable and easier to be compromised?

</comment><comment><USER23> I have AT&T Gigapower with a Pace 5268AC, so not one of the modems discussed here.

I don't use its wifi and I have it configured for pass-thru mode. When I got service early this year, I briefly investigated bypassing it entirely. It turns out you need the modem to periodically respond to authentication packets from the AT&T network. But with some ingenuity, you can hang the router off an extra port on your own router and use it only for authentication purposes:

[http://www.dslreports.com/forum/r29903721-AT-T- Residential-G...](http://www.dslreports.com/forum/r29903721-AT-T-Residential- Gateway-Bypass-True-bridge-mode~start=480)

I eventually decided not to do this because it's somewhat brittle and I didn't otherwise have any issues with the Pace. It's performance is fine.

But, given this disclosure, I'm going to revisit my decison. First, it seems like it's just a matter of time before the Pace has a similar security issue. Second, that kernel module for injecting HTTP advertisements. Just the idea of it bothers me.

<comment><USER23> Update: I've moved the 5268AC behind my EdgeRouter Lite. I wasn't happy with any of the 802.1x proxies other folks wrote and/or they weren't working for me and/or I just wanted to write it in Python, so I wrote my own:

[https://github.com/jaysoffian/eap_proxy](https://github.com/jaysoffian/eap_proxy)

</comment></comment><comment><USER12> What really ticks me off about this is that for FTTN access around here, you _have_ to use their crappy routers. This is true even if you go through a third party like sonic.net.

Worse, their routers seem to do something to defeat attempts at two-level NAT setups.

I thought one of the network neutrality principles said you couldn't discriminate against compatible network hardware. Too bad Pai is in now.

<comment><USER24> This is one reason why I really like FiOS. I get ethernet straight into the house. Sometimes you get coax instead, but you can use a MoCA adapter to convert it to ethernet. _And_ their provided modem is actually pretty decent! I had planned to bypass it when I signed up for the service, but after using it for a bit I decided to just keep it in place.

</comment></comment><comment><USER20> Can someone please use this to lift the EAP certificate so that any individual can authenticate _themselves_ with AT&T instead of having to put the gateway in the very entrance to the home network?

</comment><comment><USER19> I have AT&T U-verse (Gigabit fiber product) at home and I believe that I an not vulnerable to public Internet attacks because I've configured my modem in pass-through mode. The AT&T pass-through is pretty weak and is really only a 1:1 NAT, not a bridge, but as far as I can tell, the modem does not answer to the Internet when configured in this mode.

</comment><comment><USER25> This is a shocking and overly broad title.

I have Sonic Fusion, which includes a Pace 5268AC modem which is provided by AT&T U-verse and I cannot replicate the issue.

The title should be "Some AT&T U-verse modems..."

<comment><USER26> i have the 5268AC modem and i just did a quick nmap -PU . open ports from that are 80, 8443, and 49152

<comment><USER27> 80,8443 not open on the external IP are they? Hopefully only internal unless you're OK with that.

</comment></comment></comment><comment><USER28> 1\. SSH exposed to The Internet; superuser account with hardcoded username/password.

2\. Default credentials "caserver" https server NVG599

3\. Command Injection "caserver" https server NVG599

4\. Information disclosure/hardcoded credentials

5\. Firewall bypass no authentication

</comment><comment><USER29> So since Sonic was highly reviewed and hyped here (San Jose), I checked them out/tried to switch to them. For my address the only option from them was the one on AT&T's IP network. For that service, I must use the modem they (AT&T) give me. There's modem renting fee, and there's router feature that I cannot turn off. That's the dealbreaker for me so I stopped trying. I'm glad that I didn't go that route, and I hope Sonic could do better here.

<comment><USER30> Sonic uses AT&T's networks but provides their own service on those networks. The modem is not an AT&T modem and it's not the one in the article.

<comment><USER29> But still, there's router feature on that modem that I cannot turn off, so I cannot bring my own router (unless I want to do double-NAT), and there are still highly likely some hardcoded remote access password.

</comment></comment></comment><comment><USER31> I can't seem to find any information on how or if this was disclosed to AT&T. Does anyone know how the blogger proceeded here?

<comment><USER32> Comments at the bottom indicate it was not pre-disclosed.

</comment></comment><comment><USER33> This is why, if I can, get bridge mode on the ISP provided device and put in an OpenWRT router. I am still on 802.11n but who cares, most of my devices are not 802.11ac either.

I want to know what runs on my router, damnit! It's my biggest vulnerability if done wrong and one of the more important security features of the home network if done right.

</comment><comment><USER34> Well I have AT&T and the hack it worked for me! Words could not express the feelings of terror that I have right now.

<comment><USER35> > Words could not express the feelings of terror that I have right now.

have you tried the word "hyperbolic" ?

<comment> yjftsjthsd-h I disagree; it is totally reasonable to be terrified when the device at the heart of your network has a internet-facing root exploit that you can't patch.

</comment></comment></comment><comment><USER36> This wouldn't be the first time I've heard of some AT&T-specific vulnerabilities on a router: [https://www.soldierx.com/bbs/201704/voip-router- hacking](https://www.soldierx.com/bbs/201704/voip-router-hacking)

</comment><comment><USER27> Has anyone with this modem in the wild actually confirmed this update was pushed to them and if so is ssh listening on their public IP? So far in the article comments (haven't looked thru HN comments yet), those having this modem have verified that ssh is not listening.

</comment><comment><USER37> Another way around this is to just request a modern modem. I recognize that modem as an older model and, especially if it is having hardware problems, you can just call up AT&T and ask for their newer model (not sure if it is still the newest) 5268ACFXN.

<comment><USER38> You sure the new model isn't similarly vulnerable?

</comment></comment><comment><USER39> I just installed a Ubiquity Unifi Security Gateway and AP behind my Uverse modem and turned everything off including the radios. Thank God. I'm sure I could still be MITM so running all traffic to a VPN now.

</comment><comment><USER40> I am _not_ joking when I ask this question: will this open me up to potential CFAA charges if I run the commands to check if I'm vulnerable and run the self-mitigation commands?

</comment><comment><USER41> This is terrifying

</comment><comment><USER42> In a world where users should have control over their own computers, it is the customer who should have SSH access, not AT&T. But as you all know, most times the customer does not own the modem. One well-known workaround is for the customer to use their own modem or to use their own router as a gateway to the modem. But does this really give the user more contorl over the modem/router?

These user-owned modems/routers usually do not encourage SSH access by the user, if they even provide it. Instead they promote a "web interface". _Indirect control_ of the settings. Better than SSH? That is for you to decide.

The "market" seems to love the "web interface". But this often the easiest vector for successful attacks. Less control, and less safety. Is the tradeoff still worth it? That is for you to decide.

[https://threatpost.com/vulnerability-disclosed-in-ubquiti- ne...](https://threatpost.com/vulnerability-disclosed-in-ubquiti-networks- admin-interface/124392/)

[https://www.sec- consult.com/fxdata/seccons/prod/temedia/advi...](https://www.sec- consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170316-0_Ubiquiti_Networks_authenticated_command_injection_v10.txt)

[http://www.securityweek.com/worm-infects-many-ubiquiti- devic...](http://www.securityweek.com/worm-infects-many-ubiquiti-devices-old- vulnerability)

Relying on "Keep up to date with patches" or "Enable updates" as a strategy to improve the safety of a product that was _unsafe to begin with_ is a bit of cognitive dissonance given that its safety was deemed "good enough" for the renter/purchaser at the time of rental/purchase. To achieve a safer product requires not only manufacturers to set new priorities but also consumers as well.

How important is that "web interface"? More important than safety? And why not configure using SSH instead? Whatever the reasons, tradeoffs have consequencesre: safety.

</comment><comment><USER43> I applaud Hutchins' choice to use Full disclosure instead. Let that be a lesson to all Big Corps, there are White Hats out there who won't be bullied by your "Responsbile disclosure" propaganda. The writing is on the walls, Big Corps, take responsibility and secure your gear by design or be pilloried.

<comment><USER44> At the end of the day, it's pretty unlikely AT&T will suffer any significant losses for this, but there's a decent chance some consumers will.

<comment><USER43> Every codependent has some excuse for enabling their abuser.</comment></comment></comment>


Netflix boss: Remote working has negative effects - <AUTHOR> https://www.wsj.com/articles/netflixs-reed-hastings-deems-remote-work-a-pure-negative-11599487219 <comment><USER2> [https://archive.is/6iK6Z](https://archive.is/6iK6Z)

<comment><USER3> What kind of a paywall does WSJ have? I always get a wall.

Is it X articles free per month, or do they allow only crawlers on their sites?

<comment><USER4> They used to allow crawlers and Twitter and some other links through, but they're almost entirely behind a paywall now.links through Facebook or Twitter may still work, but they definitely do not work through Google anymore.

<comment><USER5> I blocked them from my Google feed as well as numerous other ones. I'm not going to pay to see ads

</comment></comment></comment></comment><comment><USER6> I've mentioned this before, but WFH has a huge difference in result depending on who you are, when you are (in your career), and where you are in a company (or organization).

\-- For the budding young developer who can't wait to show ideas to teammates and demonstrate being a go-getter by asking random questions and finding unaddressed issues to innovate on, WFH might be terrible. You're going to schedule time to fortuitously run into the senior person who takes an interest in your idea?

\-- For the working parent whose productivity has been slashed by 50% and stress has gone up by 50% due to parenting obligations, WFH might be terrible.

\-- For the middle manager who can coast along and not need to move greatly in his/her career, WFH might be great.

\-- For the developer who works by tickets on very concrete things and this is nothing new, WFH might be great.

\-- For the small company CEO who relies on force of personality and everyone in the same room urgently working to get something done, WFH might be terrible.

There's a huge variability in what WFH means, depending on what you want from the situation.

For some people, remote working is really not good.

And that's aside from the point that, when everyone is remote, you're also competing with the world who is also remote. Jobs and job qualifications (and competition) may change...

<comment><USER7> I'd like to propose a reframing of your scenarios for objectivity:

WFH is horrible for some people in some scenarios.

WFO (work from office) is also equally terrible for some people in some scenarios. It's just that people have generally normalized and accepted that these horrible WFO situations are required to feed yourself.

Barring jobs where you cannot function without physical presence, I'd say we need to fundamentally rethink why WFO is a default. And why we think a baseline of suffering for some people is generally OK.

<comment><USER8> Can you provide some examples of WFO being such an issue? Is it mostly "commuting sucks"?

<comment><USER9> WFO nickels and dimes you on equipment. I can bill out 300k in hours a year but getting a company to spend $1,000 on monitors, chair, keyboard, etc. is like pulling teeth. They expect me to work on a 14" laptop and maybe an external monitor. At home I can use my setup.

<comment><USER10> WFO nickels and dimes you, but you're okay paying out of pocket for all your equipment at home?

By that logic, you could just bring your own monitor and chair and keyboard into the office.

<comment><USER11> which is often BANNED

<comment><USER10> Your office wouldn't allow you your own chair?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> In the article he says he'd be up for 4 days in the office and 1 day work from home after covid. These CEOs just can't let go of the 5 day work week. It's so frustrating. 5 day work weeks don't leave enough time for employees to take care of their personal lives, in my opinion. This results in employees taking more sick days and not concentrating at work because they have to deal with their personal business while at work. I think we need to move to a 30 hour work week. Four 7.5 hour work days would vastly improve working in my opinion, whether it is remote or in the office.

<comment><USER13> Either that or provide humane vacation time. In the USA you accrue like 11 days of vacation per year. Contrast with many places in Europe such as Sweden where you are entitled to at least 25 days. Not to mention the cultural differences where most jobs in the US will shame you for enjoying your meager time off.

Don't even get me started with "unlimited" vacation policies which are a joke. When I used to interview with companies and they told me they had unlimited vacation, I let them know immediately that I respect their time and dont want to waste it any further because I can already tell I dont want to work with them.

This is why I ONLY do contract work now. Truly unlimited vacation and however many workdays per week I want.

<comment><USER14> Netflix has unlimited vacation. It works well because they encourage people to take vacation, starting at the top. The CEO always makes a big deal about how he's taking 1-2 weeks off at a time, and encourages all the VPs to do the same.

Not all unlimited vacation cultures are bad. The best way to find out is to ask how much vacation the CxOs took and how much vacation the hiring manager took. If they can't answer that, _then_ be concerned.

<comment><USER13> I'm not buying that they're doing it out of the generosity of the business. Otherwise why not just offer a generous number of days vacation in the benefits package? They're making it unlimited because they're counting on people using less than average vacation time so the business can save money while maintaining a good image.

<comment><USER15> I think the "unlimited" thing started as just trying to get the vacation time off the books as a liability, and treating it as "no time off" happened for cultural reasons.

Ugly and hostile reasons, but still cultural -- I don't think there was ever an evil cabal of CEO's rubbing their hands over the thought of engineers working 50 weeks a year.

<comment><AUTHOR> That's how a lot of these things work: There's (almost) never an _actual_ conspiracy of people meeting in secret to orchestrate the terrible things that have been done to our society. It's just that given the way our version of capitalism has been set up for the last few decades, the incentives are structured such that already-rich people can get themselves _even more_ money by finding more and more legal-if-shady ways to squeeze everyone else.

</comment></comment></comment></comment></comment></comment><comment><USER14> This doesn't surprise me. Netflix was always very anti-WFH. When I was there I know of only one team that did it, and that was the OpenConnect team (Netflix's custom CDN). And the main reason that was allowed was because the team was spread all over the world.

The Netflix culture is very strongly built around in-person collaboration.

One interesting way this manifested itself was when the new HQ was built, it had _a ton_ of 2-4 person meeting rooms, more than I've seen at any other big tech company. This was a reflection of the many 2-4 person meetings that were scheduled every day. In the old building, you'd often see a 10 person room being used by two or three people because there were no small rooms left.

Sure you can replicate this on zoom, but it's just not quite the same as sitting across from someone reading their body language.

<comment><USER16> It's not the same- why try to replicate an inefficient process anyway. Most meetings are a colossal waste of time.

<comment><USER14> I agree that many meetings of 4+ people can probably be done more efficiently via email or wiki or whatever, but I've found 2-3 person meetings far more effective than any other means for information transfer and decision making.

<comment><USER17> Can you come to my meetings and tell my CTO how to make decisions faster?

<comment><USER14> Propose a "memo culture". That was how we managed larger meetings at Netflix (and I'm pretty sure we stole it from Amazon).

Before the meeting, everyone who has a stake in what's being discussed contributes to a memo outlining their thoughts on it. Then everyone reads it ahead of the meeting.

The meeting is then just to hash out what's in the doc and agree on which already proposed solution will be adopted.

<comment><USER18> How does one propose and win a culture change of one isn't in charge?

<comment><USER16> No one is in charge forever, lead by example and if you're doing things right eventually people will follow. You are as much a part of the culture as the current "boss"

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> All I'd say is; Netflix have a pretty extreme culture[1]. From the outside it looks pretty solid, but I understand the reality is that if you are not above average for two performance cycles in a row they let you go. There is an expectation of drive, and constant commitment (no judgement; it works for them, though I'd never work there!)

WFH naturally allows more flex into your real life. This will not vibe well with Netflix's culture IMO.

1\. [https://jobs.netflix.com/culture](https://jobs.netflix.com/culture)

<comment><USER20>
      > All I'd say is; Netflix have a pretty extreme culture[1]
      > 1. https://jobs.netflix.com/culture

Scary. From some extracts, it seems more a cult than a company:

      > You question actions inconsistent with our values
      > You seek what is best for Netflix, rather than what is best for yourself or your group
      > You accomplish amazing amounts of important work

They're taken out of context, but could be interpreted as hints to how the company really works.

<comment><USER21> If it is, I'm leaving my FAANG role for Netflix - it's very refreshing to hear people might be motivated by larger causes.

Most of my last week was spent trying to avoid fallout from our team's massively skewed performance reviews: our first promotion case in 2 years is the colleague who performatively did no work for months while the manager was out, bullied me for continuing to schedule and work with our partner teams, and encouraged another co-worker to have a meltdown about it that cost them significantly.

<comment><USER20> > If it is, I'm leaving my FAANG role for Netflix - it's very refreshing to > hear people might be motivated by larger causes.

I don't get it. What's the larger cause here? Netflix is not doing anything special for the society. If you talk about engineering, they certainly have an excellent engineering culture, but I don't think they're implicitly more talented than many other companies.

I actually see it (but obviously, it's my opionion) as a very skilfull marketing targeted at outstanding but naive engineers (that is, people who sacrifice their work/life balance for the company). In a cynical way, it's like the nigerian scam, but oriented at intelligent people.

> Most of my last week was spent trying to avoid fallout from our team's > massively skewed performance reviews

A company like Alphabet is more than 10x the size of Netflix. Politics and inefficiency is pretty much inevitable at those magnitudes.

<comment><USER22> _"If you talk about engineering, they certainly have an excellent engineering culture, but I don 't think they're implicitly more talented than many other companies."_

If we took a random sample of Netflix engineers and compared them to a company with weak engineering cultures, like Blockbuster, I'm sure we could agree that Netflix engineers are more talented.

<comment><USER23> But we aren't comparing them to a random company, we are comparing them to the rest of FAANG. Do they have a much stronger engineering culture than Google/etc?

<comment><USER24> Pound for pound I would probably say yes.

Netflix is often where the best of the best aspire to be even if they have already done rotations at FB/Google.

At least in my field (infrastructure, big data, etc) this mostly holds true.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Reading the absolute claim in the title ("no benefits at all") makes me dismiss his opinion instantly.

You can claim it's net negative, but not seeing anything positive probably just means you are a workaholic with no life and can't fruit a good debate about it.

<comment><USER26> Yeah, in my company we are seeing a lot of positive impacts, especially for those who live far from the offices, and are saving 10~15 hours a week from commuting. People can focus more on work, than spend time and energy commuting, and dreading the long commute home

<comment><USER25> I totally can see negatives:

\- no water cooler talk and lunchs > bad for team spirit/work friendships

\- heated discussions going stale and ending up in resentment > easier to resolve in person when you get a good feeling for how the other feels (and interact about non-problematic things, e.g. the mentioned lunch together)

\- grabbing a busy person when you feel the time is right

\- harder to motivate yourself when you are on low-energy or stuck

(And yet I think the positives even that all out)

<comment><USER26> In the end, everything depends on the team and the person right?

I would like going back to the office. I miss the espresso machine, the snacks, seeing people, playing boardgames after work. But that's because it's a 10 min. walk for me to go there.

For some coworkers, it's a 1 hour drive each way, having to pay for parking, and needing to leave work no later than X because otherwise they have to pay extra.

Also, I can concentrate more at home. In my previous job, I ended up moving to a small cubicle that was not being used, because I couldn't stand the noise of other people talking around me (had some loud speakers there).

</comment></comment></comment></comment><comment><USER27> As long as Netflix continues paying top-of-market they'll have no problem attracting talent regardless of whether they allow WFH. It's the companies that don't pay top-of-market that have to think longer and harder about WFH.

<comment><USER28> What data did you use to make this assertion?

I know of at least one counter-example. Maybe it's the exception that proves the rule but I'd rather see some numbers before believing it.

<comment><USER29> If you consider ability to work flex hours or WFH as part of your employment package, they don't offer WFH but they do offer more money. Overall comp is still high. What additional data do you need? Relative value of WFH vs cash to various demographics?

</comment></comment></comment><comment><USER30> What's best for the company doesn't mean it's best for the individual employees. People need to focus on what's best for them because we've probably all learned at this point that the company puts their needs above your own.

<comment><USER31> Yes, the same guy thinks sleep is a competitor of Netflix. So no, I do not think he has the best interest of other humans.

[1]: [https://www.fastcompany.com/40491939/netflix-ceo-reed- hastin...](https://www.fastcompany.com/40491939/netflix-ceo-reed-hastings- sleep-is-our-competition)

edit for possible misunderstanding that I'm critisizing the OP

<comment><USER32> did you know netflix's first CEO is Edward Bernays' great-nephew?[1]

Makes a lot of things make sense.

[1] [https://en.wikipedia.org/wiki/Marc_Randolph#Early_life_and_e...](https://en.wikipedia.org/wiki/Marc_Randolph#Early_life_and_education)

<comment><USER33> I think you're putting far too much weight on a great-uncle who Randolph may not have never met.

</comment></comment></comment></comment><comment><USER34> I'm so pleased that someone isn't afraid to reject the WFH kool aid.

Just because certain personality types work better in solitude doesn't mean it's one-size-fits-all.

Others are suffering loneliness, marginalisation, are struggling inside their own heads, are stuck in tiny apartments or don't have access to outdoor space. If you hate the office that badly, you're probably working at the wrong place.

And yeah, a truly creative collaborative working environment can't be replicated over video call.

<comment><USER35> I hate everything about WFH. I like travelling to a different environment each day, interacting with my colleagues, being in a space designed for work (proper seating and desks, aircon), looking someone in the eye when I'm talking to them, feeling the bustle of the city centre when I go for a stroll at lunch. Working from home makes me feel like a widget at the end of an internet connection.

Then again I don't have children and I cycle to work so maybe that's the difference.

<comment><USER36> You are pretty much describing a coworking space or a good library. I don't know if you own a house, but you might change your opinion once you'll be on the search.

</comment></comment></comment><comment><USER37> _The Wall Street Journal newspaper asked Mr Hastings if he had seen any benefits from staff working from home.

"No. I don't see any positives," he replied_

Not even a tiny bit of positive? I would be curious to know Netflix's workers point of view on this.

<comment><USER38> How does someone in such a high position see things so black and white?

Either way, this world wide work from home experiment isn't even a good one because there's a massive pandemic going on that... Judge wfh after the world is vaccinated.

<comment><USER39> >How does someone in such a high position see things so black and white?

The CEO of Netflix is a brand in itself. The guy is selling a message, a vision (and a book!) My guess is, deep down inside, he sees several positives of WFH, but that doesn't vibe with his overall message or the culture he's trying to cultivate.

</comment></comment></comment><comment><USER40> Reed Hastings just released a management book (written before the pandemic) which is heavy on traditional, in-person management styles. I think the statements in the book make it difficult for him to suddenly welcome remote work on a permanent basis.

In addition, certain (but not all) aspects of the media business such as creating media _do_ work better in person. This is true of many industries, not just media, and may explain some of his thinking.

</comment><comment><USER41> What I've noticed at my company is, the people who were massive fans of working from home are now the people who are missing the office the most, except for one or two people. Working from home has it's benefits but it's really not for everyone. I, personally, am looking forward to going back to the office full time. I can go to the office just now but without other people there it just seems pointless to go.

<comment><USER42> I think we need to understand that everyone is in different situations and not force personal preferences on others.

I think allowing people to work however they want should be the way forward.

I personally don't plan on ever going back into an office. For me, WFH is the best thing that has ever happened. No commute, no open office bullshit, more sleep, more focus, more time for personal hobbies, no working in a filthy neighborhood in downtown SF, options for better accommodations (due to no commute), no waiting for people to finally clear a meeting room, no need to stand in line to go to a smelly restroom, etc. etc.

<comment><USER43> > no working in a filthy neighborhood in downtown SF

One of the things I miss most about the office is that I _live_ in " a filthy neighborhood in downtown SF" and the office was wonderful. I also miss the commute, which was on one of the tech busses, so I could sit back and take in the scenery.

I am upgrading neigborhoods though, so that's something.

</comment></comment></comment><comment><USER44> I can't imagine anything more "pure negative" than a business culture with stack racking and firing people who aren't "keepers". Netflix's success is from being first to market, pure and simple, and has nothing to do with a toxic management structure that, from all accounts, is abusive to its workforce.

<comment><USER45> >Netflix's success is from being first to market

Plenty of companies are first to market and don't win the market. Also, Amazon Video predates Netflix streaming and Hulu was out only a year later.

</comment></comment><comment><USER46> Remote working has positive and negative effects. First come the positive, over long term the negatives become self evident.

Hopefully Covid-19 exposed people to the positive effects and there will be more remote work opportunities than before. People frequently working 1-3 days a week from home in many professions might become accepted norm.

<comment><USER28> Are you saying you don't know what the negatives are or have they not become self-evident yet?

I think there are immediate negatives, like collaboration, synchronous decision-making. I wonder what the long-term ones are.

<comment><USER47> > I think there are immediate negatives, like collaboration, synchronous > decision-making.

This hits companies with teams who sit in the same office. Companies that are more spread out didn't suffer as much. My team of four people is spread of four cities, so we were always remote to each other.

The negatives come from equipment and socialisation:

\- most homes are not equipped to be offices (anything from lack of proper chairs to lack of proper quiet places at home, especially if kids are on vacation)

\- you do miss interactions with other people at the office even if they are not on your team: lunches together, coffee breaks etc. This can be mitigated (just ask freelancers how they cope), but it will eventually affect most people

\- You often end up working more at the detriment of your work-life balance due to some routines just not being there. No one asks you to join them for lunch? You end up skipping lunch because you're working. People are not leaving for home en masse, you end up staying way beyond work hours hacking at "just one more bug and PR, and I'm done".

</comment></comment></comment><comment><USER48> I mean its sort of a blanket statement. Do I believe remote work is harder for c suite and writers? Absolutely. Is it harder for engineers? Probably less so.

<comment><USER49> Yes but not everybody works in it/engineering.

<comment><USER50> For solo writers propbaly not but for a writers room i could se it being a problem,

Ill have to ask one of our TTRPG streaming group who is a writer / co-producer on a netflix show.

</comment></comment></comment><comment><USER51> So glad remote work is simply a bigger undeniable phenomenon that the suits can't wish away.

Even a four day work week with one day remote for most white collar jobs was a foreign concept until this year. The quality of life improvement for everyone is insane. People have more time to spend with family, cut entire commutes a few times a week, getting that extra hour of sleep, or have that extra hour or two after work, it's about as close to the mythical European quality of life Americans hear rumors about.

</comment><comment><USER52> Talking of Netflix, genuinely curious about something...

I know that they have a leadership position today and supposedly hire great engineers, pay them very well and are doing very well in the stock market.

But, in view of numerous other streaming services, purely in today's context, do they have an engineering edge that is a key strength that will help them keep their leadership position or is that engineering edge no longer relevant and leadership in streaming services would simply be determined by who has the content.

<comment><USER47> It's no longer the question of "engineering edge". People will subscribe to Disney+ even if it only offers 720p streams with long buffering times. Even now in some countries (I'm writing this from Sweden) Netflix is 70% Netflix content, 5% a small number of fairly recent movies, and 25% a hodgepodge of movies not more recent than 2005. For the sole reason that the main content hoarders, ahem, rights holders have stopped their broad licensing deals with Netflix (Disney, WB etc.) and are openly hostile towards Netflix.

If you don't have content, your technical edge means nothing. Netflix understood this the moment Disney (or was it WB?) announced they would cancel their licensing deal with Netflix a few years back, and Netflix started pumping billions of dollars into producing its own content.

<comment><USER53> Netflix has plenty of content. Just enjoy what's there.

And I'm really enjoying punishing Disney for taking their ball home.

My budget for entertainment is already 100% allocated to to Netflix, and Disney has lost my entire family (2 adults, 3 kids), both now and possibly into the next generation as well.

<comment><USER47> Outside the US Netflix was pretty bad even before WB and Disney left the platform. Now it's bordering on ridiculous. Same with Amazon Prime, see my other comment [1]

I would "just enjoy what's there" if there was sufficient content. There's enough to go back to it once every two or three months, maybe.

[1] [https://news.ycombinator.com/item?id=24405780](https://news.ycombinator.com/item?id=24405780)

</comment></comment></comment></comment><comment><USER54> My company has been WFH since mid-March. I've loved being able to just start working instantly after waking up and finishing my morning routine, but one thing I've really missed is the 30minute drive home after work. That period of time was effective in resetting my brain from "work-mode" to "home-mode".

It's been hard going from shutting down my laptop straight to playing with my kids, it seems like I'm part-zombie at first and not as lively as I would be later in the night with them.

<comment><USER55> There has to be a better solution that WFO. For example, step out for a 10 minute walk outside.

</comment></comment><comment><USER56> Working remotely for years and I've never found it to be as good of an experience is a flexible office job.

One of the things I hate the most of the fact people just disappear and things then take way longer to get done.

The best jobs I've had is probably what Reed is describing in terms of attendance.

3-4 days in the office, flexible hours and some work from home options.

It's a good balance and I don't have to sacrifice some part of my house to being an office.

</comment><comment><USER57> I'm going to go against the vibe on this site and agree with him. The next Apple or Google definitely will not come from a remote working startup, and there's undoubtedly a lot of value from in-person collaboration. In a bigger company like Netflix this might be less important. A big part of this is the transfer of knowledge, which isn't as easy over Zoom calls.

<comment><USER58> I bet the next Apple or Google will use Linux, an operating system developed by a globally distributed remote team, or other open source technologies.

<comment><USER49> Uhm... You're vastly underestimating the amount of work that companies like red hat and size put into both GNU and Linux.

Yes many of the maintainers and key people are allowed to work remotely, but a lot more people work in the office.

I don't want to against the general WFH vibe, but that statement is hardly 100% true.

<comment><USER59> Unless those companies are all in the same building, that's also distributed...

<comment><USER49> Lol ok I guess?

</comment></comment></comment></comment></comment><comment><USER60> I have been remotely working for years, and had thought about applying to Netflix, but if they don't have plans for remote work to continue, then I'll consider other jobs.

</comment><comment><USER61> One of the big downsides I've found with my company being remote for about 6 months now is the nearly constant issues with tone and attitude in communication channels like video calls and Slack.

I listened to one coworker tell another that they had no sense of humor and were too "by the book" and it was disrupting the ability to communicate.

When a fraction of people worked remotely, this virtually never happened, because with only a small set of people working remotely, people had the mental bandwidth to devote a little extra time being sure to interpret their tone charitably, check for assumptions and follow up more often with them to fill in communication gaps that in-person gestures and signals would avoid.

But when everyone is remote, it's like taking the attention and time budget you have and dividing it by a much larger pool of people. It's simply intractable for a human to spread their attention like that and remain diligent and focused on communication metadata about every pairwise colleague interaction channel. It spreads you too thin and you run into extremely exhausting ego depletion and decision fatigue from all these little micro communication assessments you have to make that our brains are just not setup or wired to handle because we're so adapted to analog facial and voice analysis with gestures and cues.

I despise loud, distracting open floor plans deeply, but the pandemic time period has made me deeply question whether fully remote work would actually be better. I feel way more tired and mentally exhausted from remote work, and casually I've noticed many, many more arguments and short fuse communication issues with everyone in my company.

I think it speaks to the evidence that the most cost effective office environments for knowledge workers, even in dense urban centers, from the point of view of pure short term cost savings to the company, are environments where every individual knowledge worker has a private office with a door that shuts, combined with separate communal workspaces for the extreme minority of people who either need a mix or need more extraverted / social work environments instead of quiet / private workspaces.

That way meetings naturally happen in person and it's low-cost to setup meetings, grab coffee together, grab lunch, etc., while still preserving the remote work benefits of privacy and quiet.

Unfortunately though my experience working remotely has taught me that avoiding a commute is deeply not a good reason to be remote, because the costs in terms of worse work experiences and worse communication are way too high.

</comment><comment><USER62> Looks like I'll never work at Netflix!

</comment><comment><USER63> "Politics is tough because in many ways people elect people who lie a lot. In business, we really try to avoid that. The skills to succeed in politics are really quite different than in business."

I disagree with this on multiple fronts, but certainly lots of business is built around lies and perception.

</comment><comment><USER39> I'm noticing a theme in this thread, which is the literal interpretation of the CEO's comment, paraphrased as "WFH has no benefits".

Try to understand that this guy is cargo-culting. He's selling a vision (and a book) -- that the Netflix way of doing things is superior to the average way of doing things. I'm sure deep down inside he knows WFH has benefits, but acknowledging them would go against the culture he believes is required to keep Netflix at the top.

Many times he used sports as an analogy, and I will too -- the greatest coaches in history say and do odd things to inspire greatness. You might not agree with them, but you can't deny the results.

<comment><USER64> This is my take on it as well, and some other quotes like this one also show that he's somewhat exaggerating for effect:

WSJ: Do you have a date in mind for when your workforce returns to the office?

Mr. Hastings: Twelve hours after a vaccine is approved.

</comment></comment><comment><USER65> i've read articles that suggest the line between work and life is actually more blurred due to WFH and people just end up working longer. logically it makes sense when it's all happening in your home.

<comment><USER66> You just need to ask any PhD grad student why work from home is harmful for work-life balance. Once the boundary between home and work gets blurred, stress from work starts seeping into your personal life. Burn out rates among software engineers will be through the roof if WFH continues for a few more months.

<comment><USER67> > Once the boundary between home and work gets blurred, stress from work > starts seeping into your personal life.

For me the fact that the line between work and home gets blurred reduces stress by a huge amount. No longer do I have to do all my work in a specific 8-hour window. I don't have to be 'on' for 8 consecutive hours anymore. I can do a few hours of work, do some mindless chores around the house, then go back to work. If I'm stuck on a problem, I can just take a break instead of sitting at my desk going in circles. I'm more productive and more relaxed since the start of the lockdown.

In addition, just the fact that I have access to a fully equipped kitchen makes a world of difference when it comes to breakfast and lunch.

</comment></comment></comment><comment><USER68> glad i dont work at netflix

<comment><USER69> I sorta had the impression that they were going to be WFH for the duration of the pandemic, so unless the boss is trying to prepare the ground for a change, I guess he's just complaining?

<comment><USER68> yeah but alot of companies are also becoming more open to longer term wfh arrangments

</comment></comment></comment><comment><USER70> "Debating ideas is harder now... I don't see any positives. Not being able to get together in person, particularly internationally, is a pure negative."

Some of this might be personality differences, but it sounds like how Reed Hastings experiences work is very, very different from how I experience work.

</comment><comment><USER71> > Netflix's chairman has said working from home has no positive effects

No positive effects for him. Maybe. And even that is pretty dubious considering we're in a pandemic and nobody is at their best.

<comment><USER72> And the layers and layers and layers between Netflix' CEO and non executives probably mean he has almost no idea what he's talking about wrt general employees.

<comment><USER73> The layers of "Yes men" are likely in agreement with whatever he believes

<comment><USER74> And in all likelihood have very little to do but attend and hold meetings.

<comment><USER75> Ya, I suspect this very fact is going to keep wfh from becoming a broad reality. There is a lot of upper middle management that have nothing to do but meet with people. If talking and collaborating is all you do then you are going to push for in person.

</comment></comment></comment></comment></comment><comment><USER76> Coming to the office once a week on friday made me realise how starved I was for social connection.

</comment><comment><USER77> What do work do people at Netflix do anymore besides writing blank checks for D-tier Hollywood garbage that no real studio wanted? Their app has been stagnant for the past 5+ years and the delivery issues seem to have been solved some time ago.

</comment><comment><USER78> I always wondered how most of the open source software like apache projects .. linux etc got built ? I guess it is "Work from home".

</comment><comment><USER79> This is an obvious statement. Working at the office surely has negative effects too. This is a really personal matter.

</comment><comment><USER80> From their Culture Slides and overall stories about Netflix, it seems they are a bit different from most companies, read: move more slowly but more predictably.

Yes, as a lot of people I've been feeling negative effects of prolonged WFH however this talk of WFH "makes debating ideas harder" just makes me roll my eyes. I don't think there was anything I didn't manage to do over a quick zoom call compared to what's doable in person.

</comment><comment><USER81> I mean, they are a glorified streaming company. Probably hard to keep up the motivation for that at home.

</comment><comment><USER82> my take on wfh trend is that it turns the workers office into a gig economy and by 2021 having a job with an actual office in the same metro will be a perk. Then the start of a new cycle will begin.

</comment><comment><USER83> Wasn't there a story awhile back about how Netflix does like ritualized firings, guided by all kinds of weird dark, internal politics? Probably harder to do over Zoom.

<comment><USER84> A lot of employers have turned their culture more into a cult than anything else. I feel the same way about working for AWS.

</comment></comment><comment><USER84> I stopped subscribing to Netflix. Their recommendation engine is honestly terrible. They'd be much better off using curated genres.

<comment><USER20> I suspect that they have an overengineering vision. This could originate from a culture very strongly (excessively, in this perspective) centered on engineering.

They have a very positive view of their recommendations, like they have of their customized thumbnails.

Yet I, and all of my friends, find the recommendations nearly useless, and I also find the thumbnails mostly ugly.

<comment><USER85> Yeah it's really bizarre just how bad the recommendations are, even after all of these years of development and data collection. Offsite lists and personal recs are the only ways I've found new Netflix shows I like.

</comment></comment></comment><comment><USER66> Fully agree. Working from home is pure hell. I can't wait to go back to in- person office, once the vaccine is out. And if my employer mandates WFH policy even after vaccine, I'll look into renting a personal office space at least 2-3 miles away from my home. Just so I can get my commute and structure back into my life.

<comment><USER42> I'm genuinely curious why it's pure hell for you.

<comment><USER66> Lack of clear boundary between work and home, mainly due to lack of commute but also due to spending all day at home. Lack of in-person social interactions at work. More procrastination leading to less productivity and having to work longer hours to make up for it. Etc etc.

</comment></comment></comment><comment><USER86> This is a very interesting comment so will add some thoughts to this

WFH has a huge difference in result depending on who you are, when you are (in your career), and where you are in a company (or organization).

 __* agreed 100%

\-- For the budding young developer who can't wait to show ideas to teammates and demonstrate being a go-getter by asking random questions and finding unaddressed issues to innovate on, WFH might be terrible. You're going to schedule time to fortuitously run into the senior person who takes an interest in your idea?

* yes, for people who don't know how stuff works, company culture, how to get things done

this is very bad

\-- For the working parent whose productivity has been slashed by 50% and stress has gone up by 50% due to parenting obligations, WFH might be terrible.

* pretty sure there are more parents who wish they could WFO than want to work from home and also homeschool their kids

\-- For the middle manager who can coast along and not need to move greatly in his/her career, WFH might be great.

* depending on company 'coasters' can be 20% to 70%. For all of them WFH is superb because no one knows whether they are working hard or coasting. All their tricks like having certain things set up and certain screens on their monitors etc. - not needed any more

\-- For the developer who works by tickets on very concrete things and this is nothing new, WFH might be great.

 __highly focused developers who like to shut off everything. WFH is great

Except the PM/Project Manager/Tech Lead goes crazy because then developers start making what they find interesting and there is no way to keep them on track

\-- For the small company CEO who relies on force of personality and everyone in the same room urgently working to get something done, WFH might be terrible.

 __* yea, this is absolutely terrible for anyone who has a leadership role

much of the work you get done is by leadership, and sometimes by leadership by force of personality or by 'created' consensus

good luck getting that in a WFH scenario

 __ __ __ __ __ __ __ __ __ __*

The real test of WFH will be when we see how companies that choose WFH after Coronoavirus, do compared to companies that go back to WFO

lots of tech companies are slobbering at the thought of cutting out office costs and paying employees less

my money is on such companies getting trounced by teams that work together and interact in an office environment

Right now we are in the honeymoon phase of work from home and very few (if any) real products are being launched that were started after coronavirus forced work from home

let's see how people feel in a year or two

It just takes 1 or 2 lazy people to bring down an entire product launch. WFH makes it very hard to figure out who these slackers are, and even harder to cover up their mistakes/flaws

Mythical Man Month is even more dangerous when WFH scenarios are involved

</comment><comment><USER87> Url changed from [https://www.bbc.com/news/technology-54063648](https://www.bbc.com/news/technology-54063648), which points to this.

</comment><comment><USER88> It's amusing reading all of the HN comments that insist that any attempts to _not_ work remote must be some ploy by "the suits" and act like remote work is some panacea for all the problems in the world.

My very large tech company did a survey this summer about remote working conditions. Out of tens of thousands of respondents, _less than one third_ said they wanted to continue working 100% remote. Nearly half said that their work/life balance was _worse_ when working remotely. Over one third said they are less productive.

HN lives in a bubble of pro-remote talking points. In reality, most of the tech workforce (to say nothing of the non-tech workforce, which I assure you is much more anti-remote) does not enjoy it.

<comment><USER87> Please don't frame comments like this as sneers at the community. Perceptions of the community are extremely subject to bias (see [https://hn.algolia.com/?query=notice%20dislike%20by:dang&dat...](https://hn.algolia.com/?query=notice%20dislike%20by:dang&dateRange=all&page=0&prefix=true&sort=byDate&type=comment)) and it detracts from the substance of your argument. The community here is simply divided on divisive topics—reality is that tautological.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER88> It's disingenuous to frame my comment as a "sneer", and censoring (via pushing this comment down, when it was previously the top comment of this thread) mentions of community self-introspection is doing this community a disservice. If it truly is not a bubble, then my post would not have been upvoted to the top comment of the thread. Clearly it was something that people wanted to discuss prior to your intervention. Living within an echo chamber is a bad thing, both for the community and for society in general, and HN should be able to discuss that without your intervention.

<comment><USER89> Your comment was previously near the top because newer comments always start near the top. It's gone down because it has failed to attract enough upvotes and newer comments have taken its place. It doesn't take a moderator shadowban for a negative comment to lose ground on HN.

<comment><USER88> I know how HN works, but thanks for explaining it. New comments are only given the top spot for a small time period. My comment was at the top long after said time period, because it previously had more than enough upvotes to stay at the top (in fact, it actually had been knocked down to middle-ish of the thread, and then garnered enough upvotes to again be the top). As soon as dang commented, it suddenly was at the bottom.

</comment></comment></comment></comment></comment><comment><USER90> From my experience at some workplaces, Netflix was 'a pure negative' for office work. Every time there was a popular show, which was several times a month, productivity at the office noticeably took a toll.

I particularly remember some colleagues behaving like zombies for a couple of days after spending their night sleep hours binging on the platform.

</comment><comment><USER91> I see a lot of comments about pro WFH (family, more relaxing work schedule, kids/pets around) and against WFH (less collaborative, can't read body language, a quick IM is slower then a simple live question for next chair) and while Netflix mainly talks about them - it actually boil down to one thing only -> SEX.

Humans are a social animal and we like crowds. And with less physical work required then in past centuries jobs became more a brain exercise and less muscle required and with that means our brain requires more stimuli. And what is the easiest way to entertain brain? SEX. It's way more easy to work with a beautiful colleague alongside, it's more easy to take a coffee break and stroll through HR area to "cleanse the eyes" over "Janet" there. That's all about for those who hate WFH and are missing office. They can say a crap load of reasons why they don't like WFH but it boils down to one reason that absolutely nobody will talk about and that's SEX.

<comment><USER92> Lmao, you might be alone on this one. Also, doesn't your theory mean that child-free monogamous couples who both WFH are the real winners?

<comment><USER93> As one of these people that's absolutely correct, it rules</comment></comment></comment>


The US used a standard issue $5.50 flag on the moon - <AUTHOR> http://www.jsc.nasa.gov/history/flag/flag.htm <comment><USER2> That's what you got from this article? I don't even understand why that's surprising. Did you expect them to use a specific moon flag?

I guess I also wouldn't be surprised if they used a flag specifically resistant to bleaching in the sun, I suppose.</comment>