Docker to rate limit image pulls - <AUTHOR> https://www.docker.com/blog/scaling-docker-to-serve-millions-more-developers-network-egress/ <comment><USER2> I originally came here to ask how folks use that many docker images in six hours (I'm mostly a Docker n00b, and not being facetious); however, after reading the article, I clicked to see how much unlimited is and it's $5 a month. Now my question has changed to: is $5 a month really a deal breaker for folks to get unlimited? Or what are the use cases where the cost is prohibitive? Open source or community projects?

In most cases it would seem $5/user isn't much as a business or organizational expense, and if it's a personal project 200 images in six hours seems pretty solid?

I'm just sort of shocked it's so cheap. I figured it'd be like $25-$100 a month or something just because of all the bandwidth someone could probably burn building random/broken shit over and over.

I'm mostly curious because I've considered using Docker recently for personal projects and my home server; but I'd rather not invest a bunch of time porting things only to find out it's gonna be way more than $5 (not including my time).

Or is it that hard to just build your own images? To be honest, I've never really understood that part of Docker (using other folks images)... It always seemed like an enormous security risk[1]. FWIW, I still deploy my personal projects using chef/ansible, shell scripts, and systemd units like some sort of curmudgeon-y monster...

[1] Everything is a security risk (APT, source, etc), I know, I get it. No one need scribe miles of pedantry into the comments explaining it to me. It's what each of us has tolerance for and can accept that matters.

<comment><USER3> $5/month isn't $5/month. It's convincing your boss you need $5/month, because they need to convince their boss, which eventually makes its way up the chain to C-levels, who don't know Docker from yesterday's rotting tuna casserole and view eating either that _or_ the $5/month with the same level of disdain.

It isn't about the money, it's about the Mommy-May-I up and down the chain with emails and meetings and careful explanations to skeptical glares. It's a psychological and institutional barrier.

<comment><USER4> If your C suite is personally approving a $5/month charge, your organization is likely no where near the size where a change like this from Docker impacts you.

<comment><USER5> Or maybe your organization is a public institution, where each penny spent needs to be authorized/accounted for.

<comment><USER6> > It was revealed on January 22, 2009 that Thain spent $1.22 million of > corporate funds in early 2008 to renovate two conference rooms, a reception > area, and his office, spending $131,000 for area rugs, $68,000 for an > antique credenza, $87,000 for guest chairs, $35,115 for a gold-plated > commode on legs, and $1,100 for a wastebasket. Thain subsequently apologized > for his lapse in judgment, and reimbursed the company in full for the costs.

> > [https://en.wikipedia.org/wiki/John_Thain](https://en.wikipedia.org/wiki/John_Thain)

"Sorry I got caught. I will work harder to hide next time."

</comment></comment></comment></comment></comment><comment><USER7> Good!

I'd even welcome much more agressive limits than what they're proposing; the current culture regarding builds and CI in general is horrifyingly ineffficient, wasteful and in the end just plain slow.

I'm looking forward to developers adjusting their workflows (and caches, etc.) to actual, reasonable limits, not just perusing the service as if it were an unlimited cost-free cornucopia of software.

<comment><USER8> > the current culture regarding builds and CI in general is horrifyingly > ineffficient

I used to be in charge of the website for a company you've heard of. We once realized some huge proportion of our traffic originated from a hosted CI company requesting the site thousands and thousands of times (guessing one for each build they hosted) every 5 minutes.

I can't remember what proportion of traffic it was but I'm pretty sure it was a majority, maybe even more than 80%.

<comment><USER9> I sure hope the "cloud first" advocates are happy now, because they have managed to create masses of developers who have next to no idea that what they're doing is an incredible waste of resources. These are also the same people who are perplexed why their systems intermittently fail, or are surprised that they do when the Internet connection cuts out for a bit.

</comment></comment></comment><comment><USER10> There is very little reason for a build node to need to pull 200 images in 6 hours, and here is why:

When a machine issues a ``docker build`` command, the program reads the relevant dockerfile to check for any base images that need to be pulled (a la "FROM:")

These base images are identified based on the image repository, image name, and image tag. The first thing docker does is it checks its local registry and tries to find a match for the base image the docker build is requesting. If a matching image is located in the local registry, it uses that one in lieu of downloading the image.

This is significant - if your organization only uses a few dozen base images from DockerHub, those images will only be downloaded by each build node _once_, then never again.

Many docker users erroneously believe that if their Dockerfile requests a "latest" tagged image, docker build will always download the newest version of the image. However, the "latest" tag is literally just a tag, it doesn't have any special functionality built in. If the docker build command finds an image tagged "latest" in the local registry, it stops there.

The only way to get docker build to always use the "actual latest" version of the base image is to add the "\--pull" parameter to the docker build command. This arg will tell docker build to check the repository remote to see if the SHA hash of the image tagged "latest" has changed, and if so, re-download and use it. In the absolute worst case, this means each build node will pull 1 copy of each base image when the base image is updated. So unless you use 200 different base images that all have updates deployed to Dockerhub each and every day, you are fine.

<comment><USER11> I don't disagree with what you are saying, _but_:

> Docker defines pull rate limits as the number of manifest requests to Docker > Hub.

> For example, if you already have the image, the Docker Engine client will > issue a manifest request, realize it has all of the referenced layers based > on the returned manifest, and stop. ... <excluded> ... So an image pull is > actually one or two manifest requests,

This still implies that even if you are appropriately re-using layers on your machine, with a free plan you can only do maximum 200 builds (since docker still needs to verify it has the image) per 6 hours?

This change also seems to imply that builds steps which previously did not handle/require authentication against Docker hub (it was only pulling public images, and pushing elsewhere) will now be required to auth against docker hub in order to double the number of pulls/checks/builds it is allowed?

<comment><USER10> This is an excellent point. Trying to find out if docker build --pull without an accompanying blob download will trigger the rate limiter.

If it does, then this will definitely be a reason to riot. It will effectively mean that anyone who wants to do more than 200 builds every 6 hours using the "right" way will have to get a docker pro subscription.

<comment><USER11> It sounds like it definitely does trigger the rate limiter.

> There is a small tradeoff – if you pull an image you already have, this is > still counted even if you don't download the layers.

I expect we're just going to see a lot more recycling of build nodes once it has "used up it's docker credits".

<comment><USER12> All reasonable orgs should have had their private docker repo a long time ago.

Everybody else is living the pipe dream where they have externalised their risk and probably deserve the Docker treatment.

<comment><USER13> Yes but Docker achieved their goal of making it annoying as hell to not user DockerHub. Because you can run your own private repo just fine but what you _want_ is a transparent proxy (like apt-catcher) that will let you pretend you're using DH but actually pulling from either the cache or your private repos. All the pieces are there with private repos and "pullthrough" proxies they're just not well integrated, seemingly on purpose.

RedHat's patches to Docker make this possible but Docker has refused to upstream it.

<comment><USER12> > annoying as hell to not user DockerHub

Why? All your need to do is to use your domain name when referencing the image.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> I kinda wonder if Docker as a company is struggling. Redhat made Podman which is a compatible replacement, Then there's swarm but apparently that's not recommended and actively developed anymore, then as far as I know they sold off their enterprise clustering product. Seems Kubernetes is the popular thing now even if a bit complex to setup. Wonder what the current business model? Pretty neat idea of using containers, but seems they put it out in the wild, got popular and sorta lost control with so many competing options being released.

<comment><USER15> > Redhat made Podman which is a compatible replacement

I would actually prefer if they made an incompatible replacement. Docker's CLI is pretty bad in my opinion.

I want to use Docker the same way I use a headless virtual machine running an SSH server. I want starting/exiting containers to be independent from their 'main process'. I want to attach/detach whenever I need to and execute arbitrary processes.

\-- Just use /bin/bash as the main process

This seems to be the workaround, but I always have problems with containers exiting when I don't want them to and it's just harder than what it needs to be. I've spent a total of like 6 hours learning Docker and I still don't know exactly how to achieve this simple workflow without my containers quitting on me or attach/detach issues. With VirtualBox I can do this easily. Am I too stupid to use Docker?

\-- Then just use VirtualBox

That's what I do, but I would like not to have the overhead of a vm.

<comment><USER16> > I want to attach/detach whenever I need to and execute arbitrary processes.

Isn't "docker exec -ti container-id /arbitrary/command" enough for that?

<comment><USER17> And if you want a shell? Just use "bash" as the command.

</comment></comment></comment></comment><comment><USER18> Yes, good. After reading the comments on their image retention limits [0] talking about simply pulling the images all the time to keep them fresh, this seems like a reasonable response.

I'll repeat what I wrote there [1]:

If people really think this is a problem, they'd contribute a non-abusive solution. Writing cron jobs to pull periodically in order to artificially reset the timer is abusive.

Non-abusive solutions include:

\- extending docker to introduce reproducible image builds

\- extending docker push and pull to allow discovery from different sources that use different protocols like IPFS, TahoeLAFS, or filesharing hosts

I'm sure you can come up with more solutions that don't abuse the goodwill of people.

\</comment><comment></comment><comment></comment><comment></comment><comment>-----

Additionally, hosting a local network docker repo would mitigate this rate limit completely. Or straight up pay. It's not that difficult. Getting mad about a free, open-source service becoming pay to use... I couldn't imagine the gall and conceitedness.

0: [https://news.ycombinator.com/item?id=24143588](https://news.ycombinator.com/item?id=24143588)

1: [https://news.ycombinator.com/item?id=24144475](https://news.ycombinator.com/item?id=24144475)

<comment><USER19> > introduce reproducible image builds

This is a great idea in concept, but in practice very challenging.

RUN curl [https://www.random.org/integers/?num=1&min=1&max=99999](https://www.random.org/integers/?num=1&min=1&max=99999)

Docker will cache this after the first invocation. The build is not reproducible. Now what?

Replace "curl random.org" with "nondeterministic and really expensive code build/model training/etc operation".

> extending docker push and pull to allow discovery from different sources > that use different protocols like IPFS, TahoeLAFS, or filesharing hosts

This is great, if you can solve the image integrity/trust issues therein, which should be just some signing/merkle tree work.

</comment></comment><comment><USER20> Ugh, I don't envy their position. There are many ways to reduce the size of a docker image. I'm guilty too. Probably the best thing to do is leverage multi- stage builds. Those have the largest effect on repo size. (Like a 10x reduction often).

The problem is, docker, the company behind the repo, has no control over what Open Source Joe and Developer Suzy are committing and the other developers pulling down their images. They can send out all these notices and announcements, and I think the typical reach of such things probably gets like what, %0.05 percent of the developers it needs to?

And of those, are any willing to rewrite the image to be smaller?

<comment><USER21> Well, they could use different rate limits depending on the size of the image. Say if the image size (or the size of the added layers) is in line with what we want for dockers you could offer different rates. Unlimited for images <10MiB, high limits for <100, and low limits for everything else. That way they both push for small images, and keep everyone happy.

Or people will just add a proxy/imagestream in between instead of directly pulling from docker hub.

<comment><USER22> Or you just do it the easy way and limit the speed based on the amount of data downloaded so far, with the history being 'lost' after 6 hours. This way you also prevent someone from doing dumb things to get around it, like using multiple connections (or in this case, multiple layers for a project that doesn't actually need them)

<comment><USER21> That is possible but it means distributing the total amount of data to all the nodes. Luckily it doesn't require correctness but it is more complicated to setup regardless.

</comment></comment></comment></comment><comment><USER23> This is the future of containers:

[https://guix.gnu.org/](https://guix.gnu.org/)

[https://nixos.org/](https://nixos.org/)

You can build a Docker-compatible image from a Guix or Nix package. You never have to use Docker or Docker Hub.

The limitation of Docker is that the nice semi-reproducible sandbox you get exists on top of an operating system that was not designed for it, resulting in giant blobs to get it to work. It's inefficient and a band-aid stopgap until we get to the future where the operating system is a pure function (which can be versioned in a tree, diffed, reverted, etc. just like git). If you used NixOS, you wouldn't need Docker. Sure, it's available and you can use it, but you wouldn't need to.

<comment><USER24> It works fine though and a lot of companies have valuable time and process built on top of it. However I'm all for natural selection, if these are better products may the the best container win

</comment></comment><comment><USER25> Honest question, but why can't docker use something like bittorrent to download images?

Most of us download our OS via torrents only, so we may as well download the images too if there was support for it.

<comment><USER26> How would bittorrent work in companies? Only HTTP traffic is allowed and often only when going through the company proxy.

<comment><USER27> You could have a mixed mode pretty easily. Heck, it would even be pretty efficient.

For your own company, you'd host a swarm that is firewalled in. Then when someone says "I want image xyz" the first thing you do is look for seeders in the swarm for that file. If non exists, then you initiate an http download from docker to get the image.

Now you've got fast distribution with low external network traffic.

Not sure how this would play with Cloud provider pricing, though. I don't believe AWS would be too happy seeing their services turned into BT swarms :)

</comment></comment></comment><comment><USER28> I see a lot of people mentioning the low cost, saying that it's no big deal. It's not the cost that I find annoying; it's dealing with credentials and secrets..

<comment><USER29> And docker hub account management and security management options have always been _horrible_. For example, I can't create a login token exclusive to one organization or repo on docker hub, meaning anywhere i use those credentials is a potential security risk to ALL my orgs and projects.

</comment></comment><comment><USER30> Okay, now can you finally accept patches about the default registry?

[https://github.com/moby/moby/issues/1988](https://github.com/moby/moby/issues/1988)

[https://github.com/moby/moby/issues/4324](https://github.com/moby/moby/issues/4324)

Or we're still stonewalling?

</comment><comment><USER31> I setup a local docker cache using a docker image. The transition to HTTPS everywhere makes caching this sort of thing difficult. One has to install and often manually configure trusted certificates on every client to maximize the cache.

APK and APT caches often come hand-in-hand for this sort of thing as the logical next step is to add some OS packages to the pulled image. This also benefits from local caching and also means frustrating cache setup, certificate setup, etc.

To maximize local caching there's a lot of manual work to setup a house-of- cards series of proxies that only work on the network. Setting it up on a laptop then traveling means everything breaks in not-so-obvious ways when you leave the network.

</comment><comment><USER32> Does anyone have any good ideas on how the Docker Hub could be monetized in a way that's user friendly and makes sense?

AWS, GCP, Azure, DigitalOcean and even GitHub / GitLab all have private container registry offerings.

If your stack is on X provider, chances are you're going to use their private registry service instead of using the Docker Hub because you've gone all-in with that provider. That means private repos alone isn't enough to get folks to pay for Docker Hub.

<comment><USER33> take over supply checks?

E.g. make base images for programming languages, systems, etc and guarantee security.

I think many small companies would like it a lot better if they got could externalize the cost of running docker images with all their dependencies.

<comment><USER34> This what Cloud Native Buildpacks do. There are already three major suppliers of these: Heroku, Paketo (by Cloud Foundry folks), and Google Cloud.

I'd be pretty thrilled if Docker encouraged buildpack use. It would be a huge win for them.

</comment></comment></comment><comment><USER35> This is good, just like pruning old images. What's bad, and what Docker isn't saying, is it was a mistake to ever allow unlimited free plans. Independent of scale. Setting up an expectation of unlimited free hosting and bandwidth at any point of a business is bad. Tuning knobs of paid hosting and services at all tier levels, with a _limited_ free tier, should have been baked in from the beginning, and would have led to a much stronger business.

<comment><USER36> I don't think it was a mistake per se, it was part of their growth strategy. Their biggest problem is that they never really managed to capitalize on the market (and kubernetes happened), so now their plan B is to effectively reduce costs of docker hub or get some money out of the people using it.

Completely understandable imho.

</comment></comment><comment><USER37> Want to see if you're affected?

kubectl get pods --all-namespaces -ojson | jq -r '.items[].spec | .containers[] // [] += .initContainers[] // [] | .image' | sort | uniq | less

... and look for anything that's not from a private registry that you control.

Give people two months to migrate? What a nightmare.

<comment><USER38> Giving people over a certain limit two months to migrate or set up a cache or give them a few dollars. What a non-nightmare.

</comment></comment><comment><USER39> I guess CI services like Github Actions could be easily hitting these limits (100 pulls per IP per 6 hours).

<comment><USER40> I'm thinking the same thing. GitLab has shared CI runners that probably do a lot of image pulling. Hopefully they have plans to implement their own docker registry cache.

<comment> tr-gitlab GitLab PM here - we have a feature called the [Dependency Proxy]([https://docs.gitlab.com/ee/user/packages/dependency_proxy/](https://docs.gitlab.com/ee/user/packages/dependency_proxy/)) that allows you to cache images from DockerHub. Currently this only works for public projects, but we are working on adding support for private projects now: [https://gitlab.com/gitlab- org/gitlab/-/issues/11582](https://gitlab.com/gitlab- org/gitlab/-/issues/11582).

</comment></comment></comment><comment><AUTHOR> This seems incredibly likely to break development use cases at both extremes: CI/CD systems and developers just starting out could end up pulling quite a few images per hour. Imagine if NPM, Ruby Gems, and so on rate limited package downloads until you paid!

I'm not sure if there's a _better_ way to monetize the Docker Hub, but this seems so hostile to adoption.

<comment><USER41> > Imagine if NPM, Ruby Gems, and so on rate limited package downloads until > you paid!

Sounds like an entirely reasonable thing to start imagining.

Reliability, safety, determinism and predictability are not thrust upon someone from the commons.

I frankly find it someone atrocious and abusive that downstream systems do not adequately cache these assets. The main archive repositories should be the source of truth, but they also don't need to be the fountain.

<comment><AUTHOR> Do you think NPM, Ruby Gems, or others would last long if they were so user hostile? Would Node have grown into the genuinely useful development environment it is if free users were limited to 10000 package downloads an hour?

It's so unbelievably user hostile that it seems like the result will be people just stop using Docker. The right solution for Docker is probably to spin off or monetize the Hub in a different way.

Imagine if GitHub started charging users for git cloning too many packfiles per hour.

<comment><USER42> All these things cost money to run why would it be surprising if they cost money to utilize their resources beyond a point?

<comment><AUTHOR> You can either monetize the thing that brings you business directly, adversarially impacting users.

Or you can monetize something else that's correlated to those costs to subsidize the main use case and keep new user acquisition frictionless. Like NPM charging large businesses with special needs with NPM Enterprise, or GitHub with teams and CI/CD features and GitHub Enterprise, and so on.

Docker sold off Docker Enterprise. Now they're trying to extract rents from people who are just trying to "docker build", a command whose ease of use is what drove people to use Docker in the first place.

Foot, meet gun.

Docker is breaking their main selling point. "docker build" and "docker run" should _just work_. By breaking that expectation in subtle ways they risk alienating users. By advertising that they're willing to break their main use case, they're going to alienate businesses and early adopter developers like myself.

Now I'm looking for alternative registries and making sure that devops code I manage doesn't depend on Docker. That's surely not what they wanted, right?

<comment><USER42> Forgive my unfamiliarity. From the article

>We've been getting questions from customers and the community regarding container image layers. We are not counting image layers as part of the pull rate limits. Because we are limiting on manifest requests,

> For example, roughly 30% of all downloads on Hub come from only 1% of our > anonymous users.

The limits appear to be 100 pulls per 6 hour time frame per ip address for anon users and twice as much for authenticated users. The least favorable reading of this is to assume a rolling period so lets roll with that. Pun intended.

According to docker whom I imagine is in a better position to evaluate the situation this will impact almost no users. Logically properly caching downloads seems like it would improve local performance. Do you really need, given the possibility to cache downloads, to pull a new image every 1.8 minutes in environments where paying $5 a month for individuals or $25 a month for a team would be prohibitive?

I'm going to assume that orgs manage a variety of one off and recurring expenses. I don't see how this is any different.

What I think is the most salient point is that docker is not a new endeavor. They already have many users. Acquiring new people who consume resources and pay nothing isn't a valuable proposition for them. Why would it be? Do you wish you had more roommates living with you eating your food and paying nothing towards the rent?

<comment><AUTHOR> > Do you really need, given the possibility to cache downloads, to pull a new > image every 1.8 minutes in environments where paying $5 a month for > individuals or $25 a month for a team would be prohibitive?

Given that even a "docker build" does a manifest pull, it's not just "new images", but existing ones as well.

Now expand that to a team that say, builds 10 images in parallel using Docker Compose. Now it's a build every ~18 minutes will hit the limit. Larger builds, like say a CI system building every time there's a push to a branch? Yikes.

I've expressed my thoughts in detail here about why I think they should find another avenue to monetize Docker: [https://twitter.com/AaronFriel/status/1297988737981247488](https://twitter.com/AaronFriel/status/1297988737981247488)

</comment></comment></comment></comment></comment></comment></comment><comment><USER43> MS should just buy them and put out of their misery.

</comment><comment><USER44> We have seen that a thousand time with google products and co.

First, you have unlimited, then you have reasonably large limits. The rational is "limits are needed to reduce abuses and should not impact normal users".

Then, it starts to be mandatory to be authenticated. Again, officially for reducing abuses.

Once everyone has an account, and are used to limitations, free limits are reduced again, little by little, and finally to the point where you need to take the "pro" offer to have a normal usage.

</comment><comment><USER45> I'm very conflicted about this. On the one hand, I recognize that there are potentially significant costs to be born to serve these repositories. On the other hand, making docker part of your infrastructure requires a certain degree of availability.

At some level this seems to me like using my IDE and after 6 hours it would stop working or finding that my CDNJS references to bootstrap stopped working after 6 hours of my site being up. I think it is exactly as if NPM or PIP were to stop working for the day if you included "too many" packages.

I don't really have a good feeling for how these new limits might impact setting up new dev/test environments so I'll likely switch from using specific images to using generic images to limit my exposure.

For example, at the moment, if I want a new dev container for a project in python, I'll _FROM python:latest_ and supplement with pulls from support service containers like nginx:latest and postgres:latest.

Moving forward, it would seem a safer approach will be to use pull a single 18.04 image and run the required installs into them. This super bums me out though as it seems to bypass some of the nicer aspects of getting up and running with docker.

<comment><USER46> Do pulls for a "latest" tag bypass the cache?

<comment><USER47> No they don't, but if you do something silly like spin up a bare VM build node, and then pull your environment every time, then obviously you won't get any caching.

<comment><USER48> Github Actions? Gitlab CI? Many of those don't do any caching because of the chance of poisoning a tag in the local registry, and don't have a good way to do caching per project.

I can imagine that this affects those sorts of operations.

<comment><USER46> Yeah, that's what I was getting at - in CI I can see it, but in local dev it would seem surprising to need more than the free-with-authentication quota.

That said, if your CI needs more, it's probably time to invest in a paid account if you can, and certainly if you're commercial.

</comment></comment></comment></comment></comment><comment><USER49> Why don't they move to a P2P model? Something like BitTorrent DHT or IPFS? DockerHub itself can just be used if the image is scarce and to penalize free riders.

<comment><USER16> Ipfs is already implemented. [https://blog.bonner.is/docker-registry-for- ipfs/](https://blog.bonner.is/docker-registry-for-ipfs/)

But it's on you to use it. (And it doesn't solve the metadata queries the way I understand it)

</comment></comment><comment><USER50> Also worth mentioning they added a 6 month retention policy for unpaid accounts. [https://www.docker.com/pricing/resource-consumption- updates](https://www.docker.com/pricing/resource-consumption-updates) If you don't want your images disappearing, you should probably move off of Docker Hub. (That said, I don't think there's any reason to continue using Docker Hub, even with a paid service. I suspect such docker services will be discontinued gradually.)

It's not hard to run a registry yourself. [https://docs.docker.com/registry/deploying/](https://docs.docker.com/registry/deploying/) Registry supports all sorts of storage backends (files, S3, GCS ...). It's just a stateless HTTP server. It's not hard to configure for production (it comes with decent defaults). If you deploy this to something like Google Cloud Run, you can get ~free hosting (sans the storage costs) for the "registry" itself plus TLS and autoscaling too (I should probably write a tutorial on this).

</comment><comment><USER29> The real reason this is a problem, is that docker hub has never focused on implementing standard and secure features for account management. Even with the recently implemented access tokens, there's no way for me to limit the scope of those tokens to a specific organization or image, and thus it's no different from a password.

That means if I build something from one organization, it's going to impact the ability to build something for another organization.

This effort seems to me like they are trying to disguise a last ditch effort to stay afloat.

Now that github, gitlab, and other great image repository options exist that don't lack these inherent security/integration features, anyone impacted can easily switch providers for no cost.

This new rate limiting won't help anything for docker, it's just going to kick off the exodus away from docker. Ironically, it's this account/security/integration stuff that they lacked focus on that lost them so much financial opportunity to begin with.

</comment><comment><USER51> Can't say I'm surprised. They must be incurring significant data costs. The limits seem reasonable at least.

</comment><comment><USER52> The sysadmin in me dies a little bit inside every time I realize there are shops that actually pull images for production from the global registry.

</comment><comment><USER53> Hrm, based on this: [https://docs.docker.com/docker-hub/orgs/#add-a-member-to- a-t...](https://docs.docker.com/docker-hub/orgs/#add-a-member-to-a-team)

I see that Docker doesn't actually offer an AWS-style enterprise account that one can use to hand authorization to developers without requiring those developers to make individual accounts.

It feels pretty sassy of docker to give everyone 2 months to shove credentials everywhere when docker themselves haven't done the minimum to make enterprise accounts realistic. Instead, they're adopting the github model of "oh, just ask everyone to make personal accounts and then include their personal accounts in the org team". That has problems.

Firstly, it puts employers in the unpleasant position of attempting to compel employees to make legal agreements with third parties (docker, in this case). The correct way to do this is AWS-style, where the org itself makes /one/ agreement and then delegates that agreement via access keys. This is the minimum I expect from enterprise account systems, hard fail for docker.

Secondly, it's a clusterfuck to manage. You end up with an org filled with random-arse account names that you can't really audit, and you don't know who has access to what. If employees leave the org, it's hard to ensure that their access is revoked because the access takes place entirely outside the standard account domains.

Github has recently improved this a shade by adding ADFS authorization to org accounts, but that involves asking employees to tie their personal (and all github and docker accounts /are/ personal) account to their work ADFS account, which is a shitty half-solution.

All things considered, docker made this problem for themselves. They've spent /years/ working hard to get everyone to make docker accounts and push everything to docker hub instead of fostering an ecosystem of registries by different orgs for different purposes. All of a sudden it's now "too expensive" and they're dropping the hammer on everyone to sign up and push credentials everywhere with very little warning, whilst not doing their half of the work by making a proper delegated authority account system.

Doesn't fill me with confidence for their future as a stable platform on which to base a business.

</comment><comment><USER29> People are also forgetting how newer docker infrastructures use multi-arch and multi-stage builds, meaning a single build could count for dozens of manifest hits, especially with distributed caching.

All the things docker has been working for to enhance the build tooling will now be more difficult to use, even if the user never stores a single image of their own on docker hub.

</comment><comment><USER54> Numbers seem reasonable. Does anyone have a quick guide for me to use ECR as a transparent cache or something?

</comment><comment><USER55> I'm hoping GCP/AWS steps up and creates a limitless docker registry. Considering the size of their infrastructure operations, I suspect this would be a small cost but bring a lot of goodwill.

One thing this is bound to do is to make the process of using docker a bit more complex. Explicit registries will probably start to be used everywhere, which is something I welcome. But it seems like a really poor decision by docker, the company to do this: they're going to drive people off using docker hub.

<comment><USER56> They have registries already which work with docker after an auth setup. They are generally private to you.

Yes, docker is a struggling company which sold some lines of business and is now trying to reinvent itself again towards developers. Given other recent moves, I'm not sure the new leadership understands how to do this.

<comment><USER57> They have registries but at least AWS' one is not free at all...

<comment><USER56> They all cost money, because it's expensive to ship bytes out of the cloud. Docker is likely going the way of the Dodo because they likely funded our free access with VC money.

They also probably made a bad assumption in that they could define the only container format before standards bodies got involved. Blitz Scaling was the mantra of the time, seems to have bitten those back who took a bite of that cake.

</comment></comment></comment></comment><comment> awinter-py yeah docker is both the best and the worst build tool

best because it's hermetic

worst because it's wasteful and isn't great at any kind of graph-based step caching (even with buildkit graphs, that's not going to integrate well with your package management and build tool)

</comment><comment><USER58> They want you to login, so they have better data for monetization

<comment><USER34> I think they want you to login because it's hard to monetize _anything_ while hemorrhaging cash to egress fees.</comment></comment>


What Makes People Fall for QAnon? – The Dispatch - <AUTHOR> https://thedispatch.com/p/what-makes-people-fall-for-qanon <comment><USER2> IMO, figures of authority have abused public trust to an excess.

Combined with the Internet, this has resulted in wide-spread distrust, which forms the basis for belief in false conspiracy theories.

The most easy to believe lies are those that are rooted in partial truth. Its too rich for politicans, elites, or social media giants to complain about conspiracy theories when they so regularly lie, cheat, or gain advantage behind firmly closed doors. The dissymmetry breeds mistrust.

<comment><USER3> Yes, and it happens when there are no _apparent_ viable alternatives, when there are alternatives such as The Grayzone, TJDS, Chris Hedges, Ralph Nader but they are buried, undiscoverable, inaccessible, and/or banished from the mainstream for going against nationalist fervor.

So, it's much easier for people to make up an imaginary bogeyman or "they" that they don't have to and can't do anything about because it psychologically excuses them from internal locus-of-control and taking the initiative against powerful forces who would likely crush them, i.e., Assange, Manning, or activists and reporters in Mexico or Russia. Conspiracy theories also give people a chance to tribally bond over some "secret, forbidden knowledge" when their lives are otherwise so entirely horrible and devoid of a sense of community.

</comment></comment><comment><USER4> [https://www.pewresearch.org/fact-tank/2020/03/30/qanons- cons...](https://www.pewresearch.org/fact-tank/2020/03/30/qanons-conspiracy- theories-have-seeped-into-u-s-politics-but-most-dont-know-what-it- is/ft_20-03-18_qanon_1/) (March 2020) is a relief (3% to me counts as merely a fringe of lunatics)

> _We 've only really been making a concerted effort on [the conspiratorial > mindset] for 12 years_

I'd say since the seventeenth century, but I'm a cynic.

[https://en.wikipedia.org/wiki/Age_of_Enlightenment](https://en.wikipedia.org/wiki/Age_of_Enlightenment)

</comment><comment><USER5> Ignorant layperson here.

"But it's like she just wants to be this warrior."

I think, for QAnon, this is especially relevant. Some people feel that they have no way to make a significant contribution. Child abuse is significant, and there's enough real child abuse for this part of the theory to hide in.

Also QAnon is "fun." Q drops are puzzles, and followers have to "do the work" to figure them out. "Researching" the drops only requires you to sit in front of your computer and scroll blogs and social media, and listen to podcasts.</comment>


Ask HN: Acquihire early stage bootstrapped SaaS advice - <AUTHOR> Hi,<p>I'm running a bootstrapped SaaS service in the software engineering space. It's really early and slowly getting some traction. A pretty big player in this market has approached me about a possible acquisition / acquihire. My service would become part of their portfolio of services. I've had talks with C-level and we're moving to a technical due diligence. I'm open to an offer, depending on the terms of course. Any tips from people who went through the same process? Should I have an NDA in place for the DD? Thanks! <comment><USER3> Haven't been through an acquihire process myself, but I am familiar with this sort of thing.

Yes, you should have an NDA and other agreements (e.g. an MoU) before you divulge serious details. Think of it like this: there are two possiblities, and you can't know in advance which is true: 1)BigCo is acting in good faith, 2) BigCo is acting in bad faith. In the first you have nothing to worry about. But if it is the second, after they've figured out exactly how you've implemented things, what exactly stops them from having their own techs build in a few weeks/months? An NDA/MoU or any other agreement doesn't mean you'll definitely sue them if they screw you over (mainly because you're not that rich), but it will give them just cause to think long and hard before doing so. If you have signed paperwork validating your stand, you can (theoretically, but also practically) raise a stink about the whole business, if they turn out to be "dishonest".

The more potential leverage (i.e. legal documents) you have, the greater the opportunity cost for them to screw you over - much easier to simply buy you out instead of copying your tech, and risking a furore in the media, and possibly with customers.

Understand that this is just business - just cost and benefit. They obviously have much to benefit from your tech, else they wouldn't be pursuing you. Make sure the potential cost of possibly screwing you over is high enough. If it is cheaper for me to simply copy you and profit, and know that you can't do a damn thing about it, I'd be damn stupid not to.

That being said, don't be a dick to an acquirer if you want to get acquired. Be upfront and ask for the paperwork. Call it a proof of good intentions. If they are genuine, they'll appreciate your situation and arrange it quickly. If they don't that's your first sign of trouble.

Good luck.

<comment><USER4> A corollary to this great answer, which I hope is apparent, is to get a lawyer who has experience with this sort of deal. A good one will be able to advise you through the whole process and tell you when they see red flags. Worst case you burn a few thousand dollars to prevent being taken for more. Think of it like insurance in that case.

To put it another way, it's usually cheaper to hire a lawyer to avoid a dispute than to resolve one.

<comment><AUTHOR> Parent's and your advice make a lot of sense. I have a lawyer that is in this space, luckily. They are in the loop. I was just curious of other experiences from the HN "hive mind".

</comment></comment></comment><comment><USER5> The real danger of going through this process is that you will get so enamored with this acquisition that the normal drudge of plugging away becomes uninteresting in comparison. They drag you along, you stop shipping, you stop growing and then they can offer you whatever they want or nothing at all. In the end, I don't think many people are very happy post acquisition, so if you feel good about your product and team, you might want to just stop talking to them and go back to work.

<comment><USER6> Or, worse yet, you spend a lot of time and effort on this acquisition, time passes, due diligence goes through, all of your team already expects it to happen, growth stalls, everybody slacks off - and then they cancel it completely at the last moment.

<comment><USER7> What I see happening at a larger scale company merger is the walkaway price clause. I wonder if it could be used here as a poison pill.

</comment></comment></comment><comment><USER8> One thing I've said to acquirers in the past is: "You're a big company that can afford to dedicate a person full-time to this deal for months with no impact to your company's focus and bottom line. We're not. I'm excited about this opportunity, can we brainstorm how to limit the cost of exploring this? And perhaps how we could share the cost a bit more equally?"

When we get into brainstorming mode, two things I navigate towards are: time- boxing the exercise (setting and sticking to an condensed schedule) and earnest money from them after some amount of diligence or discussion.

If a suitor can't commit to getting to a handshake/LOI after X weeks, I wouldn't pursue it.

Unrelated advice: try to hack your own brain and your team into believing that the default result of this is "no deal, time wasted". Many/most deals fall through, which can feel pretty brutal if you get optimistic about it.

</comment><comment><USER9> Understand that your compensation can take many possible forms. It's _all_ up for negotiation. Don't hamstring yourself by assuming you must be paid in cash, or that the payment must all be upfront, etc. Consider the myriad other possible options and variables that you can tweak to get the the outcome you desire. If you can, talk to people who can help you ballpark what a reasonable level of compensation is for others at the company in roles similar to yours.

If the process goes far enough (i.e. you like the offer), get a lawyer. I got a lawyer when my company was acquired, and she was great. She'd seen similar deals in the past, and she worked very hard over the course of a month to look out for my interests. There are all sorts of little clauses in this type of paperwork that are negotiable and worth negotiating. In the end, her bill turned out to be something like $2,500, which was more than worth it. I was expecting 4-5x that.

<comment><USER10> Wow, $2,500 is great. Can you share who that was? I had a small acquisition a few years ago and my bill WAS 4-5x that.

</comment></comment><comment><USER11> Don't forget to do _your_ due diligence.

Don't treat the acquisition as something that is purely about them making an offer you like. Dig into the nitty-gritty of how they run their company and its financials and whether you want to be working there. You're going to be an employee of them if an acquisition happens; what does that mean for you and your team?

</comment><comment><USER12> I've been through a small acquisition/acquihire twice. The first time, it was part of a small team. The second time it was my own bootstrapped one-person startup.

My biggest piece of advice is if you believe in your product and that it's a good fit for the acquiring company, you should ask for an earn out as a sliding percentage of sales over 3 or 4 years. For example, you get 75% of sales the first year, 50% the second year, etc. In my experience, the earn out is a common part of product acquisitions. It aligns everyone on the goal of promoting and building on the technology being acquired.

<comment><USER13> Agree with this. You would usually discuss valuation etc and complete financial and technical due dilligence once you have broad agreement.

</comment></comment><comment><USER14> I would first set a sell price and ask a 15% diposit before due diligence. If due diligence fails, you keep the diposit, if DD succeeds, you get the remaining 85%.

This is a good test for good faith and allows you to offset bad faith.

<comment><USER15> Is this a common practice?

<comment><USER16> It's not common but isn't completely unusual. It can be structured in different ways but is often referred to as a "breakup fee". My sense is it's much more common on larger deals than smaller ones, though.

</comment></comment></comment><comment><USER17> Great points made here. We went through something similar not too long ago. From that experience, I recommend you discuss at least the ball park of what they're willing to offer up front (and what you're willing to accept), before going through any further diligence. This way you can avoid going through an extremely distracting process and then only find out at the end that the offer isn't a compelling one.

</comment><comment><USER18> You should already have an NDA in place preferably including a non- solicitation clause, usually that comes first. After that you should have an LOI in place. After the LOI and before signing a purchase agreement, you'll go through DD. Even at that, you should hold back your IP until the Nth hour and you have a final version of the purchase agreement if you think that there's IP that they could steal and recreate to put you out of business.

Obviously, you should speak to a transaction lawyer too.

</comment><comment><USER19> I was in a similar position several years ago, and it seems like you have already jumped through the first mental hurdle.. actually being prepared to give up working on your own business. (Note, I don't mean this in a negative way, it's a serious consideration and opinions will vary.)

In my case, we met, no NDAs, they outlined initial terms (no actual numbers), and the idea of them shutting down the thing I'd built and working for them on their flat salary structure was too unappealing so I withdrew before we got to numbers.

</comment><comment><USER20> I've been through this process. Everything came out alright, but had some bruises.

It's easy for the acquirer to take their sweet time. Some here suggest ignoring them completely. I think it's fine to go down this road if it's what you want and you like them well enough, but, first, understand that they want you and your team, so you should treat your interactions like a normal two-way job interview. Do you like and respect the company? Do you like and respect the people? Could you work there for five years?

A competitive situation is for the best--that encourages the acquirers to move swiftly and to ignore immaterial imperfections. If you can't create a competitive situation, then be sure to do the following: 1) reserve enough time and/or sandbox the rest of the team so that the business continues to advance during discussions; 2) if you sign a no-shop provision (it'll be hard not to), make sure it expires in 30-45 days; 3) do not extend the no-shop provision. If they can't close in the initial timeframe, it's fine to let them keep going so long as you still like them, but be very firm about not extending the no-shop.

Be sure to be professional and courteous throughout, even if things don't go through. It's good practice and you'll want a good reputation. Always remember your BATNA.

</comment><comment><USER21> A bit orthogonal to the questions (apologies for that), but leaving the link just in case someone might find it useful: [http://www.paulgraham.com/corpdev.html](http://www.paulgraham.com/corpdev.html)

<comment><USER22> _The tactics you encounter in M &A conversations can be like nothing you've experienced in the otherwise comparatively upstanding world of Silicon Valley. It's as if a chunk of genetic material from the old-fashioned robber baron business world got incorporated into the startup world._

Brilliant!

</comment></comment><comment><USER23> If you are getting traction and enjoy what you are doing focus on that and keep working at it. You might not be interested in selling in 6 to 12 months or you might sell for 10x what you would sell for now.

If you haven't check out @DHH's start up school talk. (Link is to a section for you, but go back and listen to it all) [https://www.youtube.com/watch?v=0CDXJ6bMkMY&feature=youtu.be...](https://www.youtube.com/watch?v=0CDXJ6bMkMY&feature=youtu.be&t=17m20s)

</comment><comment><USER24> I've been through M&A twice from the selling side and once from the buying side. You need an LOI before you turn anything over you wouldn't tell a potential investor. NDA should have been the first thing done before talking in detail. Feel free to reach out if you want to talk confidentially through the process.

Edit: if they are keeping the product/tech you should have them value it based on future expectations of value. It's less of an acquihire in that case. Don't take an acquihire price if they're going to immediately realize more value than they're paying you to take a job.

<comment><AUTHOR> Thanks John. I looked up your background and will take your advice to heart. You are correct it is not a strict acquihire. The product will be used /integrated in some form. There is just no real revenue / customer base as of yet.

</comment></comment><comment><USER25> [https://tylertringas.com/selling-my-bootstrapped-saas- busine...](https://tylertringas.com/selling-my-bootstrapped-saas-business/)

Might contain a few useful tidbits. What most stuck with me from his pieces on microSaas is that the best time to sell is when you don't have to - <USER2> implies that you should not put yourself in a situation where starting the talks leads you to have to sell (because you fall in love with the idea of selling, of you neglect the business, etc)

</comment><comment><USER26> Only take the deal if it's great money, a quick process, has very little risk of failing, and you don't believe you could make way more money operating independently.

I am not a good founder. I have weak risk tolerance, I'm lazy, and I don't have the mental fortitude needed to see complex problems through to completion.

So if someone seriously offered me quick money for my lackluster business, that's the only time I would take it.

</comment><comment><USER27> Someone like Justin Kan could help you with this process. Look into his startup Atrium - but looks like you already have an experienced lawyer, so it might not be as useful.

I'm also going through this process right now, and it's a lot more work than I've envisioned. Others have said this, but make sure not to burn out - I'm trying to best.

</comment><comment><USER28> Lots of great stuff here, but I'll add this:

Make sure if you absolutely can't stand it and you leave after 7 months you still are ok. You'd be surprised at how bad things can get.

Also, if you want more specific advice tailored to your situation feel free to email me. I've been around HN for almost a decade and I know how to keep my mouth shut.

</comment><comment><USER29> License it to them as a whitelabel reseller (15% commission) with the option to buy? They can go to market with it immediately giving you immediate cashflow with less DD and you are protected by the resell agreement that they can't copy it.

<comment><USER30> If someone comes to you to discussion purchasing it and you come back at them with a commission reseller deal they're going to think you have no idea what you're doing.

</comment></comment><comment><USER31> No way I'd go through any DD process without an accepted offer. They're likely digging for info and will just clone your product themselves. No offer on the table? You are naive and will get screwed here, hire a lawyer now.

</comment><comment><USER32> I'll just leave this here as on point of view: [http://www.paulgraham.com/corpdev.html](http://www.paulgraham.com/corpdev.html)

</comment><comment><USER33> You might get a lot of value from the following book

"Magic Box Paradigm: A framework for startup acquisitions"

</comment><comment><USER34> lawyer up

</comment><comment><USER35> "I'm open to an offer" is fundamentally unserious and everybody knows it

<comment><USER30> It's not and they don't.</comment></comment>


Ask HN: Growth hacking within a city - <AUTHOR>

Hi guys, i have a growth hacking question: How do i get viral with my social network within one city. The network connects people who don't know each other (yet) for activities they like. Activities are not limited to sports or things like that. Drinking coffee or having a walk is also fine. A lot of growth hacks out there just work on a global scale - i'm facing the problem to get enough users within one city with about 230 000 inhabitants… How to solve my chicken-egg-problem? Any help is appreciated. THX <comment><USER2> Get local newspapers, radio stations, and evening news to cover it. Post on craigslist. Do things that don't scale (talk to people at bars or on the street, post flyers around town, etc.)

My experience with MeetUp was that all social meetups were single men looking for women. It made for some very creepy gatherings, and my friends and I gave up on MeetUp permanently as a result.

If you can solve that problem (have good gender balance and prevent creepy people from showing up), you'll be a lot more likely to succeed.

<comment><AUTHOR> Thanks a lot! The gender topic is especially interesting, because at the moment we have about 1000 users - 70% women.</comment></comment>


Employee sues Google for 'illegal' confidentiality policies - <AUTHOR> https://www.engadget.com/2016/12/20/employee-sues-google-for-illegal-confidentiality-policies/ <comment><USER2> The article doesn't mention all of the alleged offenses regarding the lawsuit. There's definitely more than just a "spying program" here:

* Restrict the Googlers' right to speak, right to work, and right to whistle-blow.

* Prohibit Googlers from speaking plainly – even internally – about illegal conduct or dangerous product defects, because such statements might one day be subject to discovery in litigation or sought by the government.

* Prohibit Googlers from telling a potential employer how much money they make, or what work they performed, when searching for a different job.

* Prohibit Googlers from using or disclosing all of the skills knowledge, acquaintances, and overall experience at Google when working for a new employer.

* Prohibit Googlers from speaking to the government, attorneys, or the press about wrongdoing at Google.

* The policies even prohibit Googlers from speaking to their spouse or friends about whether they think their boss could do a better job.

There were alleged training practices, policies, and documents outlining these offenses and they are written up pretty plainly in the suit itself[1]. Makes for better, more detailed reading, than this Engadget piece.

[1] - [http://www.bakerlp.com/Google-Blackout- Case/2016-12-19-PAGA-...](http://www.bakerlp.com/Google-Blackout- Case/2016-12-19-PAGA-Complaint-Against-Google.pdf)

<comment><USER3> That's interesting, a clause in my contract (pulled up the PDF just now; dated prior to the suit in question) explicitly states that the confidentiality agreement does _not_ apply to my ability to discuss "terms, wages, and working conditions of employment, as protected by applicable law".

That certainly contradicts several of those points.

<comment><USER2> The suit goes into much more than just a confidentiality agreement. It doesn't allege that only the agreement is the source for those points.

The evidence and facts brought up are:

1) A quote from his offer letter.

2) The confidentiality agreement.

3) A Code of Conduct policy for "internal purposes only."

4) Data Classification Guidelines.

6) Employee Communication Policy.

7) Training programs including one called "You Said What?"

8) "Prepare to leave Google" policy.

9) "Exit Certification" note upon termination.

10) A "Global Investigations Team" led by Brian Katz.

11) "Stopleaks."

12) Quotes from all hands meetings.

13) Alleged amendment of a policy in response to his letter to Labor Workforce and Development Agency violations.

<comment><USER4> 14) Literally getting fired for discussing terms, wages, and working conditions of employment

15) Lawyers telling employees to STFU on discussion threads about legal problems in the news

<comment><USER5> Who got fired for that?

We have people who started a spreadsheet where googlers can post their salary/total comp and they are still working at google.

<comment><USER6> The _former_ Googler who started that spreadsheet faced retaliation from management for that spreadsheet, actually.

"Former Google employee Erica Baker revealed in a flurry of messages on Twitter Friday that she faced retaliation from management after compiling a spreadsheet of employee salaries."

[http://blogs.wsj.com/digits/2015/07/21/ex-google-employee- ex...](http://blogs.wsj.com/digits/2015/07/21/ex-google-employee-exposes- unequal-pay-with-spreadsheet/)

<comment><USER5> That was one side of the story - presumably there is another side of the story. Since she left, there is another spreadsheet going around, and the maintainers are all still working at google AFAIK

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> This complaint seems pretty silly. Just taking a single point, paragraph 45:

"Don't send an e-mail that says 'I think we broke the law' or 'I think we violated this contract.'"

That seems like pretty reasonable training. You shouldn't put that on the record because you're not an attorney. You are just some Dork, or Senior Dork, or Staff Dork, or whatever grade of Dork you happen to be who is still not an attorney.

Maybe the attorneys also have to take training that advises them not to say "I think this dereference might be undefined behavior" in emails. Who knows.

<comment><USER8> Why not though? What's wrong with it? In the case where the employee is wrong then nothing happens besides, maybe, some negative news stories if it's leaked. That's reasonably controllable. On the other hand though, if the employee is actually correct, then the employer is protected from any claim they were informed about the illegal activity if employees don't use language that says they think wrongdoing is going on. Should employees work under threat of breaking rules designed to protect their employer if the employer is breaking the law? I don't think so.

<comment><USER9> > Why not though? What's wrong with it?

One of the reasons is jury trials: such emails are discoverable and Google has first-hand experience with this in Oracle v. Google. Oracle brought an email sent by a non-lawyer technical Googler[1] and used it as evidence that Google _knowingly_ infringed on Oracle's copyright. Googles lawyers had to go to great pains to deflect that line of attack (including asking the guy if he was a lawyer on the stand as Oracle's hostile witness).

Even if the email is wrong, it still looks bad to someone who does not understand the nuance of law, like members of the jury.

1\. [http://arstechnica.com/tech-policy/2016/05/apache-e-mails- sh...](http://arstechnica.com/tech-policy/2016/05/apache-e-mails-shown-in- court-say-android-ripped-off-oracle-ip/)

<comment><USER10> This is corporate policy to protect the corporation. It is power gone too far. People need to know that it's ok to speak up when something wrong occurs.

For example, If I were to see Jimmy stealing some GoogleBot servers then absolutely the company would want me to inform them about Jimmy's actions. Communication is largely done by email. So, there is no problem reporting illegal activity by email.

But, that's not what the corporation is fearful of, they are afraid of Jimmy's department which is infringing Big Corp.'s Patents. If I see this and email the company then the company has to respond with an inquiry to their lawyer and investigate, otherwise this could come out later in a court trial and cause financial harm. So the company doesn't want people to do what they believe is right. Oh sure, we can still report it verbally. But, that's absurd to have a policy that says email is fine for all communications except for anything that could potentially be detrimental to the company. What if I was harassed at work, I'm not supposed to say anything about that in email, it all has to be done face to face?

I hope this case wins, I hope that folks here understand that it's important to do what's right and not to do what their corporation tells them is right.

<comment><USER11> As I said above, most corporations advise employees to raise legal concerns to lawyers. This makes those concerns privileged _and_ ensures the concerns go to people who can, you know, professionally evaluate them.

So I don't think you can reasonably say this is a case of companies not wanting illegality to be disclosed. It's wanting disclosure to take the proper form.

(Indeed, they have a vested interest in proper handling of illegality to ensure that higher-ups are aware of and can mitigate legal risks.)

</comment></comment></comment></comment></comment><comment><USER12> > Apparently, the tech giant has a "Stop Leaks" program in place that is > managed through an internal website. Employees have the option of reporting > a colleague to superiors, which then look into the matter and fire the > whistleblower if the report is true.

Not all leaks are made in the sprit of "whistleblowing". This article seems pretty misleading… many of these measures are designed to protect the company's intellectual property and secrecy, though I see how they can be abused. I would hardly call it a 'spying program' though.

<comment><USER7> Indeed, the leak in question seems to be this transcript of internal company- wide forum: [http://www.recode.net/2016/4/13/11586092/tony-fadell-nest- go...](http://www.recode.net/2016/4/13/11586092/tony-fadell-nest-google-tgif)

Which does not appear to be any kind of public service.

</comment></comment><comment><USER13> > If successful, the state would collect 75 percent of the penalty, while the > rest would be paid out over to the company's 65,000 employees. Since there > are 12 alleged violations in the suit, the maximum fine could amount to $3.8 > billion, with each employee getting about $14,600.

14k per employee. That's quite a payout.

<comment><USER14> Is that global or just the employees in California?

<comment><USER15> It won't apply outside the USA. International people never get such payouts, yet get the same treatment

<comment><USER3> That said, the headcount reported in Alphabet's last quarterly statement to investors was ~69k, but it depends what this 65k figure includes (temps / vendors / contractors? interns? past employees?). If it's just straight-up fulltime employees, then that's certainly not just California. And the payouts might vary from state to state -- a number of these claimed labor violations cite California law.

(Of course, I'm doubtful that any general payout is coming around.)

</comment></comment></comment></comment><comment><USER16> > If successful, the state would collect 75 percent of the penalty, while the > rest would be paid out over to the company's 65,000 employees

What is the logic for the state somehow being entitled to such a huge cut? Presumably, if anyone was wronged here, it was the employees.

<comment><USER17> IANAL but skimming through the complaint, they're basically acting as a "private attorney general". The lawsuit alleges that Google's policies violate state law. Normally, the state would sue the company, but in this case, the law firm is saying that they'll handle the enforcement for the state. If they're successful, they get a percentage of the penalty.

I don't know how damages are divided up in cases like these, but I'd guess that the state's cut would be distributed (at least partially) to affected employees.

<comment><USER6> And this would be a choice by the lawyers in how to file this case, as opposed to some sort of civil suit.

<comment><USER18> See paragraph 66:

> Because Google requires Googlers to waive their right to seek class-wide > injunctive relief for Google's illegal conduct, the only effective remedy to > address Google's illegal conduct is the aggressive and full imposition of > penalties under the Private Attorneys General Act.

<comment><USER6> I'd be quite curious if that clause would hold up in court. Forcing employees to give up their right to seek relief for employer misconduct almost certainly is illegal... right?

</comment></comment></comment></comment></comment><comment><USER19> Google has an incredibly secretive culture. Secrecy was drilled into us time and again. When collaborating with external vendors, it was quite painful to strike compromise between corporate secrecy and sharing enough information to be productive.

After leaving Google, I'm always amazed at what I'm allowed to talk about with vendors. I'll start talking in my Google-conditioned non-committal cagey way, and a colleague will remind me that I'm not at Google anymore, and I can just say what I mean.

</comment><comment><USER20> > "Google's motto is 'don't be evil.' Google's illegal confidentiality > agreements and policies fail this test," the lawsuit said.

It occurs to me only now that a company that wasn't evil wouldn't need to make such a show of stating it like this.

<comment><USER21> Even better, they've since changed the slogan, citing it as being silly.

<comment><USER22> I don't know anything about it being a slogan, but it's in the Code of Conduct still.

I just started at Google and had to sign it.

<comment><USER23> According to the OP, you're going to get fired.

</comment></comment></comment></comment><comment><USER24> Quite schizophrenic of the company to open up every information/book/news they can crawl and on the other hand close down the little interior world as much as possible. Not that this would be news or unexpected though.

</comment><comment><USER25> People commenting on this who work for google or hope to probably should say so in their comment.

</comment><comment><USER26> "According to the lawsuit, Google's policies don't allow employees to discuss work-related topics including salaries, to post their personal opinions about the company online, and must not leak any product or other Google related information to the public. If Googlers break the company's rules, they just might end up getting fired."

I have read several blog posts of Googlers about their work experience on their own blogs. If leaking unannounced works to the public, that's definitely a standard how work should be treated.

So I'd want to hear more about exactly what's going on. A "spy program" is a catchy phrase to grab reader attention. I think anyone should report if they spot anything against the interest of company such as insider trading, violate NDA etc, especially given Google is publicly traded.

<comment><USER27> >Google's policies don't allow employees to discuss work-related topics including salaries

isn't this illegal?

<comment><USER28> My understanding is that employers may not hinder employees in discussing salaries among themselves, but may impose restrictions on providing salary information to non-employees.

So I can tell another Googler my salary but I can't tell you (unless you're a Googler) because my NDA forbids it. I'm pretty certain that I'm allowed to tell you that I'm not allowed to tell you, though. :)

There's an internal site where a number of Googlers share their compensation, anonymously or otherwise. I've never received any indication of disapproval or retaliation from management for being on it.

(I am not a lawyer, standard disclaimer applies.)

<comment><USER29> No need to give numbers. Just tell us your city and your job title and we'll look it up on the secret salary list :D

[http://h1bdata.info/index.php?em=Google&job=&city=&year=2016](http://h1bdata.info/index.php?em=Google&job=&city=&year=2016)

P.S. Add 10% for non-H1B workers.

</comment></comment></comment></comment><comment><USER30> I've seen several Google employees comment on this site even on matters related to Google. How do they bring up the courage to do this? Seems pretty risky as per this "Confidentiality Agreement".

<comment><USER31> Only comment on things that have been publicly announced/published, don't comment on leaks or make new ones.

(I work for Google)

</comment></comment><comment><USER32> >In addition, John Doe is also stating that Brian Katz, the director of global investigations, intelligence, and protective services over at Google, has falsely accused him of leaking information to the media.

Doesn't seem like a false accusation to me...

</comment><comment><USER33> Right, so I don't remember having any such language (don't disclose your salary or your work) in my departure paperwork. I was a SA in a SRE team. Does this apply to people in X?

That said, Google has a VERY restrictive IP a policy that effectively prohibits employees from running side businesses at ANY time during their employment on ANY medium, Google-owned or not. Anything you make is Google's.

<comment><USER34> "That said, Google has a VERY restrictive IP a policy that effectively prohibits employees from running side businesses at ANY time during their employment on ANY medium, Google-owned or not. Anything you make is Google's. "

Actually, this is pretty much 100% false (I help run the invention assignment committee, so ...). We let it happen all the time, and in fact, grant people the IP to do it. This is significantly better than most companies, who pretty much don't tell you, and then if you come up with something cool, will sue you and get it from you.

<comment><USER33> The language in the IP agreement I signed said the exact opposite. Engineers from the group I was in left because of this. Can you elaborate?

<comment><USER34> "The language in the IP agreement I signed said the exact opposite."

Did you actually attend the week two training we give entitled "open source and IP", that covers this in great detail?

"Engineers from the group I was in left because of this." I would love to know who you believe left because of this. In the 11 years i've worked at Google, the vast majority of people i've seen leave in this situation left because they basically wanted to start a competitive startup, get the IP from google, and still get paid by google at the same time (quite literally). The number of people who left for ideological reasons i can count on one, maybe two hands.

</comment></comment></comment></comment><comment><USER35> > Further, Google apparently warns employees to not write about potentially > illegal activities within the company, even to Google's own attorneys.

'Don't be evil' indeed.

</comment><comment><USER36> This comes to mind.. [https://www.youtube.com/watch?v=7xH7eGFuSYI](https://www.youtube.com/watch?v=7xH7eGFuSYI)

</comment><comment><USER37> Didn't this happen to Hooli in the last season of Silicon Valley?

<comment><USER38> Life (maybe) mimics art!

</comment></comment><comment><USER39> I'm truly shocked to read that an organization founded on grubbing as much data as possible is also spying on its own workforce.</comment>


AeroFS is x87 faster than Dropbox in LAN syncing [video] - cool-RR http://blog.ram.rachum.com/post/33073905775/aerofs-is-x87-faster-than-dropbox-in-lan-syncing

<comment><AUTHOR> People often misunderstand what the Dropbox LAN Sync does. The file needs to be already in the cloud before it can be synced over LAN. This means that when you add a new file, it will first get uploaded to Dropbox servers then transferred to other computers over LAN. Considering that most home connections are asynchronous (slow up, fast down) the entire processes gets bottle-necked by that slow upload rate.

<comment> cool-RR You've given an excellent answer to the question _Why is Dropbox's LAN Sync so slow?_ but the more interesting question is _Why don't the Dropbox engineers change how LAN Sync works so it won't be so slow anymore?_

<comment><USER2> +1

Also, uploading the data to Dropbox server, and then downloading again, wastes valuable quota for those under a data cap.

<comment><USER3> No, it doesn't download it from the master server. It transfers directly between the computers on the LAN. The only thing that has to go through the Dropbox servers is the master file _list_.

</comment></comment></comment></comment><comment><USER4> I love AeroFS. Although it is missing many of Dropbox's features (e.g. web storage of files, better version history, etc), the fact that it is extremely fast and there is no cap on P2P sync makes it my weapon of choice when sharing files/folders with colleagues.

<comment><USER5> Sounds like exactly what I need - and what I usually use Dropbox for.

If anyone could spare me an invitation...

<comment> cool-RR I'll be happy to invite you, but I don't have your email address.

<comment><USER5> firstname.lastname@example.com

</comment></comment></comment></comment><comment> martin-adams What's the best way of writing this. Is it x87 or 87x faster? Thank goodness it wasn't x86 faster as that would have confused me.

On a related note, I've been using Livedrive for a number of years now and they have a lan transfer option to obtain a file over the network than over the internet. I suspect however a lot of use cases are separated by the internet and generally aren't on the same network.

What would be awesome however is if after the sync both computers were able to contribute to uploading the file to the live server. So I could sync my files over lan to my laptop, go to work, then have my home/work computer upload them to the net, thus 2x quicker to store it in the cloud. But that would be a bit of an edge use case I think.

<comment><USER6> x87 is the original FPU instruction set of the x86 family, so time to be confused again. But now you can be .75 confused instead of 1 confused.

<comment><USER7> > But now you can be .75 confused instead of 1 confused.

A confusion index of 1.0 would be described as perfectly confused. But, as is often said, nothing is perfect. :)

</comment></comment></comment><comment><USER8> Just tried this myself with a couple of 8.5MB MP3 files. One appeared on the second machine in about a minute, the other in about a minute 30.

Not sure why this is taking upwards of 12 minutes for the OP.

<comment><USER9> OP probably didn't disable dropbox speed limiting - this is the default:

<http://i.imgur.com/wTWzG.png>

<comment> cool-RR Thanks for that tip. I disabled the limiting now and it sped up from 11:42 minutes to 01:40 minutes! Now Dropbox is only x12.5 slower than AeroFS.

The real solution, of course, would be for Dropbox to transfer the file over the LAN immediately before waiting for it to be uploaded to the Dropbox servers.

<comment><USER10> That's not a solution, it's a design tradeoff. Dropbox's servers are the "truth", and the software's clear goal is to get a copy on the servers. There are many reasons for this--weird conflicts, inconsistencies, and so on--that are much harder to resolve than if there is a copy on the servers.

Once that happens, other clients will ask to download from the servers, notice that it's on the LAN already, and take it from there. I bet if you install a new client on the same LAN, or share a folder between clients on the LAN, or add a folder to selective sync, once the files are already there... it will be a competitive speed.

</comment></comment></comment></comment><comment><USER11> This is like comparing apples and oranges. I'm inclined to think that the creator of this video is biased towards AeroFS.

<comment> cool-RR Funny, I'm actually biased towards Dropbox. I use it for most of my stuff because of the versioning and the Packrat feature. But there's no reason for Dropbox not to do direct LAN syncing, and no reason for AeroFS not to offer infinite versioning. It may be more complex to design, but definitely feasible. So I don't think that this is an apples-vs-oranges comparison.

<comment><USER12> > But there's no reason for Dropbox not to do direct LAN syncing, and no > reason for AeroFS not to offer infinite versioning.

Really, no reason? None at all?

For "infinite versioning", it's obvious - there's no upper bound on the amount of data the server has to store. Storage space costs money.

As for no direct LAN syncing, someone's already mentioned the reason - consistency. Syncing is already a hard problem, and it's dangerous to allow more things to go wrong because the clients synced but the server didn't receive all the data.

<comment><USER3> So what if there's no upper bound? Treat it like normal data and charge the normal price. Spideroak already does this.

</comment></comment></comment></comment><comment><USER13> What would this get someone who already has Dropbox and Air Drop on OS X?

Answer: compatibility! Now that walled gardens are going up, there's pain in getting through the walls. If they can make this compatible with Dropbox, it would be a great combination. There's also the possibility that Dropbox could add Bonjour/Rendevous to their client side software, reducing AeroFS to just a feature.

<comment><USER14> Not really, the attraction of AeroFS is not having a connection/reliance on S3. So for something like 1Password syncing, it would be great not to have a copy sitting somewhere in the cloud.

<comment><USER15> If you use a strong master password, and given that 1Password uses a secure key-derivation function, does it really matter if your 1Password file is sitting somewhere in the cloud?

<comment><USER14> Yes.

My take on it is if there is no/little benefit of putting something in the cloud, there is no reason to do so particularly if it's something security related.

</comment></comment></comment></comment><comment><USER16> This is one of my major annoyances with Dropbox — I'd love to shift everything to my Dropbox, but the slow sync speed is painful.

I signed up a long time ago for an AeroFS invite but had no joy. Anyone got one they could share? I'd love to try this out.

<comment> cool-RR Sent you an invite :)

<comment><USER17> Can I have an invite too? Pleeaassseee. :)

<comment> cool-RR Sure, I'll just send it to the email address that you've conveniently included in your profile. Oh wait :)

<comment><USER17> Ok. Updated. (Also, sorry!!)

<comment> cool-RR Update: Got more invites, sent you one.

<comment><USER17> Thanks man!! You're awesome. :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> What protocol does AeroFS use?

</comment><comment><USER19> I would love an invite if anyone could spare one. My email address is hotspam{at}gmail.com. I've been on the sign up list for over a year but haven't heard a thing. Thanks in advance!

</comment><comment><USER14> AeroFS looks cool but I'm not too keen on having to run Java just to run AeroFS given that I had disabled Java on MacOS due to the recent exploits.

<comment><USER20> I wouldn't worry about it.

The Java to be disabling is the Java browser plugin, which allows un-trusted web sites to run applets in a sandbox on your machine. As you know, there have been a lot of issues with Java sandboxing.

However, AeroFS runs locally (as far as I understand, I don't have an invite) so should be fine as long as you trust the provenance of the code.

</comment></comment><comment><USER21> It's nonsense, they are 2 different technologies</comment>


Why the Dress mania has much deeper implications - <AUTHOR> http://www.buzzfeed.com/mitchcorreia/the-dress-why-this-oddly-viral-meme-is-actually-i-1d2zg

<comment><USER2> It's spread to T-Shirts already: [http://hashtagthedress.com/](http://hashtagthedress.com/)</comment>


What are some good hacker spaces in silicon valley? - <AUTHOR>

I'm in mountain view and looking for comfortable places with a good connection. Hacker dojo is awesome but I'm looking for a few more. Any suggestions? <comment><USER2> <https://www.noisebridge.net/wiki/Noisebridge></comment>


Ask HN: What Is an "Water Tower Ad" Equivalent on the Web? - <AUTHOR> That is to say, an ad that has permanence to it? <comment> tony-allan A water tower is highly visible to anyone nearby and will be around for 50 or more years. If you own the tower or its advertising space then you have permanence. This is hard to beat with technology unless you are Google, Microsoft or IBM.

Fifteen year old adverts are about as permanent as you get: [http://www.milliondollarhomepage.com/](http://www.milliondollarhomepage.com/)

A look at the page shows that long term ads are not as useful as they first seem.

Other than that, a short .com domain name can be used to permanently advertise whatever you want if you can afford to buy one.

Other than that, find a popular website and make them a deal. You advert will last as long as your credit card and the website. In reality that's isn't forever.

<comment><AUTHOR> >A look at the page shows that long term ads are not as useful as they first seem.

what a depressing graveyard</comment></comment>


An interview with OpenGL lead designer Kurt Akeley - <AUTHOR> http://www.budiu.info/blog/2009/12/28/an-interview-with-kurt-akeley

<comment><USER2> _Q: Would you use today something like FPGAs (Field-Programmable Gate Arrays) for such systems?_

He answers the question by basically saying, "No, if we started today, we'd never be able to compete with Nvidia and ATI." However, there _is_ a group today trying to create a new graphics card from scratch, and it turns out their first step was indeed to create a big FPGA card:

<http://wiki.opengraphics.org/tiki-index.php>

<comment><USER3> The FPGA is for development. When the design is ready for RTM, it will be as a custom ASIC. [http://wiki.opengraphics.org/tiki- index.php?page=FrequentlyA...](http://wiki.opengraphics.org/tiki- index.php?page=FrequentlyAskedQuestions#What_is_the_use_of_the_OGD_card_)

<comment><USER2> Yes. The question in the article was regarding SGI's initial use of custom ICs in development, and the relative superiority of using gate technology to prototype.</comment></comment></comment>


Vue Router – Essential and Advanced Patterns - <AUTHOR> https://nordschool.com/vue-router <comment><AUTHOR> Hey folks!

I wrote a guide about the Vue router including all the essential concepts and more advanced patterns.

Example of the topics covered are:

\- Routes Using props \- Nested routes \- Dynamic routing & Router param \- Route guards \- Wild card routes \- Router transitions \- Lazy-loading routes \- Navigation Resolution Flow

Any feedback is appreciated, cheers!</comment>


Office 365 to begin setting Bing as Chrome's default search engine - <AUTHOR> https://docs.microsoft.com/en-us/deployoffice/microsoft-search-bing?chrome <comment><USER2> This seems like it will just start a cat-and-mouse game with Google releasing Chrome updates to break their extension, like Firefox's "extensions.installDistroAddons" toggle.

Also I assume "Version 2002" means "2020, February", but that seems unnecessarily confusing in a way the Windows 10 "20H1"-style versioning isn't. Doubly so considering Office XP was co-branded "Version 2002" eighteen years ago! [https://i.imgur.com/4814T6a.jpg](https://i.imgur.com/4814T6a.jpg)

<comment><USER3> Your assumption is probably correct, but it also seems like an unusual coincidence, as 2002 was when Microsoft reached a final judgment on the case that DOJ brought against them in 1998 [0].

[0] [https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor...](https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corp.#Settlement)

</comment></comment><comment><USER4> I remember the great lengths Microsoft went to cleaning up Browser Helper Objects, toolbars, and extentions that kept changing the IE default search engine and homepage.

Chrome will need to add similar enforcement, and will likely end up removing the ability for addons to change these settings like Microsoft eventually did.

</comment><comment><USER5> It might be a bit of a stretch but I wonder what standing someone has to sue when search results are noticeably worse and changed in this way.

e.g. I just searched "<my town name> emergency" in google and bing. Bing came up with a travel site and several news articles. Google came up with a map with the local emergency department as the highlighted pin and urgent care as subsequent pins.

Google's little blurbs are also very handy in this case with instructions popping up as the first result when I search snake bite treatment and seizure care. (Actually I went through a few more emergencies after that and was pleasantly suprised how good google was at turning up instructions for emergency care)

It wouldn't surprise me if the monetary pressure associated with medical care in the US and the deep pockets of microsoft made them a tempting target.

<comment><USER6> > search results are noticeably worse

This is not an endorsement of this article's allegations, or even of of Bing. But.

DDG uses Bing as one of its primary sources of data, and IMO DDG results are better than Google's for me both professionally and personally today. Maybe DDG is doing some special sauce behind the scenes, or maybe they're blending results from multiple sources, but that quality of search means I'm not at a point where I can unilaterally dismiss Bing and promote Google. Google's search results have just slid backwards too much lately.

<comment><USER5> I don't disagree that Bing can give great results and is better than google in at least a few areas and use cases. So I probably painted with a broad brush in that subjective statement. I do think the point that the bing results (at least for my location) are objectively worse (considering why most would make such a search) compared to google when looking for emergency healthcare information.

Primarily I use duck duck even if I occasionally fall back to the !g command. But I think anyone who is able to change their default search engine in chrome could not then argue that microsoft changing the default impeded them from easily searching for information (which would be important in any legal action). So while ddg is a great search engine I don't think it needs to be considered in the thought experiment of reasons you could sue microsoft for this change.

</comment></comment></comment><comment><USER7> If you want to prevent this without installing the Office ADMX January update, you can set the following registry entry:

          [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate]
          "preventbinginstall"=dword:00000001

Save the above in a .Reg file and execute.

<comment><USER8> FWIW, the (untested) PowerShell equivalent would be:

      New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\office\16.0\common\officeupdate" -Name "preventbinginstall" -PropertyType DWord -Value 1

</comment></comment><comment><AUTHOR> The comments on the bottom, plus the UserVoice ([https://odinsiders.uservoice.com/forums/920533-distribution-...](https://odinsiders.uservoice.com/forums/920533-distribution- upgrades-servicing/suggestions/39494872-do-not-force-push-bing-as-the-default- search-engin)) really emphasize how this change is impacting customers.

</comment><comment><USER9> Isn't this behaviour making use of their market power and should be looked at by the antitrust authorities?

Overriding user's preferences with a forced installation of an extension reminds me very much of the old Microsoft I had hoped was gone for good.

<comment><USER10> Co-incidentally, they've started using their Windows monopoly to push Office via adverts (eg in Wordpad) now too.

Hopefully the anti-trust / monopoly authorities do decide to pick this up, as it'll be the _2nd_ time around for MS.

They obviously didn't learn from the first, so the measures this time around will need to be much, much stronger. :)

</comment></comment><comment><USER11> > Office 365 to begin setting Bing as Chrome's default browser

shouldn't that read "...Chrome's default search engine"?

<comment><AUTHOR> Good catch. Corrected.

</comment></comment><comment><USER12> Looking forward to the day that windows apps run in a container that prevents access to anything but itself and requested permissions

<comment><USER13> Microsoft App-V has been a thing since 2006.

</comment></comment><comment><USER14> At least they're warning us! Sadly, we're forced to use O365 where I work, so this makes me doubly glad that I don't use Chrome.

<comment><USER15> > Support for the Firefox web browser is planned for a later date.

<comment><USER16> I strongly doubt Chrome is going to support this and Firefox seems even less likely.

</comment></comment></comment><comment><USER17> Read the post before you get your knickers in a twist. The purpose of this change is so a special type of business client can allow their employees to search not just the web, but also their company's internal resources.

Considering that most businesses provide their employees with company laptops, this isn't something that is going to affect consumers.

<comment><USER18> If I'm that special type of business client that is actually using Microsoft Search, cool, maybe I want an easy option to change the default engine. But that should be opt-in. Because Microsoft Search is also opt-in. They are deploying this to all O365 customers, regardless.

<comment><USER17> No they aren't, read the post. It's for ProPlus subscribers only, which is a plan that includes Microsoft search.

<comment><USER19> Pro plus is pretty much every business and university. It's not like you buy pro plus for the amazing Bing integrations.</comment></comment></comment></comment>


Bionic beaver (Ubuntu 18.04) released - <AUTHOR> https://wiki.ubuntu.com/BionicBeaver/ReleaseAnnouncement <comment><AUTHOR> Hmm... Perhaps I jumped the gun by linking to this. This looks like a draft of announcement to be released later (today, hopefully).

<comment><USER2> Yeah, the URL for the Release Notes [0] -- as of now -- clearly states:

> _Ubuntu 18.04 LTS will be released on April 26._

> _Ubuntu 18.04 LTS HAS NOT BEEN RELEASED YET and is not recommended for use > on production systems or on your primary computers yet._

While it's _probably_ safe to assume that it will be announced today as expected, there's always a chance that they will find something that causes them to change their mind at the last minute.

I would certainly hold off on hitting the "upgrade" button until it's official, though. (I, personally, wait a lot longer than _that_. YMMV.)

[0]: [https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes](https://wiki.ubuntu.com/BionicBeaver/ReleaseNotes)</comment></comment>


This Is How People Can Actually Afford to Live in Seattle - <AUTHOR> https://www.vice.com/en_us/article/j5373k/this-is-how-people-actually-afford-to-live-in-seattle <comment><USER2> I don't get this part:

"The worry is that this might not be the case for long. Though the housing market has finally recently started to cool, experts tend to agree it'll tick back upward before long—especially given the reticence of the powers that be to impose the slightest limit on the breakneck pace of growth."

Which are "the powers that be"? City/county/state government? Or large tech employers? Local municipalities do seem to be limiting growth through zoning (a contributor to the high cost of living). If this is to suggest that local employers should somehow limit their own growth, I guess you could point to Amazon choosing to open new headquarters in VA and NY.

I guess I just don't get this paragraph.

<comment><USER3> I wouldn't say it's government or industry that's preventing growth - it's just people. Every time the city tries to rezone something, a bunch of local residents come out of the woodwork and scream bloody murder (or in one case, threaten the families of city employees) about changes to their neighborhood.</comment></comment>


RIM thinks Social Networking is answer for slow BB app sales - <AUTHOR> http://www.techcrunch.com/2009/07/13/rim-launching-a-blackberry-social-network-for-venting-tomorrow/ <comment><USER2> Other possible reason sales are slow:

1) The interface on OS 4.x is terrible. Even the most simple app is a frustration to use. Most BlackBerry apps feel like some elaborate e-mail message with extra buttons.

2) Some apps are not compatible with all BlackBerry devices -- even relatively new models. I couldn't use SlingPlayer on my 8330. On the flip side of this there are very few (any?) applications that take advantage of the bigger screen size and nicer UI the Storm provides. It must be a drag to run ugly old clunky 7200 era apps on a shiny new Storm or Bold.

3) IOException() I guess this is how BlackBerry apps crash? I tried a few random apps when the store opened and found this to be a familiar outcome.

4) The games (good impulse buys) are lame.

5) Most of the commercial apps are way too expensive or serve a very small niche -- which may justify a higher price but isn't so good for volume.</comment>


Hacker Guccifer 2.0 revealed as Russian agent when forgets VPN - <AUTHOR> http://www.dailymail.co.uk/news/article-5536507/Hacker-Guccifer-2-0-uncovered-Russian-intelligence-agent-forgetting-turn-encryption.html <comment><USER2> We are living in crazy times, where russians showing a big fuck to all of us breaking all laws, using chemical weapons, hacking, killing, occupying other countries. Capitalism for the win, money rules the world, and Russians know where to invest them to keep everyone in their pockets all over the world. We have biggest Mafia state in the world inside the Europe and everyone is just fine with it. Sad..

</comment><comment><USER3> > > [http://i.dailymail.co.uk/i/newpix/2018/03/23/13/4A7A6E970000...](http://i.dailymail.co.uk/i/newpix/2018/03/23/13/4A7A6E9700000578-0-image-a-23_1521812653436.jpg)

If this guy hacks any harder he might pwn the whole Internet.

<comment><USER4> They could at least use hacker typer on the screens :|

</comment></comment><comment><USER5> Previous discussion: [https://news.ycombinator.com/item?id=16653671](https://news.ycombinator.com/item?id=16653671)

</comment><comment><USER6> Please don't give the Daily Mail your clicks. [https://outline.com/UCs4vs](https://outline.com/UCs4vs)

<comment><USER7> i'm not from the UK/EU, could you expand a little? is it a tabloid?

<comment><USER6> Sorry, for context, it's actually worse than most of the tabloids, it pushes an agenda of hate to monetise anger - almost everything in it is lies.

<comment><USER7> yeesh, thank you both for the further detail I'll steer clear of them</comment></comment></comment></comment>


Ask HN: Best Email client for Linux? - <AUTHOR> I need something with GMail support for a university account. I have been using Thunderbird, but I would like something actively in development. <comment><USER2> When you say "with GMail support" I assume that you mean "Handles IMAP".

As you say Thunderbird seems stalled, but despite that it continues to work. So are there specific annoyances you have with it? Or think you'd like added/changed?

Most of the big (graphical) mail-clients are very similar in terms of featuresets, if you ignore the GUI toolokit and similar distractions.

I personally prefer console mail-reading, for many years I used mutt, but then I started to get annoyed that I couldn't script it terribly well. So I wrote my own mail-client, console-based, modal, and scripted with Lua. It works for me, and even has IMAP support, but I suspect it is not so useful for you:

[https://lumail.org/](https://lumail.org/)

[https://github.com/lumail/lumail/](https://github.com/lumail/lumail/)

<comment><USER3> IMO, Gmail isn't really IMAP. It's more like kinda semi sorta MAP.

You can't ever delete mail from gmail. Only hide it, at best.

Gmail only ever has one folder, into which everything gets thrown.

</comment></comment><comment><USER4> the last thunderbird release was two days ago. it's not getting fancy new features but it IS getting bug and security fixes, so if it suits your needs there's no reason to switch.

[https://www.mozilla.org/en- US/thunderbird/52.5.0/releasenote...](https://www.mozilla.org/en- US/thunderbird/52.5.0/releasenotes/)

</comment><comment><USER5> [https://mail.google.com/](https://mail.google.com/)

</comment><comment><USER6> I use claws-mail. Not exactly fancy but it's fast, stable, and can handle several GB of data in inboxes even in slow machines without a hiccup.

My second option, beacuse of the features it offers, would be Kmail/Kontact.

</comment><comment><USER7> I use thunderbird, but I have fond memories of Evolution. It is way faster than thunderbird.

Claws-mail is pretty good too, if you need something light yet functional.

</comment><comment><USER8> You could use Geary, Evolution, mutt.</comment>