CSS Lint - <AUTHOR> http://csslint.net/ <comment><USER2> The About[1] page, which explains the linter's rules, should be more prominently linked I think.

I am very much an amateur at CSS. I know the basic rules (I hope), but I'm definitely not a designer or an expert. After running some CSS through the linter, though, and reading the About page, I have a few questions.

First: Why are IDs bad? The About page says:

>> _Don't use IDs in selectors

IDs shouldn't be used in selectors because these rules are too tightly coupled with the HTML and have no possibility of reuse. It's much preferred to use classes in selectors and then apply a class to an element in the page._

I don't quite follow. Isn't the whole point of an ID that it is like a class, but unique? Why exactly would it be better to change all ids to classes with only one member? (I don't even see how that would be different, except for making it less obvious to me that they're unique.) _Edit_ : the context about OOCSS which Jacobr mentions below helps explain this.

Second: Why is it so important that heading styles be declared in exactly one spot. Again, the About page:

>> _Heading styles should only be defined once

Heading elements (h1-h6) should have exactly one rule on a site. CSS Lint warns if it finds more than one._

I ran into this because I had one ruleset for h1, h2, h3, etc. to make _all_ the headings use the same font and color, but then I had distinct blocks for settings that I wanted to be different. (Example, I wanted the h1 to be larger and have a different bottom margin from h2 or h3. And so on.) I could easily duplicate things so that each set of rules was in exactly one block, but that would make the stylesheet less DRY.

(Edit - putting my cards on the table, here's the CSS I checked: <http://ithaca.arpinum.org/css/screen.css>. I definitely don't doubt it could be improved.)

[1] <http://csslint.net/about.html>

<comment><USER3> Don't pay attention to that tool. Nicole has her own and peculiar view on CSS and many rules in CSS Lint make very little sense.

There is nothing wrong with .foo.bar. There are problems with outdated versions of IE, should that stop you?

There is nothing wrong with ID selectors.

There is nothing wrong with having display:inline on the floated element. No harm done, fixes double margin bug in IE6 if you need that.

It is ok to have many rules for heading no matter that CSS Lint says.

It is ok to have width, padding and borders defined. I do that all the time and surprise surprise, result is just as I intended. I am not sure if CSS Lint knows anything about box-sizing rule.

Etc., etc.

Unit-less zeroes, no empty rules do make sense, but I guess decent CSS compressor would take care of those.

<comment><USER4> Agreed -- almost all its complaints about the first css file I passed it were "don't use id selectors".

I suspect some of the complaints are valid, but simply saying "broken box model" doesn't explain why.

<comment><USER5> Ditto. Funnily enough you also get some rules that tell you to use id selectors:

        Overqualified Elements	Element (a#galleryLink) is overqualified, just use #galleryLink without element name.
        a#galleryLink {

This was given as a warning, but it's spot on too - <https://developer.mozilla.org/en/Writing_Efficient_CSS> for example.

<comment><USER4> I think it's actually saying a#foo is worse than #foo (assuming you're not reusing #foo in which case, conceptually, shouldn't it be a.foo?).

Indeed, I'd argue it ought to say that you EITHER ought to use a.foo or #foo depending on what you're doing in the page.

I'm not an efficiency nut, but it's quite possible #foo runs faster than .foo and this might be important to you, even if giving multiple things the same ID makes you feel dirty.

</comment></comment></comment></comment></comment><comment><USER6> Curious. Running csslint.net's CSS through itself resulted in 65 warnings. I would expect them to use their own tool on their own code.

<comment><USER5> They possibly did - a warning is not an error.

The tool flags these issues for the [OO]CSS writer to attend to. If I say "look out walking on that floor it's wet" that doesn't mean you can't choose to walk on the floor nor even that I'm telling you not to.

</comment></comment><comment><USER7> The rules are too frivolous and personal-standards flavored, it's difficult to care enough to look for anything _actually_ wrong amongst the ton of "I don't do it like this" warnings.

</comment><comment><USER8> _Using float for layout isn't a great idea, but sometimes you have to. CSS Lint simply checks to see if you've used float more than 10 times, and if so, displays a warning. Using this many floats usually means you need some sort of abstraction to achieve the layout._

Why is using floats bad, and what are the abstractions one would use in place of floats? Tables? Or grids?

<comment><USER9> I don't know either.

I've posted a bug report demanding a clarification of the documentation on that point.

<https://github.com/stubbornella/csslint/issues/26>

<comment><USER10> Demanding justification for things a tool you got for free, is a bit ungrateful. Why not 'request' or 'ask', you might get a better answer. Demanding things from open source is a pointless venture.

<comment><USER11> The person you replied to might not be a native English speaker. Demand shares a common ancestry with the verb "to ask" in some languages. Take French's "demander" and you might see why someone could use "demand" in a way that sounds confrontational in English but quite normal in another language.

</comment></comment></comment></comment><comment><USER12>
        Heading (h1) should not be qualified.

Yes it should, especially if you are using HTML 5 and are using different heading sizes for different parts of your site... Otherwise an h1 in a header (tag) would look the same size as a h1 in an article (tag).

<comment><USER13> I could be mistaken, but I think the idea is you only have one h1 per page. If you use an h1 in different contexts on different pages, the rules for those pages should probably be in different stylesheets as well, obviating the need to qualify them.

<comment><USER12> In HTML 5 you can use the h1 element multiple times. For example, lets say you are writing an article

      article
        h1
        h2

That is perfectly valid, now lets say you have an header that gets added before each article that contains some information such as author, time created/published

      header
        timedate
        h1
          Article Title
        author
      article
        h1
        h2

This is valid HTML 5.

<comment><USER14> In HTML5, not only is it valid, but doing otherwise would break the document outline.

</comment></comment></comment></comment><comment><USER15> I'm entering the CSS found on major websites. The following is a rough feel for how many errors and warnings csslint is detecting.

this page = 1 errors and 2 warnings

craigslist.css = 4 errors and 340 warnings

facebook's css files' = 0 errors and 140 warnings

google home page: 0 errors and 0 warnings

ebay = 0 errors and 64 warnings

Are these results meaningful? I don't know. Thoughts?

<comment><USER16> Don't forget the 65 warnings thrown... on CSS Lint's CSS code.

I'm not going to say it's useless, but it certainly isn't as good as a real CSS validator.

</comment></comment><comment><USER17> Well, that was impressive. 82 warnings, and every single one was wrong. This is not a useful tool.

</comment><comment><USER18> The biggest problem with CSS today is that the source code _is_ the product. One possible solution to this problem is to use SASS (<http://sass-lang.com>), thereby separating the concerns of the quality, structure, reusability (etc) of code from the aspect of browser rendering efficiency.

Many of the aspects of CSS Nicole is trying to improve with OOCSS/CSSLint simply vanishes when you use SASS (though some still stand). Some of the points as they pertain to CSSLint: <https://github.com/stubbornella/csslint>

Take for instance the issue of reuseability. Nicole's solution to that is less CSS selector specificity, to not use IDs, and to sprinkle containers with several modular CSS-classes. By using SASS functions, mixins and extends you can achieve that _without_ doing either of those things.

I much prefer using SASS to manage my source code and the related concerns, without resorting to these kinds of sacrifices.

<comment><USER19> I know some of the things that SASS gets you, but I'm curious: how DRY and light is your generated CSS?

Anecdotally, the designer where I work uses SASS, but in our last iteration of our web app, his compiled stylesheet was something like 10,000 lines.

<comment><USER18> It depends on how you use SASS. Used correctly, with @extend rather than @include for big swatches of styles that reoccur in multiple places, it will be DRY and light.

Your designer colleague probably didn't have a sufficient understanding of the difference between @extend and @include. It's not hard though, a few tests using the different methods and analyzing the results should be enough to understand when to use each.

It is utterly impossible to generate worse CSS with SASS than by just writing CSS directly, as SASS does not _deprive_ you of any CSS feature. SASS provides you with a bigger and more capable toolbox, but won't stop you from using the wrong tool in any given situation.

</comment></comment></comment><comment><USER20> I don't see any reference to a CSS standard, for example pylint follows PEP 0008. This looks like the experience of a developer.

</comment><comment><USER21> I know it's just picking nit, but seeing as that's basically the entire point of CSS Lint... [https://github.com/stubbornella/csslint/blob/master/lib/pars...](https://github.com/stubbornella/csslint/blob/master/lib/parserlib.js) The entire library is in a single ~4700 line file with ~80 line long functions... Ugh.

<comment><USER22> The included parselib is actually sourced/built from the following: <https://github.com/nzakas/parser-lib/>

As well, the functions and built lib are chock-full of comments, which any decent IDE should be able to fold away.

Note: I paid no mind to how integrated libs are made as dependents of CSS Lint project. Then again, I have a feeling javascript projects are only more recently warming up to the idea and being built around the idea of dependencies, cross-party builds, etc.

</comment></comment><comment><USER23> During their presentation at Velocity today, they made the github project public:

<https://github.com/stubbornella/csslint>

</comment><comment><USER24> Linting (where you're going wrong) without explaining why (you're going wrong) is one of the most pointless exercises ever.

Maybe too much attention put on aesthetics, less on code (nice start though)

</comment><comment><USER25> Owing to the lack of options, this is only useful for linting CSS written by the authors or anyone who happens to agree with their opinions on what constitutes good CSS.

Crockford may be an opinionated cantankerous old goat _, but at least he gives you options to dial down some of the crazy he's baked into JSLint.

_ * He's also awesome, but anyone who's worked at Yahoo! or glanced at the JSLint Issues list or Pull Request queue can attest that he has strong opinions. _

<comment><USER26> You can't remove all the craziness in JSLint. The warnings about using == instead of === and not having your var statements at the top of the function, for example.

</comment></comment><comment><USER27> _width: x; padding: 0_ produces "Broken box model: using width with padding." Same for height. Isn't it exactly the opposite of using padding?

</comment><comment><USER28> "CSS lint found 0 errors and 0 warnings. How can you fix it? See the details below." Um, right. Whatever.

</comment><comment><USER29> The rules that this tool follows appear to be based on the creator's own personal opinions. Personally, I'd advise against at least several of the rules.

</comment><comment><USER30> Reading "JavaScript: The Good Parts" is an excellent crash course in writing decent JS but JSLint regularly ensures that you stay on the right track. Reading through CSSLint's guidelines, I agree with the bulk of it and am excited to have CSSLint keep my stylesheets on the right track. Hopefully an analogous TextMate "run csslint on save" bundle is right around the corner!

</comment><comment><USER31> It seems like this is useful in generating critiques of CSS for web pages in development, but user-style CSS (the primary sort I work with) has a different set of priorities that lead to selectors that seem to be considered poor style and warned against accordingly. It did point out several valid points I hadn't noticed and should fix, though.

</comment><comment><USER32> I like it, but it'd be really nice if it linked each rule to some kind of explanation on why is the rule right.

</comment><comment><USER33> I've been using paddings and left and right margins on inline elements and this tool tells me I can't.

</comment><comment><USER34> _"Don't use IDs in selectors"_.

What?

I need my CSS fast, Ferrari fast.

I don't need toddlers to be able to have a mental model of all my style rules.

<comment><USER35> I don't agree with this suggestion either, but I don't think IDs have significant speed advantage:

• browsers support duplicate IDs already (try `<p id=foo></p><p id=foo></p>` and you'll find that `#foo` styles both)

• both IDs and classes can be preprocessed and looked up using hash tables or similar

<https://developer.mozilla.org/en/Writing_Efficient_CSS> — suggests that Gecko optimizes class lookup as well

</comment></comment><comment><USER36> An obvious next feature is to allow submission of a URL, and it parses out the linked stylesheets and runs itself on those. i.e. lint my site

</comment><comment><USER37> Hah, I was just sitting in the talk at Velocity where they announced and open- sourced this.

</comment><comment><USER38> Eh, command line output is a bit weird. Still, trying to get it work in Emacs... :)

</comment><comment><USER39> It's useless, too many stupid or plain WTF rules, like

1) "Don't use IDs in selectors"

2) Most "Overqualified Elements"

3) "Broken box model: using height with padding"

<comment><USER40> The "Don't use IDs in selectors" was really random.</comment></comment>


Report: US would make Internet wiretaps easier - <AUTHOR> http://news.yahoo.com/s/ap/20100927/ap_on_hi_te/us_internet_wiretaps

<comment><USER2> "Any service that provides encrypted messages must be capable of unscrambling them."

Isn't that unrealistic in a private / public key encryption scenario? I worry that lawmakers don't quite grasp the implications of the technological changes they want mandated</comment>


Will YCombinator invest in a Non-US startup - <AUTHOR>

<comment><AUTHOR> Folks, There are many threads running on immigration laws and visa issues, and being someone who wishes to apply for the next round of YC school this leaves me a bit uncertain. So here is my question, what if the startup is good and Ycombinator likes it but the founders have visa trouble and aren't able to come to the US. What will happen then?

Also I am from India and in India companies of foreign origin are allowed to own 100% in an Internet startup, will Ycombinator consider letting us run our company out of India if we cant manage the visas? Any clarification will help immensely. Thanks

<comment><USER2> There have a few non-US teams in the program. If you stay where you are, you are missing the main benefit of Y Combinator.

<comment><AUTHOR> Not by choice though..just if we don't get a visa.</comment></comment></comment>


Intel 4004 programming manual (1973) [pdf] - <AUTHOR> http://bitsavers.trailing-edge.com/pdf/intel/MCS4/MCS-4_Assembly_Language_Programming_Manual_Dec73.pdf <comment><USER2> Thanks, this clears up some of the strange wonderment with the Intel 4004. For example, I never knew what the "status characters" in the data RAM chips were for. This manual suggests to use them to store sign and exponent, or program RAM addresses. They seem to be general purpose, though.

Note that there is separate "program RAM" and "data RAM", the latter having a more complicated structure with the aforementioned status characters. It's surprisingly complicated to address any RAM on the 4004, with both types of RAM having separate quirks for doing so.

There are also plenty of other oddities, like I/O ports on both RAM and ROM chips, dedicated instructions for e.g. "keyboard processing" but no AND or OR instruction (with horrifyingly long examples on how to implement them in this document), and some instruction names for seemingly straightforward things that are completely unintuitive.

It's well worth exploring.

<comment><USER3> The 4004 is often described as the world's first microprocessor, but it has more in common with contemporary microcontrollers --- programmable, yet not really general-purpose. The Von Neumann architecture and specialised instructions are examples of this.

<comment><USER4> You mean Harvard architecture?

</comment></comment></comment><comment><USER3> A 4 bit datapath may seem very limiting, but note that 4-bit microcontrollers are still produced in massive quantities today, used in devices which you may not even be aware of as having a microcontroller: [https://en.wikichip.org/wiki/4-bit_architecture](https://en.wikichip.org/wiki/4-bit_architecture)

<comment><USER5> I had know idea they were still popular! Thanks

<comment><USER5> It is a special kind of online community that downvotes someone for liking the idea of four-bit integrated circuits. I will try to regain my lost karma by upvoting a chip at the 32- or 64-bit level.

</comment></comment></comment><comment><USER6> I like all the tables at the end, the manual for one of the first calculator ICs of course predates handheld calculators that convert between hex and decimal.

</comment><comment><AUTHOR> We've come a long way, but it is really cool how easy is to tell that it is the x86-64's ancestor.

<comment><USER7> Noncoml, did you really read the manual? The 4004 is unrelated to the x86-64.

Perhaps you are confusing it with the 8008 which is related to the 8080 which is related to the 8086 which is related to the 80286, 80386, 80486, and so forth.

<comment><AUTHOR> Hmm, I don't know. Especially the way the segregate RAM into banks reminds me a lot of the x86 segments with their direct and indirect addressing modes.

Also a lot of instructions have similar names: CLC

You are right, it is not a true ancestor, but ready through the manual, it did seem to me that it was designed by the same people.

To be honest I haven't dig into other CPU families, so maybe these were pretty common.

But I can definitely see 4004 DNA in x86.

<comment><USER8> The CLC - clear carry - instruction predates the 4004. The PDP-11 for instance used it. I think you're seeing patterns that aren't really there.

One thing the 4004 and 8008 _do_ have in common is a similar floor plan for the chips. They both have the ALU on the left, data bus along the top, instruction decoding in the middle, registers on the right, and on-chip stack on the right. Other processors of that era (e.g. 6800, 6502, 8080) have very different layouts so it's not just coincidence. Texas Instruments produced the TMC 1795, a chip equivalent to the 8008 (before the 8008), and it also has a completely different layout.

If you look lower-level, at e.g. the ALU implementation or the register implementation or the pin drivers, there's less similarity. I would have expected they would essentially cut-and-paste some of these low-level pieces, but they are more different than I would expect.</comment></comment></comment></comment>


Tuning Out: What Happens When You Drop Facebook? - <AUTHOR> https://siepr.stanford.edu/news/drop-facebook <comment><USER2> I'll tell you what happens.

You end up compulsively refreshing hn and reddit while telling yourself that you've increased your productivity.

<comment><USER3> > _You end up compulsively refreshing hn and reddit while telling yourself > that you 've increased your productivity._

Anecdotally, I didn't. According to this study, on average, that's not what other participants did either: "They didn't replace Facebook with another social media platform like Twitter."

<comment><USER2> Anecdotally I just looked at your profile and you comment on hn approx once per day.

<comment><USER4> Half an hour a day isn't an issue

</comment></comment></comment></comment><comment><USER5> I dropped FB after one of the many privacy scandals, and after not using it much at all for years. Thus, I'd not fit the study inclusion criteria of 15 mins daily, but is there really 15 minutes of fresh content from friends and family? Most of the content I recall was quick to read, and a ton of it was garbage, sponsored, memes, etc. If anything, I just replaced that minimal time with more HN and reddit and NYT. Reddit is going a similar way, I am contemplating deleting and blocking it, but its very good for niches like starcraft, personal finance, ask historians and scientists, etc.

</comment><comment><USER3> The heading "Small, but significant, impact on well-being" should really be "Small, but significant, negative impact on well-being". There's no reason to bury the lede further.

Quitting Facebook is a very nice thing to do for yourself.

<comment><USER6> Actually, it was claiming a small but significant positive impact on well- being from quitting FB.

If you find anything negatively impacting your mood, seems good to cut back.

<comment><USER3> Ah, I see what you mean. Your restatement disambiguates nicely, thank you.

> _If you find anything negatively impacting your mood, seems good to cut > back._

Of course, yes. The insidious thing is, like many additions, there's a reward component too.</comment></comment></comment>


AJAX developers continue migrating to unobtrusive JavaScript - <AUTHOR> http://www.infoq.com/news/2008/06/unobtrusive <comment><USER3> It's not obvious at all that "unobtrusive" coding has advantages. First of all, the line between HTML and what they call "behavior" is vague: many, if not all, presentation elements contain built-in behavior of some or other form, for example take any form element. JavaScript code that we write extends or customizes this behavior, rather than creates it from scratch.

Second, when we read raw HTML it's better to see explicitly that the behavior of a given element is customized. Even a small hint of customization in a form of a function call from within onClick, for example, would be a sign that a given element is different from the standard one.

Finally, less code always means easier to understand and easier to debug. There is no excuse for writing more, no matter how you call your technique, if there exists a simpler and clearly more concise way of implementing the same functionality.

<comment><USER4> Damnit, there's no reason to downvote this man. He may not be right, but he's not detracting from the conversation.

A rebuttal: Unobtrusive coding has many clear advantages - not the least of which is the fact that your js files can be cached, increasing the loading speed of your app.

And more code in, say, a library can mean less domain-specific code that has to be maintained, making your app easier to understand and debug. I use YUI, jQuery, and the module pattern to create surprisingly concise and easy to understand js files. They're pretty much all cacheable, they're easy to read, and most importantly, related things are all in the same place.

This is actually kind of key for debugging. If you want to find out where the function call attached to a dropdown's onChange event, you check the YAHOO.Company.page.init() function. That's just where it is. You don't have to sort through reams of HTML to find the dropdown. This is better still if you have a function that prints multiple instances of that dropdown - the events are all attached, line-after-another in the js file, not hidden in a function somewhere in a different language.

Certainly there's downsides to it, but there's a lot to gain.

<comment><USER3> I should have made myself clear: I'm not against moving JS code to a separate file and I understand the benefits of caching.

My point is, some _hint_ of change for a given element must be given where it's declared, for example as a function call in onChange. This function itself can be defined anywhere, preferably in a separate file. Why - <USER2> when building a web app you usually look at the page and decide to modify the behavior of an element. In a good WYSWYG editor it's just one click, and you see that there's custom code attached to one of the events of that element.

With "unobtrusive" style it's not _obvious_ at design time whether an element has standard behavior or not, unless you know the code well, I mean, every bit of code in all modules.

<comment><USER5> I'm not sure that's 100% true. Some development idioms have you staring at HTML all the time, others don't: take a look at the arc code behind YC for a good example. Likewise view-based architectures like rails spend more time worrying about how to invoke/include the view than they do tinkering with the presentation internals.

And that "hint" that you want can be gotten many ways, it doesn't have to be a hard-coded event handler. Make it a class, for example. Or better, a class on the containing element (a collection of category selectors, whatever). That's even clearer than the event handler, because it's a statement of pure semantics.

</comment></comment></comment></comment><comment><USER6> jQuery FTW

<comment><USER7> Do it yourself FTW

<comment><USER4> Man, YOU write jQuery's selectors yourself. Maybe you even could, but why would you want to?

jQuery's the most excellent basic "toolkit" javascript product I rely on.

<comment><USER7> Why do you need selectors like that? just give things IDs if you need to reference them...

Oh well :) Maybe I'll try a javascript library properly one day.

<comment><USER4> What if you wanted to get an array of all the table cells in a particular table?

$('#tbl-order td')

versus

\- Getting the table \- Getting the table body \- Getting each row \- Getting each cell

Much simpler. It's cool though, I dismissed it until I tried it too. It's a real eye-opener how much easier things are using jQuery's selectors.

<comment><USER7> If you want to get an array of all the table cells in a table, you're probably using the DOM to store data, instead of display data, which is bad IMHO.

I prefer having the data in js, pointing to nodes in the DOM, or containing IDs that may need adjustment, updating.

<comment><USER4> Or you're adding rollover events to the table, or styles to the table.

Also, the DOM's not a bad place to store data. Why duplicate it elsewhere if it's already in-place in a table? This allows you to say, gracefully upgrade your simple HTML table to a YUI DataTable if your user has javascript enabled.

<comment><USER7> That's like using a video cards display ram to do inter process communication, or store other program data.

Sure though, if you want to add things to a table once loaded to be unobtrusive I can see that use. Although then I'd say just give them sane IDs, and have a js array with the IDs you need to update.</comment></comment></comment></comment></comment></comment></comment></comment>


How to Save the Troubled Graphene Transistor - <AUTHOR> http://www.technologyreview.com/view/518426/how-to-save-the-troubled-graphene-transistor/

<comment><USER2> Link to source article: [http://www.technologyreview.com/view/518426/how-to- save-the-...](http://www.technologyreview.com/view/518426/how-to-save-the- troubled-graphene-transistor/)</comment>


Ask HN:What are some SEO techniques for bootstrapped project - <AUTHOR>

What are some of the specific on page and off page techniques one can try when there are well established sites already existing in the same category.How to make sure you rank well on same keywords. <comment><USER2> your standard H1, H2 tags. meta title for all pages 55 characters or less. meta descriptions 155 characters or less on all pages. of course original content that is "unique" for the niche, takes a different approach to the topic, not just original work. different media if possible for consumers to want to share, or come back for more. i would recommend you read groovehq.com/blog and ViperChill.com as well as Moz.com for tips to expand on the topics... solid advice fromm all... Good Luck

<comment><AUTHOR> thanks!

</comment></comment><comment><USER3> I am working on some solution to this problem. I have created tool which helps you find profitable keyword niches in Google: metrics11.com

</comment><comment><USER4> i would recommend guest posts: they work for google (you place a link to your website in the author info section), but they also bring other website traffic to you.

<comment><USER5> Careful about guest posts. Google has said there's a difference between guest posts and posts that you've paid for (paid linking). See this video from Google:

[http://searchengineland.com/googles-matt-cutts-guest- bloggin...](http://searchengineland.com/googles-matt-cutts-guest-blogging- best-done-in-moderation-174367)</comment></comment>


Show HN: IGeon iOS Arcade Space Shooter - <AUTHOR>

Hello HN!
IGeon is an IOS game that I have been working on. It was released last week on the app store! To commemorate the release I am giving away 20 Promo Codes to the game. http://codehookup.com/8769c573
^ Code Hookup is a Promo Code distribution tool.
Enjoy! Feedback is much appreciated.
Itunes: https://itunes.apple.com/us/app/igeon/id887223161
Facebook: https://www.facebook.com/IGeonIOS
Twitter: https://twitter.com/IgeonIOS <comment><AUTHOR> If anyone has questions on how I developed this application I would be more than delighted to answer.</comment>


Facebook can now read your texts - <AUTHOR> http://tony.calileo.com/fb/ <comment><USER2> This has been a thing for about a month and a bit now. A Facebook engineer posted the following on Reddit[0], explaining the rationale behind the SMS permission:

> As for the READ_SMS permission, we require that so we can automatically > intercept login approvals SMS messages for people that have turned 2-factor > authentication for their accounts, or for phone confirmation messages when > you add a phone number to your Facebook account. Unfortunately, the Androids > permissions system does not allow us to specify that we would like to be > able to read only SMS messages from a specific number (plus that wouldn't > scale well because the list of numbers varies per country, but that's a > separate issue).

[0] [http://www.reddit.com/r/WTF/comments/1t5z45/facebook_why_the...](http://www.reddit.com/r/WTF/comments/1t5z45/facebook_why_the_hell_do_you_think_its_okay_to/ce4y6x2)

<comment><USER3> I feel like some sort of manual component to two-factor authentication is the whole point (a clickable link, copy+paste, or remembering a 4 digit number).

Besides that, two factor is a bit of a joke in an app (on your phone) that caches your password, and then sends a message (to your phone) which is automatically read and accepted, before allowing you to login. What exactly are we achieving here in terms of security? Every 30 days the app authenticates itself with no user intervention.

It would be much more secure to just force a password login.

<comment><USER4> We are achieving the same security guarantee as before, just without the user pain. All two factor provides in this case is proof that you have the phone associated with your account. Why does it matter if the app does the legwork for you?

<comment> grey-area _We are achieving the same security guarantee as before, just without the user pain._

I'd argue that a corporation other than the phone company being able to read all your text messages is significant pain.

Given that FB seems to want to take over all communication between users (contact list/blog/email/photos/messaging) FB being able to track and access anything you do is the inevitable endpoint of such aspirations, but many people are not comfortable with that, and the farther FB go down that road, the more people they'll alienate.

</comment></comment></comment></comment><comment><USER5> At this point I'm running at least 2 versions behind on the facebook app. I didn't install it last time it asked me to allow it to "Send emails to guests [of events] without host's knowledge" among other things. I see now that they also want to be able to connect and disconnect from WiFi.

The Facebook app is probably the fastest way to find a list of all permissions in the Android system. "Draw over other apps", "Read battery statistics". I don't know what part of facebook requires either of those options, and the mobile version of their website offers me the minimal amount of functionality I need.

The act of writing this comment has made me uninstall the damned thing. Just reclaimed 17.61MB, and probably a fair amount of space in my mind since I'll check Facebook less often.

I'm sure, as the author of the linked article asserts, most people blindly accept the permissioning changes, but I hope this permission-creep starts to cost them installs.

<comment><USER6> "draw over other apps" is to implement chat heads (see [http://www.piwai.info/chatheads-basics/](http://www.piwai.info/chatheads- basics/))

<comment><USER7> Which caused me to freak out when it first happened. I was furious. I had to stop everything I was doing _immediately_ in order to figure out how to disable it.

I can't possibly state emphatically enough how user-hostile that feature is. It is so disruptive to my thought process...it's nearly as bad as that awful focus-stealing thing that Windows does.

<comment><USER6> I can understand it might have been unnerving but on the other hand the feature was documented in the change log and in the list of new permissions the app required (in the version chat heads were introduced). Personally I find chat heads convenient and useful

<comment><USER7> "Useful" for what purpose?

<comment><USER8> It makes it easier for me to carry on conversations while also doing other things on my phone. If I'm reading something, and someone responds to a message, I can quickly pop open the chat window and respond, then close it and go back to what I was doing. I find that more convenient than going back to the home screen and launching an app from there or the (rather slow) app switching process.

Yes, sometimes it does get in the way of what I'm doing, and in those cases I just swipe the chat head down to the bottom of the screen and it goes away. And considering turning it off is one of the options in the first page of the settings, I'm not really understanding why it would make you furious or think this is user-hostile. Overall it's a pretty unimportant change that is easy to disable if you don't like it.

<comment><USER7> Notifications in the top bar achieve that purpose for me, without disrupting what I'm currently doing.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Is there any recourse short of "don't use the app" that regular users have against this sort of thing?

Is there no meaningful way to push back against Facebook for demanding this permission?

<comment><USER10> use cyanogenmod + privacy mode, you can disable what the app can do. for example, you can disable that. app still works, it just gets an empty sms list.

<comment><USER11> Sure would be nice if someone would jailbreak the iPhone, so we could have these sorts of options in our little walled-gardens too.

<comment><USER12> Can't you already disable access to Contact, Calendar, Reminders, location, etc per app on the iPhone?

<comment><USER13> Yes. And of course no app can read your text messages in the first place there.

<comment><USER14> Well, they could read all that other stuff by default with no warning previously until all sorts of apps abused it. Then Apple had to add in the prompts for things like reading Contacts. I'd imagine the Android devs are working on similar since the list of permissions model is breaking down.

</comment></comment></comment></comment></comment></comment><comment><USER15> The main reason I rooted my Android phone is to run AppOps 4.3/4.4. I can revoke permissions from apps, just like the one in the linked article.

This should be a standard part of Android, in my opinion.

The app, for those curious (I have no affiliation with it):

[https://play.google.com/store/apps/details?id=com.colortiger...](https://play.google.com/store/apps/details?id=com.colortiger.appopsinstaller)

My favorite permissions to revoke are: Wake lock, Location, Read contacts. As a result, I get almost 2 days on a full charge on my Nexus 5.

<comment><USER16> What does revoking the wake lock do, both to the app and the phone?

<comment><USER15> The Wakelock allows the app to wake up when your phone is asleep. My twitter client wants one, but I have notifications turned off. It might be that because I have them turned off it doesn't invoke a Wakelock. But it might. Basically, Wakelocks are the #1 cause of unnecessary battery drain.

<comment><USER16> I see, thanks. That's what I thought, but I thought that apps rely on push to get notifications. I guess that would not be very scalable, so the client wakes up once every X hours and polls.

</comment></comment></comment></comment><comment><USER17> At this point, if you care about your privacy, why would you even still have a Facebook account?

I used to think I could be 'safe', that my advanced knowledge of privacy settings and optimised usage patterns could somehow shield me from the fundamental nature of these data monger corporations. But the truth is concepts like cloud and social networking are fundamentally toxic to privacy and freedom.

I'm now pretty close to the day I delete my Google account, and that provides far more useful functionality than Facebook.

<comment><USER18> >At this point, if you care about your privacy, why would you even still have a Facebook account?

You could have a Facebook/Google account under a different name. I have one and its rather useful when websites have an option of logging in using facebook/google accounts.

>I'm now pretty close to the day I delete my Google account, and that provides far more useful functionality than Facebook.

What is this "far more useful" functionality ?

<comment><USER19> _You could have a Facebook /Google account under a different name. I have one and its rather useful when websites have an option of logging in using facebook/google accounts._

You can easily be identified by your network of friends. The name of your account doesn't matter.

<comment><USER18> Ah, I should clarify.. the account does not have any friends.

</comment></comment></comment></comment><comment><USER20> The title of this thread should be modified with the addition of: "if you use an Android phone."

<comment><USER21> ... but nonetheless it's an important example of the erosion of data privacy. Just as users are getting accustomed to clicking past EULA's so to they click past these permission request screens, and if they don't then the app keeps nagging them ... the user just wants to use the app, so permission granted.

</comment></comment><comment><USER22> This sucks because even if you don't have the application, you might be texting someone who does... facebook can collect that data too and build profiles of people who don't even have the app or even use facebook.

<comment><USER23> Good point. Wow, there really is no hope for private communication.

<comment><USER24> Other than hand-delivered letters and face-to-face conversation in a secluded space, but then again, how can you trust the person you're communicating with to keep those communiques private?

Argh...paranoia...all consuming!

<comment><USER22> that is a little different but point taken.

if facebook wanted to be nefarious with these newly granted permissions, they have an extremely large pool of data to mine.

</comment></comment></comment></comment><comment><USER25> Like others have said, on Android you can use App Ops, and if you're on 4.4.2, App Ops X ( [https://play.google.com/store/apps/details?id=com.colortiger...](https://play.google.com/store/apps/details?id=com.colortiger.appopsinstaller) disclaimer: I developed it). It still sucks that you're on an "open" platform but you still have to root/jailbreak your phone to keep your privacy.

<comment><USER26> Cool app, thanks. Is there a place where I can see an explanation for all of these permissions? I have no idea what the difference between "location" and "monitor location" is, for example.

<comment><USER27> Total guess based on their names: Location probably refers to retrieving the location of the device using an API.

Monitoring Location likely means continuously getting notification about device location as you are moving around.

<comment><USER26> That's what would make intuitive sense, but it also makes intuitive sense that those would be one and the same, given the topic of the article we're commenting on, so I'm still not sure about it.

</comment></comment></comment></comment><comment><USER28> Access to all your texts is scary, but what about "Add or modify calendar events and _send emails to guests without owner 's knowledge_ ...". I feel dirty just reading that - I'm so glad I've broken my Facebook habit.

Facebook's value proposition is going downhill fast. All but the dumbest users are now very careful about what they allow FB to know, if they stay at all. I suggest that their hallowed social graph contains less and less reliable info about the more valuable demographics.

<comment><USER29> And record audio and video? Are they insane? Who the fuck would agree to this?

<comment><USER30> how else would you expect them to be able to take photos / videos in app?

<comment><USER29> I'll take it on my phone and upload it.

</comment></comment></comment></comment><comment><USER31> "Read your text messages (SMS or MMS) If you add a phone number to your account, this allows us to confirm your phone number automatically by finding the confirmation code that we send via text message."

That's a pretty crap feature to use to justify this.

[https://www.facebook.com/help/210676372433246](https://www.facebook.com/help/210676372433246)

<comment><USER31> Looks like Twitter is doing something similar. One of the commenters here shows some decompiled code:

[http://android.stackexchange.com/questions/57726/twitter- rec...](http://android.stackexchange.com/questions/57726/twitter-receivesms- permission)

<comment><USER32> Yep, both Twitter and Facebook's apps seemed to start asking for this permission around the same time - they seem to be oblivious to how scary "Read your text messages" sounds to anyone vaguely concerned about privacy. I'm holding off on updating for now.

</comment></comment></comment><comment><USER33> Right now, the Twitter app is no better:

      - NEW: Receive text messages (SMS)
      - NEW: Read phone status and identity

Another reason I haven't updated yet.

</comment><comment><USER34> The whole idea behind these apps is in gaining access to user's data. This is why in recent versions of Android user cannot control not just what an app could do, but whether or not it should be started automatically.

The "strategy" is very straightforward - first to gain "popularity" offering a reasonable service "for free" and then, after accumulation what they call "user base" they just change the rules (permissions). The idea behind separate "messenger" app is exactly to "hijack" user's messaging service by "forcing itself to be" default messaging app.

I don't even want to talk what kind of spyware Skype is, using exactly the same "strategy" of quietly "adding functionality" and having permissions to do everything.

There is no other "working" way to monetize user's data, but collecting and selling it.

The next level is just adding malware functions in "next version".)

</comment><comment><USER35> I switched to using the mobile web version of FB on my phone because of this (and made a shortcut to it on the homescreen)... though really it's a losing battle, the real solution is to dump FB altogether.

I will say that the app provides very little that the mobile web version doesn't give you. I don't even notice the difference.

</comment><comment><USER36> I once talked to CTO of a quite popular app and he mentioned that he finds it best to ask for all permissions you might need upfront (on first install), even if you don't need them yet. Adding them in upgrades later results in lots of customer support questions (and negative reviews).

It is also telling that OP is bothered by "read your messages" permission but doesn't seem to mind "record audio, take pictures and videos" just below it. Just because it is not new?

<comment><USER37> The facebook app has its own camera app, if memory serves, that has some facebook specific features.

</comment></comment><comment><USER38> The best way to prevent this in this app, and many other apps is to use "App Ops" in 4.4 or use CyanogenMod and enable privacy guard and then you can long press on the app and prevent the app from reading SMS and many other things while you are at it.

<comment><USER39> I wish Google would recognize that it would be beneficial to protect users from this kind of thing by providing a decent management UI that didn't require using CM. Of course, that goes against some of Google's own interests...

</comment></comment><comment><USER40> This sort of crap is the reason I'm using Tinfoil for Facebook [1].

[1]: [https://play.google.com/store/apps/details?id=com.danvelazco...](https://play.google.com/store/apps/details?id=com.danvelazco.fbwrapper&hl=en)

</comment><comment><USER41> SMS is nothing. There are now many Android apps that demand the right to turn on your microphone any time they want to without notifying you. If you carry an Android phone and are not really careful about permissions you are carrying a wire.

<comment><USER42> Which apps would those be?

<comment><USER41> I do not remember which apps specifically stated "without notifying the user", however it was worded and I can't find any permission that specifically states that now but I am pretty sure that with MODIFY_AUDIO_SETTINGS permission it can be done by an app using the AudioRecord object:

[http://developer.android.com/reference/android/media/AudioRe...](http://developer.android.com/reference/android/media/AudioRecord.html)

To my chagrin I find 31 apps on my phone now that have that permission.

</comment></comment></comment><comment><USER43> Not just Facebook. There are many apps that are overstepping in terms of permissions. I turned off auto-update long ago and removed many offenders, but it seems every app these days is now requesting as many privileges as they can get away with. The general population of users aren't reading the list of new permissions on updates and no one is making these co's explain themselves as to why they need listed permissions. I asked an engineer behind an app I wanted to use that paired with a paid service I love why they needed access to my contacts, considering my contact list wasn't part of the core service. I told him read access to my contacts and full network access made me wary; what would keep them from reading and storing all my contacts on their server? His only response was that they promised not to do anything nefarious. I should not have to root my phone to use apps while protecting my personal data. Android User Profiles sounded very promising to keep private away from social, but my experience testing this feature out on the Nexus 7 was terrible.

<comment><USER44> Apps do not autoupdate from the Play store if there are new permissions. You have to manually update them. I am not sure if this is a recent change or not as I started using Android with the Nexus 5.

<comment><USER45> It's always done that

</comment></comment></comment><comment><USER46> 1\. This has been a thing for quite a while now, there have been numerous articles about this. This is nothing new, although it may have not rolled out to all users.

2\. Facebook gives explanation of all the permissions they need, including read SMS one, here: [https://www.facebook.com/help/210676372433246](https://www.facebook.com/help/210676372433246)

3\. This is more android permission issue than specifically Facebook app one. Facebook, in order to implement automatic confirmation, didn't really have a choice.

And fwiw, I use the app daily and I've had this update for at least a month and the read sms permission was never used according to various privacy tools which allow you to see, disable and view usage history of app permissions.

Until facebook starts abusing this feature/permission I don't think it's really an issue like most articles about this make it look like.

<comment><USER47> Why not just disable the feature if you want to deny it? Seems like a pretty shit feature if you ask me.

<comment><USER46> I'm not sure what you're saying exactly.

Why facebook doesn't disable it? Because people use it.

Why don't users disable/deny it? Because you can't select which permissions you want to grant to application upon installation, it's either all or nothing, even though the permissions may never be used.

And it's not really a shitty feature, the auto confirmation is pretty good - the permissions needed for it are shitty though, but they don't really have a choice other than completely disabling that part of application and having users enter the code manually.

</comment></comment></comment><comment><USER48> ...and this is why not to install the facebook app.

Try Tinfoil: [https://play.google.com/store/apps/details?id=com.danvelazco...](https://play.google.com/store/apps/details?id=com.danvelazco.fbwrapper&hl=en_GB)

CyanogenMod with Privacy Guard also works, but facebook's app is stupid bloatware anyway.

</comment><comment><USER14> Don't forget that Google Hangouts now has access to all your texts, too, now.

<comment><USER49> Err, yes, but on any modern version of Android, Google Hangouts _is_ the SMS app - so I thing that's a bit of a red herring, and completely unrelated.

<comment><USER50> > Google Hangouts _is_ the SMS app

What do you mean by that? It asked me if I want it to handle my sms, I said no. It asked me again when I updated to 4.4, I said no again. I can (and will) keep saying no...

<comment><USER51> They removed the default messenger and combined it with hangouts so they can have a ubiquitous chat service like imessage on iOS.

<comment><USER50> but I have the default messenger on 4.4.2?

</comment></comment></comment></comment></comment><comment><USER52> I remember noticing this on a lot more than just facebook. The Android permissions model seems to now be pointless as so many apps ask for pretty much all of the permissions.

</comment><comment><USER53> The only astounding thing is that people seem surprised.

Also it's a moot point regardless: Facebook can read all my messages to friends on Facebook already, and all their messages to their friends, and everything they publicly and privately share, including photos and videos, and they have access to most e-mail accounts around the globe. My texts are a relatively small deal in comparison.

</comment><comment><USER54> Asking for SMS (read/send) permissions is a growing trend among mobile apps (Facebook, Facebook Messenger, Twitter, Google Hangouts…).

Most of the time, they're here to make the app slightly more useful to the end user. But at the same time, you're potentially saying "yes" to a company who might, one day, use your most personal info for bleaker purposes.

It's thus something I've always been fighting against (at least at a personal level): I've stuck to the older, non-requiring-SMS-permissions version of these apps until I could upgrade to a version of Android with App Ops, then Cyanogen.

If SMS permissions is where you draw the line regarding your privacy, either run a version of Android with App Ops, or Cyanogen with Privacy Guard.

I find it sad that companies still think most users value simplicity over privacy.

<comment><USER36> I find it sad that most users value simplicity over privacy.

<comment><USER54> I believe most users _seem_ to value simplicity over privacy, but actually _do_ care about privacy. What's sad is that they don't get vocal enough about it until private information gets exposed.

</comment></comment></comment><comment><USER55> Just delete facebook already.

</comment><comment><USER56> Heading should have been proper if it was 'Android allows apps to read your text messages'.

</comment><comment><USER57> I noticed they pushed an update to the iOS app too, but those permissions weren't mentioned in the update log. Anyone know if they claim the same access in iOS? There's no granular permissions in the iOS Privacy section to control access to messages.

<comment><USER58> iOS apps can't access messages.

<comment><USER57> Thanks. I wasn't sure about that.

</comment></comment></comment><comment><USER59> [http://imgur.com/W09C9uO](http://imgur.com/W09C9uO)

Twitter is doing the same. It requests access to contacts list, SMS, phone call, phone Identity. I noticed the same and stopped updating. Andiord should enable users to control apps.

<comment><USER60> It is a ridiculous and I would say blatant insult to users and their security to not firewall off apps. I really, really don't understand it.

</comment></comment><comment><USER61> I have about 10 apps that I refuse to update, because they want some new permissions that I'm not willing to grant them. It is sometimes hard to find apps that respect your privacy and don't request absurd permissions.

<comment><USER62> You can control the permissions of each apps with AppOps [1]

[1] [https://play.google.com/store/apps/details?id=fr.slvn.appops](https://play.google.com/store/apps/details?id=fr.slvn.appops)

<comment><USER42> What's New: v 1.4 \- No more support for 4.4.2. I cannot do anything about it so far.

</comment></comment></comment><comment><USER63> Add Hangouts to the discussion. They incorporated SMS into the app, but the implementation doesn't look complete/polished, let alone the app. So, it doesn't provide me an alternative to the OEM provided messaging app, and at the same time they are accessing my SMS messages.

I personally don't use Facebook on phone now, but I would recommend using a third-party app for accessing Facebook on android. I have used Friendcaster, Fast and Seesmic before and found them pretty decent.

<comment><USER46> They're not accessing your messages unless you use it as default SMS application.

</comment></comment><comment><USER64> The RSA had a similar new permission recently, the ability to use your camera. With the knowledge of the NSA's backdoor to RSA encryption, I'll continue to refuse the update. I know that I'm being on the paranoid side, but I'd rather be paranoid than blindly accept these kinds of new requests. Facebook is out of control. They are trying to get their hands on as much of your personal data as possible. That alone should be enough for us to quit.

</comment><comment><USER65> That's why Privacy Guard from CyanogenMod is so useful.

(Actually it's called AppOps and it's from Google but it's an hidden feature on stock Android)

<comment><USER66> Looks like not many people knew it. If it's available on Android, FB should ask user's permission instead of force them to accept. If it's for the sake of a feature, when user declines, only need to disable that feature.

</comment></comment><comment><USER67> I only use Facebook via Firefox on Android ([https://play.google.com/store/apps/details?id=org.mozilla.fi...](https://play.google.com/store/apps/details?id=org.mozilla.firefox)) and it works great. Not wanting to grant intrusive permissions to the Facebook app is my number one reason.

</comment><comment><USER68> Facebook had this permission a long while ago and apparently removed it at some point. People complained about the same thing then, too.

Ref: [http://www.businessinsider.com/facebook-might-be-reading- you...](http://www.businessinsider.com/facebook-might-be-reading-your- texts-2012-2) from Feb. 2012

</comment><comment><USER69> It is not only with facebook. Vodafone also does the same but also with write permission on your sms. [http://www.intrepidkarthi.com/2014/01/vodafone-is- reading-sm...](http://www.intrepidkarthi.com/2014/01/vodafone-is-reading- smsmms/)

</comment><comment><USER70> Reminds me of apps within facebook that want access to post on your wall, and then you uncheck that, but then the app goes "NNOOOOOOO!" and tries to get you to check it just to use the app, even though it does not need such permissions.

</comment><comment><USER71> Which is why Privacy Guard from CM is so important.

I have it enabled default for all newly installed app.

</comment><comment><USER72> What I find more insidious is the new FB app permissions that allow it to read all of your private calendar data. Maybe no big deal for many people, but I put a lot of stuff into my calendar entries that I consider pretty private info.

</comment><comment><USER73> And Dropbox can read your contacts. Haven't updated yet, and probably won't.

Hello Owncloud !

</comment><comment><USER74> Ever since Facebook requested permission to paint over other apps, I've refused to upgrade or uninstall just to contribute an infinitesimal amount to the maintenance cost of their software.

</comment><comment><USER75> Is it possible for another app to interface with facebooks chat or do they prevent this? I remember there used to be chat apps for pc that could do MSN, AIM, Yahoo and a bunch of others.

<comment><USER76> You can just interface with Facebook chat using the Jabber protocol [https://developers.facebook.com/docs/chat/](https://developers.facebook.com/docs/chat/)

</comment></comment><comment><USER77> Gotta love Android. No recourse short of custom and/or rooting

</comment><comment><USER78> This is true only for Android phones? Should iOS users be wary?

<comment><USER79> Nup, iOS is far more secure than android

<comment><USER23> Far more secure? Thanks for the information, I didn't know that, and didn't know the topic here was about security.

</comment></comment></comment><comment><USER80> I don't mind. The Facebook chat has already replaced any texting I'm doing so the only new stuff they will get access to are postal delivery notifications.

</comment><comment><USER81> Which leads me to question - can HN read my posts?

</comment><comment><USER82> Who _can 't_ read my texts nowadays?

</comment><comment><USER83> This is why I do not use any Google, Facebook or Twitter apps on my android devices. On my iPhone, I block all requests.

</comment><comment><USER84> Everyone I know - me including - just clicks "yes" on the giant list with every second application.

It's kind of sad.

</comment><comment><USER85> Facebook and Zuck have waaayyyyy too bad a privacy track record to be entrusted with this imo. I deleted the app.

</comment><comment><USER86> It's not just Facebook. A lot of Google apps also require read (even write) SMS permissions.

</comment><comment><USER87> I just use the web app, when I use FB at all. The value/intrusiveness ratio is pretty low.

</comment><comment><USER61> I dont use facebook or twitter apps, I am only using them in mobile chrome and is good enough.

</comment><comment><USER88> Thank God that I cannot uninstall the FaceBook app from my HTC One.

</comment><comment><USER89> Could this be one of the reasons web apps get traction on Android?

</comment><comment><USER90> Does anyone know what they are using this feature for exactly?

<comment><USER57> It helps expand their social-graph beyond what you've shared on their platform. It also gives them access to geolocation information for users that haven't shared it previously, as photos shared over text messages may contain geo-location coordinate information. It likely also gives them context about where people are, what they're doing, who they're talking to the most, and what they're communicating about so they can deliver more context-aware advertising.

But if you ask them - they'll say it helps them deliver a better experience for their users and helps connect people, and that's what people really want ... to be more-connected.

<comment><USER91> More connected than what ? I am conencted with all of my friends and business contacts, whats the next level of "more connected" ?

</comment></comment></comment><comment><USER92> This sucks I should start reading privacy spolicies

</comment><comment><USER85> This WAS THE LAST STRAW!!!

I DELETED FACEBOOK!!!!!!!!!!!!!!!!!!!

</comment><comment><USER93> Hey, where is the "Reject" button?

</comment><comment><USER94> Just use their web site.

</comment><comment><USER95> I'm a god fearing american citizen with nothing to hide

<comment><USER96> Let's test that. What's your Social Security Number?

<comment><USER97> I just sent it to you in a text message. Didn't you get it?</comment></comment></comment>


Rents Creeping Back Up in San Francisco, San Jose and Oakland - <AUTHOR> http://www.siliconbeat.com/2017/07/28/bay-area-rents-theyre-creeping-back-san-francisco-san-jose-oakland/ <comment><USER2> Good for property owners

Bad for renters</comment>


Is Rust Used Safely by Software Developers? - <AUTHOR> https://www.youtube.com/watch?v=iOBXVOAbpdY <comment><AUTHOR> Related paper: [https://arxiv.org/pdf/2007.00752.pdf](https://arxiv.org/pdf/2007.00752.pdf)</comment>


Millennials 'have no qualms about GM crops' unlike older generation - <AUTHOR> https://www.telegraph.co.uk/news/2018/05/07/millennials-have-no-qualms-gm-crops-unlike-older-generation/ <comment><USER2> This survey was brought to you by a pro-GM crop organization.</comment>


Calling all Coders – Yet another survey - <AUTHOR> http://coders-survey.com/

<comment><USER2> I was a bit puzzled at first with the list of skills/languages and had to go to the "About" page to understand you're targetting specifically web developpers, you might want to make that more obvious at least in the introduction.

You should also add an "other" option with an input field to allow developers to indicate technologies you did not put in your list especially when dealing with IDE or frameworks.</comment>


Robust Spammer Detection by Nash Reinforcement Learning - <AUTHOR> https://github.com/YingtongDou/Nash-Detect <comment><USER2> It would be interesting to see the false positive and false negative rates.</comment>


Ask HN: Has the market for software engineers diminished at all? - <AUTHOR> There was a big rush of layoffs a few months ago, but has that significantly impacted the industry? Was there enough demand for experienced engineers that those who were laid off were able to quickly find a place?
I'm still getting contacted by recruiters, and yesterday's "Who is hiring" had plenty of postings.
What's the experience like been for people who are trying to find a job? Do offers seem lower?
What about from those who are still trying to hire? Do candidates seem to be of higher quality? <comment><USER2> My gig ended due to covid, and I've spent the past few months interviewing for IC and leadership positions (12+ years experience).

Personally I've been getting plenty of meetings and interviews, but out of 10 virtual on-site interviews I've yet to receive an offer. I'm based in the US, and these were remote positions.

I interviewed with two companies for leadership positions which would have required hiring developers. Both CEOs were adamant about hiring non-US developers. One stated that because he was forced into a remote environment he would rather hire 2 or 3 offshore workers than one US based engineer.

Interviewing is tough. I think I'll need to take a few months before I can start accepting interviews again. The processes are all so long and the results at times can seem so arbitrary.

While I do need a job, accepting an interview is effectively agreeing to several phone meetings, a couple of automated hackerrank style coding tests, 6+ rounds of technical and non-technical interviews, all to receive a canned rejection email.

<comment><USER3> I'm not sure what kind of job you prefer but startups can sometimes speed the interviewing process up. If you can easily get interviews with companies, you can be frank that 6 or 5 hours of interviews for an onsite is too much.

<comment><USER2> Thanks for the tip, I'll give that a shot.

</comment></comment></comment><comment><USER4> Thanks for asking this. As someone who's probably going to have to get a job in this climate very soon, I was about to pose nearly the same question.

> _...and yesterday's "Who is hiring" had plenty of postings._

At the time of writing (July 2020), the current thread is over day old with 578 comments. By contrast, the July 2019 thread had 912 comments.

I did happen across this comment, which is bleak: [https://news.ycombinator.com/item?id=23586183](https://news.ycombinator.com/item?id=23586183)

Likewise upon hearing about senior engineers with 20+ years of experience being out of jobs and grinding leetcode, it made my blood run cold.

First-hand accounts on either side of the process would be great, or even more formal analysis.

Just how brutal is it out there? How high has the bar been raised? What's the approximate chance of success applying for a typical position prior to COVID and now?

<comment><USER5> Thanks for sharing. I was curious and checked the trend too:

Comments: May 2018 (1,199), 2019 (1,018), 2020 (697)

Comments: June 2018 (911), 2019 (799), 2020 (671)

Comments: July 2018 (857), 2019 (912), 2020 (622)

The hiring environment is a mess.

For example, big tech (FANG etc) is vacuuming up folks everywhere from startups to those hit hard like Uber, Lyft, and Airbnb.

The top career priority in times of uncertainty is stability. So you have not just those laid off from the those companies, but those still employed and nervous, who are eyeing and applying to big tech. Startups that survive and grow now and after will have the advantage of less business competition, but will see a drop in candidates who will need more time to re-adjust to risk.

</comment></comment><comment><USER6> There was a decline for sure, here in London I noticed hiring has almost completely stopped for 2-3 months during the lockdown. Now it's starting to pick up again from my observation but it might take long time before job market is back to normal. By September it should be much better already imho.

</comment><comment><USER7> I wouldn't use "Who is hiring" as a significant representation of "market software for engineers". It's difficult to answer your question since every single answer in this post is highly biased towards personal experience. In my personal experience: no, the market for software engineers has not diminished at all.

</comment><comment><USER8> Despite layoffs, I think the market for engineers is going to grow. Working remote is just going to increase the number of people building tools to make working remote better.

</comment><comment><USER9> Hiring is definitely down. Been so since before the pandemics. Pandemics just accelerated it. The upside of pandemics, remote is more acceptable. There's a slight upswing since early June though.

</comment><comment><USER10> The "who is hiring" threads have had a slight decline but it doesn't seem much.

[https://imgur.com/a/omLukeG](https://imgur.com/a/omLukeG)

</comment><comment><USER11> On the bright side, there's a marked increased in remote jobs.

</comment><comment><USER12> In the US I would suspect trump's H1b freeze to push up the market value for any engineer, especially the middle standard deviation skill-wise.</comment>


Show HN: A formal proof of deMorgan's law in lean - <AUTHOR> https://github.com/picrin/deMorgan.lean <comment><AUTHOR> Formal proofs are becoming easier. This proof was achieved in a couple days of intermittent effort, starting with no knowledge of formal proofs.

<comment><USER2> Wouldn't easier usually mean shorter proofs and better proof automation? What is Lean offering over other proof assistants?

<comment><AUTHOR> By easier I mean there's a good tutorial and a low barrier of entry (you can learn to type proofs in the browser). When a couple years ago I decided to teach myself coq, I very quickly gave up, because there just wasn't any good entry-level resource available online.

<comment><USER2> I strongly agree there's a lack of text along the lines of "theorem proving for regular programmers". The majority I ever read assumed a strong background in maths, logic and functional programming and were really off-putting.

<comment><AUTHOR> Well, have a look at the two tutorials to which I link in readme.md of the github project. The first is very suitable for programmers with minimal prior knowledge of maths, the second is aimed at the opposite audience (mathematicians without much CS knowlede) (and I think is actually even simpler).</comment></comment></comment></comment></comment>


Some things I've done with Apple watch in the last 11 hours - <AUTHOR> http://log.ericalba.org/post/117307478867/some-things-ive-done-with-apple-watch-in-the-last

<comment><USER2> Sounds pretty fake IMO</comment>


The only 2 ways to build a $100 million business - <AUTHOR> http://versiononeventures.com/the-only-2-ways-to-build-a-100-million-business/#ixzz26yrNNdkY <comment><USER2> <http://news.ycombinator.com/item?id=4544063>

</comment><comment><USER3> This has literally been on the front page for the last ~14 hours.</comment>


Death to Captchas - <AUTHOR> http://timkadlec.com/2011/01/death-to-captchas/

<comment><USER2> I'm sorry, I have a hard time with articles that complain but offer no solutions (and the one line at the end about Akismet doesn't really cut it for me.)

I've seen some captchas that have you do simple math problems or other basic questions, which seemed to be a better alternative. I also remember seeing prototypes of a captcha that showed nine pictures and told users to select the three that were cats. Not sure why that never caught on, though.

<comment> mike-cardwell The trouble is, those sorts of captchas are trivial to bypass. They're good against an automated fly-by attack, but completely pointless against a targetted attacker. Not even a good targetted attacker, just somebody who knows how to write a script which submits a form.

I could probably get away with using the cat captcha on my blog, but Facebook or Google wouldn't be able to use it. But the thing is, for a site like my blog, I don't even _need_ to use a cat captcha. I just need to make sure dumb bots can't submit anything, eg using hidden fields:

[https://secure.grepular.com/Blocking_Comment_Spam_Using_ModS...](https://secure.grepular.com/Blocking_Comment_Spam_Using_ModSecurity_and_Hidden_Fields)

So where do these image captchas have a place? Not on big sites, and not on small sites...

<comment><USER3> The problem with only screening for dumb bots is that it won't screen for the 25-cent-an-hour Ukrainian or African hired to submit spam with a human-driven browser.

<comment> mike-cardwell That is a problem with _all_ captchas

</comment></comment></comment></comment><comment><USER4> He gets it slightly wrong on how it works. One is not verified by a computer and one verified by a user. Here's a quote from <http://www.google.com/recaptcha/learnmore>

"""But if a computer can't read such a CAPTCHA, how does the system know the correct answer to the puzzle? Here's how: Each new word that cannot be read correctly by OCR is given to a user in conjunction with another word for which the answer is already known. The user is then asked to read both words. If they solve the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct."""

</comment><comment><USER5> I recently tried turning off our CAPTCHA for a few weeks and instead just blocking all comments with links. I was still getting hammered by 10% of junk comments that don't have a link. Many of them were gibberish; my guess is it's a bot cataloging which sites accept comments in the first place.

Solving a CAPTCHA sucks for the person submitting the comment, but having a page full of Viagara spam burying any legit comments sucks for _everyone_.

What scares me is the noticeable rise in spam comments being submitted by _actual humans_ apparently in India and China. I set up a ModSecurity rule to block inbound hits coming from a Google search that includes the phrase "post a new comment" but that's only going to work for so long.

</comment><comment><USER6> >A far more elegant solution is to use some sort of filtering system (like Akismet). Such a system can run behind the scenes and work without complicating the user experience.

I disagree.

An automated system that calculates the probability that user data is invalid will inevitability report false positives, leading to blocked or deleted content. Try explaining that to a user.

</comment><comment><USER7> It's a 2 of 3 problem; We want three things 1) access to stuff 2) that access to be secure 3) no effort/time/delay for access. But in reality you only get two of those.

In general things of _"value"_ can't be both secure and fast/easy. If it's fast/easy it can(and will) be brute forced and/or Amazon Turked.

</comment><comment><USER8> <http://www.nucaptcha.com/> Offers a solution in video captchas. Moving letters are way easier to read and if fraudulent activity is detected the videos slow down to a rate which becomes uneconomical to solve.

</comment><comment><USER3> Weird for somebody to complain about visual accessibility _and_ have a site design that's so poorly readable. I mean, OK, I only got 2.5 hours of sleep last night and so I'm more sensitive than normal, but my eyes are still jangling from reading that.

</comment><comment><USER9> Does anyone have any experience with HashCash or alikes? <http://en.wikipedia.org/wiki/Hashcash>

Obvious problem is that in case of directed attacks spammers (or other malicious persons) would use native code or even GPUs to perform computations, while ordinary users would be limited by slower JavaScript implementations. It would help (but not solve the problem completely), though, if someone would show us some non-trivial code, that performs computation in background (without any noticeable impact on page interactivity), that'll finish in some minimal time required to write a meaningful comment or fill out a form.

</comment><comment><USER10> If you can afford to require registration for comments, then using the blacklist at www.stopforumspam.com works quite well. I've cut down my number of spambot-induced accounts by about 90% for a couple of forums I manage.

</comment><comment><USER11> The next captchas will likely be "choose the animal" from a 2D picture. given the small images across the screen, choose the dogs.

The people working to get through security measures will always be there, we might as well put them to good use. Get them to build innovative AI software to bypass security. The code to identify the animal in the picture will eventually find its way into the public and be put to good use.</comment>


Poverty is a lie in US. - <AUTHOR>

I believe poverty is big lie at least in US. Here someone considered poorest of poor can get at least food stamps, various govt supported programs. 2. Largest military , defense , city and town police departments ( compare this to India who have large human police deficiency ) 3. If there is poverty who owns skyrocketing buildings in every major city.  Even towns have high polished houses.
4.  Poverty is myth because family-forking ( sorry can't find better word) happens at very early age in life.  In US, life expectancy is 80+. Consider someone living 80 years and leaving parents house at 20 , claiming homeless and poor. In reality he/she is not poor.  They still inherit what their parents have. This is not fundamental reason but important to consider. You can't expect to own a house ( $200K ) at age of 21.<p>People live far far comfortably in US and always whine about something in US. What is your take on this ? <comment><USER2> Well, if you're getting food stamps, that means you probably don't have enough money for food. Just because someone else is paying for your meal doesn't mean you're not poor!

You seem to be looking at averages. "Who owns skyrocketing buildings" very, very few people own those buildings. They get rented out to the people and businesses inside them. It's rare for a business to own its own skyscraper, and it's even more rare for a person to own the skyscraper they live in. Having a few rich people in a city who own a bunch of buildings doesn't mean no one is poor in the city.

People don't start out owning houses, but they start out renting and maybe move up to a house later. Usually they use a mortgage (loan) that takes 15 or 30 years to pay back. And again, not everyone can afford rent or a mortgage payments. Some people really are poor.

It's getting harder to inherit money. Mainly because of taxes, and a general feeling that someone should earn their wealth instead of inheriting it.

<comment><USER3> The estate tax exemption is $5 million (so even someone with several children can pass on quite some wealth to each of them without taxes being a factor).

<comment><USER4> On the third hand, according to [http://www.interest.com/retirement- planning/advice/what-will...](http://www.interest.com/retirement- planning/advice/what-will-you-do-with-your-inheritance/)

> One in four Americans between 18 and 59 years of age expect to receive an > inheritance sometime during their lives. ... The median projected > inheritance was between $50,000 and $100,000

This means that most Americans won't be getting any inheritance, taxes or not.

<comment><USER3> Note that is the result of a poll, not from statistics about actual estates.

(I don't expect it is particularly wrong, but it isn't a very strong number. Apparently a larger percentage of those over 60 think they will have money to pass on [http://www.interest.com/retirement- planning/advice/interest-...](http://www.interest.com/retirement- planning/advice/interest-com-2013-inheritance-survey-results/) )

<comment><USER4> Point taken. I haven't been able to find any firm numbers on this topic.

BTW, that link you referenced says "money, property, or valuable possessions" and not just money. That might include, for example, one's wedding ring.

(Which then goes into the next chart. 11% of those who expect to leave an inheritance expect to leave less than $10K.)

Thinking about it, both of my parents are over 60 so would be on the survey. If one dies, then the other still keeps the house, belongings, etc. Does that count as "leaving an inheritance" to the spouse, in that survey?

If not, then it's only when both die that the money gets passed down. I have one sister. So if they combined leave $10K then that's an average inheritance of 5K.

The charts don't show that skew between joint estates and inheritance to a single person, but then again it would be influenced by the number of divorced people over 60, the number of remarried people, the number of widow(er)s over 60, and the number of children per household.

</comment></comment></comment></comment></comment><comment><USER5> A lot of these are looking at what _some_ individuals have and wrongly generalizing. Some people _could_ live with their families rather than be homeless - but for some, their parents won't _let_ them, or their parents are _dead_ , or they got out of abusive situations, or their parents are poor themselves.

What we do about that, what we fail to do, and what we should or shouldn't do are separate questions, but you can't simply wave off poverty with "it's their own fault because they're not falling back on familial support".

</comment><comment><USER3> There isn't a single definition of poverty that sees widespread use. Some of what you are saying is that people in the U.S. generally aren't destitute (which is major part of the broadest definition of poverty). Wikipedia seems to have a reasonable discussion of the issues:

[http://en.wikipedia.org/wiki/Poverty](http://en.wikipedia.org/wiki/Poverty)

</comment><comment><AUTHOR> edit: I don't want to hurt anyone's feeling or its not my intention. Having lived in 3 counties , including US and two poor asian countries, I can say that social support & services are far better in US. Though food stamp may not be sufficient considering various point , they do provide at least some support. I also worked with 1000+ people spending my weekends helping them to find jobs , rather disappointed to find hard way that many, if not all, don't want to get come out of poverty cycle. Again I am coming from global prospective so might have different look than what you propose.

</comment><comment><USER4> There are many definitions of poverty. One is the Orshansky poverty thresholds, which the US uses. It's based on the amount needed for basic food and housing. Under this definition, some 15% of Americans live in poverty.

Focusing on just the food issue, people who are 'food secure' have enough food for an active, healthy life. Food insecurity is another indicator of poverty. About 10-15% of Americans are food insecure some time during the year.

A third definition of poverty, more common in the EU, is measured as a percentage of the median income, usually 40-70%. HPI-2, used for high-income OECD countries, uses "population below income poverty line (50% of median adjusted household disposable income)." Under that definition, 17.0% of the people in the US are poor.

What you are saying is that none of these definitions are correct, or even relevant.

I strongly disagree, and propose that you have little idea of what you're talking about.

Your #1 assumes that SNAP (what used to be called food stamps) is enough to bring people out of poverty and food insecurity. This is incorrect. SNAP averages less than $1.40 per person per meal in 2014. While it's possible to survive at this level, it is difficult. See [http://www.jneb.org/webfiles/images/journals/jneb/45_6_Leung...](http://www.jneb.org/webfiles/images/journals/jneb/45_6_Leung.pdf) for one study ("Supplemental Nutrition Assistance Program participation was not associated with improved household food security over 3 months (P=.25)")

Your #2 highlights part of the issue. We spend money on military, law enforcement, and prisons, and not on social services. That we spend the money doesn't mean poverty is a lie - it can also mean that we don't care as much about poor people.

Your #3 is also beside the point. This is an aspect of income inequality. Rockefeller, Ford, and Mellon were rich even during the Great Depression. The Empire State Building was built during the Depression. That doesn't mean that the Hoovervilles of that era were a lie. The Gini coefficient is a rough measure of income inequality, and it's higher now than it's ever been.

Your #4 has some merit. To start with, life expectancy in the US is 79.8, not 80+. Only 1/4 of Americans will get an inheritance, and the median inheritance for that 25% is $60K or so. Your logic doesn't apply to the other 75%, which is quite the majority. (I won't be getting any inheritance from my parents - they don't have the money.)

But it's true - if we changed our culture drastically, then fewer people would be food insecure or housing insecure. Accounts of life 100 years ago have families of 5 in a one bedroom place, and may include relatives. Zoning laws often prevent mother-in-law apartments/granny flats, or guest cottages, and prevent multiple families from sharing the same home.

Still, the fact that culture _could_ change doesn't mean that no one is currently poor, which is your thesis.

Your observations instead point out that we could reduce poverty if we are willing to tax the rich, reduce military spending, shift police/prison money over to social services, and change zoning laws to support denser living.

Which are the same points everyone's talked about since the War on Poverty began in the 1960s, or since the social reforms around the Great Depression, or the socialist movement starting in the 1800s.

</comment><comment><USER6> You...I don't...this is a joke, right?

Please?</comment>