Crowd steps up to fund 'NSA-proof' app  - <AUTHOR> http://stream.aljazeera.com/story/201307112159-0022901 <comment><USER3> I'd been wondering when the explosive kickstarter campaign that leverages the NSA news would appear.

My feelings about projects like these are always complicated. Even though it's encouraging to see that people are excited about building secure communication platforms, my initial reaction to announcements like these is typically extreme dread.

There is a small community of people who have been working on secure mobile messaging for years, and unfortunately newcomers to secure communication generally fuck it up. Not only is that bad for users, but it's bad for those of us who have put years of effort into this, because it sets a tone where users begin to assume that _all_ apps which attempt to provide secure communication must have done it incorrectly, so it's not worth using any of them.

I think there are probably enough apps in this space now (TextSecure, ChatSecure, Gibberbot, Silent Circle) that these folks could have probably just partnered with or contributed to an existing project in order to meet their needs. Despite the article's subtitle, this will be far from "the first secure mobile messaging system."

<comment><USER4> Anyone who knows this stuff can provide additional feedback on apps like ChatSecure and Gibberbot? Are they considered to be good crypto implementations?

Update: I installed ChatSecure on my iPad and it's very easy to set up. So easy in fact that I'm thinking there must be something wrong with it, because otherwise it would probably be recommended more often in these types of threads...

One of the things that seems problematic is that the background session expires after a few minutes, so if someone tries to just randomly message you, chances are you won't be logged in, so this can't be a replacement for IM.

<comment><USER5> Time out on chatsecure is a draw back of iOS. It forces app to close after 10 minutes of inactivity. Very annoying.

I'm with moxie. There are already plenty of good encryption apps out there. That 100,000 could have gone to existing apps that do what they say they do rather than an app that might not turn out as promised.

<comment><USER6> I never quite understood this. Certainly you don't want to send an unencrypted notification message ("Matt says: here are the meeting times") to Apple's notification servers. But do you really have to be that verbose? I'm not terribly concerned about the NSA logging "you have $n new messages!" notifications.

<comment><USER7> > I'm not terribly concerned about the NSA logging "you have $n new messages!" > notifications.

But you can appreciate that as part of risk assessment some people might have a valid reason to be concerned about leaking even that much information?

GCHQ / NSA are _good at finding patterns in data_ , so a collection of "You have $n new messages!" notifications can provide insight into the organization of a group.

<comment><USER6> Yes, I certainly understand. Most people wouldn't be concerned—and would be far more likely to use the technology if they could enable a feature like "You have $n new messages."

I propose it as an option, not a default.

</comment></comment></comment></comment></comment></comment><comment><USER8> Don't trust this any more than any other closed-source "encrypted" communication product (like Skype). If they control both the source and the backend, how can you be sure it isn't compromised? How can you be sure it won't eventually be sold to the highest bidder?

Disclosure: I am the original author of ChatSecure, the only open source OTR+XMPP app for iOS devices.

<comment><USER9> They are planning on releasing the source "later when it's stable and good enough".

Souce: [https://twitter.com/brokep/status/354608029242626048](https://twitter.com/brokep/status/354608029242626048)

Edit: But they will still control the server. (It's audited by third parties, but... yeah)

<comment><USER10> If the client source proves that the message is properly encrypted though (they're using PGP), the servers can be as insecure as the open internet and it should be ok

<comment><USER9> I agree. The reason I put in that last sentence is because I read this in their FAQ ([https://heml.is/](https://heml.is/)):

> Distributing to other servers makes it impossible to give any guarantees > about the security.

Not sure what they're referring to.

</comment></comment></comment></comment><comment><USER11> Port bitmessage to Android then release it alpha and then wait 2-3 years to see if anything goes wrong. Then release it beta with gigantic warnings.

I hope this isn't another Jabber/OTR implementation because those would be full of metadata the NSA wants in order to identify social networks. Once identified, and if they look interesting enough they want to listen in, they would then go to town on your device, car, or home with surveillance equip to read your screen as you type, or just sneak inside the project's servers using nginx shell exploits or linux/bsd exploits none of us know about yet to inject code into the apk for download which will still pass signature tests. [http://www.pcworld.idg.com.au/article/512362/proof-of- concep...](http://www.pcworld.idg.com.au/article/512362/proof-of- concept_exploit_available_android_app_signature_check_vulnerability/)

Another problem is most devices are carrier built so can't be trusted not to have a new CarrierIQ-like rootkit, and they can just send an OTA update that can basically do whatever it is they want it to do including recording the screen whenever this app get's turned on. Maybe these carriers leave their build keys lying around and the NSA gets a hold of them and sends you their own OTA update. Or maybe their agents volunteer to work on this project and sabotage it like the NIST Special Publication 800-90 that recommended an inferior deterministic random bit generator that researchers assumed were deliberately made standard so a federal skeleton key could determine the random numbers and unlock the encryption.

The best NSA proof cell accessory is thermite to melt your phone so you stop using it to communicate stuff the NSA might want to find out. If you're not a terrorist, Snowden, or Assange then you can use Gibberbot only with a .onion jabber server because of SSL problems, and even then your device is still wide open, and Tor sacrifices traffic analysis timing prevention for usability so technically still vuln to metadata analysis by gigantic spy agencies like the NSA

<comment><USER12> there is no such thing as a secure cellphone platform, at least for us non- govt folk. expecting your comms to be secure on a cellphone because you use some app is super naive. as dobbsbob points out, your phone is likely ownable/backdoored by (1) the manufacturer, (2) the OS maker, (3) the ISP and (4) the local intelligence services.

the best way to keep anything secure as it relates to your phone is to not use it. in fact, keep your phone well away from where you work and have important conversations. there is a reason certain ppl are not allowed to bring their cellphones to work: it's because they're not even remotely secure.

</comment></comment><comment><USER13> Odd coincidence that today, I came across this late 2012 article, "What Happened to the Facebook Killer? It's Complicated"

[http://motherboard.vice.com/2012/10/2/what-happened-to- the-f...](http://motherboard.vice.com/2012/10/2/what-happened-to-the-facebook- killer-it-s-complicated)

It's a detailed look at the failure of Diaspora, the secure, privacy- preserving app that raised $200K during the height of Facebook privacy concerns, but fell apart, with the founder eventually committing suicide.

I bring it up _not_ because I think hemlis is doomed to the same fate, but precisely because the differences between what the OP aims to achieve compared to Diaspora makes it much more likely to succeed...if it's just a messaging app, rather than a social network that has certain infrastructure challenges, then it should definitely be doable (it goes without saying that the Pirate Bay co-founder probably has a lot more experience than the Diaspora founders)

</comment><comment><USER14> "The way to make the system secure is that we can control the infrastructure."

This is an incredibly narrow vision of the future. We need an interoperable network that supports a variety of encryption technologies. Users should be able to select the apps they prefer with the features they need.

Locking the social graph into a single service and a single app which like most applications will eventually have vulnerabilities is a tremendous liability.

<comment><USER15> We need an easy to use/transparently embeddable version of Freenet or I2P with a rich messaging app built on top.

</comment></comment><comment><USER16> Direct link: [https://heml.is](https://heml.is)

Hemlis is founded by The Pirate Bay co-founder.

</comment><comment><USER17> Encryption is only half the battle. NSA et al. could still get metadata - <USER2> is communicating with whom and when. Unless they carefully engineer a solution to this problem into their app, it's useless.

</comment><comment><USER18> NSA proof app for Apple and similar devices is oxymoron. Until you know what exactly the vendor can do remotely with your device you cannot assume security.

These devices and OS-s are provided by companies that are part of PRISM so they have a track record of collaboration with law enforcement.

So running secure software on them is like putting a steel lock on a mosquito net.

<comment><USER19> All carrier locked phones, including Android and Firefox OS, can receive ota updates without knowledge or consent. Any open source phone OS can and will be modified to benefit the carrier before reaching consumers.

</comment></comment><comment><USER20> "Heml.is would be the first secure mobile messaging system."

Heh... I don't think so!

<comment><USER21> I made a short list of the end-to-end encrypted messaging applications which are available now: [https://blog.kejsarmakten.se/all/personal/2013/07/10/end-2-e...](https://blog.kejsarmakten.se/all/personal/2013/07/10/end-2-end- encrypted-messenger-apps.html)

</comment></comment><comment><USER22> Reminds me of this

[http://www.gocomics.com/foxtrot/2013/06/30](http://www.gocomics.com/foxtrot/2013/06/30)

</comment><comment><USER23> [https://en.wikipedia.org/wiki/Deep_packet_inspection](https://en.wikipedia.org/wiki/Deep_packet_inspection)

 _Deep Packet Inspection (DPI) (also called complete packet inspection and Information eXtraction - IX -) is a form of computer network packet filtering that examines the data part (and possibly also the header) of a packet as it passes an inspection point, searching for protocol non-compliance, viruses, spam, intrusions, or defined criteria to decide whether the packet may pass or if it needs to be routed to a different destination, or, for the purpose of collecting statistical information. There are multiple headers for IP packets; network equipment only needs to use the first of these (the IP header) for normal operation, but use of the second header (TCP, UDP etc.) is normally considered to be shallow packet inspection (usually called Stateful Packet Inspection) despite this definition.

There are multiple ways to acquire packets for deep packet inspection. Using port mirroring (sometimes called Span Port) is a very common way, as well as optical splitter. Deep Packet Inspection (and filtering) enables advanced network management, user service, and security functions as well as internet data mining, eavesdropping, and internet censorship. Although DPI technology has been used for Internet management for many years, some advocates of net neutrality fear that the technology may be used anticompetitively or to reduce the openness of the Internet.

DPI is currently being used by the enterprise, service providers, and governments in a wide range of applications._

[http://www.adax.com/products/dpi.html](http://www.adax.com/products/dpi.html)

[http://www.infonetics.com/pr/2013/2H12-Service-Provider- DPI-...](http://www.infonetics.com/pr/2013/2H12-Service-Provider-DPI-Products- Market-Highlights.asp)

With DPI encrypted comms can be routed to storage, from there the encrypted data can be sent to the supercomputers for further analysis. Just what can, and can not, be cracked is open to conjecture, as I don't really know the specific capabilities of the supercomputers in use by the alphabet gang. However, with the rapid decline of storage prices it would be safe to assume that what cannot be cracked today, may be broken in the not too distant future.

I'm wondering if there actually is any currently known encryption which cannot be broken in the unforeseeable future...

Whichever way it is, I wish this venture luck and success.

</comment><comment><USER24> Hopefully they wont host the servers in Sweden.. [https://en.wikipedia.org/wiki/FRA_law](https://en.wikipedia.org/wiki/FRA_law)

<comment><USER21> In their FAQ they mention how they intend to connect serveral countries through VPN tunnels and using anycast so that personal traffic won't cross national borders: [https://hemlismessenger.wordpress.com/2013/07/10/first- bunch...](https://hemlismessenger.wordpress.com/2013/07/10/first-bunch-of- questions-from-our-funders-answered/)

This would stop FRA since they are not allowed to look at domestic traffic, only traffic crossing the border.

<comment><USER25> Like that has stopped NSA or any other spy agency before. But I guess what you mean is that it won't be legal for them to do it, not that it will "stop" them from doing it, necessarily.

</comment></comment></comment><comment><USER26> What would the government do if Google bought these guys?

<comment><USER27> I guess its safe to presume they wouldn't sell it. Otherwise, the simplest way to deal with the "piracy problem" would be to buy piratebay and shut it down.

</comment></comment><comment><USER28> If the only thing that comes out of this is that someone solves key storage in a user friendly way, it will have been a bargain.</comment>


Your Candidate Won the Popular Vote? Irrelevant - <AUTHOR> https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/11/09/your-candidate-got-more-of-the-popular-vote-irrelevant/ <comment><AUTHOR> It's also worth noting that if we had a popular voting system for President, there would have been fewer protest votes in states where the EC outcome was never in doubt (CA, TX, etc.). So it's likely that Johnson (and other third- party candidates) would have received fewer votes. In this case, most of Johnson's would _probably_ have gone for Trump. This is not for sure, but Johnson was the generally-accepted alternative candidate for most Republicans (outside of UT, where McMullin got on the ballot and made a good showing).

Johnson received nearly twice as many votes as all other third-party candidates (3% vs 1.7%), so it's hard to know how it would have all broken down at the end of the day.

But it's quite possible that—even if the campaigns hadn't redirected resources, which of course they would have—Trump still would have won.

</comment><comment><USER2> And people forget the measurement tolerance of the voting system itself. If Clinton's popular vote margin over Trump is 200,000 votes out of 60M votes cast for each (in round numbers that I've heard quoted) that is probably not within the bounds of expected error or variance.</comment>


Escher's "Ascending and Descending" in LEGO - <AUTHOR> http://www.andrewlipson.com/escher/ascending.html <comment><USER2> The 'Relativity' one is also quite nice: <http://www.andrewlipson.com/escher/relativity.html></comment>


Adblockers are immoral - <AUTHOR> http://thenextweb.com/insider/2015/05/17/adblockers-are-immoral-and-mobile-networks-should-know-better

<comment><USER2> Sorry, but there's no obligation for the world to keep your business model viable. If you hold on to it no matter what, it's your problem, not mine. I'm not required to feed you while you pursue your whims about lifestyle. On the other hand, you could try doing something of actual use, like carpentry.

</comment><comment><USER3> This is one of the most annoyingly designed sites I've ever seen.

The float-to-the right-to-see-the-background effect, reminds of the awfulness of MySpace when DHTML was a thing. Only it's worse.

Also, the article loses a lot of credibility when it responds to anyone calling the ad-infested web horrible, with this:

""" No, it really wasn't – it was perfectly fine, you're just being a snob. The Web works well for me with the ads displayed. """

Yes, it's perfectly fine... If you want to punch-the-monkey, a dozen popups beneath your window, moving images that can cause photo-epilepsy all over the place and of course the latest trend: "Oh, you scrolled a couple of times? Let me show you a huge overlay ad with a very dark backdrop(that isn't always click-to-dismiss) and a very obscure close button."

Truth is that people are naturally becoming more resistant to ads, which leads to making them more intrusive. And this in turn leads anyone that can, to seek ways to get rid of them.

This may continue for a few years, but I think that publishers should begin preparing for alternate sources of income, instead of hoping to go back in time.

Disclaimer: I've used ads, made even some(little) money of them. And I use AdBlock because the web is truly awful without it.

</comment><comment><USER4> I find hard to comprehend how some people don't see those really obtrusive ads (flashing, overlay etc.) same as spam or other unsolicited product information like flyers being put to your mailbox. And for former ones this is in many countries treated as felony or either way forbidden by law.

Frequent contra argument to "I'm not influenced by ads so I'm not going to buy this stuff either way" is that it works on subliminal level, yada yada. And that's what's immoral, mildly brainwashing people.

</comment><comment><USER5> > No, it really wasn't – it was perfectly fine, you're just being a snob. The > Web works well for me with the ads displayed.

I have a lot of trouble reading when there is something moving on my screen

<comment><USER6> On my god, this. I hate trying to read while animations are running. And whoever came up with the idea of autoplay video is an asshole.

</comment></comment><comment><USER7> Wow, those canvas ads are incredibly annoying. I accidentally clicked a Hootsuite advertisement by accident when visiting this article. Absolutely horrible and people wonder why a lot of web users block ads. How about instead of clinging to an antiquated business model of advertising sites like TNW try something new?

<comment><USER8> I don't think advertising is a antiquated but banners are. We are trying something new and this is it. It's new and needs to be fine-tuned but we hope it will be less annoying than seeing banners all over a page. Give us another chance or at least keep an open mind.

</comment></comment><comment><USER9> Sorry, did that site have ads? I didn't see any.</comment>


7 things I've learned by running a business myself - <AUTHOR> https://medium.com/@benschwarz/7-things-i-ve-learned-by-running-a-business-by-myself-5e047386be65#.gb89gukc2 <comment><USER2> I agree with his "fuck startup weekends" slide, but a lot of the other information feels generic.

<comment><USER3> One thing I'll add is if your customers other businesses it'll often take 12-18 months for them to realize you even exist. And they won't commit their business to yours without testing you out' for 12-18 months after that.</comment></comment>


Compression in Scylla, Part One – LZ4, Deflate, Snappy, ZStandard - <AUTHOR> https://www.scylladb.com/2019/10/04/compression-in-scylla-part-one/ <comment><AUTHOR> Lossless compression algorithms are vital to make sure that your big data doesn't become unmanageably huge. Compression algorithms help users save on hardware and storage expenditure. But the wrong compression algorithm can lead to poor performance. Kamil Braun wrote a great explainer on how this works in ScyllaDB, part one of two in a series. Stay tuned, because part two will get into performance characteristics!</comment>


Kickstarter game project raises $10k, made using a DIY Platformer tutorial. - <AUTHOR> http://www.somethingawful.com/d/news/ron-paul-kickstarter.php <comment><USER2> What is the point of this article? The guy said he'd make a video game, and people pledged money. He's pretty upfront about what he's making on the Kickstarter page. The article author is upset because the fellow is using a tutorial? Who the hell cares? So long as the supporters get their "sidescrolling platformer action/adventure game, reminiscent of console classics like Super Mario Brothers and Sonic the Hedgehog", like he promised them, what's it your business anyway? They paid for a game, and he's developing a game. What's the problem?

<comment><USER3> I think the problem is something like this.

Vast majority of the people, slog till the calcium in their bones disappear to learn the craft of software. HN'ers are full of Clojure learning, Python beauty appreciating programmers who would happily burn a summer down practicing exercises in Structure and Interpretation of computer programs. They would never hire anybody who doesn't know how to sort a million integers in a million different ways.

And yet after they learning how to do 22nd century algebra using haskell and learning how to bend the skies with macros some one here comes along reads a tutorial and builds an app to sell for a decent amount. This upsets their whole belief systems and makes their expertise seem irrelevant to winning the game.

This is called 'Holier than thou' attitude.

Anybody who doesn't go through the regime of K&R C -> Algorithm book -> DS Book -> Haskell -> Lisp is considered shit.

He is not supposed to win, succeed or do any thing big with software.

This happens all the time. Anybody who doesn't have a CS degree and can't handle the math/Algo quizzes is not supposed to win ever. And if he does, he is considered undeserving, lucky or just evil.

<comment><USER4> I was tasked with porting Platypus to the Mac, which was probably the most nightmarish code base I've ever seen. The entire code base consisted of hundreds of arrays, and three or four, twenty thousand line long functions. But the game was brilliant.

Anthony Flack, the creator, made a fantastic game. Absolutely brilliant.

I'm not saying you need technical chops to know how to make a game. I'm saying you need to make games to know how to make games! There's not a game developer alive that didn't play around extensively before finishing their first project.

Using a tutorial is a smoking gun that the author has not had this experience. It's literally like someone learning scales on the guitar, trying to write a song.

Except he's _taking money_ on the _preorders_ to that song.

He's not successful because of what he's done, he's successful because of the _promises he's made_.

If you don't see the problem there, I just don't know what to say.

<comment><USER3> I got your point.

Lets say you develop a hobby for making furniture. You start developing Tables. You read a DIY book and start making stuff. In the meanwhile, you make mistakes, you don't put as many nails where there are necessary. You put more gum than what is necessary. Your finished product is definitely a table, but you've made is so badly it could hardly last for a couple of years.

A carpenter down the street comes down to you shop and gives a detailed critique of what he thinks is wrong with your table.

Now you both go and try to sell your story, You have a table and he just has a critique. The user comes and sees your table and listens to his critique. He decides something that exists is better that just talk. Remember the user is seeing the table only, he didn't see you making it. He decides to go with your table despite the carpenters critique.

He orders 50 more tables from you to be made based on what you showed it to him.

Now the professional carpenter can argue about how bad and how many technical deficiencies exist in your tables. But you know what, the user won't even understand that language.

Because, Shipping is a feature. And the one's who ship almost always win. Sometimes even if they ship crap. That is what is happening here.

<comment><USER4> Look, if the guy wasn't taking money for it, I'd be completely supportive. Trying stuff, MVP, and all that. Great angle for a game, great way to get started. Clearly a smart go getter.

But to use your analogy, the man has ordered 50 tables, not knowing they're likely to fall apart. The seller _never revealed_ his lack of experience. At the end of it, we're just going to say caveat emptor?

That just doesn't sit well with me.

And I definitely agree with you that shipping stuff is #1, but I'm not sitting around idly by criticizing the work of makers. Every dollar I've made in the last 8 years has been from games, and only 2% of it or so from contract work. My own attempt at building a community around preorders has been more successful:

<http://www.underthegarden.com/>

And I'd made 12 commercial games, some that set me up financially for years, before I felt comfortable being in a position to take peoples money before they've played the product.

<comment><USER3> Well actually I'm not disagreeing with you. I'm just trying to show you how the world is. We have to learn to live with this thing. The way programming has evolved in the years is scary to say at the least. And we may see more and more of this kind of stuff.

This is almost the same fury we saw when YC announced they would fund Ideas. Although they are not the same, but YC really was ready to fund stuff which wasn't really into material existence. While many who had working stuff might not have got funded, many of them might have had good enough experience and skill building stuff. At the same time there might have been ideas from non tech founders.

Sounds strange ain't it? These days you can do a lot of things by just knowing how to discover things and be a little productive.

No wonder yesterday there was thread on software engineers hitting dead ends at 40. There is simply too much competition and tools are reducing the barrier to entry opening a flood gate of people looking to make money here.

<comment><USER5> I think another problem might be how he claims "the game is designed, programmed, conceived, and produced by me," and then it is revealed that he is doing some pretty shady things with reusing sprites. Plus since he is following a tutorial to make it is likely going to end up with code that is pretty similar to the tutorials code, and that might have interesting implications depending on what the tutorials author said could be done with the code from it.

But this is all hearsay, this might all just be place-holder graphics, he might just be using the tutorial to learn quickly and then remake everything from scratch. We don't know yet. However, if it is place-holder graphics, why remake Waluigi at all instead of just using him completely for testing...

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Pick on it because its a poor game, not because of how it is written. It shouldn't matter to the backers if the guy was learning to program (how many experienced programmers would be happy with $10k-expenses for 2 months work?), or what tools he used to get the job done, as long as it does what it says on the proverbial tin.

<comment><USER7> Actually, don't even pick on it because it's a poor game (and granted, it looks like one whopper of a poor game and I'm as shocked as anyone that this got funded). The magic of crowd funding is that decisions as to quality belong to the backers. They felt it was worthwhile, it's their money, so it's none of our business.

If it's fraud, then sure: Kickstarter would be on the hook for abetting it. If he promised something he didn't deliver, there's a problem. But this doesn't qualify. It's just a dud project. Projects fail regularly, that's why they can't easily raise money from investors.

<comment><USER8> >If it's fraud, then sure: Kickstarter would be on the hook for abetting it.

I'm not even sure that's the case, is it? They provide a platform, and take a cut, but I'd be a little surprised if that's enough to make them legally liable.

<comment><USER7> Surely they'd have some level of liability. Safe harbor rules from laws like the DCMA certainly wouldn't cover deliberate fraud. There would be enough to file a case, anyway. And if it was filed and not tossed out, they'd probably settle rather than risk all the bad press.

<comment><USER9> I don't know if they'd be liable, but they could take action that would reduce the possibility of this kind of thing happening.

One very helpful tool would be setting a community expectation of weekly updates from funding time to shipping time. They can't really enforce a rule like that since they have no leverage over the project people once the money is released, but they can certainly set the expectation that frequent updates are the rule, not the exception.

There are some cases where frequent updates may not make sense, but for the vast majority of projects, there's got to be some sort of news to share on a weekly basis. It's surely not too much to ask of project people that they spend a few minutes every week updating those who made their project possible.

If there's literally not any news to share, then maybe that project is in trouble, and that too would be communicated if the standard was for weekly updates and the project wasn't following that guideline.

Setting a standard along those lines is certainly better than the current state of affairs.

</comment></comment></comment></comment></comment><comment><USER8> Does this author not understand how prototyping games works?

You'd never spend the time drawing the assets and _then_ code up the platformer... first you just grab a bunch of temporary placeholder art, so that you can work on the actual gameplay. This is incredibly common in any project like this.

This particular game might well end up being completely terrible, but the whole post shows a crazy misunderstanding of game development.

</comment><comment><USER10> I really feel this is getting blown out of proportion. The game wasn't even built yet and all of the assumptions the article makes are based on what they found in open directories on the server.

<comment><USER11> It might actually be worth blowing this out of proportion to prevent this sort of thing from happening again. I don't really want to support "I am going to paint second Mona Lisa" and end up supporting guy's quest for learning how to squeeze paint from a tube. This is not only misleading, but also damages KicStarter's reputation in general.

<comment><USER10> I think the outrage should come after people actually see the finished product and _not_ just from some random files that someone pulled off a public server. The project isn't even fully funded.

Also, the outrage should be directed at Kickstarter and _not_ the person doing the project. Directing the outrage to Kickstarter will encourage them to do better vetting. Directing it to the person doing the project will only make other people question if they should do a project.

</comment></comment></comment><comment><USER12> Don't forget, he'll also spend $3000 to produce and send all the t-shirts and posters promised to the backers.

<comment><USER13> Has he produced and sent t-shirts before?

</comment></comment><comment><USER14> At first I thought that failed Kickstarters were a small minority of projects, but I've come to think that failed projects (or at least greatly delayed) are the norm, rather than the exception. Of 4 projects I've funded 1 was delivered as promised and on time, 1 is currently on pace to be delivered only slightly late (~1 month), one is 5 months late and still being designed, and one is mostly content complete but over a year late for physical delivery. People really, really don't seem to realize what they're getting themselves into with these, and drastically underestimate time to completion.

<comment><USER15> does Kickstarter post stats on these kind of things? Like what percentage of funded projects are delivered?

if not, why not?

<comment><USER16> probably because its not beneficial for them to publish these stats, but I would love to see these statistics.

<comment><USER17> Actually, found the blog article: it's 46% in 2011 (43% in 2010), but whatever: <http://www.kickstarter.com/blog/2011-the-stats>

<comment><USER9> That's actually just the percentage of projects that hit their funding goal. There is no indication of what percentage delivered.

I suspect someone could figure this out. To my knowledge, all funded projects still have accessible pages. You could go through them all and see which have updates that indicate shipping...

<comment><USER17> Ahh, I believe you're correct. I optimistically read those stats...

</comment></comment></comment></comment></comment></comment><comment><USER18> This is the second article I have seen in similar form criticizing a funded project for being simple/theoretically easy to make or relying on prefab tech.

Every person on KickStarter has a chance to vet projects and decide for themselves. Most of these people are not professionals promising a slick top of the line product. They are just people who want to make something. Sometimes its a team of well qualified professionals but a lot of the times it is people who just have the desire to do it. Why are people bashing them? Sure, the guy didn't throw it out there that he was not experienced but most people wouldn't. He will probably deliver what he promised.

In my early days, I did more than a few tutorials to complete clients objectives.I refined it and refined it before they ever saw it.But at the end of the day, I learned it and made it my own. I think tech-savvy people tend to judge here but a lot of these backers have no clue how to even begin thinking about how to make a game. To them, it may not matter.

Besides who knows, I bet the backers are just aching for a Ron Paul platformer and thats all they heard when they watched the video.

</comment><comment><USER19> <http://nibruki.com/games/rp2012/core/screens/TitleScreen.js> now is forbidden!

</comment><comment><USER20> I'd be interesting if you could actually invest in Kickstarter projects and not just give away money.

<comment><USER21> I thought so, at first, but I don't believe that anymore.

I think it's plausable that small projects with shareholders who want a profit may actually be less stable than projects by independent groups who have funding without oversight.

I'm happy to give money to projects I believe in. I spend a lot of money on Kickstarter, and I'm happy to see projects succeed. Yeah, I hope I get a cool wristwatch out of that one project, but mostly it's about living vicerally through the experience of artists and designers and engineers being given the opportunity to really realize their own vision. That's worth a lot to me, and I'm willing to spend money on it, with no guarantee that I'll get mailed a toy at the end.

</comment></comment><comment><USER22> Have these types of things happened on Kickstarter before (or has anyone attempted to just completely game the system?) What types of recourse do investors have? Any?

<comment><USER23> Here's some snake oil for $270,000:

[http://www.kickstarter.com/projects/1047510073/remee-the- rem...](http://www.kickstarter.com/projects/1047510073/remee-the-rem- enhancing-lucid-dreaming-mask?ref=category)

Kickstarter isn't particularly thorough about vetting technical projects.

<comment><USER24> There are a lot of lucid dreaming devices, and people report varying degrees of success with them, but I've never heard that any of them are completely worthless. Is there any particular reason why Remee wouldn't work?

<comment><USER25> > Is there any particular reason why Remee wouldn't work?

There is no reason it wouldn't work in the same way that there is no reason that there couldn't be a giant teacup orbiting the Earth.

<comment><USER26> Ok so you're a realist, fine. But I'm curious, do you not think lucid dreaming is real? Or do you just not think it can be triggered with flashing lights?

<comment><USER25> I've had many lucid dreams, non of them involved flashing lights in my face. More importantly of all the methods to induce lucid dreams, flashing lights in your eyes isn't among the practices normally used in scientific studies. If it were actually reliably effective, it is highly likely it would be used in studies as a reliable method of initiating lucid dreams.

<comment><USER27> It has been used in some small studies, like this one: <http://www.asdreams.org/journal/articles/laberge5-3.htm>

But as far as I know, lucid dreaming in general is not something that is being studied by a very large number of scientists, so we're not likely to find a whole ton of studies like this regardless of how effective it is.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Don't know about this project, but the problem with kickstarter is that once you back a project is no longer your money, and there's nothing you can do about it.

It's right there on their TOS: they are not responsible for the project, nor to provide ways to keep the project's creators from running away with the backers' money.

This "give money and something MAY happen, eventually" model is going to collapse on itself.

<comment><USER21> I actually think that this is Kickstarter's saving grace: if I give money to somebody, I know it's a gamble. I'm not a venture capitalist looking for a guaranteed return, I'm not going to pressure anyone to have a "exit strategy", and I'm not a shopper who can demand my money back. I'm taking a risk with a small, disposable amount my money - usually less than the cost of going out to dinner at a nice restaurant, and I get to help give someone the gift of working on a project they believe in, that I think the world would be better off having. And sometimes - usually, even! - they give me a gift in return.

I find this to be way more optimistic and healthy than the traditional investment model, where the VC are pushing you to sell your baby for parts so they can get even richer.

<comment><USER28> Since when is getting what you were promised the same than a VC ROI model? VCs expect as much as possible, they want to hit jackpot. I give $100 for a watch so I expect said watch, not a Rolex!

And getting jack shit is the exact opposite of what kickstarter says it does, you could just press the donate button of any harebrained scheme on the internet and get jack shit, you don't need kickstarter for that.

</comment></comment></comment><comment><USER29> Considering what it costs to produce a new title, is it any surprise?

</comment><comment><USER30> Fake it 'til you make it, kid</comment>


Companies made millions building unemployment websites that didn't work - <AUTHOR> https://themarkup.org/coronavirus/2020/07/16/unemployment-benefits-website-failures-deloitte-ibm <comment><USER2> Although they aren't mentioned in the article, it seems like a pretty similar story: I worked for Accenture and they cared very little about the end user, product, or the client. The things they cared the most about were sales, billable hours, and reputation. As a software engineer, every review season completely ignored all of my technical accomplishments and problem solving skills and focused entirely on growing sales and billable hours. The cherry on top was the way they treated their employees that were working in the states on Indian salaries. They no doubt billed the customer ten times what they were paying the employee while claiming cost savings. The dishonesty, disrespect, and lack of integrity were palpable.

It's no wonder why projects managed by large consulting companies are total disasters.

<comment><USER3> Don't gripe, celebrate it! Huge companies getting conned by large consulting firms creates opportunities for startups. If Deloitte and others were actually good at what they do, it's be much harder to compete. Large companies blowing a hole in their budget so that Deloitte can deliver a garbage product 6 months after the deadline is the kind of thing you want to hear if you're involved in startups.

<comment><USER4> Except, no. As a startup you are absolutely not going to get the contract to create a new unemployment web site for a government. Even aside from the bidding process that is deliberately set up to exclude small players any responsible government wouldn't go with you anyway: what happens in five years time when your startup has shut down (or complete it's Wonderful Journey with an acquisition) and the site stops working?

<comment><USER5> You _could_ , but would require extensive involvement before the bid, making sure you understand the organization and structures (e.g. [https://www.naswa.org/](https://www.naswa.org/) and [http://www.itsc.org/Pages/default.aspx](http://www.itsc.org/Pages/default.aspx) ) perhaps hiring someone who worked there, plus experience in dealing with legacy tech.

The RFPs are public, and many states are willing to take a look at new approaches.

</comment></comment></comment></comment><comment><USER6> Nobody wants to bring up Accenture here? Why should Deloitte get all the credit? There is plenty to go around. The large publicly traded consulting companies are like the mafia - once you let them in the door, they're not leaving until all your money is gone.

Thats all there is to it. Funny thing is those companies are never brought in by technical departments. My most recent experience saw the Marketing dept bring in CONSULTING COMPANY to do a particular job because the internal Engineering department's quote for the same work was "5 times what CONSULTING COMPANY said it should cost if they did it".

(queue violent laughter for those who have seen this joke play out)

It was a mess - consultants were as inept as they were numerous but damn, they dressed nice every day. They all had great glasses too, like they were assigned by the wardrobe department. Picture a Banana Republic Catalog's worth of new, very young people running around the office and you get it.

I'm not saying these consultants were inept because they couldn't invert a binary tree or because they couldn't tell me the time complexity of a HashTable. I'm saying it because they literally knew nothing aside from the intensive training CONSULTING COMPANY gave them for this job. If it was not covered in training they not only couldn't do it but didn't know what it was in the first place.

The whole project became a train wreck in slow motion. You could see it was going to be bad but it had so much momentum there was no chance of stopping it. Must be how the people felt on the Titanic come to think of it.

Things got so insane I realized that the consultants and those responsible were looking for someone to blame - and I promptly accepted a new job offer and vanished in a puff of smoke. I would later find out I was on the short list of people to be "promoted" to manage deliverables for that project!

<comment><USER7> After being laid off in 2016 I joined a big consulting company (you've heard of them but they're not Accenture) because I needed to pay the rent. I didn't come up through their training program as a new graduate but as an experienced developer.

Every year I got glowing praise from the client - I solved the problems they had faster than their in house guys did, I delivered on time with the lowest defects of any contractor across all firms that worked at the client, and was a domain expert in one of the client's systems after about six months there.

Do you know what the consulting company offered me as a raise? $150 on top of my base salary. Not $150 a week or month - $150 total. When my consulting company reviews came back, despite high praise from the client, I wasn't enough of a member of the consulting company's team because 1) I didn't hang out with only consultants from the company, 2) I didn't attend drinking events every week with consultants from that company, and 3) I was too specialized on what the client did, so how were they going to move me to another client for more money?

I stuck around for another year and then the client negotiated hiring me on directly.

I will starve before I work as a consultant at someone else's consultancy. I'll start my own one-man firm first.

<comment><USER8> Worked at an MSP. Company charged $165 an hour for my work. I was being paid $16 an hour. This is sysadmin/IT Infrastructure work.

<comment><USER9> I'm not defending consultancies here - working at one would be my own personal hell on earth.

But when charge-out rates are so much higher than salaries, this is because their value is in the customer relationships and sales pipeline, not technical competence.

It's far, far easier to replace technical talent than to replace customers.

<comment><USER10> Just because you can make exorbitant profits off of your workers doesn't mean you necessarily should. I'll never understand why someone would you want to own a company that treats its people like shit and sucks to work for.

<comment><USER11> Middle management can run distraction on the owners so that they don't see the misery of the operations people who actually keep the buisness going.

<comment><USER12> >> Just because you can make exorbitant profits off of your workers doesn't mean you necessarily should. I'll never understand why someone would you want to own a company that treats its people like shit and sucks to work for.

> Middle management can run distraction on the owners so that they don't see > the misery of the operations people who actually keep the buisness going.

More likely, the owner is greedy and just doesn't care about how miserable the employees are as long as the cash keeps coming in. Some people just plain lack the regular moral compass and feelings of empathy, and others have gotten good at holding on to BS justifications to assuage any guilt they feel.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Ex Deloitte here:

In several years I never once saw the firm not deliver what they agreed to in writing.

There's one way to deal with a consulting firm: a rock solid statement of work and people on the client side to verify you got exactly what you paid for.

If the system didn't work as agreed in the statement of work and that was clear, Deloitte would be footing the bill.

If you gave out a time and materials contract without clear acceptance criteria, testing requirements, and verification / support / warranty detailed, you probably shouldn't be handling 100 million dollar budgets.

<comment><USER14> > acceptance criteria, testing requirements, and verification / support / > warranty detailed

Some orgs just don't have the in-house capability to do this, so they seek a consulting firm... oh wait.

Edit:

I guess the strategy is to hire technical staff, keep them around a few years until you can be sure they can deliver on projects and understand your existing systems and processes, and then embark on the larger project to transform those systems and processes.

Alternatively, shop around to find a consulting firm that is motivated to have good long-term outcomes. Probably a smaller operation, that has good word-of- mouth reputation, but doesn't have an established brand to fall back on.

<comment><USER13> To your edit:

A good strategy is to hire a team, get a few consultants who have literally built the same system down the road, and use that blended team until 2.X release.

That way you a team that has made a thing already (and often consultants are just as passionate about their work too!) ready to build a better 2.0, plus you keep responsibility and control.

<comment><USER14> > A good strategy is to hire a team

Some orgs may not know how to hire. I think here, competent (and well connected) consultants can help, and maybe source from their own networks, but we're back to the dilemma of which consultants to trust. And let's not speak of recruitment agencies :)

</comment></comment></comment></comment><comment><USER15> I've worked with a bunch of Ex-Deloitte people and without fail they all could talk forever about the subject at hand, sound very technical, but in practice were completely incapable of executing anything correctly, and had absolutely no knowledge of their subjects of "expertise" beneath the surface. They really are expert bullshitters.

I think the real trick to being an expert bullshitter though is that you have to forget that you even are bullshitting. Ex-Deloitte people have deluded the most important person which is themselves. In technical conversations it's almost as if the idea that there even was something beneath technical talk behind these ideas.

It's to the point now where Deloitte on a resume is a huge red flag.

</comment><comment><USER16> Software consultant chiming in here. Deloitte is a dirty word that most people in the office react sourly to... This doesn't surprise me one bit.

<comment><USER17> My fiancée is a senior tech consultant at a big 4 firm and I can say with the utmost confidence that they have zero ability to actually build things. I specifically watched her project manage a multi-million dollar product for a client. Clueless. Consultants are good, organized, hard-working people but they are not technical in the ways most on HN are. And the outsourced dev teams they hire at bottom dollar will just never deliver anything of quality.

<comment><USER18> I'm a former tech consulting manager at one of the B4 and my experience is that the types of multi-million dollar software projects that they get involved in are lose-lose situations from the start. They are always high- profile, huge projects that a ton of executives, salespeople, etc all have their hands in, and everyone is fully aware that the delivered product is going to be a steaming bureacratic pile of shit with a never-ending list of feature requests and bugs, no matter who they hire. Then they hire Deloitte/IBM/Accenture because Deloitte/IBM/Accenture are so big that they are the only companies that will knowingly take on a losing project as long as they get paid handsomely for it.

And if the project is gonna be a loser anyway, why would you waste your best people on it instead of the C-stringers from your offshored development center? At my B4, the major multi-million dollar government projects like that were basically the company graveyard where you were staffed when literally no other project would take you.

For the actually successful and typically much smaller software projects, we actually had a subsidiary company with a much better reputation that would handle the design and development instead of our offshore dev centers.

<comment><USER19> What is the solution? How can these huge systems be developed economically and correctly? These government agencies don't have the technical experience to hire and manage their own software developers and, from what people say, the big consulting firms don't either and/or they don't care. But a smaller firm that might be able to deliver a working solution would be seen as "too risky" to be awarded a big government contract when compared to a large, well-known consulting firm.

<comment><USER20> Why does the government not have more than a handful of people at 18F? Do they think computers are a fad that will go away? Government should be staffed to accomplish its mission, and the mission requires software. 18F should have tens of thousands of permanent employees.

<comment><USER21> The problem is Deloitte is in the pockets of Congress and won't ever allow this to happen. In fact, they've made it worse.

</comment></comment></comment></comment></comment></comment><comment><USER22> Remember the healthcare.gov rollout? It was built by EY and I may have worked there.

It was being hosted from one of the main developers homes. Let that sink in for a few...

<comment><USER23> It was CGI Federal (the US version of CGI) and QSSI (eventually bought by Optum part of UnitedHealth Group). CGI was the lead contractor and got it by low balling on the website. When CGI immediately got behind on project deliverables (2 years before launch) they started forcing all the people to work 7 days a week which immediately caused every good developer to leave. All that was left were the most inept H1B developers I've ever seen (some literally couldn't touch type). I joined 2 weeks before launch as a product consultant. There were basically no senior people working there at all. It was a bunch of middle managers and either inept H1Bs or fresh college students brought on as subcontractors. There is no way it could've succeeded in any alternative universe. Basically no one cared about the product at all, everyone only cared about their slice of the pie, and by everyone I mean the tens of different subcontracting companies and middlemen that were involved. The only reason CGI even lost the contract is because it was such bad publicity HHS had no choice. CGI ended up suing and I'm pretty sure they were given alternative contracts anyways. There was never any accountability for anyone involved. When I quit I made sure the next job I had wouldn't get close to government contracting.

</comment></comment><comment><USER24> I don't think the article convinced me that Deloitte is specifically at fault for these systems failing.

They were paid one time to design a system, seven years ago, to handle probably less than 1/10 of the kind of volume that we are seeing due to the pandemic.

It really isn't Deloitte's fault that our government isn't willing to just pay civil servant employees to build and maintain technology in house.

I don't claim to know why the government is so sub-contractor happy but I guess that's the way it is right now.

Also, the government needs to stop thinking about software like it can be boiled down to a one-time cost. Building software one time and leaving it alone to rot for a decade doesn't work.

<comment><USER25> 1/10th isn't even close. In my state you were looking at 40x the volume. And you have a good point, that much more traffic is probably going to break a lot of systems.

Not to mention, even if the systems were only down for a few hours or a few days, the government agencies just don't have the manpower to process all those claims. Especially when people are working from home or not working at all.

Then you have the massive fraud. A perfect time for scammers to apply for unemployment benefits.

Remember the people who don't have computers and call their claims in via touch-tone. Those systems all crashed as well, or had busy signals for weeks.

</comment></comment><comment><USER26> Not just unemployment systems. There's a graveyard of broken systems made for governments, all over the world.

I genuinely believe that their business model is to ship out unfinished and broken software, and then spend xx years billing them (steeply) for upgrades and maintenance.

That's of the few explanations that makes a lot of sense.

edit: This isn't only aimed at Deloitte, lots of habitual offenders out there.

<comment><USER27> It's not clear how so many government procurement systems are broken everywhere.

As a counterexample of some procurement did work, just a tiny one, my state DOT rebuilt a major road over a decade. The whole project was many millions broken out into milestones and each milestone had penalties for being late and rewards for early, presumably with some quality gates too. The contractors got it done. So it is possible, just not common.

Another example is NASA batting 1 for 2 on Commercial Crew, although politics messed up the ULA half of that.

<comment><USER28> > It's not clear how so many government procurement systems are broken > everywhere.

One of the two major political parties in the USA actively sabotages government projects. The other one frequently fails to wield the tools of government well. Some of the procurement details might not be clear, but it's not terribly hard to figure out where the upstream problems are.

<comment><USER29> I don't think it's typically that partisan.

I have an insider's perspective on one of the systems mentioned in the article, and from what I could see, politics played no part until everything went off the rails and they started flinging shit in the media.

Things start out with a few in-house sysadmins hacking together some scripts to start batch loading records into a database or whatever. At some point they get far enough along to decide to bring in an external consulting firm to build out a more fully-featured solution.

At that point, it becomes a very ironic situation. The meat of the requirements are laid out by career bureaucrats who work in state government agencies (unemployment, in this case). They are extremely risk-averse because their jobs are typically very secure and, barring any criminal activity, the only thing that can sink a career is some sort of publicized failure involving taxpayer dollars.

So they negotiate contracts for this sort of work with really large, established consulting firms like the Big 4 and include all sorts of requirements and checkpoints and little details that they think are protecting themselves and would drive the average dev shop batty. Furthermore, they want to go from 0-100 right away and convert an old manual paper process to a fully-featured SaaS-style product in one go with a bunch of different feature requests coming from different people.

Thus they ironically end up with a massive risk of failure precisely because of the steps they took to mitigate risk in their minds. They have no prior experience developing software and are usually lacking in overall technical expertise. Really they have no business designing any sort of software solution or negotiating a contract to build one. It's doomed to fail simply based on the premise.

The best outcome would be for a dedicated SaaS company to build something that could be purchased by multiple states. I actually briefly explored starting something like this but couldn't make the numbers work. These departments have very little discretionary budget. Selling to each state would require a literal act of congress, and your TAM is only 53 distinct customers. And because of the inability to quickly make a purchase, they all seem to start out with that in-house hacked approach which naturally leads to paying for consultants to "improve" it, not starting over with a product purchase.

<comment><USER30> > So they negotiate contracts for this sort of work with really large, > established consulting firms like the Big 4 and include all sorts of > requirements and checkpoints and little details that they think are > protecting themselves and would drive the average dev shop batty

To be fair to the bureaucrats involved in a specific project, this approach, including specific staging of particular waterfall-style deliverables (with more complex checkpointing and midproject external reporting and oversight required the larger the project and sometimes on other bases, such as particular outside-of-the-agency, e.g. federal, funding streams) is often mandated by statewide contracting rules (a mixture of general and IT-specific mandates), not something that the bureaucrats directly involved in a particular project impose.

And while in many cases ill-advised and counterproductive, each of those rules is typically reactively developed in response to and as a means of mitigating repetition of specific instances of negligent, incompetent, or outright corrupt contract administration that occurred in the past.

</comment></comment></comment></comment></comment><comment><USER31> Question for the HN crowd: My apologies if I offend anyone (sure I will), but I can't imagine a good programmer wanting to work for any of the big tech consulting companies. They don't pay very well, their work is generally boring but tedious, and their corporate cultures are not known for attracting top talent. If you're a good programmer, seems like the top options are:

1\. Join a FAANG or other well-regarded software company (e.g. a Salesforce- like company)

2\. Join a startup

3\. Research (academia) or a company that does big "research-like" work (e.g. the NSA, SpaceX, etc.)

So I just don't see any way this kind of work is going to get done and not kinda suck.

<comment><USER32> Define "good salary". In the DC area, they pay well. We don't have the unicorn FAANG salaries you see in SV or Seattle, but $150k+ isn't uncommon for somebody with a few years under their belt.

The biggest problem I see with them is they tend to throw bodies at the problems. Many junior employees trying to build complex solutions isn't efficient. Even if those junior employees are smart.

Also, not everybody can get hired at a FAANG, sometimes because they're good but not great, sometimes because the FAANG hiring process is terrible, and sometimes because they don't want to live in SV.

<comment><USER15> > $150k+ isn't uncommon for somebody with a few years under their belt.

I don't think that's much higher than government employees make these days. In DC an engineer "with a few years under their belt" can easily make that at a startup and be working on much more interesting problems for a much less slimy company. There are plenty of jobs outside of FAANG that pay that or better.

The parent isn't wrong, at least in my experience, nobody who is technically competent would take a job at one of those places (and in my experience none of the technical people coming out of them have been competent).

<comment><USER33> What's with holding Startups up on some pedestole? They can be slimy and most will fail. Working at a well known consultancy company offers not only financial security, but additional insurance, and pension benefits that a startup would not.

It's also not impossible to work in substeams in such a company that mirror startup processes.

</comment></comment></comment></comment><comment><USER34> Anecdotally, when I had a stint in consulting I eventually learned that whenever a client wanted estimates the only way I could get the contract was to bid about 1/2 of what I knew it would actually take, else one of my competitors would do the same and they would get it.

These same clients would usually be giving me much praise when we'd eventually deliver 100% over budget, because that was "much better than their last contractor"...

A lot of times the buyer isnt even qualified to do that and so the seller has all the power.

</comment><comment><USER35> I had a recruiter from Deloitte approach me, telling me how great I'd be for the role they had in mind for me, etc. They wanted a phone interview immediately. I said fine, I'll go for an interview. Then I got an email thanking me for my application but my skillset was unsuitable. Except I never applied for any role, never gave out my CV (although it is out there in the wild). Absolutely wild. They can't tell their asshole from their elbow.

</comment><comment><USER36> My wife works for a state in a department using software being made by a company mentioned. The weekly meetings and calls are so astonishingly slow and deal with such meaningless minutiae that I am sadly not surprised at this article. Heartbroken a bit, nit not surprised.

</comment><comment><USER37> A bit tangential but I recall working with a company that wanted to use a particular very expensive brand name closed source software framework to build their ecommerce site. The going price on using this was in the half million ballpark. Working with this framework I was incredulous that anyone would actually want to buy this framework -- also none of the sites I have seen built on this actually work very well. But the force of the brand name and the audacity of the asking price just seem to mix well I suppose. If you are in a corporate setting with little technical ability, and more money to spend than brains, 'you won't get fired' if you choose to go with vendor X (not IBM but point stands) -- even if vendor X is going to fleece you of millions while providing little value. Its just the safe thing to do.

<comment><USER38> You must be talking about Oracle ADF :)

</comment></comment><comment><USER39> I worked for Deloitte for a year. I'm convinced their business strategy is to put their worst foot forward first, find the clients that will put up with it, and then milk them dry.

<comment><USER40> Purely out of interest, what does the tech stack tend to look like for these big projects?

Do they use open source components and frameworks? Are they using Oracle?

Do they tend to have good test coverage and continuous deployment?

What kind of version control do they use - what kind of branching / release model etc?

I've been immersed in the GitHub-centric open source world for so long I don't really have a feel for how these big Deloitte government IT projects work.

<comment><USER41> Visual Basic and MongoDB on Azure.

<comment><USER42> What, no /s?

What's sad is that you could be serious and correct.

<comment><USER26> Well, to the defense of VB - it's .NET, so that shouldn't be much of a big deal these days.

</comment></comment></comment></comment></comment><comment><USER43> Enterprise software consultancy is a variation of the design price-list [https://digitalsynopsis.com/design/graphic-design-price- list...](https://digitalsynopsis.com/design/graphic-design-price-list-charge- clients/):

$100k Consultancy spec everything

$200k Consultancy spec, provides client with drafts

$300k Consultancy spec, listens to client feedback

$500k Consultancy spec, accepts client changes to requirements

$800k Client spec, accepts consultancy changes to requirements

$1.3M Client spec, listens to consultancy feedback

$2.1M Client spec, provides consultancy with drafts

$3.4M Client spec everything

</comment><comment><USER44> I've been on both sides of the argument and there's plenty of blame to go around.

On the client side there's the utter lack of clarity, plus in-fighting and adversarial dynamics between departments and execs.

On the consulting side, it's just too easy to milk all the issues on the client side. Including playing one side off another - like lawyers in a never ending divorce settlement.

<comment><USER45> Clients are never clear. They don't know what they want, need or how to express it.

I consider it my job to work with them until it becomes clear. I bill them for that.

If the project fails because of lack lf clairity, it's my fault.

</comment></comment><comment><USER46> Internally they're quite honest about what's most important on IT projects: billable hours.

</comment><comment><USER47> For all the people talking about how much BS there is in big consulting, dont any of you think there could be a business model that could usurp the way the BS'ing boys club siphons money through narcissism, lies, and incompetence by replacing them with better quality development for a smaller price tag (but still with very well paid developers - from the looks of it)?

I'm personally thinking of a team building model where developers can join together and form teams to bid on projects and win financial rewards for delivering, reviewing, and passing quality benchmarks, with some sort of rating system in place to keep bad actors and bs-er's out.

<comment><USER48> An immediate problem I see with this is the realistic estimates problem. If you go to your average deloit/accenture customer and offer them the services of this anti-BS'ing boys club collective, and then deloit swoops in and says they'll do it in half the time and tick every single checkbox in the massive excel RFP including the contradictory requirements and the requirements that flat out make no sense, then guess who is likely to the win the bid? In the end it will be your deloits and your Accentures that win and then predictably the project will run long, not tick every requirement, and end up costing double.

<comment><USER47> > says they'll do it in half the time and tick every single checkbox in the > massive excel RFP including the contradictory requirements and the > requirements that flat out make no sense

I see your point, thanks for the counter arg, I can't refute this.

It seems the key strategy is to make the payer aware of how much BS they're paying for... but knowing all the people I know, I know that's just flat out not going to happen save for a very small percentage of people.

</comment></comment></comment><comment><USER39> While we're shitting on Deloitte:

Between the target billable rate they give you and the amount of time you spend on regulatory compliance, plus the fact that your own vacation time counts against your billable rate, you're guaranteed to have to work at least 10 hours of unpaid overtime every week just to hit your target.

I accidentally started a small riot during my introductory training period when I did the math in my head and blurted it out in the room of 50 other new people.

The guy running the training left shortly after I got canned, started his own business, and even sent me some work. He hated that place, too.

</comment><comment><USER49> Are people surprised by this? This happened also over two years ago during Hurricane Maria where the contractor failed to supply food to Puerto Rico.

The reality is that all consulting firms are trash. From big to small. They pay their employees far less than working direct and abuse foreign workers looking for a good career. They don't care about the product or the people they work with. I used to work as a contractor and the people I worked with was fantastic, but what I saw from the larger companies and the way they treated their work was awful. The incentives are just not aligned properly because the higher-ups only care about prolonging contracts and siphoning more money, not about actual quality.

For the government we'd be in a better place if they just hired people directly rather than going through contracting firms to play telephone and get a non-working product out of it.

</comment><comment><USER50> I saw a Vox video recently that hinted that the Government WANTED broken unemployment systems after showing some of the bugs that existed in their interface. It infuriated me, because they mentioned Deloitte built it and I (like others have mentioned in this thread) know they are infamous for bad software.

It appeared to me Vox wanted to make people mad at some bogus government conspiracy that a specific state had against it's people. Also that they don't respect the complexities that go into software development.

Edit so you can get mad at Vox too with me: [https://www.youtube.com/watch?v=ualUPur6iks&t=1s](https://www.youtube.com/watch?v=ualUPur6iks&t=1s)

<comment><USER51> Florida purposely built a broken system under Governor Rick Scott. It was engineered to make sure that as few eligible people could access it as possible. It is socially and technically engineered to make it so that people give up trying to claim the unemployment benefits they are entitled to. Florida used the system to keep their unemployment numbers artificially low coming out 2008 recession.

<comment><USER52> I'd note that while a broken unemployment system would affect statistics on the number of claims made, the official unemployment rate is calculated differently, using the Current Population Survey, and doesn't incorporate data on claims:

[https://www.bls.gov/cps/cps_htgm.htm](https://www.bls.gov/cps/cps_htgm.htm)

<comment><USER28> The state of Florida cares less about the unemployment rate and more about whether they have to pay out of their unemployment fund. The federal government is different because they just increase the deficit whenever the situation is dire.

</comment></comment></comment></comment><comment><USER29> Biggest question in my mind is why state bureaucrats are given the latitude to think it's a good idea to build their own one-off solutions. There are 50+ markets for these sorts of systems. It makes absolutely zero sense for them each to build & maintain their own software products. Of course big consulting firms are going to _leap_ at the opportunity to bill $50M per state and then throw together products as cheaply as possible.

States need to start working together on these platforms with in-house technical teams that can actually own the systems long-term. Or we need to make it far easier for them to purchase SaaS products like any sane private market.

<comment><USER5> That's something they've been working on since 2010. See [http://www.itsc.org/itsc%20public%20library/NationalViewUI_I...](http://www.itsc.org/itsc%20public%20library/NationalViewUI_IT%20Systems.pdf)

And what [http://www.itsc.org/](http://www.itsc.org/) and [https://www.naswa.org/](https://www.naswa.org/) are supposed to help with.

<comment><USER29> NASWA is good at facilitating knowledge-sharing, but they are no better equipped to build a software product than any state IT department. Each state is still ultimately handling "modernization" in their own way. There's very little appetite for COTS for whatever reason, and little sharing of technical components between states.

<comment><USER5> If a motivated small company wanted to work with NASWA in a "not business as usual" approach, perhaps with 18F involved, I believe it could be done. Part of their role is to reduce duplicative efforts across states and try to establish best practices.

The problem of course is how many small companies are knowledgeable about the UI IT systems, and can put together a strong proposal? It's a bit chicken and egg. Yes, NASWA could push this harder if they really wanted to, but it's hard to manage a consensus oriented organization.

(I was not implying NASWA was going to build things themselves...though if I were king, I would have them develop an open source UI platform, and then give it to the states to customize for their individual scenarios. Companies could compete on how well they make those customizations, and support contracts. Of course the trend seems to be going in the opposite direction, unfortunately... c.f. VistA -> Cerner).

</comment></comment></comment></comment><comment><USER53> Yes, there are sharks out there who do poor work. That's why we should expect the government procurement process to be competent. If the government hires a shark, the shark is not suddenly going to change. We should be holding the government responsible for hiring the shark in the first place.

When a government hires a consulting firm to perform a service, the responsibility does not shift to the firm - it remains with the government.

When procuring the system, did the government provide adequate requirements? Did they perform proper diligence in selecting the consultant? Did they provide proper oversight of the work?

The answer is rarely 'yes' to all of these questions.

</comment><comment><USER54> Deloitte is a horrible consulting company. I worked at a company where someone senior in my org had a husband who was a partner at Deloitte. We ended up going from barely using consultants to using them for everything. They even billed us for our own work and most of the time just ran down the clock on the contract and left without finishing the project. Pretty sure what our senior leader was doing was shady and wrong. I ended up leaving and noted this situation in my exit interview but nothing was ever changed. Conflicts of interest aren't taken as seriously as they should be.

</comment><comment><USER55> So I work for an APM vendor. COVID-based unemployment has been excellent for our public sector sales (as well for other APM vendors who are the competition). One of the sales people went to (I think) every unemployment insurance department in every state and pitched them our software. Quite a few were standing in a smoldering wreckage and they gladly accepted to see what they could do.

That is how I personally got to look at the guts of unemployment insurance system of Kansas and Florida back in May.

The KS system was ... well judge for yourself. It was run on 3 (yes that's three) servers - a 8 CPU 32GB web server hosting UI and IVR web service, a 4CPU 48GB service layer hosting a WCF service talking to mainframe, and some auxilary 2CPU 4GB server doing some little batch stuff. Yes, that's right, no redundancy. That's for the state with almost 4 million people. The bottlenecks were all in the mainframe which was reached by via screenscraping host key- sending software, which was doing GC.Collect on every end of the given session. It worked well when nobody was using the unemployment system but once half the state of KS lost their jobs, everything melted down. The vendor for the host-key fixed the library by commenting our GC.Collect. Don't know what happened afterwards.

Then next week I got a look at FL which is the uFacts system built by Deloitte [https://www2.deloitte.com/us/en/pages/public- sector/solution...](https://www2.deloitte.com/us/en/pages/public- sector/solutions/unemployment-insurance-services.html) mentioned in the article. There was no Deloitte there anymore and from what I can tell there hasn't been for 3 years. That one was is a standard 3 tier (web layer, services layer, database layer) hosted by more than enough hardware on web and services layer - although very much an inconsistent hodgepodge of IaaS machines from Azure, but it all ended in the big Oracle database that had some atrocious performance under heavy load. All timeouts were cranked up to the limit - I am talking WCF/WS timeouts north of 600 seconds, and Oracle DB query timeouts set to what I think is infinity - so things just backpressured out of the slow Oracle queries like there is no tomorrow. But optimizations were pretty obvious. They had an "Messages" table that was adding all the things that could happen to a case that was north of 100M records and suffered tremendously on the inserts. Pretty easy sharding or just archiving opportunity. Here I and couple of my colleagues were able to get to the team leads and developers in charge to present our findings. Even though the governor was yelling at them and the lawsuits were filed and people were struggling, the response back from the dev leads was remarkably devoid of urgency. "well that we already know about this, we'll hoping to be getting to this 3 sprints from now". We all shrugged and moved on.

</comment><comment><USER56> this article reminds me of the demotivator "Consulting, if you're not part of the solution there's money to be made prolonging the problem".

</comment><comment><USER57> It is the apex of mediocrity to hire the apex of mediocre consulting body shops that are the so called global systems integrators.

</comment><comment><USER58> It's always worth remembering that large firms like this are not hired for their ability to deliver products but the free underpants the brand supplies to the hirer.

It's never about the delivery. It's about the backside covering.

</comment><comment><USER59> Quote: "Deloitte also faced blowback in 2013 for an unemployment benefits system it built in Massachusetts. There, the benefits system arrived in 2013, two years late and $6 million over budget—only to be filled with glitches that erroneously cut workers' benefits, according to the Boston Globe."

Ha! I don't think those were glitches, but a clever plan to siphon here and there a bit of extra money. Kind of "you cut them a small amount of money, you get some, I get some" deal between state officials and Deloitte. Easy to blame computers when you do this and have experience. This is a classic case of evil genius at work.

</comment><comment><USER60> IR35 reform in the UK(every contractor must pay as much taxes as full time employee and no expenses allowed) is a conspiracy of Deloitte and the government

<comment><USER61> Source? (neither supporting nor disproving your claim, just genuinely curious as IR35 is something that could affect me)

</comment></comment><comment><USER62> Its a government program. Why are people surprised at this point. It literally always happens. Literally every single time.

</comment><comment><USER63> Alternative title: Incompetent bureaucrats wasted tax payer money, as usual.

There's a saying in the home building industry: "If the boss says put the toilet on the roof, you put the toilet on the roof." So often in government contracts, the people writing them are the complete and utter definition of incompetent.

</comment><comment><USER64> Sure... probably by design? And 90% of the work was outsourced.

</comment><comment><USER65> Who's managing the projects, and where are the workers doing the development? This story sounds awfully familiar.

</comment><comment><USER66> It's ironic. In the USA they freak out over the idea that someone might receive more unemployment than they are entitled to, but they will happily waste millions of dollars paying someone to do a shitty job.

<comment> jagged-chisel Tangent: during my last stint on unemployment, there was this class we were required to attend. In that class, they repeatedly told us that we are not _entitled_ to unemployment benefits. They didn't exactly offer an alternative vocabulary.

<comment><USER67> That's absurd. They take it out of your paycheck every month, it's paid entirely from employee wages, it can't be spent on anything but unemployment, and you get benefits proportional to what you contributed. It's literally your own money that they're giving back to you that they took for the sole purpose of forcing you to save money for if you lose your job at some point. It's like if I asked to borrow a pen, then when you asked for it back pretending like it was some benevolent gift.

<comment> jagged-chisel It's definitely not a line item on paychecks in my state. It's structured as an insurance premium paid by companies to the state. The company's premiums increase when there's a claim against the "policy." Smaller companies like to try denying claims in an attempt to prevent this increase.

One could certainly argue that if this 'premium' didn't exist, it could be paid out in salaries.

<comment><USER67> That's right, I recall something like that. I think states administer their own unemployment system even though it's mandated by the federal government. It's a payroll tax where I live. It's calculated based on your wages and paid based on the amount of insurance you've funded regardless of whether the regulations/company decides to display it on the calculation or not. It might also get buried under something like "state and local taxes," too.

</comment></comment></comment></comment></comment><comment><USER68> Dog eat dog

</comment><comment><USER69> 1 billion dollars later healthcare.gov almost works good.

Sure I need to click the same 14 screens just to get to the Health insurance options screen, and sure any time I open a URL on page 4 and hit back, it takes me to the top of page 1....

But government healthcare would surely not run into issues that seem to trouble every other government service. (Can I post /s or does that delete your post?)</comment>


The intriguing legal ramifications of Pokémon Go - <AUTHOR> http://brettterpstra.com/2016/07/25/the-intriguing-legal-ramifications-of-pokemon-go/ <comment><USER2> > Let's take the example of a restaurant that advertises itself as a "Poké > Stop" and utilizes a game image in connection with the stylized "Poké Stop" > mark in its store window. That is arguably an instance of both copyright and > trademark infringement.

It seems crazy to me that a developer can put a pokestop(or w/e) inside of a store with no notification or permission from the property owner, but the property owner can't put up a sign indicating that a pokestop has been created inside of their store without getting a license. If that's really how the law works we've already reached the dystopian future.

<comment><USER3> Are there any Pokéstops (and gyms) in stores? Almost all of them that I've seen are public art, plaques, signs along nature trails, etc. Some of these are on private property, but I haven't seen any that you'd need to actually enter the property to use. One near me is literally a mailbox. The closest I can think of as a business is a church. All of these things are accessible from sidewalks. They're not really "putting" anything any properties; they're just marking things on a map.

<comment><USER4> I was at Providence hospital at the University of Alaska Anchorage campus for the past week and a half, I had family that was there.

I wanted to get outside and walk around for an hour out of the day, so I downloaded the game and wandered around for a while.

Amazingly, there is a gym right at the ER entrance. (Their hockey arena is also right across from the ER, which strikes me as a poor decision considering how traffic could result in someone being delayed in getting to the ER but I digress.) There is a pokestop outside at the non-emergency drop off cul-de- sac. And to top it all off, there is a pokestop at a piece of art in one of the hallways in what should be a secure area-- there was zero security between my family members room and that pokestop.

The hospital is pissed about it, and rightfully so imo: [http://www.ktuu.com/content/news/Providence-asks-Pokemon- Go-...](http://www.ktuu.com/content/news/Providence-asks-Pokemon-Go-players-to --386729991.html)

The issue is that the pokestops are really just the portals in ingress, and ingress was a low-traffic game where people weren't trying to come in every 30 minutes, so inappropriate locations could fly under the radar. Now that it went mainstream, they're being noticed.

Even outside of populated areas, the choices are bad. The closest pokestop to me currently, no longer in Anchorage but now in Fairbanks, is about a kilometer deep into private property.

</comment></comment></comment><comment><USER5> I'm curious why so many of these issues seem to differ so greatly from any other reason people may be doing something in public.

Does it really matter if they are using an app on their phone instead of reading Yelp or listening to a podcast while they crash into someone, act like an idiot, etc? If I put out a podcast that is meant to be listened to as a walking tour of somewhere do I have these same liability concerns since I'm suggesting locations to the user?

How random would an app maker have to make their AR game to make it clear they just want to make a game that people can play by moving around, without being liable for everything stupid people do in public while they happen to be running the app?

<comment><USER6> A sufficient difference in quantity becomes a difference in quality. Some of these concerns are merely amusing now, but could conceivably become real problems at scale.

I'm hedging, because I think this is likely to be a fluke event and be a non- issue for a long time. Even if AR games become big, this is probably the first and last time we're all playing the exact same one. Plus over time this sort of thin connectivity to the real world may be seen as a fluke; AR may require much stronger computer vision and real-world understanding to take off in a non-fluke way.

Pokemon Go reminds me a lot of the GPS unit my father had 20 years ago, where all it knew about was cities. I'm not even sure why he bought it, the most interesting thing you could do is zoom out in the Chicago area and roughly see Lake Michigan. Prior to GPS units being hooked up to road databases and able to give directions, they were not that useful. Similarly, for all the flash and pizzaz Pokemon Go may superficially seem to have, all it really has is your coordinates.

This doesn't make it "bad" but it's not clear to me this is going to be a new genre. It may just be one cool fad game, with the "real" stuff still to come in what could even be another 10 years.

<comment><USER7> I used a GPS that barely had a map. It was still useful. It was nice for day hiking in unfamiliar areas, just record a track and it's easy (within reason) to get back to where you started. I also used it as a "compass", where I set it to point at the destination and then chose a route that tended to head in that direction (say I didn't feel like driving on the busy freeway).

</comment></comment></comment><comment><USER8> The very first point mentioned in the article is that pokemon go requests access to too much data. This was a bug that has been (or is being?) addressed by the developers [0].

I believe this is usually the occasion to cite Hanlons razor[1].

[0] [https://support.pokemongo.nianticlabs.com/hc/en- us/articles/...](https://support.pokemongo.nianticlabs.com/hc/en- us/articles/222648408-Permissions-update)

[1] [https://en.wikipedia.org/wiki/Hanlon%27s_razor](https://en.wikipedia.org/wiki/Hanlon%27s_razor)

<comment><USER9> Draft might've been written before the bugfix.

</comment></comment><comment><USER10> > But now, the XYZ Candy Company building also has become a Pokémon Gym. > Players from miles around aggregate to that location because the name and > logo are depicted in the app as a Pokémon Gym location. At what point does > this mean the app is using the copyrighted design in violation of the > copyright registration?

All the pictures used are taken from public property iirc. Wouldn't the copyright for the picture taken and the copyright of the building be two separate things, the former belonging to the taker and licensed to the company? If not, is Google Maps compelled to censor their street views of copyrighted architecture?

<comment><USER11> There must be a limit - otherwise video games like Grand Theft Auto could put photos of say, McDonalds, in their game and not break any laws. I'm not sure where I sit on whether that's right, but currently they shy away from it for a reason.

An interesting corollary may be use of products in TV - at what point does everyone using a MacBook or Windows (and then having problems with beachballs/blue screens) count as copyright infringement?

<comment><USER12> There's a gap between "we can legally do this" and "we can legally do this but we don't want to spend more money on lawyers."

<comment><USER11> I suspect that's the biggest reason - lawyers are easy to throw at problems, getting answers from them is hard, especially with settlements.

</comment></comment></comment></comment><comment><USER13> >it can be irritating to suddenly have 50 people show up at a national landmark because it has now become part of a video game

Do you know really need to know why someone is in a public space so we can cast aspersions?

<comment><USER14> As a DC area resident, the idea of getting upset at 50 visitors to a national landmark is just _adorable_.

</comment></comment><comment><USER15> I think things will get interesting when augmented reality becomes so ingrained in our society that it becomes difficult to separate it from what is real.

As virtual entities take over the mindshare of 'real entities' in our lives, we might start integrating the virtual entities more into our thought processes and into our artworks - Which would increase the frequency of copyright infringement.

So basically, as the virtual world takes over the real world, companies who produce virtual goods will be able to take over ownership of our reality and therefore of our minds.

Combined with big data, companies will be able to monitor our usage of their intellectual property as part of our lives and charge us for it.

<comment><USER16> A) we already do, its called a "concept" \-- its pretty much the fundamentals of how we see and understand the world around us. Concepts don't need a physical manifestation to have real effects. (e.g. wave patterns)

B) This isn't much different than headphones, just for your eyes. Temper your fears with what being able to take music everywhere did to make a dystopia.

<comment><USER17> >Temper your fears with what being able to take music everywhere did to make a dystopia.

A culture of self-isolation in public spaces where 50% of inhabitants are stuck in semireality instead of a functional member of the environment? It's a bit dystopic, just socially acceptable.

</comment></comment></comment><comment><USER18> From what I've seen, many of these locations can be accessed without ever actually entering the property. The name, description, and photos are user- generated, and no more illegal than what Google Maps provides. Some locations are unique (airports come to mind), but most of the IP risk seems completely frivolous to me.

<comment><USER19> There is a PokeGym smack-bang in the center of the pentagon. I don't think you can't even enter the building without security clearance.

[https://www.inverse.com/article/18034-pokemon-go-in-white- ho...](https://www.inverse.com/article/18034-pokemon-go-in-white-house-and- pentagon)

</comment></comment><comment><USER20> I liked seeing a chiptunes musician and promoter promise "LURES ALL NIGHT!" for his DJ set at jwz's new club: [https://twitter.com/8bitsf/status/757067417910509568](https://twitter.com/8bitsf/status/757067417910509568)

</comment><comment><USER21> This is an interesting article. I find it a bit curious though that Niantic hasn't solved these problems for itself, given that they already had Ingress before developing Pokémon Go. Of course, Ingress is miniscule in comparison; I wonder if Google's legal team even bothered to take a look.</comment>


Ask HN: Steve Job's Net Worth? - <AUTHOR>

Doing a quick Google search shows that Steve Job's net worth is about $3.4 billion.  That's an absurd amount, make no mistake, but why is it smaller than Sergey Brin's ($12 bn), Larry Page's ($12 bn), or Bill Gates' ($40 bn) net worth? <comment><USER2> Is the net worth of someone like that really a valid concept?--since if they announced that they were to sell all of their stock, the price would plummet (since it would imply to investors they no longer trust the stock as an investment).

It's worse than illiquid; the mere act of trying to sell such a horde would destroy its value.

</comment><comment><USER3> Depends on when he sold stock options, how many stock options he had, the details surrounding him leaving and coming back as CEO, and about a million other possible variables.

</comment><comment><USER4> [http://www.forbes.com/lists/2009/10/billionaires-2009-riches...](http://www.forbes.com/lists/2009/10/billionaires-2009-richest- people_Steven-Jobs_HEDB.html)

His net worth was estimated to be $3.4 billion by Forbes on 3/11/09. At that time, Apple shares were down 50% over the previous 6 months.

</comment><comment><USER5> Random variation.

</comment><comment><USER6> the bulk of his networth are disney shares due to pixar sale.</comment>


Installing K3s on the Turing Pi Raspberry Pi Cluster - <AUTHOR> https://www.youtube.com/watch?v=N4bfNefjBSw <comment><AUTHOR> I also posted a blog post [1] with a full transcript of the episode for those who don't like sitting through/watching the video (like me!).

[1] [https://www.jeffgeerling.com/blog/2020/pi-cluster- episode-3-...](https://www.jeffgeerling.com/blog/2020/pi-cluster- episode-3-installing-k3s-kubernetes-on-turing-pi)</comment>