Second Sock Syndrome - <AUTHOR> https://sheepamongwolves.net/2018/09/second-sock-syndrome-what-it-is-and-how-to-fight-it/ <comment><USER2> Cache/archive/mirror: [https://archive.is/jrQ4n#selection-727.0-731.211](https://archive.is/jrQ4n#selection-727.0-731.211)

In short:

> What is the Second Sock Syndrome?

> SSS usually refers to the inability to produce complete pairs of socks. > Knitting the first sock usually goes quickly. But the second one seems to > drag on, never gets completed or even cast on in the first place.

It's entirely a knitting blog, but surely this was posted here as it's a problem I know I face in all sorts of domains, including programming. Once the interesting part is figured out, finishing the project is the tough part.

<comment><USER3> It seems similar in name only to Second System Effect, from Fred Brooks.

The challenge for your second sock is to accurately repeat your process of the first one. The challenge of the second system--where you reimplement something from scratch maybe--is to keep the scope limited but you are trying to depart from the mistakes of the first one.

[https://adamo.wordpress.com/2019/02/03/the-second-system- eff...](https://adamo.wordpress.com/2019/02/03/the-second-system-effect/)

<comment><USER4> Yeah, but maybe you _should_ be making a second system instead of a second sock.

</comment></comment></comment><comment><USER5> The take-away for developers is perhaps this: There are a lot of ways to deal with the boring part of a job where there's not much new or creative stuff happening. Some are better than others.

I'd break the suggested strategies into a few general categories. You can be so intrinsically motivated that you never really encounter this problem in the first place (1). You can play psychological games to try and make it harder to lose interest (2, 3, 4, 8, 9). You can alter the workload in a way that makes it more interesting, but may cause quality to suffer (5, some 7, 10, 11, 12). You can rearrange the work in a way that actually creates _more_ work, but also helps it stay interesting for longer (6, some 7, 10, 11, 12).

I find that those last two categories tend to go hand-in-hand in programming, too. So finding ways to help yourself just muscle through the boring part really is preferable in a professional setting.

OTOH, for fun projects, both sock knitting (and mittens) and development, I tend to go for those latter strategies. The corollary here is that I try not to knit socks for others, and you probably shouldn't take a dependency on anything I'm not getting paid to write.

</comment><comment><USER6> In SW development we try to avoid this by building a framework where the second instantiation comes at almost no extra cost. However, we have the problem where we start building the framework and then never solving the original problem...

<comment><USER7> Very common in game development. Someone focuses too much on the engine but forgets the game. Or focuses too much on the graphics pipeline but forgets gameplay.

A portfolio of _completed_ projects is actually a thing worth having in game dev. Doesn't necessarily mean a project polished to the nth degree but instead, a project that is a cohesive whole. (I'm not saying polish is a bad thing...)

Notes to the pedantic: this doesn't exclude a portfolio of specific examples. eg a set of graphics assets or level assets. Or a graphics library. But the thing needs to have been "done" and not in perpetual "there's this obvious giant hole where this important functionality is missing". And yes I've had success with incomplete projects but they were fully playable just with "programmer art".

</comment></comment><comment><USER8> While this is definitely a problem developers face, many of the solutions in this article only apply to socks. HN, do you have any tips for completing personal projects when they stop being fun?

<comment><USER9> One of the mentioned approaches is "give up". For personal projects this is a totally valid approach. If you're doing it for fun and/or learning, finishing need not be a goal.

<comment><USER10> This is valid when your only goal is to learn a thing.

But I think it's really important to remember that _finishing_ is itself a skill that is worth learning and if you don't finish things, you gain no practice at that skill. Writing the first 80% of a hundred programs may give you a lot of skill in different domains, but it won't give you the ability to _finish_ a program in any of them and get it to a point that it can benefit other humans.

</comment></comment></comment><comment> d--b The thing about knitting is that you can't avoid knitting that second sock. In technology, we can just build a machine that copies the first sock.

The problem we face is that it usually takes an order of magnitude more time to build that machine than to actually knit the second sock...

<comment><USER11> You build an abstraction layer, yes:

        knit.sock(.left)

However, your next roadblock would be the framework itself: you throw new tasks at it that it can't handle, you start adding more states and conditionals, more lambdas and/or polymorphism until it gets so ugly you start hating the framework (and yourself) and realize you will never finish it. Time for a big rewrite.

One of the essential skills in software engineering is the ability to carefully craft beautiful and minimalist abstraction layers that won't let you down.

<comment><USER12> Knitting is just a monoid in the category of endofunctors. Once you realize that a sock is just a piece of yarn transformed through a series of knots, you can determine that it's topologically equivalent to where you started and you don't need to knit the other sock.

<comment><USER13> A knit is not a knot.

<comment><USER14> Tail-recursive yarn. Service mesh.

</comment></comment></comment></comment></comment><comment><USER15> I don't know specifically about socks, but with other things, I get through the repetitiveness by optimizing the process, and then each successive output gets quicker or easier. You never do it the best way the first time, and then the game becomes how can I do this with less steps or less effort, what are the tricks? Eventually you get up against the wall and there aren't anymore gains to be made, but at that point it's usually become mindless muscle- memory, and it isn't really much of a chore; it's actually usually quite enjoyable.

<comment><USER16> This maybe a good strategy when you need to churn out a series of items, but what's interesting about the 2nd sock problem is that its very hard to justify the effort in optimizing the process just to make 1 more sock.

</comment></comment><comment><USER17> I've found that often "lacking motivation" is a misinterpretation of "lacking understanding of a fundamental idea." Do you really lack motivation to implement clock recovery in your toy software modem? Or do you not know how digital PLLs work.

IMO knitting is closer to CRUD dev: it's a little challenging but it's mostly just reading/following patterns and counting (although this is coming from someone who crochets and doesn't knit.)

</comment><comment><USER18> One related "problem" I've encountered is when the 2nd iteration of something turns out better than the 1st (and the 3rd, 4th, 5th get subsequently better). Perhaps not as big of a problem when you're making stone tiles, or some other output, but it sure does suck to have one good sock and one "eh" sock.

</comment><comment><USER19> The second sock syndrome is perhaps never an issue if you have a real environment of collaboration, comadrerie or even apprenticeship. Just more yarn and code by yourself is not going to cut it for long unless you have an external motivator.

The chemicals which activate our sense of happiness more than anything is the feeling when we see our friends and family have breakthroughs and achieving a goal. It's probably a bigger factor for the one that is trying to reach that goal.

This is perhaps why twitch is so popular, even in an activity such as gaming which has been made to be fun by itself alone, socialization is a force multiplier.

I can have a sense of this at different work places, people are so focused on result and not on the process that people stop caring of craftmanship and disciplin. In the long term it makes the company rot from the inside with high turn over and lost knowledge and increase of technical debt and finally a losing business.

</comment><comment><USER20> I love how an article about knitting gets related so quickly to other domains (by reading the comments). I had to search on that blog to understand that it wasn't related to a technical domain.

However, from the title I thought it was about the law (if it's not a law, it should be) that says that if a pair of sockets in a drawer are put together you can easily find the pair. Instead if you find one of the socks of the pair, the other sock of the pair, while still in the drawer, is mysteriously teleported into another dimension, never to be found again.

</comment><comment><USER21> [https://archive.md/jrQ4n](https://archive.md/jrQ4n)

[https://web.archive.org/web/20200224190006/https://sheepamon...](https://web.archive.org/web/20200224190006/https://sheepamongwolves.net/2018/09/second- sock-syndrome-what-it-is-and-how-to-fight-it/)

</comment><comment><USER22> You could make it challenging, like knit the second sock in a mirror image, reversing the knitting direction that you have learned and practiced.

<comment> pure-awesome That's example 6 on the list.</comment></comment>


Covid-19 vaccine trial participant had serious neurological symptoms - <AUTHOR> https://www.statnews.com/2020/09/09/astrazeneca-covid19-vaccine-trial-hold-patient-report/ <comment><USER2> WARNING: shits full-screen modal in your face</comment>


Apple asks court to ban Samsung's Galaxy Note and Galaxy S III from US - <AUTHOR> http://arstechnica.com/tech-policy/2012/09/apple-asks-court-to-ban-samsungs-galaxy-note-and-galaxy-s-iii-from-us/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+arstechnica%2Findex+%28Ars+Technica+-+All+content%29&utm_content=Google+Reader <comment><USER4> I used to be on Apple's side; now they're just bullies.

I don't think I'll buy anything from them ever again.

<comment><USER5> I'm certainly disappointed in Apple's use of the patent system here, but we need to fix the patent system as a whole. Apple wouldn't have acted this way unless our patent system created the opportunity and the incentive. And if it wasn't Apple, it would have been someone else sooner or later.

So you can be mad at Apple if you want, but what's really messed up is a patent system that makes this behavior profitable.

<comment><USER6> I don't follow this logic. "I'm certainly disappointed in the pervert's use of the open curtains here, but we need to fix open curtains as a whole." Apple are still responsible for the ethics of their actions, regardless of the legality of those actions.

<comment><USER5> Our legal system has no room for ethics. If the rules of the game make it profitable to be evil, companies will probably be evil. They might not be, but it'll be an uphill battle. If we redesign the rules so that being evil is not profitable, that will make it a whole lot easier on everyone.

Of course, actually doing so won't be easy, because the status quo benefits most influential players...

<comment><USER7> > Our legal system has no room for ethics.

But your brain does.

<comment><USER8> I don't think he's saying it's _ok_. He's saying that in spite of Apple being unethical the present condition is an inevitability. We can try to shame Apple into doing the right thing but it won't fix the real problem.

</comment></comment></comment></comment></comment></comment><comment><USER9> Absolutely the last straw for me here. I've changed the price of all my apps to $999 and edited their descriptions to inform potential buyers that I'm pulling my apps in protest of Apple's policies.

If the Apple gestapo doesn't yank my apps for me for this I'll pull them completely from the store myself as long as I've posted any updates for my existing customers required for iOS 6.

Fun discovery made in the process: Apple won't allow you to use the word "Android" in the app description.

Bye!

<comment><USER10> And how about Samsung? Their business practices are disgusting.

<comment><USER11> Care to elaborate?

</comment></comment></comment><comment><USER12> What the hell is up with Apple? I'm usually all for fierce competition, but this vindictive bullshit goes above and beyond that.

<comment><USER13> The tool they're using to deliver the punch sucks (software patents).

But I'm honestly baffled that HN doesn't _emotionally_ understand Apple (maybe: Steve Jobs). Samsung has ripped off Apple wherever it could _while being one of Apple's trusted suppliers_ , to the point where the SGS2 was considered THE iPhone contender. (Mostly anecdotal, though see [1].) Now Apple is throwing whatever they have at Samsung, this happens to include software patents.

[1] <http://www.youtube.com/watch?v=X4VHzNEWIqA> ...?

<comment><USER14> There seems to be an odd mix of sentiment being expressed here in this discussion. On one hand some are suggesting that expecting ethics from a corporation is foolish, but on the other hand you are attributing their actions to an emotional response.

Surely if the AAPL corporation is capable of experiencing emotion, it is capable of acting in an ethical manner instead of just a profit-seeking manner.

<comment><USER13> > On one hand some are suggesting that expecting ethics from a corporation is > foolish, but on the other hand you are attributing their actions to an > emotional response.

Different people saying different things is not new :) But this wouldn't be a contradiction if we were the same person either. Someone without ethics can very well react emotionally. I'm only speculating about the emotions at play - which I think do exist - I have no interest in judging ethics this time.

</comment></comment></comment></comment><comment><USER15> The biggest patent troll of the past 10 years. I'm ashamed of all the Apple products I own after what's been going on.

</comment><comment><USER16> Something that hasn't been discussed: Samsung Galaxy Nexus (aka Google's phone) is on this list as well.

<comment><USER9> I hope the people that have been dismissing Apple's recent win as a deserved and minor comeuppance for Samsung will at last see the light after this latest round of developments. Apple is clearly out to destroy Android, not just Samsung, and even a child can see that the S3 and the Note are not clones of anything Apple's made but instead products filling a demand Apple has refused to meet.

<comment><USER17> In particular the note is pretty innovative (in the apple sense) in it's own right.

<comment><USER18> It is, and it holds little similarity to the iPhone.

</comment></comment></comment></comment><comment><USER19> More detailed info would be helpful. What infringement is Apple alleging in this case? For the S III, they have to rely more and more on bogus software patents since it is very different from an iPhone. Their fear is very visible.

<comment><USER20> In what way are they bogus?

Because all software patents shouldn't be granted?

Because you have studied them deeply, fully understand their claims and believe there is prior art or no inventive step (the current requirement for the inventive step seem very low, do you think that this is not being met or you believe the standard should be higher)?

The patents have now withstood not only the flawed patent office examination but have been tested in court. The presumption should now be that they are valid and not bogus unless you provide justification or at least explanation of your view.

Samsung/Google should also presume validity and develop a workaround while the case is pending to strengthen their negotiating position and remove risk of a ban. This doesn't mean that they have to stop fighting legally.

Edit: A reply suggests I may have been wrong to believe that these are the patents that were tested in court. If I was wrong the advice would probably be to plan potential workarounds but not carry them out.

<comment><USER19> "Slide to unlock" has been thrown out in the UK

[http://www.wired.co.uk/news/archive/2012-07/05/slide-to- unlo...](http://www.wired.co.uk/news/archive/2012-07/05/slide-to-unlock- invalid)

"Data detectors" looks completely ridiculous to everyone who has programmed for more than a year. I would be shocked if this stands, although I have heard that HTC modified their skin because of it.

"Unified search" is the classic "X + on a phone" patent, where X is something that has been done for decades. I hope this is challenged and closely examined. I would not be surprised if there is prior art even for phones.

"Word completion" is very obvious too, they have included details of their implementation in the claims so it will be easy to workaround.

But why would Apple sue over these patents? The best they can get are slight modifications to the software, which will not alter the experience or the look and feel much. Meanwhile they are losing goodwill and making people aware that there are better alternatives out there. All this because the former CEO felt slighted? As a stockholder I would be a little mad.

<comment><USER21> Yeah but the average person I'm sure doesn't follow tech news as carefully as you or me - and doesn't get worked up about this sort of stuff either. Any damage to Apple's reputation will be negligible, wouldn't you think?

<comment><USER19> Customers will become aware of this more and more, and Apple's trials are further helping it. It is a slow process, but it happens. Microsoft also seemed invincible once but they lost the goodwill of developers and customers over the years.

<comment><USER22> I don't think this is the awareness that Apple's competitors want. What Joe SixPack heard this week in the news is that Samsung got its ass kicked by Apple for copying. J6P doesn't understand prior art, voir dire, trade dress, etc. They just know that Samsung is currently on the hook for $1 billion. This makes Samsung look bad, and Apple look good.

Thinking that even 1% of the populace understands patent law, much less how the US legal system functions is going to leave you disappointed. No matter how Samsung tries to spin this, no matter how many articles appear on Groklaw or HN, this is a bad PR scene for Samsung.

</comment></comment></comment></comment></comment></comment><comment><USER23> What makes me rage about this more than anything is that there is no viable alt (for me) to OSX right now - for what I do.

My next phone is an S3 though.

Must be painful for Woz to watch.

<comment><USER24> If I may ask, what is it you do?

<comment><USER25> Well, I'm guessing he's either developing iOS or OSX apps.

</comment></comment></comment><comment><USER26> Even as a fan of Apple, I find this ridiculous.

It will be the consumers who lose if Apple wins.

<comment><USER10> Consumers are also people who need jobs.

If Asian companies can just clone our products and block our products from sale in their countries, there will be fewer jobs for Americans, Europeans and Australians.

<comment><USER14> Ah yes, when in doubt, fall back on good old xenophobia. It was only a matter of time really, you can always count on _somebody_ dredging up xenophobia if there are not rational arguments to be made.

<comment><USER10> What do you classify as 'xenophobia'? How can I avoid falling victim to it? How can I make my arguments more rational in future?

For what it's worth, I have lived in Asia for several years, speak three languages, and my opinions are influenced by the Korean economist Ha-Joon Chang, so I'm trying my best.

<comment><USER14> Next time try to present an argument that has substance beyond _"people from the 'wrong' continent will be making the money"_.

<comment><USER10> Is there something wrong with wishing to be economically prosperous now?

</comment></comment></comment></comment></comment></comment><comment><USER27> It's too bad it's not the iPad being banned or people might actually care and we'd get some badly needed IP reform.

<comment><USER21> Never fear, I actually patented thin rectangular prisms 20 years ago - <USER2> lawyers are preparing the case now.

(Of course, Apple is only one of many, many companies who will soon be paying for their insipid copycatting)

</comment></comment><comment><USER28> I find the worst part about this whole war is that in the end it's purely about money and nothing else. So now, because some dickheads want more of it while they already have enough, people are denied access to what seems a pretty decent device.

<comment><USER29> I found it funny when the jury foreman said "we only wanted to award a reasonable amount of damages". One billion dollars for rounded corners? I wonder if one billion dollars would have seemed like a reasonable amount of money before the financial crisis with it's monster bailouts.

<comment><USER30> If you took the time to _actually_ read the verdict, you'd see that claim was dismissed. Also, it's not a patent on rounded corners, it's a _design_ patent, which is essentially a patent granted on the ornamental design of a functional item that pretty much every other manufacture has managed not to plagiarise. And what the hell has the "financial crisis" got to do with this? Is suppose that's the jury's fault too now?

edit: language

<comment><USER29> Financial crisis: because one billion dollar suddenly is "a reasonable amount of money".

<comment><USER30> I'd suggest that the figure became a reasonable amount when both litigant started turning over several multiples of that figure _per quarter_. It's the effect of general inflatin on economies.

</comment></comment></comment></comment></comment><comment><USER31> This is getting ridiculous. It would be one thing if they went after TouchWiz, because I'd actually like Samsung give up on it, but going after them with these patents? I can't see how this is helping innovation at all. It's simply about blocking the competition from the market, plain and simple.

</comment><comment><USER32> So this is the same case being tried in front of Judge Koh?

I'm not sure what patents in particular they say are being infringed here, but it can't be the trade dress stuff -- Samsung's stuff have moved away from being obvious ripoffs of Apple's products and the Galaxy SIII looks no more like an iPhone than any other smartphone from any other manufacturer.

If it's the pinch-to-zoom and bounce-back patents (etc) then it shouldn't be hard for Samsung to issue an update to workaround those patents.

In fact, I mentioned in another comment[1] but I'm pretty sure Android (not sure about Samsung's modified version of Android) doesn't infringe on the pinch-to-zoom patent anyway, because Android allows scrolling with two fingers. Obviously, I'm no patent expert, though...

[1]: <http://news.ycombinator.com/item?id=4441202>

</comment><comment><USER33> Litigious bastards.

<comment><USER30> And Samsung are plagiarising parasites.

<comment><USER34> I've used an iPhone and I own a Galaxy Note, and I can tell you that it is _nothing_ like the former.

</comment></comment></comment><comment><USER35> At this point, I hope that Samsung will be able to obtain bans for the future Apple LTE products, at least in Europe. MAYBE this way Apple will stop being the bully it is.

<comment><USER10> Let us remember that Samsung have the South Korean government in their pocket, and they already acted to stop the iPhone from being sold for two years in South Korea when it was released, to give Samsung a chance to catch up and make more money from the domestic (South Korean) market.

Why on earth is HackerNews so pro-Samsung?

<comment><USER36> I think it's more being against validating ridiculous patents than being pro samsung

<comment><USER10> Yeah but my parent poster described Apple as a bully, when Samsung initiated this whole thing.

</comment></comment></comment></comment><comment><USER37> _The four new patents Apple is leveraging against Samsung include the '647 "Data Detectors" patent, the '721 "Slide-to-unlock" property, the '172 "Word completion" invention and the '604 "Universal search" patent._

[http://www.appleinsider.com/articles/12/08/31/apple_adds_sam...](http://www.appleinsider.com/articles/12/08/31/apple_adds_samsungs_flagship_galaxy_s_iii_galaxy_note_to_amended_galaxy_nexus_complaint.html)

Just broad nonsensical software patents that shouldn't have been granted in the first place.

I hope Samsung fights this as I think they have a much better chance in winning even a jury trial against these, I mean why hasn't anyone invalidated these patents yet?!

P.S.

I'm not clear as to when Apple is hoping to ban these devices, at the December hearing? earlier? next year? I would appreciate a clarification.

Edit: trial date is set for March 2014 according to this [http://online.wsj.com/article/SB1000087239639044361860457762...](http://online.wsj.com/article/SB10000872396390443618604577624410538954138.html)

<comment><USER20> Slide to unlock doesn't seem broad to me. It seems easy to workaround by requiring a swipe but not moving the image until the end of the swipe or requiring a pattern of taps.

There may be prior art as another poster claims, I haven't studied it but it doesn't look too broad to me.

<comment><USER38> It may not be broad but it's trivial and obvious. It's like dismissing a dialog box by pressing the enter key.

<comment><USER20> I'm not sure it is obvious.

There is quite a bit of detail specified (e.g. continuous movement of the image along the path) and it wasn't the approach taken by Ericsson, Palm or Microsoft in their previous touch devices so it isn't clear to me that it is obvious (at least in the detail).

To me it is better to have narrow specific patents even if they aren't completely revolutionary than massively broad ones claiming whole areas of technology.

Again - I haven't studied the prior art either listed in the patent or suggested by others so that may rule it out but as a concept and as patents go it seems like quite a reasonable one.

That isn't to say I don't think the patent system needs major reform and may generally be doing more harm than good but this specific patent seems to me to be the wrong example to pick as an example of what is wrong with the system.

<comment><USER39> Desktop computers have had the concept of moving your mouse to "wake up" a sleeping computer for years. How much of a leap is it translate that to moving your finger to unlock a phone?

Pretty darn obvious I would say.

<comment><USER20> Does the mouse have to move over a specific part of the screen? Does it move an image as it moves to wake it up? From a quick glance at the patent these seem to be essential parts and are the non-trivial parts of the patent that make it easier to work around and a more reasonable patent than is suggested by many commentators.

Again I'm not saying that slide to unlock is definitely valid as there may be prior art but I really find the arguments based on a straw man of what the patent is to be really unhelpful to the discussion.

<comment><USER40> Well here is a video of the Neonode prior art:

[http://www.youtube.com/watch?feature=player_detailpage&v...](http://www.youtube.com/watch?feature=player_detailpage&v=Tj- KS2kfIr0#t=250s)

It's unlocked with a left to right swipe. Contrary to the iPhone there is no image moving with the finger. I don't think that difference is worth a patent. Moving things (i.e. images) around with the finger is a pretty obvious concept for a purely touch-based device. See for example the Microsoft Surface (now renamed to PixelSense) from 2008:

[http://www.youtube.com/watch?feature=player_detailpage&v...](http://www.youtube.com/watch?feature=player_detailpage&v=Zxk_WywMTzc#t=290)

<comment><USER20> Looked at the first video and for me it wouldn't count as prior art because it doesn't include the image showing the path or an object being dragged along. If I was on a jury I would say that the Neonode wasn't prior art for this patent.

To be clear though this is based on an understanding of the patent covering only swipe to unlock with an image and a dragged object.

Haven't looked at the MS video but are you sure 2008 is early enough for prior art for this patent in the US where the first to invent rather than first to file priority was in place at that time?

There may also be other prior art but this alone doesn't convince me that this should be invalidated.

<comment><USER40> Thanks for having a look! I guess I was not clear... The point of the first video was to show that the moving image is the only thing missing from the Neonode prior art.

The point of the second video was to show that moving an image on a touch screen with a finger was known to the industry before the iPhone was introduced[1].

This means that Apple's slide to unlock is nothing more than the combination of two known concepts: swipe to unlock and moving an image with the finger. Certainly not worthy of a patent in my opinion.

[1] Linking to the MS video was a mistake of mine, since the device was actually introduced after the iPhone. But please, do have a look at this wonderful summary of the history of multi-touch technology (especially the list of devices in the second half of the page): [http://webcache.googleusercontent.com/search?q=cache:wetIwsR...](http://webcache.googleusercontent.com/search?q=cache:wetIwsRZhKYJ:www.billbuxton.com/multitouchOverview.html)

There's also an impressive TED video from early 2006: [http://www.ted.com/talks/jeff_han_demos_his_breakthrough_tou...](http://www.ted.com/talks/jeff_han_demos_his_breakthrough_touchscreen.html)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> Faulty patent system IS NOT an excuse for Apple. Aftern Jobs died - <USER3> company face has revealed, not even worth to spit at. My iPhone is last device from this manufacturer, Samsung is so much superior, they also act like humans.

<comment><USER42> Let me gladly say "thank goodness for Apple - they force everyone to lift their game". Look at Apple's warranty - it's very good (eg. a "new for old" device swap for AU $180 when the device is out of warranty - even if you destroyed it yourself).

Do not heap too much praise on Samsung - they have a very chequered history.

Do not let Apple's reprehensible behaviour in this instance undermine the value that Apple has added in other ways. I would still consider buying an iPhone - and I recognise Apple for their unique talent in high polish of a product.

I just want fair competition - I'd love Apple to think and act the same way.

<comment><USER43> there is only one thing a corporation responds to meaningfully, loss or gain of money.

Why would they give a flying fuck what you would "love them to be" if you still shovel fistfulls of money at them?</comment></comment></comment>


Quit Your Job for a Better One? Not If You Live in Idaho - <AUTHOR> https://www.nytimes.com/2017/07/14/business/economy/boise-idaho-noncompete-law.html?hp&action=click&pgtype=Homepage&clickSource=story-heading&module=second-column-region&region=top-news&WT.nav=top-news <comment><USER2> Non-compete agreements are one step away from slavery in my opinion - a person should be free to sell their labour to whomever they choose.</comment>


Cybersecurity Incident Involving Consumer Information - <AUTHOR> https://investor.equifax.com/news-and-events/news/2017/09-07-2017-213000628 <comment><USER2> Suppose Alice is a "victim of identity theft". BigBank gives $10k to Fraudster as a loan, thinking that Alice is the actual recipient. Experian, Transunion and Equifax report this loan as a debt which Alice owes to BigBank.

Who is the real victim? The credit reporting agencies want to convince people that the consumer is the victim, and so Alice bears the burden and risk of clearing her name. But it is the credit reporting agencies inflicting this upon Alice. BigBank is the victim who lost money, and BigBank bears the responsibility for making the mistake of giving out a loan in Alice's name. The Fraudster committed a crime against BigBank, not against Alice. It is Experian, Transunion and Equifax, by holding this fraudulent loan against Alice, who are victimizing Alice.

The idea that Alice was victimized by Fraudster is a concept being perpetuated by the credit reporting agencies as a way to absolve themselves of responsibility, and place the burden upon the consumer, and to avoid realistic identity-verifiction which might slow or complicate the practice of issuing large amounts of debt to the general public.

<comment><USER3> What Alice is the victim of is _slander_ , not fraud or identity theft. The bank lent some money to someone who claimed to be Alice (though the bank only relied on the fact that that person knew Alice's SSN as proof of that fact). Then when the bank didn't get paid back, they told a bunch of credit check bureaus that Alice was a credit risk. This was a _lie_ about Alice, which has a material impact on Alice's reputation. The credit agencies then go ahead and repeat that slander.

<comment><USER4> This is a great description of what is going on with "identity theft". I don't usually like changing the name of something to try to push an agenda, but calling "identity theft" "bank slander" would be good idea.

<comment><USER5> So presumably a class action law suit against the reporters for slander? Might depend on specifics of the law... Maybe it's time for a better credit reporting agency startup.

</comment></comment></comment></comment><comment><USER6> I strongly encourage anyone in the US to put a full credit security freeze on all three credit agencies. When a credit freeze is in place, you still have access to all of your existing loan accounts and whatnot (e.g. credit cards), but lenders cannot access your credit to open new accounts unless you want them to.

It's not difficult nor expensive to do, and the freeze lasts until you decide to revoke it. Whenever you need to allow access to your credit (credit check for rent, taking out a loan, etc), you can temporarily lift your credit freeze for a small fee. The fees associated with this are going to be much cheaper than any of the professional "identify protection" services that exist out there, and the freeze is significantly more effective at protecting you.

When a company leaks your social security number and personal details, which almost certainly will happen at some point if it hasn't already, then opening fraudulent accounts in your name isn't the only risk you face, but it's an obvious and dangerous possibility that can ruin you financially or make you spend a considerable amount of time and energy fixing the situation.

For every person in the US with kids, I also strongly suggest that you freeze their credit as well. There's no good reason for your 13 year old to take out a loan, but identity thieves don't care about how old their victim is.

<comment><USER7> Anyone know if there's a way to get your free credit report if you can't answer the questions for the free one?

The computer says no, and the phone number just sends a letter that says no. I tried to to buy one from my bank, but as far as I can tell they only sell subscriptions...

<comment><USER8> You could see if Credit Karma works. I think it is mostly a free interface to Trans Union though.

<comment><USER9> Funny enough, it also provides your Equifax report.

</comment></comment></comment></comment><comment><AUTHOR> _" Three Equifax Inc. senior executives sold shares worth almost $1.8 million in the days after the company discovered a security breach that may have compromised information on about 143 million U.S. consumers."_

[https://www.bloomberg.com/news/articles/2017-09-07/three- equ...](https://www.bloomberg.com/news/articles/2017-09-07/three-equifax- executives-sold-stock-before-revealing-cyber-hack)

Edit: Also discussed here [https://news.ycombinator.com/item?id=15196309](https://news.ycombinator.com/item?id=15196309)

<comment><USER10> So, that should _definitely_ get them busted for insider trading, no?

<comment><USER11> It depends...

 _Regulatory filings show that three days later, Chief Financial Officer John Gamble sold shares worth $946,374 and Joseph Loughran, president of U.S. information solutions, exercised options to dispose of stock worth $584,099. Rodolfo Ploder, president of workforce solutions, sold $250,458 of stock on Aug. 2. None of the filings lists the transactions as being part of 10b5-1 scheduled trading plans.

The three "sold a small percentage of their Equifax shares," Ines Gutzmer, a spokeswoman for the Atlanta-based company, said in an emailed statement. They "had no knowledge that an intrusion had occurred at the time."_

The timing is extremely suspicious. But - if they can prove they didn't know, they're in the clear. Of course a breech like this quickly goes to the board, and it's hard to imagine that the CFO and President of US Information Solutions wouldn't know.

<comment><USER12> > The timing is extremely suspicious. But - if they can prove they didn't > know, they're in the clear.

Burden of proof for criminal cases is the other way around. They will likely spend lots on legal fees just trying to prove they didn't know about the hack at the time they decided to sell. They will likely end up settling out of court (guilty or not) because that's how the US legal system works.

Also important -- July 29 is when Equifax claims they noticed the issue.

<comment><USER13> What actually happens is that they get interviewed repeatedly. If they get caught in a lie (like Martha Stewart), they face criminal penalties for perjury. If they keep their story straight, they are acquitted.

</comment></comment></comment></comment></comment><comment><USER14> > approximately 143 million U.S. consumers.

This was only a matter of time. We can rotate credit card numbers, but sadly not a SSN. I wish I could rotate my US social security number when significant exposure happens (this would be the 4th or 5th time in 24 months my data has been exposed).

Assuming legislation passed that allowed you to cancel an exposed SSN and get a new one, what would it take for that to happen? Surely it's not just the one agency (SSA) that would need to make the change, but multiple agencies would need to coordinate the change?

(And of course, I would be personally responsible for informing my banks, brokerages, loan agencies, etc of my new SSN)

Does anyone have insight into how this could work?

<comment><USER15> It sounds like ssn is not fit for purpose.

If the gov is going to issue a 'secret number ' why not a 2fa device?

<comment><USER16> The SSN was never intended as a national ID.

It was originally created alongside the Social Security Administration, to track what individuals put in and what they take out. People only received one upon becoming employed.

Over time, the IRS realized that it could be used as a national ID, and adopted it for that purpose. They encouraged people to obtain one from a young age (even for their newborn children), and it was used to replace the original 'honor system' of 'How many children do you have?' tax discounts; now they'd need to register their child with a SSN.

Companies eventually began piggybacking on the number as a national identifier (due to our lack of one), and voila. We're left with an awfully insecure identification system that shouldn't be an identification system for much in the first place.

For anyone interested in more: [https://www.youtube.com/watch?v=Erp8IAUouus](https://www.youtube.com/watch?v=Erp8IAUouus), and the sources below the video.

<comment><USER17> Why do we need to number people anyway? People are very consistent with spelling their own names. This combined with a birth date and/or a birth city should be enough to uniquely identify anyone.

Think about passwords. A SSN is only nine digits, 0-9. JohnHarrySmith19900101NewYork is far more secure. And doesn't dehumanize the recipient.

<comment><USER18> > People are very consistent with spelling their own names.

Is this true of _all_ people?

> This combined with a birth date and/or a birth city should be enough to > uniquely identify anyone.

For common names and large cities, probably not.

> JohnHarrySmith19900101NewYork is far more secure.

No, it's not; SSNs aren't passwords, and shouldn't need to be "secure" in that sense, but names aren't secret and birth dates and locations are easily discoverable (and the _combination of all three_ is frequently publicly announced!), so this would be _less_ secure.

<comment><USER19> > For common names and large cities, probably not.

Would be interesting to see statistics for that. It wouldn't be New York in this case, but for example Brooklyn or Queens. Even for the most popular name combinations, the number of people with the same name born on one day in one administrative area will be extremely low. Esp if you require middle names to be included.

<comment><USER20> Or you can just use a number. Because unlike names, you can assume one thing about individuals in a population and that is that they are _countable_.

You still just need 33 bits of information to identify any human on the planet, anyway.

(post-singularity, evolved into an ever-merging amorphous network of consciousnesses, we can use multidimensional fractal subsets of R^n, but we'll cross that bridge when we get there)

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Oddly, on their website equifax.com , they offer a solution to see if your identity is stolen by using a website created today called equifaxsecurity2017.com , which then offers the solution to 'enroll' which sends you to a website created a week ago called trustedidpremier.com . At which point you are to enter your identity information.

Um.

<comment><USER22> By enrolling in the free "Identity Theft Protection" you waive your right to "PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION" [https://trustedidpremier.com/static/terms](https://trustedidpremier.com/static/terms)

It is a scam to get people to sign away their rights to sue the bastards.

<comment><USER23> Shit. I already submitted and should've read the fine print. I need to un- enroll.

<comment><USER24> If you look at the site ToS you can send an opt out to arbitration by mail to them within 30 days, at least for the Equifax general ToS

</comment></comment></comment></comment><comment><USER25> Not sure if anyone else suggested this, but people should file complaints to the CFPB about this:

[https://www.consumerfinance.gov/](https://www.consumerfinance.gov/)

Not just about the hack, but the fact that their "check to see if you were affected by our shit" sites include a ToS that waives your right to participate in a class-action lawsuit.

[https://trustedidpremier.com/static/privacy- policy](https://trustedidpremier.com/static/privacy-policy)

<comment><USER26> ToS link:

[https://trustedidpremier.com/static/terms](https://trustedidpremier.com/static/terms)

To my reading, the arbitration clause may only apply to people who take the step of signing up for the credit monitoring they offer. But, of course, they are urging everyone to sign up....

</comment></comment><comment><USER27> Time for criminal penalties for the management team.

A breach like this will affect thousands of people monetarily and suck time from them they could have used elsewhere. If you've ever dealt with something like this, you know the hours it takes to rectify the damage.

The only way corporations will learn to appreciate data security is when management teams suffer criminal penalties.

<comment><USER28> I don't think it's fair to be throwing any individuals under the bus like that. There's obviously been several failures at multiple levels but the company as a whole will have to face the consequences, not just a few managers it decides to use as scapegoats.

<comment><USER29> Well, except for this:

 _" Three Equifax Inc. senior executives sold shares worth almost $1.8 million in the days after the company discovered a security breach that may have compromised information on about 143 million U.S. consumers."_

[https://www.bloomberg.com/news/articles/2017-09-07/three- equ...](https://www.bloomberg.com/news/articles/2017-09-07/three-equifax- executives-sold-stock-before-revealing-cyber-hack)

<comment><USER30> Hah, that's actually excellent news for those hoping for criminal consequences. It might be hard to put anybody in jail for their security negligence, but to me it looks like those three have served themselves up on a platter for an insider trading conviction.

</comment></comment></comment></comment><comment><USER31> Lovely. I just had to give Equifax a bunch of my own info after having my identity stolen[0]. When dealing with this, I was amazed at how technically inept all three agencies seem to be. Not to mention the extent to which they use SSN and other PII to "verify" during phone calls, and try to sell their credit monitoring services to you. This sort of thing should be provided for free by these companies if they are going to be managing such valuable data.

[0] [https://chrxs.net/articles/2017/03/23/responding-to- identity...](https://chrxs.net/articles/2017/03/23/responding-to-identity- theft/)

</comment><comment><USER22> By enrolling in the free "Identity Theft Protection" you waive your right to "PARTICIPATE IN A CLASS ACTION, CLASS ARBITRATION, OR OTHER REPRESENTATIVE ACTION" [https://trustedidpremier.com/static/terms](https://trustedidpremier.com/static/terms)

What a scam!

<comment><USER32> How can they prove it was me who waived that right if the data used to identify me was breached by them and potentially publicly available? The snake is eating it's own tail here...

<comment><USER33> Great point.

In my case, after entering the information on the "Potential Impact" page, it immediately informed me I was enrolled without actually informing me whether or not I was impacted! It basically looks like Equifax used their massive fuckup to generate business for a service they own that by its nature incentivizes them to have poor security to encourage people to stay subscribed!

Given the number of incidents that have at this point affected nearly every person in at least the US, what value does the data held by the big 3 have? Almost anyone can claim that any information held by Equifax now was the result of fraud.

And how does Equifax prove that data wasn't modified in their systems by an intruder?

</comment></comment></comment><comment><USER34> Hm, I tried using their tool to see if I've been impacted:

[https://www.equifaxsecurity2017.com/potential- impact/](https://www.equifaxsecurity2017.com/potential-impact/)

Which says it would tell me if I'm likely impacted, but instead it just gives a date where I can enroll in some free product, but no info on whether I'm likely compromised.

Anyone have a workaround? This is important to anyone that wants to identify if they've been "pwned."

<comment><USER35> I got the same page, but then I tried putting in a fake name and got:

> Thank You

> Based on the information provided, we believe that your personal information > was not impacted by this incident.

So if you just get the enrollment date, I think that means you're affected.

<comment><USER36> From the r/personalfinance thread, the site kicks back 3 different JSON status messages:

      "message-deferred": "Thank You -- Your enrollment date for TrustedID Premier is: xxxxxx Please be sure to mark your calendar as you will not receive additional reminders. On or after your enrollment date, please return to faq.trustedidpremier.com and click the link to continue through the enrollment process."

      "message-success": "Thank You -- Based on the information provided, we believe that your personal information may have been impacted by this incident. Click the button below to continue your enrollment in TrustedID Premier."

      "message-not-impacted": "Thank You -- Based on the information provided, we believe that your personal information was not impacted by this incident. Click the button below to continue your enrollment in TrustedID Premier"

<comment><USER37> So... later date means they don't know yet? Or you have been impacted and you're only eligible to enroll later?

<comment><USER36> I really don't know. If we take it at face value, I think it means they're unsure and will hopefully know more later (whatever date it kicks back). At least, that's what I hope, because I gave in and punched in my information and I received the deferred message.

</comment></comment></comment></comment></comment><comment><USER38> "Customers"? I'm not an Equifax customer - that is, I've never given them my name or any information, I've certainly never paid them for a service. Yet it wouldn't surprise me to learn I'm on their list. Why call me a "customer", I'm the product you sell to banks.

<comment><USER39> The linked article only mentions business customers (i.e. banks). And refers to us as consumers, which seems correct enough.

</comment></comment><comment><USER40> > Equifax discovered the unauthorized access on July 29

Well over a month later and they're just now getting around to telling people about a security breach that could affect almost half of all Americans...

How is this ok/legal?

<comment><USER41> Discovering a breach is only a fraction of what has to happen before customers/public should be notified of said breach. It's not very helpful to anyone if you put out a press release that just says "we discovered a breach but have no idea who, if anyone, was affected, we have no idea what was stolen, and we have no idea who did it." There have to be investigations that happen prior to any of that being known/released. Investigations to find this type of stuff out usually takes months, and typically involves the FBI or other agencies, which sometimes will actually ask you to keep news of the breach quiet if it might help them track down the perpetrators. You also want time to fix the issue before you go tell the entire world that there's a hole in your security.

I work in cybersec and I would actually say that under 1.5 months from discovery of unauthorized access to releasing this press release (and already having the equifaxsecurity2017 website up and running) is astonishingly fast work.

<comment><USER42> That seems reasonable, up to a point, but it also looks potentially self- serving and open to abuse (especially given the news about stock sales by insiders.) If a company in a position with this level of risk cannot staunch the leak within hours, it should be required to curtail its activities to the extent necessary to stop further leakage, until it has the proximate cause of the problem under control.

Nor should the instigation of credit monitoring be delayed until the investigation is complete. To pick a contemporary analogy, it would be like not informing the public of an approaching hurricane until its precise point of landfall has been determined.

<comment><USER41> Building off your analogy, you don't order mandatory evacuations every time you see a tropical depression form out in the Atlantic. It's only when the tropical depression actually turns into a hurricane and is on a collision course that you warn the public.

Data breaches are the same. If you put out a press release every time your infosec team discovered an attack, you'd be putting out releases every single day, multiple times a day, even though most of those breaches would turn out to be inconsequential after investigation. The public would become totally desensitized to them. That's why the investigation has to be done to determine if there actually is something to notify the public about.

Now, there's surely a point in the investigation where you "know" that the public needs to be notified, but you aren't completely done with the investigation yet. It would probably be in the public interest to notify _then_ rather than waiting, but I think companies are scared to do this because many companies in the past have been lambasted by the public for doing just that. Apparently people don't like it when you release a statement saying "we had a major breach and some customers are affected but we don't know who yet", so it seems that companies are opting to get _all_ the facts before saying _anything_.

<comment><USER42> You seem to be saying that, of the two analogies, mine is closer to actual practice.

</comment></comment></comment></comment></comment><comment><USER43> Sadly, they use [https://www.equifaxsecurity2017.com/](https://www.equifaxsecurity2017.com/) as their special domain for this case, which smells 9001% like phishing. I wonder if anybody at Equifax raised some concerns over that.

</comment><comment><USER44> The whole concept of these credit agencies infuriates me. I didn't sign up for it. You have a dossier on me that I have no part of. If you F it up, you'd better bend over backwards to make sure it doesn't affect me.

<comment><USER45> This simply isn't true. The only way these agencies get your SSN associated with your personal info is by your agreement with a bank or similar organization to do so. It always happens with your express approval, even if you are not savvy enough to pay attention to what you're approving.

<comment><USER46> "You could avoid being in Experian's database by becoming an off-grid hermit in Montana" isn't really a great response here.

Bank accounts, cars, housing, etc. are necessities, and consumers have no power to negotiate in a lot of cases. Good luck getting your bank or landlord to let you opt-out of credit reporting.

</comment></comment></comment><comment><USER47> Fear not. You can check to see if you were affected by visiting their site and giving them more personal data:

[https://www.equifaxsecurity2017.com](https://www.equifaxsecurity2017.com)

/s

Maybe it doesn't matter much, since they've likely already got it. But, it feels a bit too soon.

An interesting side-note: That domain was registered about two weeks ago on 8/22/2017\. Whois reveals not a single pointer to Equifax (e.g. equifax.com email address, etc.). It shows only DNStination Inc., and so is effectively private.

When you click the "Enroll" link, then "Begin Enrollment" button, it takes you to [https://trustedidpremier.com](https://trustedidpremier.com), which was registered on 8/28/2017, using a different registrar (Amazon, with Whois Privacy). There's not even a reference to Equifax in the domain itself.

As of _today_ , someone registered equifaxsecurity2018.com with a private (this time, Domains By Proxy) registration. Given the timing and the fact that this is a different registrar from the original, it's a good bet that's _not_ Equifax. Or is it? Who knows?

And SSL-wise, these don't even appear to be using extended validation certs (FWIW). At least one is an Amazon cert, free to anyone who hosts on AWS.

They are virtually training people to be phished and creating another potential disaster with all of these additional domains, private registrations, etc.

<comment><USER48> This comment should be nearer the top.

Also, equifaxsecurity2017.com appears to be a stock Wordpress site. Equifax is a bunch of fucking amateurs. Their security culture is broken.

<comment><USER47> > _Their security culture is broken._

That sums it up perfectly. This is not a mistake here or there, but a fundamental lack of appreciation for even the most basic principles of online security. It's like no one there is even thinking about the consequences of their choices.

Elsewhere on this thread, I commented on their reliance on an outside security firm to post-mortem this incident. That is ridiculous. They don't seem to understand that they are in the security business as much as anything else. They can't outsource this stuff. Their internal teams should be unparalleled.

You're right. It's absolutely cultural.

</comment></comment></comment><comment><USER49> They got hacked years ago. I know this for sure because I'd used a unique email address to sign up on their website: equifax@<my name>.com

No one else had that email address. Guess what, I started getting phishing emails to that exact address.

Tried letting them know, but it went nowhere.

<comment><USER50> They've been hacked 3 times before. Like yahoo waiting years to tell anyone this is just scummy. I hope they make a law sending people to jail over this

<comment><USER51> This administration won't be doing shit about companies like this. We need to fix the political system if there's to be any hope of justice for these types of crimes.

</comment></comment></comment><comment><USER52> Doing some junky googling, estimates for how many Americans have a credit card sits in the ~160-180million range.

In other words, when they say "143 million US customers" they really mean "the vast majority of Americans with a credit card".

Astounding.

<comment><USER53> About half of the country.

<comment><USER54> Given the average US household size of 2.53 [0], this affects far more than half the country.

[0] [https://www.census.gov/data/tables/2016/demo/families/cps-20...](https://www.census.gov/data/tables/2016/demo/families/cps-2016.html)

</comment></comment></comment><comment><USER55> Oh nice. A company that does nothing but collect personal information. I'm _already_ in their identity protection program, so I'm a little nonplussed at this.

<comment><USER56> Are you extremely surprised at this, or not at all? Just from context, I can't quite decide which it is.

<comment><USER55> I'm not at all surprised, but I am disappointed (to say the least).

</comment></comment></comment><comment><USER57> Is anyone being punished for all of the massive security breaches which appear to be happening on a nearly daily basis?

<comment><USER58> Well, they try to find and convict the hackers, of course. Or did you mean the companies like Equifax, or Target, or Home Depot that are the victims of the break-ins?

<comment><USER57> I mean the companies like Equifax. Is there nothing illegal about being careless enough to leak this much important information to hackers? I personally think they should be held accountable.

<comment><USER41> Putting aside the whole "punishing the victim" argument, the problem is that it's excruciatingly hard to draw a line between "being careless" and "you did everything right but it still wasn't enough", and thus it's really hard to punish someone for cybersecurity mistakes. I work in cybersec consulting, and it's certainly true that a large number of companies are simply not investing enough money/time/effort into cybersecurity protections, and are thus doing a disservice to their customers.

However, there are also plenty of companies that spend hundreds of millions of dollars, with _massive_ cybersec departments devoted to protecting from breaches like this, doing pretty much _everything_ they possibly can right, and they will still be hacked. Cybersecurity is incredibly difficult, incredibly expensive, and takes a _really_ long time. And even if you get 99.999999% of your company completely impervious to attackers, it only takes that 0.0000001% of exposure to sink your ship. Cybersec is also constantly evolving, so it's nearly impossible to keep up with the latest attack vectors, etc.

Take the Target breach, for example: Target has a _massive_ effort focused on cybersecurity. They actually have a cybersec research lab that some law enforcement agencies go to for help with cybersec issues. But the attack that hit them took them totally by surprise simply because it was a type of attack that hadn't really been considered, and thus was very very low on the radar (if there at all) when it came to protecting against it.

Now, companies in the US actually _are_ held accountable (to an extent). Data breaches that result in HIPAA violations, for example, usually result in massive fines for companies. Violations of PCI-DSS will land you in hot water with the major payment card companies. Some states also have cybersec regulations that result in fines if you're found to be in violation of them during an audit. The problem, again, is that cybersec is constantly evolving and these regulations are years behind. The HIPAA cybersec requirements are actually pretty laughable, partly because of all the reasons listed above.

<comment><USER33> >and thus it's really hard to punish someone for cybersecurity mistakes

No. If you take it upon yourself to hold this information, you are accepting the responsibility for its disclosure. If you are not willing to accept penalty for this happening despite your best efforts, you should not be doing it.

<comment><USER41> So, what should we do? Should we just fire/jail everyone who has ever worked for a company that was breached? You realize that would be _literally_ everyone, in pretty much every company ever, right? There's a saying in the cybersec world: "there are two types of companies: those who know they've been hacked, and those who don't realize it yet".

Cybersecurity is a field where there's already not enough good talent. And even the _very best_ talent is still going to not be good enough from time to time.

It is simply completely naive and unrealistic to expect a company to be 100% hack-proof, and if you start punishing people for that, then you're just not going to have anyone taking the job at all, and you're going to have even less security.

<comment><USER51> Oh come on. Anyone here who is a developer has at least some experience with raising a security concern to business or management and having it shot down as not important enough to worry about. We all know companies still aren't taking cybersecurity seriously enough, and it's because the consequences for a breach aren't severe enough.

</comment></comment></comment></comment></comment></comment></comment><comment><USER59> How does it take 16 days to go from buying this domain to getting to public disclosure?

[https://www.equifaxsecurity2017.com/](https://www.equifaxsecurity2017.com/)

whois: ... Domain Name: equifaxsecurity2017.com Registry Domain ID: 2156034374_DOMAIN_COM-VRSN Registrar WHOIS Server: whois.markmonitor.com Registrar URL: [http://www.markmonitor.com](http://www.markmonitor.com) Updated Date: 2017-08-25T08:08:31-0700 Creation Date: 2017-08-22T15:07:28-0700 ...

</comment><comment><USER60> From the article: "No Evidence of Unauthorized Access to Core Consumer or Commercial Credit Reporting Databases." Later on they say "The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers."

I am having a difficult time reconciling those two sentences.

<comment><USER61> Really makes you wonder what dataset this is, if it is apparently not consumer credit reports. And where did they get so much data on so many Americans?

<comment><USER46> I'd imagine the vulnerability allowed the "people" table to be accessed, but not the full list of credit report items for those people.

As for how they got the info, if you have a bank account, a landlord, a student loan, etc., Equifax knows who you are. Virtually any organization that extends credit or collects unpaid debts is going to be reporting that to the three agencies.

</comment></comment></comment><comment><USER62> Good analysis over at Krebs on Security:

[https://krebsonsecurity.com/2017/09/breach-at-equifax-may- im...](https://krebsonsecurity.com/2017/09/breach-at-equifax-may- impact-143m-americans/)

</comment><comment><USER63> > Credit reporting agencies are one of the greatest/worst rackets in the > modern financial system

Can someone notify me when the class action has been initiated?

<comment><USER8> If you want to win big, initiate it. Members of the class are likely to get something stupid like free credit monitoring from Equifax.

<comment><USER64> They are already offering exactly that. [https://www.equifaxsecurity2017.com/](https://www.equifaxsecurity2017.com/)

<comment><USER65> I'll bet $5 that signing up for their monitoring service comes with a class- action waiver sweetener.

<comment><USER66> > _I 'll bet $5 that signing up for their monitoring service comes with a > class-action waiver_

It does indeed.

[https://trustedidpremier.com/static/terms](https://trustedidpremier.com/static/terms)

<comment><USER67> Please highlight the part where it specifically says one waives the right to sue Equifax over the data breach. Because the agreement _is_ specific about what it covers.

</comment></comment></comment></comment></comment></comment><comment><USER68> Oh, hey, isn't that the corporation that is paid shit-tons of money by my potential landlords, employers, lenders, and for that matter anybody willing to pony up the cash, to determine if _I_ can be trusted?

Kind of funny, isn't it?

</comment><comment><USER47> > _Equifax said that, it had hired a cybersecurity firm to conduct a review to > determine the scale of the invasion._

I think most people are unaware of the depth of data Equifax has on them, beyond simple credit scores (e.g. health information).

Which makes the above quote from the article even more unconscionable. There should be no need for an outside firm to figure out what happened. They should have in-house expertise that is unmatched (although third-party audits ahead of time would be wise).

</comment><comment><USER69> If it's online, it will be hacked and exposed. The new reality! Let's just try to limit what info we give to companies, knowing it will be leaked soon or later.

<comment><USER70> In the case of Equifax customer data was given to them by creditors. Customers had no say.

</comment></comment><comment><USER71> How can we hold Equifax accountable for this? They literally have one job, and have failed so miserably at this one job that about half of the US population has been exposed, regardless of their personal opsec.

Is this grounds for a class-action lawsuit?

</comment><comment><USER72> Perhaps it is time for our companies and institutions to move away from social security numbers, credit cards, driver licenses and such stuff to having people authenticate using apps on their devices (or in person with biometrics).

iPhones now have the Secure Enclave, Androids have the Secure Element. You can store private keys there.

Authentication is done by apps signing challenges. This can be done in many ways, including oAuth, QR codes to authorize new devices etc.

Identity can be done by posting signed identity claims across websites, and adding/repudiating public keys in a personal scuttlebutt-type blockchain.

You can then easily sign into site X and prove your identity on sites Y and Z, without any sites necessarily tracking you between them.

Here is my semi-humble proposal for a decentralized, secure auth protocol that works with everything out there:

[https://github.com/Qbix/auth](https://github.com/Qbix/auth)

If you have experience writing tech specifications, please reply, I need someone to write the normative section of that protocol properly.

</comment><comment><USER73> The problem with the SSN is it is an identifier and a secret. It's a username and password in one, you can't change it and you need it for any substantial financial transaction.

Ideally, we'd have both a public username and a private password that we could change for our financial identification. This would eliminate most of the problems with these big data breaches. The backup for resetting a forgot password would be to show up in person and do some sort of biometric scan. Biometrics have to be done in person at a government office though since they aren't secret and cannot be changed. There shouldn't be an over the wire API for biometric identification because then you've got the SSN problem all over again, a combined username and password that's even more public than an SSN that can't be changed.

</comment><comment><USER74> These fuckers should literally be put out of business. They have one job, and they fail at it time and time again. They can't be trusted with our data. They need to be shut down. Does anyone know how to start a ballot measure in California to create a Proposition to stop using Equifax in California?

</comment><comment><USER46> > Equifax has established a dedicated website, www.equifaxsecurity2017.com, to > help consumers determine if their information has been potentially impacted > and to sign up for credit file monitoring and identity theft protection.

Really? "We lost your info. Sign up for our credit monitoring service!"

<comment><USER75> I note that equifaxsecurity2018.com is already registered, but equifaxsecurity2019.com is available.

<comment><USER76> Not anymore.

</comment></comment></comment><comment><USER50> 4 executives sold 1.8 million worth of shares randomly not on a pre scheduled basis 4 days ago likely after they realized the breach.

We need regulatory framework on cybersecurity and failure to adhere to it must result in mandatory jail time

</comment><comment><USER77> Honest question from a European: how would this work if I moved to the US? Would I simply not get a loan because I don't have a credit score? Do I apply at private companies and give them all my loan history?

Here in my country the government (or some agency) keeps track of what loans you have, and when a new company wants to issue you a loan you access the API with information like "2 years, €50 each month" and then the program responds with 'approved' or 'not approved'.

Giving all of these private companies all this data seems counter to American values of independance etc...

<comment><USER19> Most European countries have credit agencies, just that they have different names. When moving country, you usually have to build up a new credit reputation. Even when you move within Europe. A clean history will mean that you can get some credit cards but bigger loans will often require a few years of history with at least a current account.

</comment></comment><comment><USER78> From [https://trustedidpremier.com/static/terms](https://trustedidpremier.com/static/terms)

 _" By consenting to submit Your Claims to arbitration, You will be forfeiting Your right to bring or participate in any class action (whether as a named plaintiff or a class member) or to share in any class action awards, including class claims where a class has not yet been certified, even if the facts and circumstances upon which the Claims are based already occurred or existed."_

Sign for their TrustedID Premier and lose your rights.

</comment><comment><USER79> Ok everyone: Someone here has enough free time to do this, and then buy an island with the proceeds.

Set up a web page that will automatically opt out of the settlement and file a small claims court suit against them seeking $1K in damages. $1K is lower than actual damage done (in wasted time) for most people. It is also lower than the cost of defending against the suit in court.

~143 million people were impacted, so that's ~ $143B in liability. Their market cap is $17B. Problem solved.

Even better, most victims never consented to doing business with them, so there cannot be any binding arbitration issues to get in the way.

</comment><comment><USER80> >Exploited a US website application vulnerability >The information accessed primarily includes names, Social Security numbers... credit card numbers for approximately 209,000 U.S. consumers, and certain dispute documents with personal identifying information for approximately 182,000 U.S. consumers, were accessed

Was all this data available and accessible through the same application? I wonder how likely it was something incredibly trivial, like SQL injection, or whether they were truly targeted and infiltrated

</comment><comment><USER81> This is why I'm not secretive about my SSN. My neighbor, roommate or a random passerby isn't the attack vector, it is the trusted institution.

I'm not going to post it here, but I wouldn't even mind saying it over the phone while standing in line somewhere. Its just not the real attack vector.

Result here shows that whispering it and writing it down on posted notes for a bank teller have zero bearing on your identity security.

</comment><comment><USER82> This is very simple: the cost of this "incident" for Equifax is zero. As a smart business decision they are not investing (enough) in security and code quality because they don't need to.

Now if they knew that there is a $1000 fine per each stolen identity information, then the equation will shift and it will be a much better business decision to invest into protecting user data.

</comment><comment><USER83> "Residents in the U.K. and Canada were also impacted." Yet Equifax is only providing lookup or TrustedID protection for Americans.

</comment><comment><USER84> This entire thing is a joke and will continue to be a joke until we get laws that hold executives personally criminally responsible for breaches. Together with automatic forfeiture of personal assets. As long as there's no _personal_ motivation from people who make hundreds of millions of dollars by sitting on a top of the pyramid nothing is going to change.

</comment><comment><USER85> > The company has found no evidence of unauthorized activity on Equifax's core > consumer or commercial credit reporting databases.

The information accessed primarily includes names, Social Security numbers, birth dates, addresses and, in some instances, driver's license numbers.

So what are they saying? Was all this information accessed or not accessed?

<comment><USER86> If it wasn't accessed, they would have been very clear about that. They're just mentioning "core consumer or commercial credit reporting databases", whatever those are, to dilute the horrifying message and confuse everyone.

</comment></comment><comment><USER87> The fact that they're using their press release, which lets people know how irresponsible they've been, to try and trick people into waiving their right to join a class action lawsuit against them is just the worst[0]. Sure, it may not hold up in court, but it's tricky and slimy and gross.

Credit Karma sent me an email this morning with the subject line "Your New Score" and I almost spit coffee all over my workstation. In fact my score only went down a point on Trans-Union, but it still was pretty scary to see in my inbox.

[0]: [https://techcrunch.com/2017/09/07/equifax-data-breach- help-s...](https://techcrunch.com/2017/09/07/equifax-data-breach-help-site- leaves-consumers-with-more-questions-than-answers/?ncid=mobilenavtrend)

</comment><comment><USER88> Has equifax.ca also been affected? Does anyone have any intel on that? Now i'm worried

<comment><USER51> "Equifax also identified unauthorized access to limited personal information for certain UK and Canadian residents. Equifax will work with UK and Canadian regulators to determine appropriate next steps. The company has found no evidence that personal information of consumers in any other country has been impacted."

Fairly ambiguous and I trust that sentence about as far as I can throw it. I too am interested in the answer to this, both personally and as an employee of a company that uses their services.

</comment></comment><comment><USER89> >The company said that it discovered the intrusion on July 29

Why is this posted now?

</comment><comment><USER90> > Equifax is a global information solutions company that uses trusted unique > data, innovative analytics, technology and industry expertise to power > organizations and individuals around the world by transforming knowledge > into insights that help make more informed business and personal decisions.

When they have no clue on what they are conveying about them to the people, these kind of clueless incidents do happen.

</comment><comment><USER91> Everything you create online will get hacked. It will eventually just be accessible in a nice query-able format in the future. Your texts with your ex, your credit reports, your taxes, your shopping habbits, will all just be public one day. I understand people have a violent reaction to this -- but it is really becoming true. Mask who you are, hide what you do, send things that self destruct.

</comment><comment><USER92> I have once gone so far as to write a preliminary claim for defamation and libel, and put the brief to clerks for barristers to indicate interest and availability.

My issue was swiftly resolved, but I felt the cold chill as replies came revised to note that overnight instructions for a separate matter were being notified to reflect the possible conflicts of interest the association rules require disclosed.

Barristers chambers can be used by opponent litigants, but with leave from the Master of Court, if not the Justice or Judge. I am thankful for my memory fading, and I actively discourage mistaking me for a authority. But I am not unwelcoming to inquiry from any request for anecdotal vignettes of IP and Companies Court cases, should be there need and understanding of my limitations. Laddie, LJ, was the solitary Lord Justice to ever resign the Queen's Bench. He was protesting the woeful incapacity of the Higher Courts to try specialised and particularly IP cases.

It was Laddie who handed down the scintillating condemnation of Manchester United soccer club for suing fans who knitted scarves in club colors.

Closer to home for many, Laddie is the one loss lamented by Patry, who wrote both testaments and the dead sea scrolls on US copyright and became a instrumental counsel to the growing young Google. Be unaware of this two names at your peril, in a litigious world of degenerate law for inventors and artists, and all who de novo create.

Edit, "bible" was a redundant word; separated paragraphs for clarity.

</comment><comment><USER93> I expect this wont be the only bad news that is released today and tomorrow given the impending death and destruction coming this weekend.

</comment><comment><USER94> Question: Is there any way to get a notification whenever a credit account of any sort has been opened in my name, WITHOUT freezing my credit or otherwise crippling/slowing/altering any process that exists? I just want a letter or email notification, not any other changes to anything. Ideally a free way, but paid if a free way doesn't exist...

</comment><comment><USER95> So, can anyone tell me, why are there three credit agencies? Why not one, or thirty? Could I start a credit agency, just by judging that certain people are level 9000 reliable, and others are just level 100 reliable? I swear it's not slander, everyone I refer to is reliable, it's just that some of them have demonstrated exceptional reliability.

<comment><USER46> One would probably mean antitrust action or nationalization.

There are more than three - [https://en.wikipedia.org/wiki/Innovis](https://en.wikipedia.org/wiki/Innovis) for example - but the big three are the ones with market power. Anyone can start one - but it's tough getting banks and landlords to use you, especially in the beginning when you've got no data. Massive barriers to entry.

</comment></comment><comment><USER96> Points to the wise, always keep your credit FROZEN. All three of the big credit firms make it simple to do and it has been easy to unlock when I wanted to do so. if I know I am going to want to use my credit for a new account I identify which one the bank/merchant/etc will use and unlock it for 48 hours.

</comment><comment><USER97> There should be a way to freeze all 3 (and/or all significant) from a single web site, and it should be free. It's mind blowing to me that this isn't codified into law yet.

Actually, if someone did this (well) as a service I would probably even pay a small amount of money for it. Startup idea?

</comment><comment><USER98> I find the section about the arse-covering website amusing in the way they cannot help but give it a stupid marketing speak name, and phrase it like it's some fantastic product they are providing rather than a desperate response to an existential threat!

</comment><comment><USER99> > The company has found no evidence of unauthorized activity on Equifax's core > consumer or commercial credit reporting databases.

Oh good, sounds like Equifax's valuable data is safe, it's just that of their unwilling 'customers' that leaked.

<comment><USER69> _Oh good, sounds like Equifax 's valuable data is safe, it's just that of their unwilling 'customers' that leaked._

Don't worry, for $9.99 a month they'll help you clean the mess they made. I am being sarcastic, but I wouldn't be surprised at their audacity.

</comment></comment><comment><USER100> "Another potential complication for the company is that public filings show that three senior executives, including chief financial officer John Gamble, sold shares worth almost $1.8m in the days after the attack was detected."

quote from FT.com

</comment><comment><USER101> They discovered this on July 29, the CFO and two other senior executives sold shares 3 days later. They are just now reporting it (when most of the news coverage is focused on the hurricanes). What are the odds they get their day in court?

</comment><comment><USER102> Too big to punish?

<comment><USER103> Like the old saying... you owe the bank 10 thousand dollars? Your problem. You owe them 10 billion? Their problem.

</comment></comment><comment><USER104> [https://docs.google.com/document/d/1mBxLzOCEKfl4SrckBD7Bp7P5...](https://docs.google.com/document/d/1mBxLzOCEKfl4SrckBD7Bp7P5DMi7MlzSTk37RPieeMM/edit)

</comment><comment><USER105> It makes me wonder how they set up their security infrastructure. Were the hackers able to freely access their HSMs? Do they not monitor access? Would be nice if some form of RCA is made public.

</comment><comment><USER106> >I apologize to consumers and our business customers for the concern and frustration this causes

What a cop out. "Concern and frustration" are not the problem here. Identity theft is.

</comment><comment><USER107> I am dumbfounded that they are not waving credit freeze fees.

</comment><comment><USER108> People should be asking just how Equifax ended up with any of your private information. Do you authorize anyone to share this sensitive information with them?

<comment><USER46> > Do you authorize anyone to share this sensitive information with them?

Almost certainly. Any time you've taken a loan, opened a bank account, rented a car, etc. you've likely agreed to it in the fine print.

Whether you had any _choice_ in the matter is a far more important question.

</comment></comment><comment><USER109> So in order to see if my sensitive data was stolen from an Equifax database, I have to enter my sensitive information into an Equifax database.

<comment><USER46> "Your data wasn't taken! Don't worry, it'll now be lost in the next hack, so you can have your free credit monitoring then."

</comment></comment><comment><USER110> Did anyone understand what equifax is from their description in the article? I had to google it despite the "about equifax" paragraph.

</comment><comment><USER111> 143 million sounds like pretty much all of their data

</comment><comment><USER112> As long as there are practically no penalties this will keep happening. Forty- four percent of Americans are affected in this.

</comment><comment><USER113> Did they had to release the incident now by law, or did they choose the week so that the Irma weekend can blow over this?

</comment><comment><USER114> One thing seems to be conspicuously absent from the press releases; is there any inkling of who might have done it?

</comment><comment><USER115> One possible solution is to use the concept of the public and private keys we use for digital signing/encryption.

You can use my public key/public SSN to make inquiries about me and check my credit history. But to open an account or take out a loan etc, you also need my private key, private SSN, which is not stored once the account modification is done.

IMHO, this never going to happen, but seems like it could be a solution to these problems?

</comment><comment><USER116> Nice for Equifax that this happened before GDPR is enforced and they would have been fined 4 per cent of turnover.

</comment><comment><USER117> Wonder how much this would cost if it was European citizen Data under the GDPR...

</comment><comment><USER118> This is where sovereign identity solutions on Blockchain show the way forward. For example check out Civic and Pillar. Non-disclosure: no commercial interest in them. We should own our own data and that must mean decentralised. All centralised data gets hacked - all.

<comment><USER46> > All centralised data gets hacked - all.

What, and no one ever lost their Bitcoins via a key breach?

Owning our own data has very, very significant security implications. The average human isn't technically prepared to be their own infosec department.

</comment></comment><comment><USER119> This is horrendously bad.

</comment><comment><USER120> Can some form of biometrics prevent such incidents going forward?

<comment><USER46> No. Link says it was a vulnerability in their website, so adding biometrics would've probably just meant your biometrics would've been leaked alongside your SSN.

</comment></comment><comment><USER121> Is there a way to check if your information was exposed?

</comment><comment><USER122> How did it take them over a month to report this?

</comment><comment><USER89> How do you know if this affects you?

<comment> james-skemp That's what I came here for too. They have a site (go to Equifax for a notification banner) but providing the information they want just tells me to check back later. From the text I would assume I wasn't impacted, despite the fact that it seems almost everyone who used the site would have been.

Edit: Seems that if you have a date you're impacted. [https://www.reddit.com/r/personalfinance/comments/6yq36a/equ...](https://www.reddit.com/r/personalfinance/comments/6yq36a/equifax_reports_cyber_incident_may_affect_143/dmpbqlr/)

<comment><USER89> Have a date?

Thanks for the info will check it out, I suppose one saving grace for me is my credit is destroyed.

edit: that's funny "I know we just lost your SSN, but could you type it in again?" Also curious if by asking for the last six makes search faster, probably.

site to check impact: [https://trustedidpremier.com/eligibility/eligibility.html](https://trustedidpremier.com/eligibility/eligibility.html)

Edit that link (trusted) doesn't even say equifax in it, pulled it from Reddit, would be funny if it was a phishing site

Edit: this one looks more legit

[https://www.equifaxsecurity2017.com/potential- impact/](https://www.equifaxsecurity2017.com/potential-impact/)

Still not the main domain

<comment><USER115> seems to be linked to from the main equifax site : [https://www.equifax.com/personal/](https://www.equifax.com/personal/) (see banner at top)

</comment></comment></comment></comment><comment><USER123> Any info on how they were hacked ?

</comment><comment><USER124> DO NOT enter your information into their "have you been affected website".

If you enter your information, you agree not to sue them.

</comment><comment><USER125> Is it enough to freeze credit?

</comment><comment> Chiba-City The Spice will not flow.</comment>


Ask HN: How do you expend your professional network? - <AUTHOR> What practical techniques do you use in a daily basis to expand your network? <comment><USER2> Remembering remarkable people at events or on social media, going to many events, talking to smart people, try to work together or cooperate, ask for intros

</comment><comment><USER3> Obviously by connecting with my peers and [In]Fluencers on LinkedIn /s</comment>


Oceans warming at the rate as if 5 Hiroshima bombs were dropped in every second - <AUTHOR> https://edition.cnn.com/2020/01/13/world/climate-change-oceans-heat-intl/index.html <comment><USER2> I know the intended purpose of this sentence is that it shocks, but I'm not sure I'm in a position to evaluate "5 Hiroshima bombs" any more clearly than if it were presented as a metric (joules in this case) I seldom use. Would it be wrong to call it click-baity? "2019 - Yet Another Year of Record-Setting Ocean Warming" would be equally alarming to me, but I'd also understand what it means.

<comment><USER3> In this era it is important that messages with political intent not be presented as one argument, but be presented in every way possible. In regards to climate change specifically; we need the articles with reasonable headlines, we need the articles with headlines dripping in hyperbole, we need the headlines saying it's catastrophic, we need the headlines saying it's sensible and the right calm choice to make these changes now. Everyone's participation is needed to deal with this threat, and so every possible approach and argument can be deployed in the effort without diminishing any other.

<comment><USER4> > Everyone's participation is needed to deal with this threat, and so every > possible approach and argument can be deployed in the effort without > diminishing any other.

Well, unless some of the people notice the messages intended for the other people.

"It's important to tell everyone exactly the lies that will make them do what I want" is a really uncompelling pitch.

<comment><USER3> It's not what I want, but what we all need. The nice aspect of climate change is that it obliterates our tired notions of self-interest

<comment><USER5> Somehow it seems unlikely that what we all need is a total collapse of journalistic integrity. The smart answer to hyperbole and alarmism is distrust, if you advocate a dishonest approach then people are right to doubt your cause.

</comment></comment></comment></comment></comment><comment> Const-me Earth receives 1.73E+17 watts from the sun, an equivalent of 25000 Hiroshima bombs dropped every second.

<comment><USER6> That's so helpful! How many bombs are then reflected away? We can then evaluate global warming relatively against the difference.

</comment></comment><comment><USER7> Zettajoules. I think this is the first time I've seen the Zetta prefix used seriously.

</comment><comment><USER8> What's the energy / pollution released by a supertanker or container ship during one shipping? Might be close to one Hiroshima bomb

<comment><USER9> Given an engine running at 50,000kW (roughly cruising power for a post-Panamax vessel) for a week (a very rough "average" shipping), you'd be looking at ~3x10^13 J. The Hiroshima bomb was 6.3x10^13 J. So, an average shipping is about half a Bomb in direct heat - add in the emissions from burning the diesel/bunker oil, and their warming effect, and you're probably at a full Bomb per shipping.

<comment><USER10> I did a very quick and dirty back of the envelope guesstimate independently and came up with a vessel producing about 1/6th of a bomb a day. So around about the same as yours.

</comment></comment></comment><comment><USER11> Is someone trying to exhaust a ZFS storage pool?

<comment><USER12> "Humour is allowed". A rule followed at your own risk, it seems

</comment></comment><comment><USER13> Eyeballing the graph, oceans have been warming at the same linear rate for 30 years, since 1990.

</comment><comment><USER14> But are they being detonated? /s

</comment><comment><USER15> Does Nagasaki not matter? It rarely seems to matter these days as it's almost never mentioned.

<comment><USER16> Who was second man on the Moon? Who was second on Mount Everest?

<comment><USER17> Aldrin gets mentioned in the same breath as Armstrong often enough I bet quite a few people could pull that one out. You'd lose a bunch with "who's the guy who stayed in orbit?" and almost everyone with "name any Apollo 12 astronaut" or even the more-generous "name any Apollo astronaut who at least reached Lunar orbit and wasn't on 11 or 13". Most of the people who get that second one would probably just luckily guess Alan Shepard without actually knowing for sure he was on an Apollo mission, just the first famous space-program-guy who came to mind who wasn't Armstrong or Aldrin (and in fact the Apollo part of the career is not why they know his name).</comment></comment></comment>


Ask HN: Accessing databases with PHP? - <AUTHOR>

What's is the preferred method for connecting with a database in PHP in 2014? I realize things move fast in the tech industry and there are always new updates and fixes happening but when building a websites in our era which is the best way to do.<p>Mysql, Mysqli or PDO? <comment><USER2> MySQL is deprecated and outright removed in PHP 5.5, so MySQLi is your fallback option instead. However, PDO is the best choice.

<comment><USER3> To add to the above, PDO is a good choice if you will be working with different database technologies (either in this project or across different projects), you only have to learn one API. If you only need MySQL, mysqli does have a few more features than PDO.

EDIT: here is a comparison: [http://php.net/manual/en/mysqlinfo.api.choosing.php](http://php.net/manual/en/mysqlinfo.api.choosing.php)

<comment><AUTHOR> So mysqli is the best choice if I'm only working with MySQL? but PDO is good for other technologies? good to know. Thanks.

<comment><USER3> Correct.

PDO is great because one API works with many technologies. So today you're working with MySQL, but tomorrow you may be working with postgres, and the next day sqllite or MSSQL. It's nice to not have to relearn everything (sure each technology will still have quirks, but largely they work the same with PDO). That flexibility comes with a few limitations, because if one technology supports it and another doesn't, that defeats the whole "one API to rule them all" thing.

<comment><AUTHOR> if I'm working for clients is best to use PDO for database access all the time?

<comment><USER4> It is best to use PDO unless you have a VERY good concrete reason not to.

It is hard to even quantify what mysqli offers which PDO doesn't (because it is extremely niche). But it is very easy to quantify what PDO offers over mysqli (multi-database, flexibility, a better object model, etc).

PDO has been around in the PHP world for a while now, it isn't going away. Specific database APIs are dying, and the performance gap which might have once existed has been closed.

I wouldn't start a project in mysqli in 2014.

</comment></comment></comment></comment></comment></comment><comment><USER5> Were I to choose one for a new project now, I would probably go with PDO simply because of its generic nature and support for prepared queries with parameter replacement. Mysqli apparently has this too but bind variables are somewhat difficult to use with the mysqli extension.</comment>


How Fast Your Car Needs to Be to Outrun a Cop - <AUTHOR> http://www.caranddriver.com/features/how-fast-does-your-car-need-to-be-to-outrun-a-cop-feature <comment><USER2> Where I live, our community's patrol cars are late model Dodge Chargers or Ford Tauruses with souped up police packages that can go blistering speeds - but the local laws say they can't go above 95MPH even in a car chase for safety reasons. Luckily they usually just PIT those cars before they get too far away.

It's not even really about outrunning the cop - its about getting out of the 'car chase' situation smoothly.

You have several options to do so:

\-- Get far enough away/have enough leading of the cops to lose the car and be calmly walking away or better on a bus moving away by the time they arrive so they can't find you (note that this assumes they don't know who you are)

\-- Drive right out of their jurisdiction and be sure that whoever's jurisdiction you are driving into either doesn't care or doesn't know about it

\-- Exit the country (similar to #2) and don't return to the country you were speeding in

No matter what though whoever is chasing you is not just going to say 'oh well they got away, might as well not even file a report' \- you will never be able to 'undo' that chase without dealing with the law.

</comment><comment><USER3> Question isn't answered in the article unless you count "a lot faster".</comment>


The Freelancer's Manifesto - <AUTHOR> http://www.jamesshelley.net/2011/05/the-freelancers-manifesto/

<comment><USER2> Not a very inspiring manifesto. Somewhat confusing. As a freelancer writer, isn't it your job to tell other people's messages (or the messages they want you to tell)?

If you want to tell the stories you care about, and only those stories, become a publisher.</comment>


Little Bets - <AUTHOR> http://online.wsj.com/article/SB10001424052748704570704576274962717655144.html?mod=WSJ_Opinion_LEFTTopOpinion

<comment><USER2> Am I the only one who sees a direct connection between little bets and the lean startup movement? When you test your assumptions you are making a series of small bets. When you build a minimum viable product that is in effect making a small bet.

<comment><USER3> Yeah, that's it! I just read Little Bets today. Actually, I was talking to somebody about lean startups this afternoon and I found that "make little bets" is a better way of expressing the lean startup approach than "test your assumptions".

The book itself doesn't break new ground, so much as it synthesizes a lot of lean startup principles and gives some good anecdotes, some of which I hadn't read before (e.g. Gehry's architecture approach). It's a good read, I enjoyed it. Until Eric Ries' book comes out, it's actually the book I'd give people to teach them what a lean startup is.

</comment></comment><comment><USER4> We have been preaching little bets for many years. The key is to make many small bets and then bet heavily when you truly believe.</comment>