Organizing a Group Buy of Flour - <AUTHOR> https://www.jefftk.com/p/organizing-a-group-buy-of-flour <comment><USER3> Our grocery chain has been buying rice and flour in bulk from restaurant supply houses and repackaging them in 1lb bags. Pretty agile if you ask me.

<comment><USER4> I think big supermarkers are making things worse at the moment.

It was very hard to get basic supplies and food when all small shops were ordered to close, and only big supermarkets were kept open, and supplied by organised convoys.

This appears to be rational at first, but it only led to people all rushing to those few supermarkets the moment the convoy arrives, and them being emptied clean by first 50 something people.

It also led to wholesale bases being emptied by supermarkets, as they have the biggest buying power, and biggest truck fleets. Here, I heard that they went through more than 8 months supply of flour in just few weeks.

The situation got much better when small shops were let to open.

Both supermarkets, and wholesalers are of course very happy with that, but that left near nothing for small shops when they reopened.

<comment><USER5> In North America are non-supermarkets and non-warehouses even 5% of grocery retail? I think that restaurants being allowed to sell groceries would've been cool. But I don't see how mom and pop grocers move the needle at all here.

<comment><USER6> >I think that restaurants being allowed to sell groceries would've been cool.

At least 2 restaraunts in my town do this. Order online, drive around beck (sometimes with a line of cars, but never more than a 5 minute wait), and they drop your food/tp/etc in the trunk. Much better than hitting up Safeway or Costco, and not really much more expensive.

<comment><USER7> I think the pizza place at DNA lounge sells TP along with the pizza.

</comment></comment></comment></comment></comment><comment><USER8> Otherwise known as a Food Buying Club. basic idea is you get enough people together to create a wholesale account with a distributor. Get your order and split it up between the members. Hippies and other Frugal people have been doing this forever (in my world forever, I grew up going to them).

<comment><USER9> Niche hobby communities do this all the time.

The mechanical keyboard community wouldn't exist without group buys, they rely on them to hit minimum order quantities from producers of custom keycaps, PCBs, and other manufactured items. These are then shipped to proxy vendors around the world who do last-mile shipping to end users.

Homebrew clubs also put in wholesale orders for raw materials like yeast, grain, and hops. These are usually more localized given the large volumes involved, and involve a physical meetup where the goods are repackaged and distributed to the buyers.

I daresay there are more groups like this (home bakers maybe?) but they're largely invisible outside their own circles.

<comment><USER10> This is kind of the point behind drop.com, no?

<comment><USER11> Drop has been transitioning away from group buys for sometime now. Since their re-branding their strategy appears more reminiscent of private labeling.

Most products have Drop / Massdrop in the name now.

The most recent two actual (keyboard) group buys that I participated in have been really poorly handled. One is still delayed and has not shipped (order placed 561 days ago). The other shipped broken (to everyone in the drop) after being delayed for months. I had to manually ISP flash a bootloader.

<comment><USER9> > I had to manually ISP flash a bootloader.

I read about that problem with the Tokyo60 v3. Seems like a big problem with quality control, that should have been fixed by sending a new, working versions of the PCB to all customers.

I'm currently waiting on some Aqua Zilents which are delayed thanks to the current pandemic. I understand the delay, but they waited until the posted ship date (April 10th) to inform customers that it's going to be late. That rubbed me the wrong way for sure.

</comment></comment></comment></comment></comment><comment><USER12> Based in Paris, France - even prior to the lockdown, bakeries sold baking- related supplies if you knew how to ask (flour, yeast, pre-made dough at various stages, etc.).

But now they sell it like a main product; even today when I went to buy some bread at one of my local shops, they had sacks of flour set up in the storefront and showcases.

<comment><USER13> I had no idea! TY!

</comment></comment><comment><USER14> This isn't really a political point as much as an observation, but... the people in this country who have the worst compensation and benefits are the ones who are involved in the harvesting and preparation of our food. To this point, the supply chain hasn't been too badly affected because poor people need to work to survive and so they'll go to work sick. But now COVID has spread all over the place, and people who are in those fields and slaughterhouses and factories are starting to fall ill. Smithfield just shut down a massive pork processing plant. What happens to our food supply when those people finally say they've had enough? Lack of healthcare, lack of pay, lack of sick days... would YOU willing subject yourself and your family to the possibility that you will catch it and die when your co-worker comes to work with a fever?

In my opinion, we haven't even begun to feel the economic shock of this thing, because we've been able to ignore the foundations of our society for so long.

<comment><USER15> There is not a shortage of people who have very little money and will take risks.

<comment><USER16> One of the reasons why it is so unethical to rely so heavily on streams of undocumented immigrants

</comment></comment></comment><comment><USER17> I hope we strengthen and cross link our food supply chains on a local and regional basis like this more in the future.

Having most everyone in a city or neighborhood buying from a single chainlink or two isn't a very resilient system, nor does it make for very efficient markets.

Commodities like flour should be available sort of like data on ipfs; the problem is, of course, trust and risk of tampering. Hopefully it won't be much of an issue and more decentralized supply chains can emerge, making more opportunities for more people.

I'd love to be able to be a local cache node in the food supply chain (or web, perhaps), as I imagine others would be.

<comment><USER18> I think you just invented grocery stores

<comment><USER17> No. Everyone in my vicinity buys their non-restaurant food from 2-3 grocery stores. I am talking about having the community's food supply be provided by more suppliers, and each other, p2p style. Perhaps a data-driven "farmer's market" style setup.

Distributed, not just hub-and-spoke decentralized. We just watched the failure mode of that one.

<comment><USER19> No we didn't, we watched a supply chain shock which could've been prevented if we had some common-sense regulation to require supermarkets and grocery stores to enact purchasing limits if their demand curves start behaving anomalously.

Distributed systems in software are hard. Th idea it'll somehow be easier when you need to truck tonnes of physical goods around is wishful thinking - <USER2> same failure modes still apply.

<comment><USER20> Around where I live, supermarkets started imposing limits pretty quickly. It's in their self-interest not to piss off customers who come into buy something and leave empty-handed.

</comment></comment></comment></comment></comment><comment><USER21> Any (developing world) group buy experts here? Many years ago, I considered trying to organize fertilizer group buys in sub-Saharan Africa via SMS, where it seemed (to me, as a non-expert in this subject) that many smallholder farmers lacked access to affordable high-quality fertilizer and that group buying might help. I explored this enough to apply for a grant to develop it (and delivery logistics), but that didn't come through and I didn't pursue it further. Has something like this been tried? Is it needed? Seeing this article brought it all back.

<comment><USER22> In East Africa, there are at least two operations that I'm aware of that do this among other things - One Acre Fund ([https://oneacrefund.org/](https://oneacrefund.org/)), and Apollo Agriculture ([https://www.apolloagriculture.com/](https://www.apolloagriculture.com/)).

<comment><USER21> Thanks very much!

<comment><USER23> also [http://pricepally.com](http://pricepally.com)

</comment></comment></comment></comment><comment><USER24> > Webstaurant would ship a pallet of flour, 50 bags of 50lbs each, for $1,081 > or $0.43/lb.

> Unfortunately, between placing the order and them shipping it they ran out > of stock

Insanity! I'm heartened that people are still baking at home though. For comparison, retail King Arthur All-Purpose flour goes for about $3.69 for 5lbs, or $0.73/lb, so at $0.56/lb Sir Galahad flour is still a bargain. Whole wheat flour has bran and germ and the oil they contain make it harder to store than white flour, so I wouldn't buy a lot of it.

Flour is for more than just bread. Top of my head: tart shell, pizza dough, tortilla, thickening up sauces, can't make a roux or a bechamel without flour, fresh pasta, cookies, muffins, cakes.

<comment><USER25> I question how many people are actually using the flour they're hoarding, and how many are just putting it in the back of the pantry because, "When the end of the world comes, you'll need flour!"

It's very irritating for those of us who actually bake on a regular basis and _resisted_ the temptation to hoard for hoarding's sake.

<comment><USER26> I present to you this commenter, who just bought 200 lbs of flour.

[https://news.ycombinator.com/item?id=22885192](https://news.ycombinator.com/item?id=22885192)

Hoarders suck, especially super hoarders like this.

<comment><USER27> > I do go through a lot of it. My hobby is baking.

Please don't reflexively characterize people who do different things or have different needs as "super hoarders".

<comment><USER26> If you're willing to dismiss 200 lbs of flour as hobby levels, then do you even believe in hoarding at all?

We're talking enough flour to make 200 loaves. At best, they bought a 3 month supply of flour (and that is baking 2 loaves every day). At worst, this is more flour than they can possibly use, and a large amount of it will go bad (storing 200 lbs of flour inside is a bit of a challenge, so it may be stored in a garage or worse).

And of course, with every product in the grocery store, if we all go out and buy a 3 month or further supply of a basic good, there's not going to be any left. Which only encourages more hoarding.

<comment><USER27> I don't know about willing to dismiss but you're making assumptions about facts not in evidence. For all you know the poster is cooking for 6 adults.

Moreover, ... whats wrong with a three months supply of flour? For the last few years we've maintained that much flour at my house-- just because its a convenient level to purchase/manage for us, nothing to do with preparedness (which, incidentally, is virtuous), and certainly not any kind of hording.

<comment><USER28> I totally agree with you. The more people that maintain a 3m supply of non- perishables and rotate through them, the more robust society will be to problems like this one.

Households also vary a lot in size: ours is six adults and two kids, so we do go through a lot of food.

</comment></comment></comment></comment></comment></comment></comment><comment><USER29> Some of my local restaurants are doing this - effectively becoming concierge grocers who will break down bulk quantities for their customers. Call an order in and pick it up in ~24 hours. They have and can get almost anything the grocery stores are out of including TP (in jumbo commercial rolls), flour, eggs, meats, etc.

</comment><comment><USER30> There used to be a startup "Mercado" in the dot com days where consumers could form buyer's groups. It worked well for a while until the downturn.

<comment><USER31> I was just thinking why doesn't this exist!

<comment><USER32> Isn't this what Groupon started out as?

<comment><USER30> Groupon is retailer lead. These other services were consumer led, like "I want to buy this -- will 50 people join me so we can collectively pay wholesale?"

</comment></comment></comment></comment><comment><USER33> I guess this depends on where you live. I went to the store three days ago (April 12) and the baking aisle was fully stocked, including all the flour.

</comment><comment><USER34> Some restaurants, with shrinking demand, are now selling their flour to consumers

<comment><USER35> We bought a 25lb bag from a baking school that had been forced to close.

</comment></comment><comment><USER7> If you are in Oakland, Firebrand -- a bakery on Broadway in uptown -- has flour and yeast some mornings on their square site. You order on square, and come by to pick up. [https://firebrand-artisan- breads.square.site](https://firebrand-artisan-breads.square.site)

</comment><comment><USER36> I've thought about buying one of those big sacks of flour—I bake bread and other stuff routinely, so I know I'd use it up eventually. I mean, I just got a half-pound of vanilla beans. But storage becomes an issue. I'm already struggling a bit to find places for the extra stocking up.

<comment><USER20> Even something like flour doesn't really last forever--especially if you don't have ideal storage conditions. Maybe you bake enough though.

<comment><USER37> eh, just look at the weevils as extra protein.

</comment></comment></comment><comment><USER38> Haven't had too many problems by hunting around, using local retailers, and asking at bakeries.

Might help? [https://helpatmyhome.com/where-to-buy-flour- online/](https://helpatmyhome.com/where-to-buy-flour-online/)

<comment><USER39> Thank you for this, I put in an order with lindley like a week and a half ago and they're swamped. Hoping it pans out but will definitely hedge with one of these others if things go south.

<comment><USER40> We put in an order with them a couple weeks ago (Monday 3/30), we didn't hear anything at all for about 2 solid weeks, and then got a shipping notification on Friday 4/10\. It was shipped overnight and arrived Saturday 4/11\. Hang in there!

</comment></comment></comment><comment><USER41> Love this idea!

I'm sending out feelers locally to see if anyone is interested (I'm in Louisiana), and so far I've got a little interest. I was wondering if you'd come into any problems other than the animal thing with your experience, or if there's anything else I might need to know. I was wondering how you found people who wanted to participate? And how you organized it. If it was all friends, or if it was people you didn't really know or found online. I don't have a ton of friends who are really into this so I'm kind of casting a wider net.

<comment><USER28> _> come into any problems other than the animal thing_

I could imagine someone having issues with theft depending on the area, but that's not something I'm worried about here.

If you did end up getting a pallet you'd want to make sure that either they could put the pallet where you wanted it or that you had the equipment to move the pallet.

 _> I was wondering how you found people who wanted to participate?_

I wrote to a few groups:

* Facebook: primarily friends in the contra dance community

* Work email list

* Email to area family

* Email to area college friends

It ended up being a mix of all these groups.

If I wasn't doing it with friends then pickup is harder. I trusted my friends to pay me and to pick up from my porch unattended -- that would be harder with a group put together from, say, reddit

<comment><USER41> Thanks for the reply! I've poked around on Facebook and Nextdoor; I'm considering emailing work to see who'd be into it as well. Good point about the ~danger of randoms~.

</comment></comment></comment><comment><USER23> This exists already in the white hot Lagos startup scene. It is called Pricepally: [https://pricepally.com](https://pricepally.com)

</comment><comment><USER42> This seems a bit expensive. I recently bought a 25lb bag of flour from Sams club and it was 6.50, or about 26 cents a pound. They also had plenty in stock. Costco also has it for a similar price. Last time I bought yeast there it's also cheap - about 5 or 6 bucks for something like 2lbs(which is a ridiculous amount of baking yeast). Baking a lot can make this practically worth the cost of the membership.

<comment><USER20> You're comparing probably the most expensive mass market flour (King Arthur) with probably about the cheapest (Walmart's). A 2x-3x price differential sounds about right.

<comment><USER28> (author)

The original flour we were thinking of buying was [https://www.webstaurantstore.com/all-purpose- flour-50-lb/104...](https://www.webstaurantstore.com/all-purpose- flour-50-lb/104HR.html) $12.25/bag (50lb), mildly cheaper than the Sam's Club price above. But then adding in shipping on a truck from PA added another $9.40/bag.

In places where people can easily buy individual 25lb bags for $6.50, though, you don't need to organize a group buy!

</comment></comment></comment><comment><USER43> Okay, but with all this flour, where is the yeast? I've actually been lucky to find plenty of flour at the local Mexican or Asian markets. Yet, no where I look have I been able to find even a tiny package of yeast. It's out all over the place.

</comment><comment><USER44> My local stores are totally sold out of flour. I had to travel to a different state to pick up my daughter from college. While traveling, I stopped at a Costco for gas. On a whim I went into the store and they actually had some flour available. I purchased about 200 lbs, even though I had to pay sales tax, since I have no idea when flour will again be available in my area.

When I got home my wife asked me if they had toilet paper too. Doh!

<comment><USER45> Flour goes bad in <8 months. I hope your using a pound a day.

<comment><USER44> I do go through a lot of it. My hobby is baking. The day after I got home I made 2 2-lb loaves with my mother starter.

</comment></comment></comment><comment><USER4> It is surprising to me that the West has hit food security issues earlier than Asia.

The food supply chain in US is much better than in Europe, and Europe is better than most of Asia.

A week ago, I was very scared myself for there being a 21st century famine in Asia, but I never could've imagined how bad panic buying can hit countries even with robust food supply chains.

<comment><USER46> These aren't food security issues, these are supply chain issues.

The difference is enormous, and it's far too soon to relax about famine. We'll know if that happened by about 2023.

<comment><USER4> A time when people can't eat food _IS_ a food security issue. Do not invent other names for it.

The Irish famine has happened when UK was drowning in corn, and had the best harvest in many years.

The Bengal famine has happened in times when most regions of India had otherwise at least bearable harvests.

The Ukrainian famine has happened in times when the soviet union had bumper harvests, and was exporting megatons of grains, and other foods.

The Great Chinese Famine has happened when Mao too has tried the same trick as soviets did, except it failed on him even worse, like ten times as much.

Bangladesh 1973 famine has happened when Bangladesh was awash with humanitarian aid.

The chronic undernutrition of socially marginalised groups in 1st world countries keeps happening with governments throwing billions of cash on food stamp programs.

<comment><USER47> > A time when people can't eat food IS a food security issue

If no food is available, sure. If other food is available, no way. Are people starving in the US yet due to food unavailability?

<comment><USER4> Have you not seen news of people in the US not able to buy any normal food for weeks, and having to subsist on things like potato chips, and instant noodles?

And, yeah. Having a double digit of your (American) population being socially marginalised, relying on unreliable food stamp program, and having no alternative to junk food should've also been called a genuine food crisis long ago.

Famines do happen even when there is food on the shelves, like in Yemen, early nineties China, or late ussr.

<comment><USER46> I lived in an American food desert for about six months. I hated it! All I could get was cheap burgers and hot dogs and chicken...

The main health problem facing the poorest Americans is obesity, with opioid addiction a close second. Famine is not an issue here and I hope it stays that way.

I'm genuinely unsure what point you're trying to make, but there's an enormous gap between the supply chain being unable to fill the shelves as fast as they're emptied, and the country not having food to put back on those shelves. That's the point I'm trying to make.

<comment><USER4> Well, it's certainly nothing like a catastrophic famine, yet it bares the existing problem with food security in US, and it came really close to the level of something genuinely concerning.

Watch for reports of wholesalers going through many month worth of food staples. In Kazakhstan, where I am stuck now, the government came out and asked "where will we get 8 month worth of grain now?" in response to panic buying. Full shelves now came at the cost of many months worth of supplies. Biggest food silos went through 1/3 of annual throughput volume in just 2 weeks here.

> I lived in an American food desert for about six months. I hated it! All I > could get was cheap burgers and hot dogs and chicken...

> The main health problem facing the poorest Americans is obesity, with opioid > addiction a close second. Famine is not an issue here and I hope it stays > that way.

I spent 6 years of my life in between Vancouver, Canada, and Seattle in US.

It was a big surprise to be that finding what otherwise be "normal" food was relatively hard, and you even had to pay extra for it. I was later told that Vancouver is considered very good on that side, and Seattle is actually better than most other US cities.

</comment></comment></comment></comment></comment></comment></comment><comment><USER48> Unpopular opinion: maybe so many people don't need to suddenly become bakers who weren't baking before, and then we wouldn't have empty shelves all of the sudden.

<comment><USER49> It's a shame that people are learning new things and experimenting with new hobbies to keep themselves busy during quarantine. All change is bad, but _especially_ personal growth.

But really though, a family buying 5 pounds of flour isn't the problem, it's the hoarders loading up shopping carts full of toilet paper and flour that give us empty shelves. I think we'd have enough for everyone if we didn't have greedy hoarders.

<comment><USER50> You don't really need hoarders to have a problem. If only twice as many households are cooking now than before, instead of stores having say 10% slack, they run out half way through the week. If you have four times as many people cooking, you run out your slack in two days.

So the store increases their orders. But their _suppliers_ only have X% slack. So _they_ have to ramp up too. The whole supply/demand balance takes time to stabilize.

The same number of people are eating the same calories as before, but the supply chains for those calories have shifted rapidly. Same for toilet paper: No one's pooping on company time anymore!

Yes there are some hoarders, but we'd get temporary problems even with 0% hoarders.

<comment><USER51> Yep. It was basically a Thanksgiving-level event without the usual months of prep work preceding it.

<comment><USER52> The situation has given me a new perspective on the ultimate purpose of all those sales around Thanksgiving. The stores _know_ they're going to be selling a large amount of items _some time_ before Thanksgiving. But they can't just order large quantities of items, only to store them until people decide to buy them. Rather, the sales let the supply chain control when people will be buying the bulk quantities, so the goods can arrive in stores as close to being sold as possible.

</comment></comment></comment></comment></comment><comment><USER53> I recently had no problem buying organic flour from the organic aisle, despite the regular aisle being sold out. People are stupid when they panic.

<comment><USER54> This story reaffirms my sense that the recent explanation du jour for scarcity, residential vs commercial supply chains, isn't quite right. This person set out to buy an order of 250 lb of flour and it still vanished before their eyes.

My experience with commercial toilet paper has been the same, watching it dry up just like retail. People seem to be stockpiling cheap familiar essentials, plain and simple, wherever they can get it.

<comment><USER20> Who knows what's going on in the commercial supply chain though. The usual buyers are canceling orders so the upstream distributors--maybe even manufacturers--are also canceling without necessarily anticipating being able to sell direct to consumers.

That said...

>People seem to be stockpiling cheap familiar essentials, plain and simple, wherever they can get it.

I'm sure there's some truth to this. I'm not stocking up on huge quantities of things I don't need. But, for example, a couple weeks ago there happened to be one bag of my favored flour in the store so I grabbed it even though I wasn't necessarily at the point where I would normally buy it. I also have an extra dozen eggs at home. Etc.

Multiply that behavior by most people and that's a _lot_ of extra buying from stores and inventory scattered around everyone's houses even though most people aren't doing the two-year supply of beans level of prepping.</comment></comment></comment>


Ask HN: Phone Support Number for Startups - <AUTHOR>

How have you guys gone about setting up a support line for your startups? I have a Google Voice account that I never got round to using, so I was considering using that. Do consumers feel more comfortable calling an 800 number? And what other services do you use to manage voicemails, etc? <comment><USER2> Use Skype-In with Skype-Forwarding to your normal phone. Skype will forward to 5 different phones at the same time, and whoever picks up first gets the call. So it's convenient when you have other people who could answer the call.

<comment><USER3> I'm certain that Google Voice has this functionality.

<comment><USER4> As far as I'm aware, you can only use a phone with a single Google Voice account. So, if you already have a personal account that forwards to your phone you can't forward a company account and vice versa.

</comment></comment></comment><comment><USER5> I've been playing around with Twilio for the past two days and I could already recommend it. It took me about about two hours to get it working well enough to make my own phone ring using their API. And of that the second hour was because I was confused, my number is international and it needed special permissions to call that. Now after two days I know how to make recordings, set up conference calls etc., so easy and powerful. I have a toll-free number in the US now ($5/month, $0.05/minute) just because I wanted to play with one.

</comment><comment><USER6> Chek out <http://grasshopper.com/> if you are in the stats og <http://www.firmafon.dk> if you are in Denmark...

<comment><USER7> I second the use of Grasshopper. Very professional and affordable.

</comment></comment><comment><USER8> I don't offer phone support for Tarsnap; but I do offer email, twitter, and IRC support. It all depends on what sort of users you have -- I'm quite fortunate in that Tarsnap has very technically competent users.

<comment><AUTHOR> We're targeting churches, and those who work there aren't that technically savvy, so I think offering phone support would help quite a bit.

<comment><USER8> _We're targeting churches, and those who work there aren't that technically savvy_

I have no idea what your startup is, but are you sure that you're going to be dealing with people who are _working_ at churches, rather than congregation members who volunteer? Most community organizations -- churches, kids sports teams, amateur orchestras, etc -- will include someone who is technically savvy, even if the priest / coach / conductor / etc. doesn't know how to use a computer.

</comment></comment></comment><comment><USER9> I have one company that uses Google Voice and one that uses Grasshopper. Grasshopper allows you to easily set up a local number and/or an 800 number (you can also import your own number, for instance you GV number). It allows you to setup "lines" (press 1 for support, 2 for sales, etc), which can forward to other numbers, record messages, have on-hold music and a hunt group, etc.

So, to really answer your qustion, I think it depends on what your startup is. If it's a B2C company that really only needs its own number for support issues and whatnot, you're probably good with just a GV account that forwards to your cell phone. If it is a B2B company though that needs to sound established and professional, I'd consider setting up an 800 number with a multiple-line answering service like Grasshopper, even if every line only forwards to your cell phone for now. This also makes it very easy to scale once you start hiring people.

</comment><comment><USER10> Our phonebooth.net offers hosted voicemail transcription by email and you can read, listen, and manage voicemail from the web (as well as the phone, of course).

There is simultaneous and sequential group ringing.

Conference bridging with up to 8 participants.

Each user/phone number can also configure external phone numbers to forward to.

Finally, you can create an unlimited number of "automated attendants" for your "press 2 to sound like a big business" scenarios. Along with nested menus to drill down to the right person/voicemail, if your needs are more complex.

If hosted isn't for you and you are willing to get your hands dirty, try the open source FreePBX.org for on premise build out of the functionality you've described.

Disclosure: I am on the phonebooth.net product team and are the primary contributors to FreePBX.

</comment><comment><USER11> If you want to use an 800 number, but with GV capabilities, then use Phone.com where you can fine a number that is relevant to your business - www.Phone.com.

</comment><comment><USER12> I'm sure that most people would be happy to call any number(not mobile), provided they really need the support.

</comment><comment><USER13> I built my own PBX using FreeSWITCH, and used the ITSP flowroute.com.</comment>


Ask HN: Suggestions from the Experienced - <AUTHOR> Hello fellow hackers of the cyberspace!
I don't have a problem, rather seeking for some stories from the experienced programmers.
I started hacking five years ago. I look up to real programmers such as Linus Torvalds and Eric S. Raymond.
Currently my job is at a small print company. I'm a graphic designer. I do desings, I print, etc...
I wrote a script for a job that we are doing by hand and it takes between 5 and 15 minutes. Now, in a click of a mouse, the piece is print ready. It took 25 hours to write this.
I value this script for 800$.
I'm constantly improving it. I can also offer technical support.
As I see things now, I'll surely write more scripts in the future. I see things that can be automated. As a matter of fact, I wrote a second one already.
Any guidelines on the internet? What are your opinions? Should I sell them the script? What shall I do?
Does anyone have a similar story?
I'm looking forward to your answers.
Thanks, -use-the-force-luke <comment><USER2> If you're an employee and you wrote the script while on the job, your employer already owns it, so you can't sell it to them. (If your script is currently running on your employer's computer, that also supports the case for it being their property.)

A better strategy might be to tell them about how you increased the productivity for this task by writing this script, and use that as evidence that you should receive a raise.

<comment><USER3> I'd bet they already technically own the second script in progress. OP should read up on what to take into consideration when working on side projects, especially when they pertain to ones day job.

</comment></comment><comment> d--b Yes, they own the script.

Developers do this all the time by the way, it's part of the job to automate as much as possible. No developer will think about selling a script for $800 to their current employer, that doesn't make sense.

What you should do instead, is making sure you get credit for your script and not one of your colleague or your boss. And try and get a raise at some point.

<comment><USER4> Also, put that on your resumé! It will be worth more that $800 in future salary and/or skills.

</comment></comment><comment><AUTHOR> Thank you all for your replies.

We have great advices here. It's pretty good to see how other people think, and what do they suggest, especially if they are more experienced.

I work from my home, in my free time, on my personal computer.

I've decided that I'll present them the first script and see how it goes.

Any more replies are appreciated.</comment>


Windows 10 now uses machine learning to stop updates when PC is in use - <AUTHOR> https://www.theverge.com/2018/7/25/17614842/microsoft-windows-10-updates-reboot-pc-machine-learning-feature <comment><USER2> Sounds like using a TI-89 calculator to solve "what is 2+2?"</comment>


Google Contributes Two Projects To Eclipse Foundation Valued At $5 Million - <AUTHOR> http://techcrunch.com/2010/12/15/google-contributes-two-projects-to-eclipse-foundation-valued-at-5-million/

<comment><USER2> It is not clear to me whether Google is doing "ethical talent acquisitions" by releasing unneeded products, or whether they have just have no need to keep these projects closed.</comment>


Show HN: An embeddable portfolio for your (side) projects - <AUTHOR> https://makerwidget.com/ <comment><AUTHOR> Heya!

I'm Armin, co-creator of MakerWidget! It's a little widget you can put on your project pages to show who you are, where to find you and what you did before.

My partner Melanie and I wanted to make ourselves more visible on our side project pages, so we tried to elaborate on Pieter Levels idea of a maker badge!

You can easily set up your widget on makerwidget.com for free and grab your embed code! It supports multiple makers, custom link lists and a project gallery. Being a team of two makers ourselves, we focused a lot on flexibility!

I built the whole thing with Laravel and Vue.js and learned so much on the way. Mostly about the fact that an iFrame can be transparent !? - In the next steps, im going to try to optimise the Request-count - if someone here can give me tips on what else I can (and should) do tech-wise please tell me!

I ship-streamed the development of this widget on Twitch, and will also be live today. You can watch me on shipstreams.com! (And yes, I'm low-key trying to make "ship-streaming" a thing!) :)

Cheers, Armin

Widgets are already embedded here:

* [https://threader.app](https://threader.app)

* [https://ericlima.com](https://ericlima.com)

* [https://builtbyher.io](https://builtbyher.io)

* [https://akshaykadam.me](https://akshaykadam.me)

* [https://www.growthjobslist.com](https://www.growthjobslist.com)

* [https://www.saasflow.co/](https://www.saasflow.co/)

* [https://madewithvuejs.com](https://madewithvuejs.com)

* [https://joblist.app](https://joblist.app)

Also, we have a Gatsby Plugin now:

* [https://github.com/deadcoder0904/gatsby-plugin-makerwidget](https://github.com/deadcoder0904/gatsby-plugin-makerwidget)

</comment><comment><USER2> I think things like this are going to become more and more popular, ways to follow people who make your favorite software and access their backlog and previous projects. Things that they've made before or are still working on. Love the idea Armin.

Full Disclosure: I stream on Armin's site shipstreams, I am biased.

</comment><comment><USER3> I love the widget!

What is your tech stack?

<comment><AUTHOR> Thank you!!

Started with Laravel Spark .. so Laravel + Vue.js :)</comment></comment>


How I reverse-engineered Google Docs to play back keystrokes (2014) - <AUTHOR> http://features.jsomers.net/how-i-reverse-engineered-google-docs/

<comment><USER2> (2014) should be added to the title.

There was some previous discussion about it here: [https://news.ycombinator.com/item?id=8562483](https://news.ycombinator.com/item?id=8562483)

</comment><comment><USER3> That would make for a hell of an anti-plagiarism tool. If you were a teacher and took 30 essays written in gDocs, threw them into the change timeline that he built, the copy/pasted ones would hugely stick out. It would even catch the folks that put a paid/plagiarized essay up on one screen and type it out again given all the natural backspacing and editing.

<comment><USER4> It falls apart if someone makes the document in any other tool and then pastes it on gDocs.

Unless you make it a requirement to do the entire thing on that platform...

<comment><USER3> Yeah, you'd have to, but gMail/gDocs is pretty prevalent. I know a bunch of schools already use it for their email/office suite so it wouldn't be too hard to make that requirement. I really like it because it's grabbing metadata out of something people already use rather than having them use some horrible web app from the 90's that was contracted out by a now defunct company.

<comment><USER5> I am against making anything like this a "requirement." It defeats openness. And all for a stupid anti-cheating system. It's better just to go to turnitin.com

</comment></comment></comment></comment><comment><USER6> This is simply fantastic. I always thought operational transformation was pretty difficult to implement robustly, but looking at Google's implementation lets you build interesting experiments without getting all those details right -- like building the world's best writing time machine. It reminds me of Cory Doctorow's approximation built on git: [http://craphound.com/news/2009/02/13/flashbake-free- version-...](http://craphound.com/news/2009/02/13/flashbake-free-version- control-for-writers-using-git/)

I think there are great possibilities for building on this idea...

</comment><comment><USER7> Kudos to the OP and Author - One of the best posts this year. The writing, samples, typography, everything about this was damned good - all that effort! Now I can make the drive to work with something to think about :)

</comment><comment><USER8> Google Docs is using what's called EventSourcing, in case you aren't aware of that. It's one way to make collaborative editing possible (probably the easiest?).

[http://martinfowler.com/eaaDev/EventSourcing.html](http://martinfowler.com/eaaDev/EventSourcing.html)

</comment><comment><USER9> Are there any machine learning applications on these play-back time-series ?

</comment><comment><USER10> I read this thinking, "This reminds me of Etherpad," only to reach the part of the story that describes Etherpad and how the author incorporated and improved on its ideas. Great piece.</comment>


What kind of jobs do software engineers who earn $500k per year do? - <AUTHOR> http://www.quora.com/What-kind-of-jobs-do-software-engineers-who-earn-500k-per-year-do

<comment><USER2> This was posted many times already:

[https://hn.algolia.io/#!/story/forever/prefix/0/What%20kind%...](https://hn.algolia.io/#!/story/forever/prefix/0/What%20kind%20of%20jobs%20do%20software%20engineers%20who%20earn%20%24500k%20per%20year%20do%3F)</comment>


Open source Slack-alternative adopts markdown - <AUTHOR> http://www.mattermost.org/open-source-slack-alternative-adopts-markdown/ <comment><USER2> no code block support ?

<comment><USER3> As mentioned in the article:

> There's still work to be done to complete the full GitLab Flavored Markdown > specification. Some of it is formatting, like adding syntax highlighting > code from various programming languages, and some elements like GitLab > Special References require deeper API integration between GitLab and > Mattermost, and that's planned as well.

Looks like it will be added in the near future.</comment></comment>


Change your business or go out of business - <AUTHOR> http://ryancarson.com/business/change-your-business-or-go-out-of-business <comment><USER2> Unless you are a consultancy at heart, doing consulting work is less about evolving a new business model and more about temporary survival.

</comment><comment><USER3> "We're also changing our sponsorship model for our events. Instead of just creating value for sponsors at the physical events, we're starting to work with them throughout the year to help them reach new customers and generate excitement. "

Translation: spamming, of the white collar kind.</comment>


If Westworld is so advanced, how come they're still using React.createClass()? - <AUTHOR> https://twitter.com/yaypie/status/805631757693304832 <comment><USER2> Well at least they don't try to pass off HTML as Code

<comment><USER3> React seems pretty solid but that bothers me a lot.</comment></comment>


The Ruby+OMR JIT - <AUTHOR> https://developer.ibm.com/open/2016/11/18/introducing-ruby-jit/ <comment><USER2> I expected CPython to have something like this, especially in 3.x but nothing.

If Ruby can get faster than Python sooner, I'd switch focus to Ruby (and somewhat make Go less of a priority for us).

<comment><USER3> Don't count on Ruby getting 10x faster anytime soon. The meta-object model and method-missing reliance of many of the libraries make performance optimizations of JITs a very limited enterprise.

<comment><USER4> And when you take those two things away, you pretty much just have Java. Which, while it can be optimized, it's also Java.

<comment><USER5> Java with Ruby's syntax and undeclared typing would make Java programs so shorter that it would be worth it. But there would be nothing left of Java, except the object orientation. It would just be a simpler more static Ruby.

<comment><USER6> You might want to look into Kotlin.

<comment><USER5> No because it's statically typed, too much work programming like that and it's not worth it for the kind of software I develop (backend of web/mobile apps), but thanks. Suggestions are always appreciated.

I found a defunct Ruby like language called Reia a couple of days ago [https://github.com/tarcieri/reia/](https://github.com/tarcieri/reia/) and [http://reia-lang.org/](http://reia-lang.org/)

It's object oriented and runs on the top of the Erlang VM. It maps classes on gen servers, which is pretty natural and it spares the developer all the boilerplate of creating a gen server module. Unfortunately the language designer killed it because "it's pretty bad to have two competing niche languages with nearly identical features." The other language was Elixir. However the two languages are very different. Elixir is 100% functional, Reia could have been the language to transition millions of OO developers to a functional and concurrent world. I could have used it instead of Ruby.

<comment><USER7> This is an odd stance. Backends are where static typing shine, and where those who like static typing sing its praises. Maybe you just don't like static typing?

I really don't find static typing to be more "work". You still have to think about types in dynamically typed languages, you just get to skip specifying them.

<comment><USER5> Skipping that saves a lot of keypresses and time. I always found very little help from static typing. I know what I'm doing if I type hash = {} in Ruby and there is no need to declare it as HashTable (what else could it possibly be?). About the types of the keys and values, they don't matter much in my experience. Maybe it's Ruby or it's Rails, but they tend to fall right into place without surprises.

<comment><USER8> In case you're not aware, many static languages have implicit typing nowadays. I still write Ruby most often, but for example in Go you could just write `something := "string"` and with that := operator it'll manage the type assignment for you. Lots of other static languages offer that now also. I'm not well versed on modern Java, but the type system in Go pretty much gets out of the way for the things I've done with it.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Anyone have any performance comparisons against other Ruby implementations? I assume performance is the main reason someone would adopt this right?

<comment><USER10> This is an improvement to standard MRI Ruby, also called CRuby. This is an experimental JIT compiler which probably won't get adopted into mainline Ruby, but will definitely cross-pollinate with it. A JIT compiler has been a goal in MRI development for a long time. Nobody is likely to adopt this for anything, it would take more work to get this working with the current installed base of Ruby code than it would be to just rip ideas from it and put them into Ruby 3. It's just cool as a proof of concept.

Other Ruby implementations suffer from not being compatible with the MRI ecosystem, you have to port them over. In theory because they're the same language, gems would be easily portable, but the sheer amount of combinatorial work involved means they slowly accrete into separate ecosystems. It's relatively easy to port a gem over and maintain it, but if you don't keep doing it, they'll become incompatible.

MRI has the largest install base, and the biggest gem library, and the largest number of eyes on it. Sure, JRuby and Rubinius are faster, but Ruby was never a language chosen for speed, so most devs reach for MRI first and then only branch out when requirements force them out.

For me, the differences between MRI and other implementations effectively make them different languages, I'd jump to Elixir before giving JRuby a shot. I have a sense that other Rubies, except maybe Opal, will always be niche.

<comment><USER11> As somebody not into the whole ruby-ecosystems: What's an example that breaks compatibility between ruby and other implementations? And what's so wrong with JRuby that you won't even consider it?

<comment><USER12> Re: jruby

I have considered it deeply. Many of our enterprise systems are Java-based, so JRuby's ability to call Java methods directly without implanting services would be a huge pragmatic boon. But every time I consider that I have to balance it against being able to use a constellation of gems in Rails. For example, nokogiri (libxml) is used in a ton of stuff. Sure there are Java equivalents, but that isn't the issue. Rather I would have to reimplement or find replacements for everything we use that depends on that without introducing side-effects. In my experience that's really hard unless it's a toy application without many dependencies. (Read: opposite of most enterprise Ruby apps)

Also, as a gem author I've tried to support jruby along with MRI, but it requires jumping through a lot more hoops. Of course any cross-platform code requires more work to support, but it's a pressure on small devs. If no one needs it, no one helps support it, so then it becomes another gem that is effectively MRI-only. Kind of a viscous cycle.

<comment><USER13> > nokogiri (libxml) is used in a ton of stuff. Sure there are Java > equivalents,

Nokogiri natively supports JRuby, no equivalent searching required.

CExts are basically the only place where this issue really pops up and all the major CExt gems (Like nokogiri) support JRuby.

<comment><USER9> +1 nokogiri works like a champ on JRuby

</comment></comment></comment></comment></comment></comment><comment><USER14> Author here: Feel free to AMA!

<comment><USER15> Slightly off topic since the post is specific to Ruby, but are you able to compare OMR to Truffle and Graal?

<comment><USER14> Not as well as I should be able to, for sure.

In my mind, I look at Truffle and Graal as a potential way forward to build _new_ high performance JVM languages.

OMR I see as a way to build language runtimes in C/C++, and have a production pedigree.

<comment><USER16> Related, are you aware of the JRuby+Truffle project [1]? Not a _new_ high performance JVM language, but a high-performance implementation of Ruby using Truffle and Graal. On the surface it sounds extremely similar to Ruby+OMR (applying a high-performance, production-pedigree compiler/interpreter to an experimental Ruby implementation), so I'd be interested in hearing about any direct comparisons or knowledge-sharing between the two projects that might be possible.

[1] [https://github.com/jruby/jruby/wiki/Truffle](https://github.com/jruby/jruby/wiki/Truffle)

<comment><USER14> I really enjoy meeting up with the JRuby+Truffle people whenever I can at conferences. Though our approaches are really different, there's definitely a cross-pollination of ideas: I've taken huge amounts of inspiration about what could be possible from Chris Seaton's PhD work which was on JRuby+Truffle.

</comment></comment></comment></comment></comment><comment><USER17> Tried looking in github, project-specific pages, wikipedia and still have no clue:

What does OMR stand for?

<something><something>runtime?

<comment><USER12> Doesn't seem to stand for anything (at least it's not defined in the project charter).

If I had to guess at it:

Open Meta-Runtime

But I could see how that might be misinterpreted compared to their goals. Not all cap names are acronyms?

[https://projects.eclipse.org/proposals/omr](https://projects.eclipse.org/proposals/omr)

<comment><USER18> It stands for Open Managed Runtime.

<comment><USER9> Is the _Open_ really open, as in acceptable license that won't hold it back from gaining adoption in OSS and Enterprise community - or - are there licensing, patents or other proprietary strings attached?

<comment><USER19> OMR is under Apache License. [https://github.com/eclipse/omr](https://github.com/eclipse/omr)

</comment></comment></comment></comment></comment><comment><USER20> "Right now, it only works for Ruby 2.1.5; however, I'm slowly plugging away at moving forward towards Ruby 2.4."

The irony.

But in all seriousness, this is awesome.

<comment><USER14> Whoops! That's actually an editing mistake: The Ruby+OMR preview is actually for Ruby 2.2 right now.

You can follow the work in progress on trunk (what will become Ruby 2.4 in December) here: [https://github.com/rubyomr- preview/ruby/tree/ruby_2_4_omr_pr...](https://github.com/rubyomr- preview/ruby/tree/ruby_2_4_omr_preliminary)</comment></comment>


Ask HN: Where should I start if I want to understand consciousness? - pi-squared The point: what is the state of the "science", where is the edge of research done so far? Ideally, I would like to understand it through simulating a brain on a machine and I have heard some attempts are done but I don't know how much of that is a media hype.
Assume I am ready to dedicate my life to this - I think it's the most interesting question in the world!
History & bg: 24 year old, with CS degree, long time lurker here. I've been on a find-myself journey in the past 2-3 years, going through interning at Google MTV for a summer on an internal infra project for them (a long time dream, bit of a fan boy). Then I tried to start my own company - that didn't go well (webapp for online reviews). Now I'm into consulting since my runway ended and found good opportunity to get myself stable for a while. Starting a company is still interesting for me but the idea can't be that shitty as last time! :) In high school I've been going and winning physics and astronomy Olympiads and competitions and loved understanding how the Universe works from first principles. Always had an interest in how the human body and especially the brain works but done nothing serious besides layman interest in the subject so far. I don't know how relevant am I...
Any opinions?
Thanks! <comment><USER2> If by consciousness you mean the property of having subjective experiences I don't think that is something that you will ever "understand" through a computer simulation.

Personally I do not believe that a computer simulation can ever be "conscious" in this sense. There are arguments for and against this thesis that I'm not going to get into here but even if you believe that a computer simulation could be conscious you will never find objective evidence of that fact because consciousness isn't defined in objective terms.

By no means do I mean to imply that studying the neural basis for conscious experience isn't a worthwhile thing to do. In fact I agree with you that it is one of, if not the single most interesting thing science can study. However if your goal is to "understand" what consciousness is based on such an undertaking then I don't think you or anyone else can ever achieve that goal.

</comment><comment><USER3> See reproducibility project (Nosek et al)... don't waste time reading psych research. Aside from that, 'consciousness' is a term they won't ever use - <AUTHOR> hard to define...</comment>


A bug bounty bug explained, step by step - <AUTHOR> https://www.youtube.com/watch?v=f3SXDBMGGb8&feature=youtu.be <comment><USER2> I enjoyed this. What got me is that it probably wasn't code written by the collaboration site to process what he put into the PDFs. It was probably some PDF Library that they had included as a dependency. Speculating, of course</comment>


Leap Motion Controller is a great toy, but not yet the future of interaction - <AUTHOR> http://www.theverge.com/2013/7/22/4544706/leap-motion-controller-toy-not-future-of-interaction <comment><USER2> I've had one for about six months now, and while I was excited at first the novelty wore off.

While it's fun for assorted abstract interaction (manipulating graphics or playing music) it falls short as a replacement for using the mouse or keyboard for actual work.

One big hindrance for me is that I tend to work off a laptop, and finding a suitable place to rest the Leap is not always easy.

I tried mounting it to a stick and attaching it to the back of my laptop screen. Seems my head gave it trouble. :)

I have to retry some experiments with the current firmware, and when my production model arrives (possibly today) see if it behaves any better. I've managed to drop my dev unit a few times and there are some scratches on the screen that might be reducing effectiveness.

</comment><comment><USER3> Mine theoretically ships today so I'm looking forward to seeing this first- hand. At $80 it was worth (a) supporting the innovation, and (b) having a new play toy.</comment>


BlackBerry Storm doesn't quite trump iPhone - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/c/a/2008/11/20/BU4P147T07.DTL <comment><USER2> "But is it better than the iPhone? Short answer: It's close, but no."

Every single smartphone review I've read could be boiled down to that one sentence. Why read them at all? Just demo each phone and pick the one you like.

<comment><USER3> Exactly - I was actually very close to just ordering an iphone but then demoed both the iphone and BB Bold and went ahead and purchased the Bold - having had a BB 8700c for a couple of years, I was more comfortable with the BB OS and from a usability standpoint I preferred the tactile feedback of the keyboard. (The screen is very pretty too ;)

</comment></comment><comment><USER4> "The iPhone still boasts more elegance in its interface, which operates beautifully, quickly and intuitively, with very little confusion."

So it's better in every way... except in the most vague and nebulous one. The author may like the iPhone's interface but calling it "quick"? That's not a word I'd ever use to describe the iPhone.

<comment><USER5> You have to agree that the UI interface of the iphone is elegant and really intuitive. It seems that, that's the hardest problem to solve for iphone competitor. They try to hard to pack as many features as possible put forget about the user experience.

<comment><USER6> And that's the biggest weakness with iPhone competitors. The problem is that "user experience" isn't a feature to be touted: they win no list-of-features contests with it. But it's what makes the iPhone so much better than all its competitors, no matter how stacked all the other features are.

</comment></comment></comment><comment><USER7> Another review from Time magazine: [http://www.time.com/time/business/article/0,8599,1860717,00....](http://www.time.com/time/business/article/0,8599,1860717,00.html)

The Time reviewer didn't like the click screen at all.</comment>


Mailto: ?attach=~/ parameter allows including arbitrary files on disk - <AUTHOR> https://twitter.com/jensvoid/status/1295357952480751616 <comment><USER2> Full Twitter thread text by @jensvoid here, since the thread appears to be broken for some people:

 _Have you ever heard of the mailto:?attach=~ /… parameter? It allows to include arbitrary files on disk. So, why break PGP if you can politely ask the victim's mail client to include the private key? (1/4)_

 _You can even leak complete directories in some mail clients. Interestingly, Evolution shows a warning if you want to include a single file, but the full home directory is fine. (2 /4)_

 _Such simple stupid mailto:?attach tricks worked in Thunderbird for Debian, GNOME Evolution (CVE-2020-11879), KDE KMail (CVE-2020-11880), IBM /HCL Notes (CVE-2020-4089), and Pegasus Mail. (3/4)_

 _This flaw, among others, is described in our IEEE CNS paper "Mailto: Me Your Secrets. On Bugs and Features in Email End-to-End Encryption" with @lambdafu , @dues__ , @seecurity , and @joergschwenk : [https://](https://) nds.ruhr-uni- bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf (4/4)_

<comment><USER3> A later reply identifies the xdg-utils package responsible for the issue. As reported by author of the tweets:

[https://gitlab.freedesktop.org/xdg/xdg- utils/-/issues/177](https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177)

</comment></comment><comment><USER4> It's even worse. From the paper:

3) Access to IMAP Storage:

Thunderbird uses an adapted version of the imap:// URI scheme to internally address emails stored on IMAP folders. This allows an attacker to include messages on the victim's IMAP server (specified by their UID) using an attach parameter, as shown in Listing 6.

       mailto:firstname.lastname@example.com?attach=imap:///fetch>UID>/INBOX>1

        Listing 6. Mailto URI to attach the first email from the victim's IMAP server.

Multiple emails can be attached by using multiple attach parameters with different UIDs. By setting the UID from one to the maximum number of stored messages, and including all UIDs as attach parameters the whole mailbox of the victim can be exfiltrated at once.

Even worse, _all OpenPGP and S /MIME encrypted emails in the attached email are automatically decrypted by Thunderbird before sending them back to the attacker_.

Sheesh!

<comment><USER5> Decrypted messages should _never_ be stored on the IMAP server. That is pretty much the whole thing here. It overtly defeats the PGP encrypt once scheme.

In the same way, a user intending to send an encrypted email should be able to be confident that the email client will not automatically save an unencrypted message to some sort of Drafts folder on the IMAP server.

<comment><USER6> It sounds like he's saying the client would fetch the messages, decrypt them, and attach the plaintext.

</comment></comment></comment><comment><USER7> The Confused Deputy strikes again [1]

[1] [https://en.wikipedia.org/wiki/Confused_deputy_problem](https://en.wikipedia.org/wiki/Confused_deputy_problem)

</comment><comment><USER8> I can't replicate this with current Thunderbird 68.11.0 on Debian. It honors parameters such as subject= and body=, but attach= seems to be ignored.

After a quick search through the paper [1] it seems that authors forgot to mention the software versions they were using in their research.

[1] [https://www.nds.ruhr-uni- bochum.de/media/nds/veroeffentlichu...](https://www.nds.ruhr-uni- bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf)

<comment><USER9> It should be patched since Dec 2019: [https://twitter.com/jensvoid/status/1295633279727673344](https://twitter.com/jensvoid/status/1295633279727673344)

<comment><USER8> I found a discussion from March 2009 which suggests this issue was known back then [1]. Maybe the same feature was re-introduced later in some other part of the code? The link to source repo in the post is dead, but the file it references (nsSmtpUrl.cpp) still contains this comment on line 88 in current version:

/* DO NOT support attachment= in mailto urls. This poses a security fire hole!!!

[1] [http://forums.mozillazine.org/viewtopic.php?f=30&t=1172555](http://forums.mozillazine.org/viewtopic.php?f=30&t=1172555)

<comment><USER10> A comment in source code. Not the discerning professional's preferred tool for guaranteeing security-critical behaviors to prevent "fire holes".

<comment><USER11> What should they do? Static analysis would be nice, but it's probably too complex to adopt in that kind of codebase.

In the end, the only viable option is to forbid this behaviour, and document a rationale so nobody will enable it back again.

Perhaps they could make this warning bigger, but other than that...

<comment><USER12> They could have added a regression test, no? Give it an example with ?attach= and verify that no attachment is added.

</comment></comment></comment></comment></comment></comment><comment><USER13> That's why I use web-based email (FastMail and Proton Mail personally) because I want email software to exist in the same sandbox as all websites I visit on the web.

<comment><USER10> Seems like a reason to use an OS with sandboxing.

<comment><USER14> I browse the web on QubesOS in a disposable VM. There's no user data in the disposable VM, and all the data is cleared when the browser is turned off. Also, QubesOS allows me to run my GnuPG daemon in a separate domain completely isolated from all other applications. This is the ultimate defense against arbitrary code execution in a buggy web browser. To take over the computer, the attacker must exploit the Xen hypervisor or a CPU side-channel, not just a 0day in Firefox or a PDF reader. Yes, QubesOS's approach is not pretty, it's a hack and resource-heavy. But this hack allowed us to continue using an existing insecure desktop system, device drivers and applications, without reinventing the OS and the desktop with its set-back of non-existent support. At least it's a very practical stop-gap measure before someone reinvents OS security.

A lightweight solution I used previously was running the browser in a separate Unix user with firejail's sandbox. If it's not running a separate X server, the attacker is free to take over the X server and inject keyboard and mouse inputs, but at least the files in the primary /home directory is inaccessible. I did this a few years ago after the disclosure of a file-leaking vulnerability in Firefox, because I assumed similar exploits may be discovered in the future, apparently I'm not wrong.

<comment><USER6> firejail does in fact run Firefox in a separate X server. Namely, your choice of Xpra or Xephyr.

<comment><USER14> Comes with a great performance penalty, my (unverified) impression is that it's even slower than Qubes.

</comment></comment></comment></comment></comment><comment><USER5> >So, why break PGP if you can politely ask the victim's mail client to include the private key?

If your PGP private key has a good passphrase then you are still OK. This attack suggests that there is some value in how most PGP implementations attempt to protect the private key locally.

As a counter example, Signal Messenger does not even try to protect the private key or saved messages except with a short pin (and that is a new feature). That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assumption. Then you can sniff any passphrase without any extra trouble.

In the end, message security is endpoint security.

This attack is entirely generic. It seems odd that the authors only mention the possibility of a PGP compromise and ignore all the other messengers out there that could be also compromised by arbitrary remote file access. It would of made things more compelling.

<comment><USER15> .ssh/id_rsa... Nasty!

<comment><USER16> You likely mean .ssh/id_rsa (or perhaps .ssh/id_ed25519). The .pub variants are safe to share.

<comment><USER15> Of course I updated my OP.

</comment></comment></comment></comment><comment><USER17> While it would definitely be better if this displayed a warning when opening the link, it still requires the victim to willingly send the email. Before doing that they see the list of attachments they are including, so this is a _very_ visible attack.

<comment><USER18> > Before doing that they see the list of attachments they are including, so > this is a very visible attack.

Depends on the client. I use claws-mail and I can't replicate this (not sure if maybe I'm doing it wrong), but I did note that if there were attachments, I wouldn't see them by default without clicking the attachments tab in the compose window.

</comment></comment><comment><USER4> The "attach" parameter is not mentioned in the mailto URI RFC 6068.

How was this standardized? Why did clients implement this?

<comment><USER19> > Why did clients implement this?

People have processes that put files in standard places and require users to email them the files. Yes, the average HN reader could automate away any need for the average process, but it exists and can't be changed. Email client developers go ahead and implement niceties without considering the risk.

</comment></comment><comment><USER20> I wonder if anyone has tried to do something like this for meeting invite responses, which are sent at least in Evolution without any user intervention. Could you craft a meeting invite URL or mail such that the response would include a file or email?

</comment><comment><USER21> Seems like a mail client stupidity, as the original twitterer follows up: [https://twitter.com/jensvoid/status/1295358144600735744](https://twitter.com/jensvoid/status/1295358144600735744)

I guess someone thought it was a useful addition (e.g. since on smartphones nowadays communication between apps is through launching of URLs, e.g. loading the URL "[https://maps.google.com/...."](https://maps.google.com/....") would open up the Google Maps app), but they didn't consider this exploit.

<comment><USER22> How can someone build such a feature and not consider the most basic security concerns?

<comment><USER23> The feature is useful for desktop applications that want to help the user compose a mail to the customer service, including some report logs as attachment.

Notice that the user is still required to actually press Send in front of their default mail client with an open window showing the full email and attachments.

<comment><USER22> I can't imagine any scenario of a widely used email app opening a hyperlink that automatically composes and attaches local files being acceptable, even if they have to click send.

<comment><USER24> Our program has documents attached to declarations. These typically come from some integration and is saved on a server/shared drive, in some arbitrary sub- directory to avoid too many files in one directory, and typically with some non-intuitive filename for good measure.

Our users want to be able to be able to open a declaration and email the documents, either internally or to their customers, along with some message.

We don't really want to implement a full email client in our program nor having to deal with their SMTP server setup, including proxies, firewall and so on. So we basically do exactly this, open a new mail in their client with some template text and with one or more attachments.

We use MAPI though and not "mailto:", but use-case is there.

<comment><USER10> If it does this without prompting the user for permission, it should stop doing that.

<comment><USER24> Our program doesn't prompt the user for permission explicitly, but then the user has to initiate this process by clicking the "email documents" button so...

</comment></comment></comment></comment></comment></comment></comment><comment> mike-cardwell _Sigh_ This works on latest Evolution on Debian, I just tested. I can see how somebody might miss that there is an attachment, especially on a large screen like mine (40 inches). I've just repointed the system default mail client at Mutt (which is not configured), so I have to copy mail links from now on to get them into Evolution.

</comment><comment><USER25> Here is the NixOS patch for xdg-utils: [https://github.com/NixOS/nixpkgs/pull/95758](https://github.com/NixOS/nixpkgs/pull/95758)

<comment><USER25> Will also sent upstream once I got an account and nobody is faster than me.

</comment></comment><comment><USER26> Much as this is bad, I will address the "GPG secret key" angle: if (like me) you only store your secret keys on a physical device, as described for example here: [https://github.com/drduh/YubiKey- Guide](https://github.com/drduh/YubiKey-Guide), then you have nothing to worry about, because your secret key does not reside anywhere where it's accessible.

<comment><USER27> OK, so replace "GPG secret key" with any other secret you definitely don't wanna email off to some random stranger :-)

</comment></comment><comment><USER28> Wait someone implemented that?

I have read some of the mail standards and know that they have quite a number of "annoyances" some with bad security implications.

But I believed that modern mail software treats them as uhm "legacy madness" and just doesn't implement them.

<comment><USER4> It's not in the standard. I have no idea why several MTAs decided to implement this, and did so in an unsafe manner.

<comment><USER29> Imagine you're providing a desktop shell. You want to support a right-click "Send this file via email" option. This also happens for things like document editing where you want to send the current document as an email attachment.

Now imagine you've decided the only portable way to marshal the information of what to send is to use an extension to the URI for mailto. This means you can no longer reliably figure out if the URI is "safe" (being generated by a program that wants to effect a "send this document") or "unsafe" (I clicked a link in my web browser).

XDG chose to go down the stupid path. Windows opted to use MAPI, so MAPISendMail lets you attach files for the shell extensions.

</comment></comment></comment><comment><USER30> I'm not convinced this is as big an issue as has been made out here.

Why would you click a link and then voluntarily send an email with a file called "passwd" or "secring.gpg" in the attachments list?!

Perhaps you could show a scarier warning or something, rather than just declaring the functionality unacceptably dangerous and removing it. There are genuine use-cases discussed in this thread. At the end of the day, the user needs to accept responsibility for things they voluntarily do on their machine.

Generally though, I'm not sure this functionality makes much sense if it's initiated from a web-page. If you had another app on your machine though, that already had disk access, it might make sense to be able to launch the email client with something pre-attached.

<comment><USER31> It is a big issue, and it's not surprising some hackers wouldn't understand how big.

A lot of people, most even, have no idea what is happening on about 90% of their screen, about 90% of the time. And they're used to being forever in the dark about what their machine is doing and why. They expect it.

They know they're writing an email and they can see the box they're typing into, but other components, like the status bar, title bar, and attachments field, are outside their sphere of perception. At least or especially when they're not actively thinking about attaching a file intentionally, say.

It's like a serious chess player, who sees the whole board and thinks multiple moves ahead, compared to a novice who learnt the rules yesterday and can only see the horsey piece and the pieces immediately surrounding the horsey piece.

These users have a checklist approach to using their computer:

Step 1: click this

Step 2: that happens

Step 3: Did what I wanted to happen, happen?

Step 4: there is no step 4

The professor who didn't realize there's a "fullscreen" button when showing videos to the class is the same one who can't perceive the attachments field and will send a file called 'passwd'. And if the mail client puts up an alert that says, "Are you sure you want to attach and send a file called passwd to firstname.lastname@example.com?", they'll click 'Yes' and get on with their day.

<comment><USER32> I think you are correct with your assessment of how most people use computers.

But I don't agree with your conclusion that they need to be protected. If I want to hammer in a nail and accidentally hit my finger that's not the hammer- manufacturer's fault or responsibility. So why should it be the email-client's fault/responsibility to make sure I don't send my private keys?

If people refuse to learn how to use a hammer they will keep hitting their fingers, if people are refuse to learn how to use their email-client they will keep sending their private keys to bad actors.

<comment><USER31> I didn't conclude that the email client needs to warn users about dangerous attachments- I mentioned that even if it did, users would ignore it.

But I do believe that UX needs to be designed according to the principle of least surprise, and those in the know (i.e. we/us), need to put in guardrails to keep people safe as they get on with their day.

If your hammer has 4,500 different everyday functions, 4,400 of them posing a danger to your fingers & bank account, but hammering nails is necessary for your job, for your kids' school stuff, and to interact with your government, then that's a closer analogy.

</comment></comment></comment></comment><comment><USER33> Anyone have an easier to read version?

<comment><USER34> The paper is easier to read than Twitter: [https://www.nds.ruhr-uni- bochum.de/media/nds/veroeffentlichu...](https://www.nds.ruhr-uni- bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf)

</comment></comment><comment><USER35> Broken Twitter thread?

</comment><comment><USER36> huh, that's surprising. Just in case anyone else is curious, this doesn't have any effect in the Mail app on macOS.</comment>


History of Lisp - <AUTHOR> http://www-formal.stanford.edu/jmc/history/lisp/lisp.html <comment><USER2> An entire page of how they were trying to implement in various ways, including FORTRAN.

Then, suddenly:

"S.R. Russell noticed that eval could serve as an interpreter for LISP, promptly hand coded it, and we now had a programming language with an interpreter."

<comment><USER3> Indeed. Lisp is a hack that got totally out of hand. M-expressions were kept around for years as conceptual technical debt before the YAGNI moment.

</comment></comment><comment><USER4> Paul Graham has a great article on this:

<http://www.paulgraham.com/rootsoflisp.html>

<http://lib.store.yahoo.net/lib/paulgraham/jmc.ps> (I noted Preview.app was having transient issues loading this specific postscript file, so I converted it to pdf -- <http://behemoth.strlen.net/~alex/jmc.pdf> )

Most important, here's the code a Lisp interpreter in Lisp:

<http://ep.yimg.com/ty/cdn/paulgraham/jmc.lisp>

I think that's the root of what made Lisp different: building a bootstrap implementation in another language was not difficult(1), so implement more complex language features in Lisp itself was possible.

If you take this further, it's quite a powerful concept: since even fairly primitive language features are implemented in a high-level and you can manipulate the AST much like you can manipulate any other data structure, you can change the language in non-trivial ways to suit your problem.

Chapters 4 and 5 of SICP demonstrate this in detail and introduce metalinguistic abstraction not only as a powerful technique in it of itself, but as a technique for teaching students about many other aspects of computer science (introducing a register-based virtual machine, compilation, and garbage collection -- all without leaving a higher-level language):

[http://mitpress.mit.edu/sicp/full-text/book/book- Z-H-4.html#...](http://mitpress.mit.edu/sicp/full-text/book/book- Z-H-4.html#%_toc_%_chap_4)

(1) Shameless plug: here's my own implementation in OCaml based in part on jmc.lisp by pg and on a C implementation by another HNer -- <https://github.com/afeinberg/ocaml-tinylisp>

</comment><comment><USER5> My favorite bit of this history is that the first Lisp interpreter was written in Lisp.

<comment><USER6> My favorite bit of this history is that the first Lisp interpreter was written in Lisp.

(hmmm, maybe it would be a bit spammy if I recursed this statement several more times.)

<comment><USER7> I am calling "turtles" on this.

<comment><USER8> That won't do you any good - the first Logo interpreter was also written in Lisp.

</comment></comment></comment></comment><comment><USER9> The big insight of the very first lisp is that treating everything as a symbol (pointer) together with conditionals and functions is good enough for almost everything, and it is as elegant and complete as Lambda Calculus.

The pair of functions at the very core of a Lisp - eval and apply - has a deep correlation with philosophy, and captured the essence of the general process called interpretation.

Since then lots of things happened, most notably, use of parenthesis to unify the notation (and representation) of code and data for the reader function(s), which, as a consequence, makes macros possible. With macros everything was possible, so CLOS and other "monsters" were created.

Lisp, perhaps, is the greatest example of how a few selected ideas (very clever ones) could be put together to create something exceptional (and beautiful) and, on the other hand, more subtly, how it is not possible to create an ideal (unfortunately, not everything is a list, and by adding new data structures the beauty fell apart), how implementation is always clumsy and cumbersome (all those ugly machine types deep inside) and how crowd of mediocrity quickly produces piles of crap.

</comment><comment><USER10> _The first attempt at a compiler was made by Robert Brayton, but was unsuccessful. The first successful LISP compiler was programmed by Timothy Hart and Michael Levin. It was written in LISP and was claimed to be the first compiler written in the language to be compiled._

However you look at it, lisp seems to be an exercise in recursion :-)

</comment><comment><USER11> A PDF version - still hard to read because of no anti-aliasing but at least for my preferences easier to read than the HTML version.

[http://www.csse.monash.edu.au/courseware/cse3323/CSE3323-200...](http://www.csse.monash.edu.au/courseware/cse3323/CSE3323-2002/lisp.pdf)

<comment><USER12> I found a much nicer (with antialiasing) .ps version hiding alongside the original, and the source .tex too:

<http://www-formal.stanford.edu/jmc/history/lisp.ps>

<http://www-formal.stanford.edu/jmc/history/lisp.tex>

The original HTML doesn't reproduce any of the TeX "special" bits like greek letters or mathematical formulae, so the PS is definitely recommended.

</comment></comment><comment><USER13> FYC: I presented a History of Lisp talk at last year's ClojureX: [http://skillsmatter.com/podcast/scala/a-walking-tour-of- cloj...](http://skillsmatter.com/podcast/scala/a-walking-tour-of-clojures- history)</comment>