Stop Disabling SELinux: A Real-World Guide - <AUTHOR> https://learntemail.sam.today/blog/stop-disabling-selinux:-a-real-world-guide/ <comment><USER2> > Jan 31 10:48:54 server audit[16067]: AVC avc: denied { name_connect } for > pid=16067 comm="nginx" dest=8000 scontext=system_u:system_r:httpd_t:s0 > tcontext=system_u:object_r:transproxy_port_t:s0 tclass=tcp_socket > permissive=0

I think one reason security programs are sometime ineffective and end up being disabled is that they give problems to developers and sysadmin but no solutions.

I wish that rather than messages like "doesn't work - too bad", these programs would output a solution as well, such as "consider setting `httpd_can_network_connect` to `true` to allow it".

In some cases it might be tricky to propose a solution, in which case even a link to the doc would be useful like "check [http://example.com/doc#456](http://example.com/doc#456) for more information". That would go a long way towards making security software issues less of a pain for those who aren't expert in the topic.

<comment><USER3> "audit2allow -a" or "audit2why" will tell you what the reason for a denial is and potentially how to fix it. Pretty sure it will tell you to run setsebool to allow httpd_can_network_connect in this instance.

<comment><USER4> audit2allow is the single greatest tool I've ever used for dealing with SELinux, people need to hear it's name sung from the mountains.

I actually write SELinux policies for software I develop, first thing I do is put them in the most restrictive context imaginable with no permissions, set SELinux in permissive mode and run the application through it's paces, at the end run audit2allow and there's 90% of the work done for you outside of defining fcontext's.

<comment><USER5> It must be used with care though, otherwise you'll end up with so many holes in your policy that you defeat whole point of using SELinux in the first place. Definitely don't use the output directly.

<comment><USER4> Certainly not, but it's a great first step.

</comment></comment></comment></comment></comment><comment><USER6> I ran a centos server for a while (ran= not my responsibility any longer) with SE Linux and a tomcat portal app, as well as other, custom web apps (ruby on rails with a mail queue and mysql backend, etc). I always left it in permissive, because I couldn't figure out how to properly configure it.

I tried understanding the principles behind it and configuring the different exceptions for several classes, but often, this didn't work (e.g. I had used wrong class, or enabled exceptions that were still blocked). The users of the rails app kept calling, asking me why this or that feature wouldn't work. It was impossible for me to configure all exceptions - to me this was not surprising, given the complexity of the software that we had installed. I simply deemed the apps too complex and too "feature rich" to configure all SELinux exceptions manually.

I then understood that there is a different way: To set it to permissive, keep it running for a while and then generate an installable permissions profile, allowing all occured violations as some kind of permissable exceptions.

This made sense to me, however it required downloading some dubious python script, that would create some dubious binary file. I got this to work, but then again, this or that feature was blocked. I finally kept it running on permissive. This is my individual story. The article makes it look as if it was really simple to configure it (When I started with SE I tried similar moves but never got it to work).

So, is it just me, or might it be that SELinux just has a major usability issue?

<comment><USER4> Why aren't you testing things with SELinux before you deploy them to production? Also, if you constantly need to alter your policy it sounds more like your application is poorly-behaved, not that SELinux is your problem.

audit2allow is a great tool for simplifying the development of SELinux policies, but it doesn't remove some hand-crafted modifications to policies, especially in regards to file contexts (fcontext).

<comment><USER7> Keep in mind there are a LOT of apps deployed on systems with SELinux with few, if any, tests

Further, the divide between ops and developers in many cases leaves this as an unsolvable problem - it's not the dev's job to do sysadmin, and ops lacks the expertise (or time) to comprehensively analyze the code base

You're right that this makes the app poorly behaved, but if that can't be addressed then... permissive mode it is

<comment><USER4> Everyone keeps telling sysadmins they need to be able to write code, how about developers start learning more about how their applications are deployed.

I wear both hats, and then some more on top of that - if someone on my team is doing something that will make deployment and security difficult I make sure to nip it in the bud during testing.

</comment></comment></comment></comment><comment><USER8> The problem with SELinux is that it's disabled by default on many distros. If you follow guides online that weren't written for a SELinux-enabled Linux install then it won't work.

To make matters worse SELinux-related errors can be pretty arcane if you don't know what's going on. I'm usually a FreeBSD guy but I had to setup a CentOS 7 box a little while ago. I thought I was going insane when I couldn't get nginx to connect to a unix domain socket. After a hour of hair pulling and non- conclusive googling I finally understood that it was SELinux related.

I will admit that after that I simply disabled SELinux and never looked back. The benefits didn't seem worth the hassle to me.

If I want additional security and sandboxing I'd sooner use something like FreeBSD/solaris jails. It's not exactly the same thing of course but I find the mental model a lot simpler ("a machine within a machine") than SELinux's complicated and (IMO) hard-to-debug rules.

<comment><USER9> The fix for that would have been:

        setsebool httpd_can_network_connect=1

audit2allow even tells you right away which booleans apply:

        tail /var/log/audit.log | audit2allow

<comment><USER8> Thank you for that, that might be helpful in the future!

But it kinds of demonstrate my problem with SELinux: when I had my unix socket issue I tried to debug my problem using my usual tools: strace, ls, ps, dmesg, etc... but I couldn't figure out what wasn't working right. All the permissions looked fine and yet I kept getting cryptic failures.

With something like a jail, once it's set up I can just use my un*x admin experience without having to learn a brand new OS-specific (if not distribution-specific) set of tools.

<comment><USER9> Well, you get that with any security technology and it's just one of many things to be aware of when you use another distribution.

<comment><USER10> _Well, you get that with any security technology_

That's just not true. There is plenty of security technology that doesn't require you to figure out new tools. There is security technology that doesn't have tools at all and there is nothing to figure out. The program either works correctly or it's buggy and there is no knob to make a buggy program correct.

And then there is security technology that is more or less understandable with knowledge of existing Unix tools. pledge() on OpenBSD, for instance, doesn't introduce new fancy tools. A program doing something it promised not to do will get killed with abort trap (which can, admittedly, be a little cryptic if you don't know pledge does that). In addition, the name of the binary, the pid, and the offending syscall is printed in dmesg. Perhaps it would be better still if the dmesg line included the word "pledge" as a hint & guarantee that you'd get relevant results on Google.

<comment><USER9> Well, "security technology" in the context of mandatory access control frameworks. Bad choice of words.

My point is that any ACL framework will require configuration, be it SELinux, AppArmor, Tomoyo, or pledge.

If you want to use pledge to confine applications that don't use the pledge API, it will get complicated, too (admittedly not quite as complicated as SELinux, but still).

SELinux writes denials to the audit log and you get plenty of relevant results.

pledge is obviously much more sane than SELinux, but someone has to write a policy no matter what technology is used.

</comment></comment></comment></comment></comment></comment><comment><USER11> The Gentoo wiki has an extensive and really good set of tutorials[0] on SELinux. It took me some time to get through those but it greatly increased my ability to work with SELinux. It does a good job of explaining the concepts themselves and help build some familiarity with the CLI utilities and especially the debugging capabilities.

[0]: [https://wiki.gentoo.org/wiki/SELinux](https://wiki.gentoo.org/wiki/SELinux)

</comment><comment><USER12> Frankly I found SELinux a little inscrutable and not worth the trouble of learning since I didn't use it at work, despite otherwise being someone who is up for self-education on anything new and interesting.

However the Redhat certified admin and engineer classes cover it with enough practical examples to make any SA functional with the tool. And as a former consultant learning anything people _consider_ difficult whether or not it really is can be profitable. :-)

</comment><comment><USER13> I never disable SELinux... but that is because it was never enabled. I use Debian and SELinux has never been on by default and if it were good enough it would have been. There is a reason it was never enabled.

<comment><USER14> True, there is a reason, but the reason is lack of focus among the developers, not whether it's good enough. Selinux has been maintained for years by just one developer (Russell Coker), and that just isn't enough to maintain up-to- date policy files for all 20,000 Debian packages. Lately Laurent Bigonville has stepped in to share some of the load, but I have never seen more than 3 people in Debian's selinux team.

It would take an explicit release goal to enable selinux for Debian, and part of that release goal would be requiring package maintainers to help with maintaining the policy files for their packages.

<comment><USER15> The facts that:

1\. The package has only one maintainer.

2\. The package requires heavy maintainer intervention.

3\. Shit's on fire, yo.

All suggest that whatever it is that SELinux is meant to be a solution to, it's not a particularly good, or compelling, solution.

Stuff that needs custom wiring for every single package (and at last count Debian was in the 50-60k packages range, though a fair number of those are extra, source, and documentation packages) suggests ... issues.

<comment><USER14> _whatever it is that SELinux is meant to be a solution to, it 's not a particularly good, or compelling, solution._

Well, yes. Enforcing that surgeons wash their hands and wear protective clothing in the OR also isn't a compelling solution to surgeons, because it limits their response time. But the behaviour is forced upon them anyway (by either employment policy or insurance), because it is better for the patient. Selinux does the same thing: it requires security-aware behaviour from developers (by requiring the package to enumerate its expected behaviour beforehand) not out of convenience for the developer, but to improve the security for the user.

And that explains why Debian does not use it while Red Hat does: Red Hat can enforce selinux compliance by company policy, while Debian has to rely on every individual developer's judgement about the effort/benefit ratio. And just as with hygiene in medicine, the effort is internal while the benefit is external. That's why I said it would take a release goal (or general resolution) to effect that change in Debian.

Protective rules are not meant to be a compelling solution for those who have to abide by it. I don't see why we should expect selinux to be any different.

<comment><USER16> > And that explains why Debian does not use it while Red Hat does: Red Hat can > enforce selinux compliance by company policy, while Debian has to rely on > every individual developer's judgement about the effort/benefit ratio.

There's also this little thing that Debian has an order of magnitude more tools and programs included in its official repository, and two or three orders more packages. This alone pretty much explains why Debian cannot just put SELinux into use, while Red Hat somewhat can.

<comment><USER17> Fedora has a repository of comparable size and still manages to ship with SELinux enabled.

</comment></comment></comment></comment></comment></comment><comment><USER18> I've been using SELinux in my Fedora the last 3 years, always on enforcing mode.

No major problems, just minor policy changes needed that the helper was already suggesting and that were easily fixed.

With the only exception that SELinux does not like my iPhone.

<comment><USER19> I just fixed a bizarre problem on Fedora by disabling SE. By the way, the user is using a PC I configured with used hardware, partly from me. It's supposed to be a just-works system, meaning that it runs Fedora and I did no special configuration at all.

That was the error description I got: "When starting the network does not work. I have to do a lot of things to make it work." Later I got more infos: "It says there are 7 errors. If I let it fix it it has to restart and then works".

It turns out that these 7 errors are all SE-Linux-Errors. Something about /etc/resolv.conf not being readable. The error helper suggests to fix it for now and also some command to fix it permanently, those commands fail and do nothing. So of course I just deactivated that SE-bullshit.

Really, fucking vanilla Fedora on a mainstream Gnome3 desktop. What the hell are they thinking?

<comment><USER9> If you'd post the actual errors, I'm sure we could help you with that.

<comment><USER19> You mean the actual error message? Sorry, it's already solved now and I didn't write it down. It was in Spanish, so I also don't remember how it was worded. But its content is correctly described above: Unable to open /etc/resolv.conf.

And btw, that is exactly what I don't want. I do report errors, I solve bugs. But I don't want to debug SE-errors, which just because of its paranoia makes perfectly normal usage impossible, so far that distros that enable SEL spit out errormessages immediately after installation.

I don't see its purpose anyway.

<comment><USER20> The main value in SELinux is to protect apps against things they should never be allowed to do (like your web app reading /etc/shadow or notepad listening for network connections) so that even if they get hit with a 0day, they're still not really vulnerable because the SEL stuff blocks all the bad things they could do. It really truly works in practice to prevent a bunch of bad stuff. In reality though, most people just disable it because it's a pain to learn and deal with.

<comment><USER19> I know. But thanks for the answer. It is not what I meant, but it responds to what I wrote.

A security-solution that makes normal use impossible is not a solution. Security solutions never work if they make usability worse. SELinux goes farther, it also makes functionality worse till impossible. That is what I meant when I wrote that I don't see the point of it.

Something like that can be a good solution if you are manually hardening a specific process. As a general security solution it is completely unfit. I don't see the point of pushing it for that. Fedora should never have activated it.

</comment></comment></comment></comment></comment></comment><comment><USER21> At my last gig we enabled SELinux as part of our PCI security procedures, I highly recommend it but be aware that there is a fairly big ramp up.

It pretty much doubles the effort for most sysadmin tasks, even simple things like tweaking a server setting become multi-step processes.

In my case, it was part of the reason I switched the team from DevOps only and brought in a real sysadmin.

<comment><USER22> Eh, "real" devops is having "real" developers and "real" sysadmins working in multi-displinary teams? Sounds like you went from NoOps (lolops?) to DevOps :-)

<comment><USER21> True, I should have put "DevOps" in quotes :-)

</comment></comment></comment><comment><USER23> I think one of the reason why people disable AppArmor/SELinux is due to bad experience spending hours trying to figure out why their service fails to run after a config update only to realize it was blocked by AppArmor/SELinux. They'll just disable it and says "good riddance".

If you're running a headless server and can't figure out why your service suddenly can't start after a seemingly simple configuration updates (changing port, changing data directory path, etc), be sure to check AppArmor (Ubuntu) or SELinux (Red Hat distros) logs first.

</comment><comment><USER24> Just my experience: Ever since it came enabled by default on fedora I've been using it in Permissive mode ie: don't enforce but notify about violations. IIRC, since the last couple of releases I've seen maybe a couple or so notifications, so the default set of rules out of the box on fedora are definitely much better now than they used to be.

I might just turn it to enforcing mode.

<comment><USER25> I've been using Fedora since 21 (I think) and I've never switched out of enforcing. Occasionally you get notified that Chrome has violated something but the notification explains how to allow it if you want to.

I'd really recommend it, it doesn't seem to impact the system usability in any way.

</comment></comment><comment><USER26> Some distro (Mandrake? Debian? This was a while ago) had a bad default SELinux setup _for years_ that introduced a subtle vulnerability that wasn't there in boxes that had SELinux disabled.

Knobs that can be tweaked can be tweaked wrong, and wrongly-tweaked knobs are security problems. Frankly I don't even like ACLs and capabilities for that exact reason: it's no longer immediately obvious what the actual permissions in a situation are ("let's see, the daemon is running in an unprivileged account, but it has CAP_SYS_ADMIN set, and this file is inheriting its ACLs from the parent dir..."). Making it more difficult to reason about security is generally a Bad Thing, and not worth whatever features that difficulty brings with it.

<comment><USER27> Practically there's been many examples where SELinux restricted a security vulnerability. I think SELinux is way too complicated. Needing to know exact commands to turn error messages into something understandable is bizarre.

That said, SELinux determines what is allowed. Having it introduce an additional vulnerability/permission just due to configuration is really odd.

I tried searching for your example, but can only find security bugs, not configuration issues.

<comment><USER26> Turns out I was thinking PAX/Grsecurity back in 2005. Same principle, though: more knobs to turn = more knobs to turn wrong.

</comment></comment></comment><comment><USER28> I want to, but this article was not enough. Say I have my own binary running as a service, and it has to do these things. What do I do? This article seems to be geared specifically towards nginx/a httpd.

I should probably just read the manpages.

<comment><USER29> Unfortunately, this is an area that could use some work. Tools for writing new policies are a long way away from what they could/should be. If you need something to work with SELinux that doesn't come with a policy you have essentially three options, in order of preference:

1) Develop a new policy from scratch. This is fairly hard, and the tools, such as they are[0], are not great. There's a couple of good resources out there, including [1] which has some good examples, and Dan Walsh's blog [2].

2) Use audit2allow to generate a policy semi-automatically. The resultant policy won't be very clean, and will almost certainly be more permissive than it needs to be, but if 1) is too much work (and I wouldn't blame you for this), then this is the next best thing.

3) Run your binary in the unconfined domain (do something like chcon -t unconfined_exec_t /usr/local/bin/foo), but leave the rest of the system enforcing. This will mean your binary itself is able to do anything, but the rest of the system is still protected.

Oh, and if you haven't read it before, you should definitely check out [3](pdf).

0: [http://oss.tresys.com/archive/slide.php](http://oss.tresys.com/archive/slide.php) 1: [https://github.com/TresysTechnology/refpolicy/blob/master/po...](https://github.com/TresysTechnology/refpolicy/blob/master/policy/modules/system/application.if) 2: [http://danwalsh.livejournal.com/](http://danwalsh.livejournal.com/) 3: [https://people.redhat.com/duffy/selinux/selinux-coloring- boo...](https://people.redhat.com/duffy/selinux/selinux-coloring- book_A4-Stapled.pdf)

<comment><USER28> Thanks, all of those links are very informative. Shame that it seems like quite a lot of work still to set up for my own applications.

<comment><USER4> audit2allow takes care of 90% of the work for you, the rest is removing extraneous permissions and defining file context's (fcontext) which is pretty simple.

Really, it's as simple as this, I swear:

1\. Write an empty policy for your application, defining a type for your binary (myapp_exec_t) with no permissions at all. Label your binary with this using chcon.

2\. Set SELinux in permissive mode, run your application through it's paces.

3\. Run audit2allow to get a decent policy to start with

4\. Figure out where your application stores data on disk, if at all. Create another type (myapp_t) and label those directories with it (you shouldn't be writing outside of these directories by default, if you allow it to be changed in a config file the administrator can label new directories with semanage), then grant your application access to this type. Also make sure the installed path of your binary is labeled with your myapp_exec_t type.

5\. Clean up the messy policy that audit2allow created if so desired, it's likely more permissive than necessary and not overly pretty. This will become easier as you work with SELinux policies more.

6\. You're done

This will be time consuming the first couple times you do it, but you'll get quicker at it over time like anything else.

</comment></comment></comment></comment><comment><USER30> OpenSUSE as well as Arch, Debian and Ubuntu uses apparmor and I never had a problem where I had to disable it.

apparmor is less complex but SELinux can be fine tuned at the cost of pulling out your hair with what security gain? The BIG ISSUE is the KERNEL SELinux and apparmor have the same policy with Linux Kernel aka both of them can be bypassed and a hacker can just focus on the Kernel.

<comment><USER31> Does Debian use AppArmor? Never run into it and I use Debian regularly. I read elsewhere Ubuntu uses it but I suspect Debian doesn't.

<comment><USER30> Once again AppArmor is great for being simple it has been a mandatory part of Debian's framework since Wheezy 2013.

</comment></comment></comment><comment><USER32> Hours I've spent dealing with security breeches (on Linux) - a few, false alarms.

Hours I've spent dicking with selinux - too many before disabling it.

OTOH I've been admining *nix from before Linux existed.

</comment><comment><USER33> Why should I not use GRSecurity?

Comparison matrix;

[https://grsecurity.net/compare.php](https://grsecurity.net/compare.php)

<comment><USER34> Why should I trust a page with checkboxes under GRsecurity and X's under everything else?

<comment><USER35> It's trustworthy, it's just misleading. GRsecurity is a whole suite of security related patches/modules that SELinux/Apparmor don't do and have never claimed to do because they're 'just' about MAC.

</comment></comment></comment><comment><USER36> some things need a change to not NEED selinux. For example, lots of password files and certificates should not be stored in directories and files (and mucked about in selinux). They are better off in the Gnome-keyring (which is severely underutilized)

for example - networkmanager-openvpn. Openvpn certfiles are usually shared by vpn providers and then when trying to load them, throws selinux errors.

Here's the bounty to fix it - [https://www.bountysource.com/issues/41582244-doesn-t-copy- re...](https://www.bountysource.com/issues/41582244-doesn-t-copy-referenced- certitifcate)

<comment><USER37> Gnome-keyring is a poorly documented, DE specific solution that will rope in libdbus abnd a dbus service as dependencies. There are few circumstances where gnome-keyring is the answer.

<comment><USER27> > Gnome-keyring is a poorly documented, DE specific solution

It hasn't been GNOME-specific for around 5 years.

Quoting [https://wiki.gnome.org/Projects/Libsecret](https://wiki.gnome.org/Projects/Libsecret):

"libsecret is a library for storing and retrieving passwords and other secrets. It communicates with the "Secret Service" using DBus. gnome-keyring and ksecretservice are both implementations of a Secret Service.

libsecret replaces libgnome-keyring."

<comment><USER37> I didn't say gnome specific, I said DE specific. There's only two implementations and both of them can only be trusted to work correctly if you run them in combination with their respective desktop environment.

</comment></comment></comment></comment><comment><USER38> selinux is enabled by default on Android (since 5.0 or so) and if I recall correctly, is required for google to certify an Android device.

IMO it definitely reduces privilege escalation attacks there. I wonder if Apple uses similar MAC system on iOS?

Also, it is usually transparent for user app developers but can cause a bit of headache for platform/system devs.

I just literally spent a day on an issue where android system service checks selinux permission but does not audit the denial (= no error in logs) under certain conditions. That was not a problem with selinux per se, but disabling selinux would "solve" the problem.

</comment><comment><USER39> The problem is that I never had local users that might be malicious or that were prone to be hacked.

The attacks for servers tend to be over the network and there are many different ways to mitigate those.

<comment><USER9> Actually, the default Red Hat SELinux is exactly for preventing network vulnerabilities. Local users are unconfined.

Example: your web application allows remote code execution. Even the default rules prevents most access (spawning a shell etc.) and generate lots of alerts.

</comment></comment><comment><USER40> Not one mention of dontaudit rules. The day I found out about them (years ago when I tried to use selinux in the "real world"), I said nope.

</comment><comment><USER41> If system administration was carpentry, SELinux would be the glue. And sometimes, it's just easier to use screws.

<comment><USER42> I like your analogy, but I would flip the metaphors. Gluing is fast and easy, using screws requires time and effort.

<comment><USER41> Consider maintenance of the object in question, now it's a task of removing glue versus screws.

</comment></comment></comment><comment><USER43> I'll stop disabling selinux when I have a problem that it solves.

</comment><comment><USER44> how does app armor compare to selinux?

</comment><comment><USER45> So, this is a guide about how you can configure a broken out-of-the-box security framework, trying to convince me to enable it?

Thanks, but I'd rather start from something that works, and build adding security from there, not viceversa.

</comment><comment><USER46> It brought shame everytime I need to config new production server, first thing I did was change to pemissive mode

</comment><comment><USER47> I call BS. I have 0 use for it. I wouldn't disable it as a matter of best practice, but it's too annoying.

</comment><comment><USER48> I will continue to disable SELinux, and no number of arcane articles about how EASY it is will convince me otherwise.

Stick that in your pipe and smoke it.

<comment><USER49> Your loss. I agree that the way it's sold as "EASY" (caps appropriate) is a bit ridiculous, but SELinux does add a stong layer of protection from vulnerabilities in one service leading to total server pwnage. Ignore the rhetoric and try to work with it - the peace of mind pays off.

<comment><USER50> What if an app does something during runtime that you had not catered for? This effectively means potential downtime for the app while your admins are trying to figure out why the app is failing.

I agree SELinux adds something to the table, but the article shows two examples (httpd_sys_content_t and httpd_can_network_connect). Let's assume there is a third httpd_can_foo_bar that is required down the line. And then a http_can_bar_quux a few hours after that. All in all this can be a bit risky. Perhaps if there was an easier way to administer SELinux?

<comment><USER51> 1\. Functionality that'll be used should be tested before going into production.

2\. Using something like setroubleshoot will make sure any SELinux denials appear in the syslog so should be simple to diagnose, and sealert will tell you likely solutions. Personally I think that's how distros should be shipping SELinux, not sure what the downsides are.

Note, I'm mainly talking about servers here. Personal computers always seem to have messily-packaged applications running, so I can see why people get annoyed with SELinux there (although I've never had a problem with Fedora, yet...)

</comment></comment></comment></comment><comment><USER52> No Thanks! Given the never ending list of revelations Redhat's deep ties to the US security industry and the NSA are problematic. Why should anyone not already a part of the government security industry trust selinux?

By not coming out openly and explicitly criticizing the US security services for their anti constitutional and blatant authoritarianism Redhat has demonstrated which side it is on. It has no qualms enabling and supporting this behavior and is not a principled member of the free software movement. Something for which it has yet to be held to account.

Given the movement against Trump is exactly against this kind of authoritarianism the lack of scrutiny of tech companies like Redhat, Palantir and others is hypocritical. By not speaking out you are supporting these actions.

The fact that it is an absolute pain to configure and representative of a user hostile software model makes it that much more easy to avoid even for those with more practical considerations.

<comment><USER9> SELinux is the least likely part of the kernel to contain a NSA backdoor :-)

<comment><USER53> there was that one program..."system-something"....system-A ? was it ? or system-B ? or , hmm. "system-C". something like that, just... _might_ have a vulnerability or two ?

<comment><USER9> Or literally any other part of the stack.</comment></comment></comment></comment>


Hand-crank flashlight +soldering + Ben Heck = man-powered HTC EVO 4G charger - <AUTHOR> http://www.engadget.com/2010/10/05/hand-crank-flashlight-soldering-ben-heck-man-powered-htc-ev/ <comment><USER2> The Ben Heck Mindsolder is by far the most essential component to any hack. I just can't seem to find it at Harbor Freight. Maybe if I checked Ace.</comment>


There will be a Nexus Two - <AUTHOR> http://www.publicstatic.net/2010/07/there-will-be-a-nexus-two/

<comment><USER2> This is entirely unfounded guessing. Everything I've heard/seen indicates that Google will not be producing another device. Its existence pissed off their partners, it didn't sell extraordinarily well (I think being only really usable on T-Mobile, and eventually AT&T, caused that problem), and it has reportedly been discontinued. The Nexus One website recommends other phones for people who want to use the two biggest networks (Sprint and Verizon). And, of course, the networks kinda hated it because it undermined their position as arbiter of what goes on phones.

Of course, all the things that networks hated about it were things that consumers _should_ have loved about it, and I wish there were a Nexus Two just around the corner...but I'm not holding my breath and when my contract ends in a couple of months, I'll buy whatever the latest generation Android phone from Sprint or Verizon happens to be.

Regardless, this is not a substantive article.</comment>


Ubuntu Touch betas are ready for testing - <AUTHOR> http://www.zdnet.com/ubuntu-touch-betas-are-ready-for-testing-7000014281/

<comment><USER2> ZDNet spammer: <https://news.ycombinator.com/submitted?id=wagtail></comment>


Ask HN: Does anyone work in anything but a casual workplace? - <AUTHOR> Long time HN follower with a serious question: do any of our colleagues around the world work in a professional work environment including neckties;
I would love to know how it is working out for you?
To our largely casual colleagues, have you considered the advantages of professional dress in computer science?
I'm asking because I've been working in a suit and tie for two years and have observed many advantages but am struggling to convince anyone of the benefits.
Would be most grateful for thoughts from all sides of the argument as I'm putting together a series of essays on the subject and it seems timely given recent events in the tech world such as our good friends at Facebook being groomed for their day of reckoning with congress and other newsworthy scandals in the tech industry related to data breeches and the like. <comment><USER2> What advantages have you experienced?

<comment><AUTHOR> Too many to list in the thread, it's the kind of thing you need to be determined to try for about a month to see for yourself. If done right it's akin to developing a superpower.</comment></comment>


Show HN: How Many Days - <AUTHOR> http://duuble.com/howmanydays/

<comment><USER2> any date i put in doesn't work. need to accept more formats

<comment><AUTHOR> woah, sorry man, currently it's just yyyy-mm-dd, but we have just added dd-mm- yyyy, and also yyyy/mm/dd and dd/mm/yyyy. thanks for the suggestion!</comment></comment>


Twitter Security Issue - <AUTHOR> http://brianshaler.com/blog/2008/11/23/twitter-security-issue/ <comment><USER2> How about this for a twitter security issue: users are accustomed to giving their passwords to many third party twitter-API apps.

<comment><USER3> Yeah they need to implement OAuth or something similar.

<comment><USER4> From what I understand is that OAuth was created when twitter developers identified this as a problem. The trouble is they were too busy fighting to keep twitter alive to roll it out on their own api.

</comment></comment></comment><comment><USER5> The fix for this sort of thing is pretty simple. Just keep a nonce on a user (the "user version" if you will) that increments every time a user makes a change to their login credentials, store that nonce in their cookie, and if the one in the cookie is lower than the one on the server treat it as a logout.

That said, this is sort of an unserious security "issue" for most people between not really caring about the security of their account and reasonably short cookie lifetime settings.

</comment><comment><USER6> Twitter have said they are going to implement OAuth (which would solve this problem) on their API page. However, they have shown no progress to my knowledge of doing this. It would be great for the community to push them towards it.

Twitter seem to have been so busy fire fighting that a lot of interesting stuff has seemingly dropped off the roadmap (such as XMPP).

</comment><comment><USER7> Users should be encouraged to not share their password with anyone or anything, but twitter. 3rd party apps could use OAuth.

</comment><comment><USER3> I suspect this is actually a very common issue. Unless you explicitly expire all sessions for a user when they change their password then this will happen.

<comment><USER8> Well when you say common, do you mean with another application that utilizes an open API that is connected to many popular platforms and that is as widely used as Twitter?

Not many come to mind.

<comment><USER3> I would _guess_ that it's true for many APIs which rely on the user providing their password to the 3rd party application.

Of course that's the bigger problem. The user shouldn't _have_ to give their password out. It's somewhat ironic that Twitter doesn't implement OAuth or something similar since Blaine Cook _started_ OAuth.

</comment></comment></comment><comment><USER9> Surely Blaine Cook didn't want to give up the admin account he had access to. ;)</comment>


Inject secrets from Vault directly into Kubernetes pods - <AUTHOR> https://banzaicloud.com/blog/inject-secrets-into-pods-vault/ <comment><USER2> This is great! Does this handle the handshake to request a token as well? Really nice example of the power of mutating webhooks.</comment>


"Google Is as Close to a Natural Monopoly as the Bell System Was in 1956″ - <AUTHOR> https://promarket.org/google-close-natural-monopoly-bell-system-1956/ <comment><USER3> I think the key point here is not whether Google is abusing its effective monopoly willingly, its that it exists at all. There may be alternatives, but not viable ones.

Try not supporting Chrome or ignoring Chrome requirements such as security mandates, you will go out of business. You can say these are 'good' for the consumer but the fact that Google has the ability to unilaterally change the web itself is partially the issue, they are not a standards body.

Whats the viable alternative to Google Search? Sure you can use Bing as a customer, but if you're a website operator you HAVE to stay on Google's good side. (not always easy to do)

Whats the viable alternative to Adsense? Especially when it comes to many Geo's that are hard to monetize.

Whats the viable alternative to Android?

Not all aspects of Google's business are so dominated, but where they are, you have little choice but to go with Google and the fact that are dominate in so many key segments is troubling.

Let's be honest, it's not like Google makes themselves easy to contact, interact with, or get support from. They are in many ways a black box.

Ever notice how the transparency reports for Safe Browsing never includes Google Properties or how they are happy to report DMCA issues for the internet, but never for Youtube?

<comment><USER4> _Whats the viable alternative to Google Search? Sure you can use Bing as a customer, but if you 're a website operator you HAVE to stay on Google's good side. (not always easy to do)_

Or you can not base your business on the fickleness of Google's search algorithms. Ben Thompson (stratechery.com) posts one article per week publically and charged $100 a year for his newsletter. The only time he gave numbers, he has over 2000 subscribers.

There are other ways to build a business that don't depend on search.

 _Whats the viable alternative to Adsense? Especially when it comes to many Geo 's that are hard to monetize._

If you are in a certain niche, find a publication or a podcast that serves that niche and make a direct connection to them. Marco Arment - a one man development shop - created his own podcast based advertising platform that is doing well.

 _What 's the viable alternative to Android_

The viable alternative to Android is...Android. Many companies are forking the AOSP version of Android and running their own services, including Amazon in the U.S. and a few companies in developing markets.

The danger Google faces is not that a company will come up with a better search engine, it's that people will start using search engines less as mobile takes over along with digital assistants that give you the information you want.

Facebook is already seen as a place for old people and young people may have a FB page but they aren't posting to it because their parents are on it.

<comment><USER5> > There are other ways to build a business that don't depend on search.

There are also other ways to run a household that don't depend on running water. (Heck, my great-grandpa never complained about having an outhouse.) Are you saying your local water utility should be an unregulated monopoly?

<comment><USER6> You seem to be trying to build an analogy between a person's right to a material necessity and a corporation's right to a convenient market. I don't think the analogy holds.

(The flip side would be "Are you saying Google should be a nationalized, government-regulated search engine?")

<comment><USER7> Municipal sewer/water isn't a material necessity, they're a convenience. There are million dollar houses in the D.C. suburbs that have well water/septic.

<comment><USER6> That's true. "Any water" is a material necessity (I think I'd argue "any sewer" too, if you plan to not pick up and nomad yourself around every few weeks). If you can self-supply it, that's fine.

</comment></comment></comment></comment></comment></comment><comment><USER8> Ma Bell's monopoly has never been "natural". It has been enforced by FCC, ever since FCC was formed for that specific purpose in 1934. Even before that, ICC through the Kingsbury Commitment had adopted an ill-considered and unjustified hands-off policy with respect to Ma Bell's anticompetitive actions.

<comment><USER9> Funny how just about every country in the world ended up with a telephone monopoly.

<comment><USER10> Every new method of radically increasing information transfer speeds is ripe for monopoly.

</comment></comment></comment><comment><USER11> It's hard to see any comparison. At the peak of AT&T's power, they were able to block sales of a third-party device that attached to your phone that helped keep people from overhearing your conversations. The device was just a cup, it didn't do anything electrical, but AT&T still decided they didn't like it and shut it down.

That was eventually overturned in court, but it was a decade-long fight. It took another decade before third parties were allowed to sell devices that transmitted sound through the phone system with acoustic coupling, and another decade after that before you could just plug in your own phone.

For everything Google does, there are viable competitors. They may not be nearly as large, but they're extremely easy to switch to if you want. People don't stick with Google because they have no choice (as would be the case with a monopoly) but because they like it more.

<comment><USER12> I agree with what you wrote, but the comparison is apples to oranges: Google customers are businesses; end users (who CAN switch easily) are the product.

Right now the only (supposedly) viable competitor is Facebook, but it's more of an advertising duopoly that divides the market - all the people I know who advertise say that you use FB for brand/interaction/marketing and Google for sales, and for a specific spend it is usually clear which one gets it (and seldom if ever anyone other than FB or Google).

<comment><USER13> > Google customers are businesses; end users (who CAN switch easily) are the > product.

I am a Google customer. They provide me with a product (Google) which I pay for by allowing Google to display advertisements on the results.

A business is also a Google customer. They pay Google to display ads to a visitors to the website.

But that distinction is moot anyway. Businesses aren't covered by consumer protections because they aren't "consumers".

<comment><USER14> I think you're being a bit mischievous with you definition of customer.

You're really a user; not a customer. Customers pay. Google is selling your eyeballs to advertisers. Advertises are Google's customers.

<comment><USER15> >Customers pay

And the important distinction if you want to counter the argument that the person you're replying to is making:

Customers pay _with money_. "paying" with a currency like privacy or convenience isn't actually paying. If you aren't paying for something _with money_ you aren't a customer, you're a user.

</comment></comment></comment></comment></comment><comment><USER16> It would be great to see more balanced discourse on monopolies, especially in a software-dominated world. Most analyses and articles fixate on the costs of monopolies.

Let's assume the worst of Google and conclude they abused their search monopoly. Innovation in search was stifled. Competitors were damaged and achieved only a fraction of their potential. For instance, Yelp might be worth $15B instead of $3B in a world without "evil" Google.

But Google's search monopoly and concomitant cash flows also gave society free worldwide communication, self-driving cars, cheaper smartphones, free digital maps, and countless other benefits.

All policies hurt some and help others.

Before supporting or rejecting a policy, it's wise to consider the overall benefits to society instead of focusing only on the injured parties. Why should thinking about monopolies differ?

To reiterate, this is neither endorsing nor disparaging monopolies. It's a request for objective analysis and updated thinking to reflect the potential new realities of monopolies like Google that give products away for free.

<comment><AUTHOR> >But Google's search monopoly and concomitant cash flows also gave society free worldwide communication, self-driving cars, cheaper smartphones, free digital maps, and countless other benefits.

To be clear you can't be sure those things wouldn't be around if google hadn't had a search monopoly. Maybe we would have even better digital maps for example had there been way more firms competing. Monopolies can't just be measured by the businesses that they outcompete but also in all the never- realized businesses who their market domination discouraged.

<comment><USER17> How does Google's search monopoly lead them to self-driving cars? This is why I question the Google vs Bell comparison. It seems to me Google wins because they are really, really good at producing technology, not because they have a systematic first-comer advantage.

<comment><USER18> Monopolies tend to be lest cost conscious. So, Google may be over investing in their self driving team which could cause a less efficient solution to win.

Picture the MBA where one team Q spends 100m/year per player to get the best players and more importantly keep them from other teams, but Q has a poor coaching staff. The fact Q keeps wining reduces the drive to replace that poor coaching staff, and other teams may fail to compete so they may give up on the playoffs instead focusing on cheaper players.

Not fast forward 20 years and the sport is overall in a worse position with Q lowering standards because nobody else is really competing. For a more relevant example consider the IE 6 stagnation before Firefox.

<comment><USER17> That's just economics at work though. The guy with more money to blow will always have an advantage.

<comment><USER18> Not so much. The invisible hand of economics just means the less efficient or less desired producers are pushed out of the market. It's just that the guy with more money can often invest it to become more efficient.

<comment><USER17> Right, money is an advantage and big companies generally have lots of money. The point is Google is not unique in that regard.

<comment><USER18> They are actually a massive outlier.

[http://www.siliconbeat.com/2016/05/20/apple-microsoft- google...](http://www.siliconbeat.com/2016/05/20/apple-microsoft-google-cisco- oracle-hold-cash-moodys-report/)

While Apple has a larger total cash horde ~(216 billion) only 7% of that is in the US or 15B, Google has a larger US cash horde @$73B * 31% = 22.6B making it the largest accessible cash horde in the US.

PS: The ~$1.68 trillion in cash held by U.S. companies at the end of 2015 is kind of misleading as financial companies are required to hold cash on hand and thus can't use it for R&D or they are keeping money out of the US while waiting for a Tax holiday under Trump or possibly some other administration.

<comment><USER17> I'm not saying that Google doesn't compete on their cash reserves, I'm saying "so what"? Does having a lot of capital make you a monopoly? Should we penalize business for having cash to spend?

<comment><USER18> Look at it from the other direction. I am saying one of the downsides of monopolies is they end up with a lot of capital, but they don't use it efficiently. At the core investing capital efficiently is a different skill.

Another way to look at it is after breaking up AT&T it created a lot of horribly dysfunctional companies. Verizon is a long way from greatness, but many of these guys where far worse and then went out of business because they where inefficient. Remember, it was the same people, tech, and business models before and after the breakup, but busting up AT&T exposed problems to market forces which then went away.

I am fine saying the rot has yet to set in at Google. But, give it 20 years and expect the same kind of problems because of human nature.

PS: Granted, this does not really answer your so what, but efficiency in the long term really is a boon to society.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> This article annoys me.

"YouTube makes $9 billion in annual revenues, but artists earn more from the sales of vinyl records than online streaming"

It's a useless comparison. Perhaps the vinyl industry is worth more than $9 billion. Not all of YouTube is music streaming. More artists are on YouTube than release vinyl. A single artist that has vinyl releases and has videos on YouTube may earn more from the vinyl, but there are many more artists on youtube who don't sell vinyl.

The article is good and has a valid points, but it's important to put comparisons you can actually compare.

Then "... Levon Helm, who was forced to put on a series of concerts at his home at the age of 70, while dying from throat cancer, in order to pay his medical bills"

Sounds like a story about medical bills / lack of insurance, not a story about digital music sales. Plenty of other people get throat cancer and aren't famous enough to put on concerts to pay the bills.

</comment><comment><USER20> Google has a ton of competition across all of its products. It's dominating in some of them but being better then your competition is a lot different then there not being any.

<comment><USER21> Google beats the competition in some markets because they have so much power in other markets.

If you start a startup even in cloud photo storage, and suddenly Google Photos comes along, you're dead. No one will fund you anymore, and you've basically lost.

Google has such an immense amount of network effect, and of knowledge they can gain from dominating in other markets, that if Google enters a market – unless there's regulations or network effects that prevent this – they immediately dominate it.

<comment><USER17> So how do you feel about Apple? When Google wins it's because they make a better product than the other guy. Apple can deliver a clearly inferior product (e.g. the last 5 years of iTunes) and still win because their customers are using iDevices. Google doesn't have that lock-in and they still do really well which makes me feel like they're not really a monopoly.

<comment><USER22> I think a big part of it is that Google controls one of the single most effective advertising channels to drive the growth of a competitor, and can therefore strangle them in the cradle.

<comment><USER23> Wait Google does not allow its competitors to use Adsense?

<comment><USER22> Fair response there.

They have unilateral power to bury someone in search results though. Which can effectively require them to use adsense.

I don't think this is reasonable. Buy our other product or get poor search results. There's a few really good examples on other threads here. The best example I saw involved a hypothetical YouTube competitor facing a large number of DMCA takedowns, they may be complying with the law, but the takedowns will give google an excuse to bury them in search results forever more, while they can "excuse" YouTube.

</comment></comment></comment></comment></comment></comment><comment><USER24> > (...) he has seen first-hand the damage that the internet economy has > wrought on working artists like his friend, legendary drummer Levon Helm, > who was forced to put on a series of concerts at his home at the age of 70, > while dying from throat cancer, in order to pay his medical bills.

this is a bit farfetched. do you really want to blame the internet for the immense fuck up health care has become? really?

</comment><comment> tuna-piano The term "Natural Monopoly" has a special meaning besides just the common definition of both words, which is missing from this discussion, but is in my opinion the most interesting topic of discussion. Basically all software fits the economic definition of "Natural Monopoly".

Natural monopolies exist in situations where the fixed cost is large and the marginal (per-customer) cost is small. In these situations, it only makes sense for one company to exist, as each additional company that exists will just increase that large fixed cost, while not decreasing the per-customer cost. Therefore, each additional company just increases the the total societal and average per-customer cost.

Natural Monopolies have been defined and talked about for longer than software has been around. The long-running natural monopoly example has been that it doesn't make sense to have two power lines to your house. Another historical example includes newspapers, who have fixed article writing costs, but can distribute it to every customer in a city. Some people consider that Wal-marts in small towns are natural monopolies, given the fixed cost of a large store, and the lack of a market for more than one store in a given area.

Software, of course, has large fixed costs and small per-customer costs.

The questions for me are:

-Historically, why have some natural monopolies been considered bad (railroads, utilities), and needing regulation, and others (newspapers, Walmart) not?

-Is Google's advantage really as a true economic natural monopoly, or is it just a really powerful habit and brand? Bing seems pretty close in search quality, but yet few switch over.

-If the economic definition of natural monopoly exists at Google and most software companies - why are there countless exceptions in software: database software (Oracle, SQL Server, DB2...), Web browsers (Chrome, Edge, FireFox, Safari), calculator apps, etc?

-What are the current issues with potential natural monopolies at these software companies, and would a regulated model make them better or worse for society?

[http://www.investopedia.com/terms/n/natural_monopoly.asp](http://www.investopedia.com/terms/n/natural_monopoly.asp)

[https://en.wikipedia.org/wiki/Natural_monopoly](https://en.wikipedia.org/wiki/Natural_monopoly)

<comment><USER25> >Bing seems pretty close in search quality, but yet few switch over.

a) Why would anyone switch if they are both equal and both free?

b) Most people use chrome. Most people don't change their default search engine.

c) As much as people pretend to hate Google, they actually hate Microsoft a lot more, and for good reason. Microsoft operates on bad faith far more frequently than Google does, most of their business decisions seem to revolve around the question "How do we leverage product A to force the user to use our product B?" whereas Google's anticompetitive behavior has always been more passive.

<comment><USER26> In fact, you are self-defeating your arguments. Chrome was entirely built to be leveraged to force people to use Google Search, since people don't change their default search engine. Bear in mind, they paid Apple and Mozilla each over a billion dollars to be everyone's default search. Sundar Pichai, the current CEO of Google, got started by pushing the Google Toolbar as one of those bloatware add-ons when you install other software, that would hijack your default search when you installed it.

Google also leverages Android to force people to use all sorts of Google products, using their agreements with OEMs which ensure things like default search, default maps, default email setup, etc. That's the whole point of Android.

Google's anticompetitive behavior is extremely active, and they make Microsoft look like an innocent kitten in comparison. It sounds like you don't know a whole lot about how Google operates as a business.

<comment><USER27> > ... and they make Microsoft look like an innocent kitten in comparison.

It sounds like _you_ don't remember Microsoft back in the day. Google "Halloween Memos". (Edit: Note particularly the bit about "de-commodifying protocols", that is, finding ways to break standards and create lock-in.)

Microsoft literally paid web sites to put HTML in their pages so that Netscape wouldn't handle properly.

Microsoft literally generated false error messages when they detected a product from a competitor. (IIRC, that one was on a spreadsheet, and the product was maybe a DOS clone? There wasn't anything wrong with the clone, but the error message made it look like there was.)

An equivalent, today, for Google would be if, when you typed bing.com into Chrome, it took you to Google. Or if Android detected Microsoft apps and made them break in mysterious ways.

ouid's point is valid. Google is more passive in anticompetitive behavior. (That doesn't make the behavior good. It makes it less bad than Microsoft. Microsoft is hardly the "innocent kitten" here. However, I will concede that Microsoft hasn't been as bad as they were for... maybe a decade?)

<comment><USER26> I would argue that if you think any of that compares to Google, you don't have any clue what Google's been up to lately. ;)

But at least you can acknowledge that there's almost no comparable evidence of anticompetitive behavior from Microsoft in the last decade. But I acknowledge as well that if Microsoft were in a monopoly position again, as Google is now, they would be up to the same hijinks.

<comment><USER27> Microsoft arguably still is, in the OS area. What mellowed Microsoft out, in my view, was the US antitrust court case and resulting consent decree.

</comment></comment></comment></comment></comment></comment><comment><USER28> In my opinion, Google is a tolerated monopoly because of being efficient, and not being too greedy. I.e. providing many efficient "free" services that work great is a good thing for the society, and in return Google gets a massive lock-in in advertising and information control capability.

So, the dilemma is: if for having such great "free" services is required the existence of that kind of monopoly, should we tolerate it and accept it as a lesser evil?

</comment><comment><USER29> It seems neither Taplin or Schechter know what a _natural_ monopoly is

[https://en.wikipedia.org/wiki/Natural_monopoly](https://en.wikipedia.org/wiki/Natural_monopoly)

</comment><comment><USER30> The Bell System wasn't a natural monopoly.

AT&T had a monopoly on _long distance service_. The natural monopoly is _the last mile_. Even after Ma Bell was broken up, all the local natural monopolies were still there. Bell Atlantic (now Verizon) didn't serve the same territory as Southwestern Bell (now "AT&T").

The way that Ma Bell _became_ a national monopoly is that nobody originally prevented them from leveraging their last mile monopolies. If your network is the only way to reach millions of telephone customers in your service area, a smaller provider has no choice but to deal with you, and so absent regulation the bigger telco can charge whatever they want for interconnection. They can also show up with an offer to buy your network for cost in one hand and a bankruptcy-inducing interconnection bill in the other. If this sounds to you anything like the current debate over network neutrality, well spotted.

Google isn't AT&T, they're IBM.

</comment><comment><USER31> I think it's dangerous of Theil to absolve monopolies as "good". Monopolies can lead to deadweight loss and stagnation.

The human species only has limited supply of attention and "goto mindspace" to reach. Human attention is a natural resources, just like coal, or oil. Imagine if a single petrol company had access to all the oil on the Earth - <USER2> wouldn't be good.

On the other hand. There's not much we can do about this problem until consumers start seeing it as a problem. Once consumers do see it as a big problem - we'll have opportunities open to us :)

</comment><comment><USER12> An important difference that a lot of people seem to ignore:

Ma Bell's users were Ma Bell's customers.

Google's users are not Google's customers - they are Google's product. Google's customers are advertisers, and it is there where Google has a monopoly, and talk of "cost of switching" is meaningless in that respect - other advertising venues are meaningless for most advertisers.

</comment><comment><USER32> I use duckduckgo more than Google for search. I almost always get hits with duckduckgo, that I want, that are on page 2 of Google.

<comment><USER33> DuckDuckGo is great. It's gotten so much better in recent years, that I can't stand the poor results that Google yields recently.

TBH, if I can't find something on DDG, google won't have anything useful either.

</comment></comment><comment><USER34> So why is he leaving Microsoft out of the mix? He claims Google having an 88% share in advertising is a monopoly, why then claim that Microsoft is not a monopoly when it has a similar share of the PC space?

He says that Microsoft competes in the market with many players, but Google also competes in the market with many players.

</comment><comment><USER35> There is another advantage/disadvantage (depending on your perspective) to Google vs. AT&T that I haven't seen discussed.

One of the classical arguments in favor of monopolies is not just efficiency but that they concentrate capital for large-scale investment. In the case of AT&T this occurred with Bell Labs, and it is also happening with Google.

Whether an alternative system could be more innovative is impossible to determine. I am of the opinion that, even in Silicon Valley, the big firms (Bell Labs, Xerox, Google) make the biggest investments and innovations (semiconductors, operating systems, search engines), while smaller startups adapt these technologies to business uses.

<comment><USER36> That extra capital is extracted from society by impoverishing it.

If you wanted to tax people for research, the government can do it way more directly, without depending on the good will of a few rich people.

</comment></comment><comment><USER37> > Q: As you point out yourself in the book, natural monopoly can also be a > positive thing. For instance, in the cases of the telephone and the > telegraph. What is the difference between those natural monopolies and > digital platforms?

Of the interview, this was _by far_ the most interesting question and he didn't really answer it.

It could be argued that at the root of the net neutrality crisis is that cable companies don't have to risk a race to the bottom. If they did, they'd sing a different tune, if only to use "we will deliver everything to you without playing favorites or selling your data" as a sales pitch.

</comment><comment><USER38> I disagree on the term "natural", but I agree that Google is a monopoly. A phone company with last mile lines has a natural monopoly because competition need access to the last mile to offer their services. That is the reason that the Bell System was a natural monopoly and essentially every phone company on the planet.

Facebook has a near-natural monopoly I think, because of the network effects of its 1 billion memebers. Microsoft had one too, when everyone was developing everything for a PC running Windows, this got broken due to the web and smartphones.

Building a new search engine is not impossible, you just need a lot of breath and patience.

</comment><comment><USER39> One big difference is that Google is free its customers.

<comment><USER12> No. Google is free to its users, but the users are the product. The customers -- the advertisers -- pay dearly.

<comment><USER39> That is not how the FTC sees it.

<comment><USER12> What definition does the FTC use?

The IRS doesn't consider "time" or "privacy" a payment; if they did, you would have to report your internet browsing on your tax return because barter.

<comment><USER39> The FTC tends to see consumers...people.

</comment></comment></comment></comment></comment><comment><USER40> I have a feeling that it will get even worst when Google will dump the Linux kernel in favor of it's own. (with Google's "Fuchsia" smartphone OS)

</comment><comment><USER41> I wonder how does this refer to Microsoft with Azure and other companies with ultra-broad platform offerings with hundreds of services and products.

Maybe internet companies should scale horizontally and not verticly in their product offering after they reach certain size?

<comment><USER26> I think there's a huge issue with all of these companies being able to own so many disparate products. It creates an effect where users feel like they need to be in one company's ecosystem or another, and inherently protects bad products or bad business models from competition through this ecosystem effect.

People who use some Google services tend to use mostly Google services. People who use some Microsoft services tend to use mostly Microsoft services.

Without much stricter regulation to at bare minimum require more intercompatibility between competing ecosystems, I don't see this effect decreasing.

</comment></comment><comment><USER42> Microsoft still has over 90% of the desktop OS marketshare. How is this not even a greater natural monopoly?

</comment><comment><USER43> Amazon is far more scary as monopoly.

</comment><comment><USER44> I've worked hard at distancing myself from Google. It seems their motto "Don't be Evil" has about as many asterisks behind it as they can manage. Every product they design seems to be built from the ground up to enable data collection, and every advertiser they partner with seems to have build plausible deniability into every aspect of the "product" they claim to deliver. I can't point to anything in particular, but whenever I use any of their software it just feels...creepy.

At the moment I'm still tied to Chrome for bookmark sync but that's about it.

<comment><USER45> Google officially dropped the "Don't be Evil" motto a while back and picked up Alphabet's "Do the Right Thing" motto, which seems a lot more subjective.

<comment><USER46> Alphabet code of conduct: [https://abc.xyz/investor/other/code-of- conduct.html](https://abc.xyz/investor/other/code-of-conduct.html)

"Employees of Alphabet and its subsidiaries and controlled affiliates ("Alphabet") should do the right thing – follow the law, act honorably, and treat each other with respect."

"If you are employed by a subsidiary or controlled affiliate of Alphabet, please comply with your employer's code of conduct."

Google code of conduct: [https://abc.xyz/investor/other/google-code-of- conduct.html](https://abc.xyz/investor/other/google-code-of-conduct.html)

"Don't be evil."

<comment><USER44> But wouldn't that technically apply to only those working at Google, not the other Alphabet companies? Not that it really matters, both are utterly without meaning. I was just using it to show how their corporate personality has changed over the years.

<comment><USER47> That's a really silly way of doing it then. Besides, "do the right thing" is more restrictive than just "don't be evil"

<comment><USER26> "Do the right thing" for whom? Making money is definitely doing the right thing... for Google's bottom line.

<comment><USER48> "Don't be evil" to whom? Making money is definitely not evil...for Google's bottom line.

This is a silly game. Proof by corporate motto.

<comment><USER49> That's Amazon's strategy, where half of the leadership principles contradict the other half so there is always a way you can spin something.</comment></comment></comment></comment></comment></comment></comment></comment>


Show HN: WebGL voxel game with source - <AUTHOR> http://voxlords.webgl.nu <comment><USER2> Is there no rotation in this game? Can't do much aiming without that.

<comment><USER3> I found I could only rotate for about 90 degrees plus/minus. I tried to circumvent the problem by dragging my cursor outside of the window and bringing it back in on the opposite side so I could continue rotating. Strangely, the game sensed I had come in from the opposite side and reset the rotation to the exact same 90 degrees. It's purposefully attempting to be infuriating.

<comment><USER4> You need to let the browser capture your pointer.

<comment><USER3> I use Chrome. Is that a specific setting?

<comment><USER4> On FF it seems sort of fiddly. It should capture (or ask you if it can) any time you click in the window, but in practice sometimes I have to click twice, sometimes I have to right-click and then cancel the RMB menu, etc. YMMV...

</comment></comment></comment></comment></comment><comment><USER5> I love how I can run Crysis 2 on my laptop on Ultra with >30 FPS, and I'd be lucky to get ~24 FPS on this.

<comment><USER6> WebGL can be very fast though hand tuned JS code and shader optimization is very important. I have yet to see a Three.js based demos that runs with a high fps.

</comment></comment><comment><USER7> Left handed people do exist in the world. Forcing wasd is not a good idea

<comment><USER8> This seems like such an obvious thing, but I never thought of it, lol.

What key-bindings do you bind your wasd to or do the arrows suffice?

<comment><USER9> Don't force any specific layout. Just have defaults plus rebindable keys for all controls.

</comment></comment></comment><comment><USER6> It's based on Three.js, calling it "WebGL" is false advertising. It's like calling a Unreal or Unity based game "DirectX". Also it's already 5 months old and neither the website nore the Github or ChromeExperiments call it WebGL.

<comment><USER10> ThreeJS is a library on top of WebGL. It's an implementation detail -- whether it uses ThreeJS, stackgl, or your home-brew library, it still uses WebGL as its primary technology.

<comment><USER11> Well, by that logic, everything is written in assembly since everything uses assembly as its primary technology.

<comment><USER12> Though you may have read the title as "game written in webgl" I'm pretty sure it's meant to be read as "game using webgl". My guess is you and frik read it using the former interpretation while others used the latter.</comment></comment></comment></comment>


Spotify giving family account owners a free Google Home Mini - <AUTHOR> https://www.theverge.com/2018/10/31/18044836/spotify-family-account-free-google-home-mini <comment><AUTHOR> It starts today through the end of the year. They say the amount is limited but I didn't see a total number of devices anywhere.

Direct link to the offer is on this page - [https://www.spotify.com/us/family/](https://www.spotify.com/us/family/)

<comment><AUTHOR> I've been granted mine already and checkout was through the Google Store.

Estimated arrival time is 3 weeks for free shipping but you can upgrade for a fee.</comment></comment>


Show HN : Web IDE in Python ( Bottle Framework ) - <AUTHOR> https://github.com/baseapp/liveide

<comment><AUTHOR> We am getting this IDE made for running on routers/embedded systems/robots . Its aim is to be a tiny IDE providing live programming experience on small devices.

We would like to hear what do you guys have to say and how can we improve it :) .</comment>


The $2 Million Mobile Game - <AUTHOR> http://ralphbarbagallo.com/2012/07/30/the-2-million-mobile-game/

<comment><USER2> Reading this just makes me want to have no part in mobile game development.</comment>


Titan Security Key No Longer Available from the Google Store - <AUTHOR> https://www.androidpolice.com/2019/02/23/titan-security-key-no-longer-available-from-the-google-store/ <comment><USER2> That sounds scary. Any google people around to tell me why this happened?</comment>


Show HN: Monarch Trips – Plan Your Trip in Minutes - <AUTHOR> https://monarchtrips.io <comment><AUTHOR> Dev here.

We couldn't find an easy way to organize your places into day plans nor see all your locations on a map so we built this. You can collaborate on your trips with friends as well using iCloud sync.

We would love your feedback. Here are some promo codes to get you started:

AR9T49PY6HXR KKXRMLNPYTPE 3H6LJRNJEJNE MTMRXPPTMPXX FNTP4HJXYK9J</comment>


Laws of Physics Can't Trump the Bonds of Love - <AUTHOR> http://well.blogs.nytimes.com/2012/12/24/laws-of-physics-cant-trump-the-bonds-of-love/ Mr. Wright's Law - "I could care less about Newtons 3rd law, I want to teach you something that you can use outside of school". <comment><USER2> Truly Inspiring. Thanks for posting!</comment>


Jack Andraka, 15, Wins Intel Science Competition For Pancreatic Cancer Research - <AUTHOR> http://www.huffingtonpost.com/2012/05/22/jack-andraka-15-wins-inte_n_1535741.html

<comment><USER2> [2012]</comment>


Ask HN: What is your take on the US stock market downturn? - <AUTHOR> <comment><USER2> Well, what did you expect when you launched massive tax cuts to stimulate an economy that was already running at full speed?

Or was it the tarrifs? Maybe the skirmish with Saudi? Pissing off the EU? Making China unstable?

Hell, I give up. It was fun while it lasted, right?</comment>


Sophisticated Computer Graphics Behind the 1977 Yellow Pages - <AUTHOR> http://gizmodo.com/5901367/the-surprisingly-sophisticated-computer-graphics-behind-the-1977-yellow-pages

<comment><USER2> Blog spam

[http://techchannel.att.com/play- video.cfm/2012/4/11/AT&T...](http://techchannel.att.com/play- video.cfm/2012/4/11/AT&T-Archives-Yellow-Pages-by-Computer-Graphics)

<comment><AUTHOR> Gizrrrmodo !</comment></comment>


Study reports cell phones may be making us hypersocial, rather than antisocial - <AUTHOR> https://neurosciencenews.com/social-interaction-addiction-8445/ <comment><USER2> > "We're Not Addicted to Smartphones, We're Addicted to Social Interaction" > [title of linked article]

Social interaction is a requirement for being a fully healthy human. Just like food, many people develop unhealthy behaviors with social interactions. It's important to choose healthy relationships and healthy ways of nurturing those relationships. Cellphones are a tool, there are healthy and unhealthy ways of using it.

We should focus on educating people on self reflection, so they can notice when their own behaviors are not in the best interest. In this way we protect not only against Cellphone Addiction Disorder (or whatever the DSM ends up naming it), but other future technology use disorders as well.

</comment><comment><USER3> > Relax and celebrate the fact your addiction reflects a normal urge to > connect with others!

Addicting partly because it's so easy. It's much harder than going into "impro" mode and striking up a conversation which will hold someone's interest around just about any topic.

Another angle is that I know people who have social anxiety who spend a lot of time chatting on FB. I suppose there are some pros and cons to this, but being hypersocial on a cell doesn't seem to ease face to face social anxiety. It's better than nothing though, I have also seen these people get involved in real activities through these interactions.

For me, hypersocial is hyperdistracted. I can't stand to chat more than a few minutes. Much prefer pricking the awkward bubble which surrounds people and breaking into a silly conversation. Sometimes it works, sometimes it doesn't, but the Ycombinator community knows all about experimentation. ;)

<comment><USER4> As someone who has struggled with social anxiety to varying degrees throughout life, online interactions are a bandage for the much larger issue. Communicating via text without the pressure of timing (generally) gives you the ability to think over your words and perfect the message. It also allows you to easily avoid and exit conversations you don't want to participate in. This doesn't help you to build some of the skills that are necessary to be social offline.

In my experience, social anxiety is being hung-up on all the "what ifs". I want all the information up front, and time to think over the "right" response. That mentality is enabled online.

Like everything, balance is key. I do believe that having the ability to communicate so easily online has benefited me socially overall. However, I have the feeling that if we had been as connected as we are today back when I was kid, I wouldn't have been able to reach that balance at the point I did.

</comment></comment><comment><USER5> Makes sense. Hypersocial seems like a good thing to me. Am I the only person who likes how connected phones have made us?

Seems like sentiments shared on here are often focused on the negatives.

I met the love of my life on social media.

I do business with people because of social media.

Being connected has let me speak with folks I never would have had the opportunity to speak with otherwise.

<comment><USER6> You might just have figured out how to use technology to your advantage.

I have a friend who can't stay away from his phone. I hate meeting up with him and then having to share his attention with his other acquaintances that I don't know, and can't even see. We sometimes play ping-pong, and even that often gets interrupted by phone checks.

<comment><USER7> This just tells you that your are just not that important to him.

Thought experiment: if he was playing ping-pong with a celebrity

<comment><USER8> >This just tells you that your are just not that important to him.*

That's the problem though: it's not just that are people X and Y, and X is "by nature or nurture" not that important to Y.

It's also that modern technology encourages X being indifferent to Y (and e.g. maximising its eyeball capture).

Not everything is about conscious decisions -- or even subconscious but from someplace within us. There are tons of factors (like social norms, fashion, family, ads, etc) that influence us and shape us, and not all of them for the better. Mobile phones are one such factor.

Evolutionary, the human is totally susceptible to all kinds of BS tricks and influences.

</comment></comment></comment></comment><comment><USER9> This study is simply moving the goalposts, conflating the low-quality screen interactions we have with the actual face-to-face social interactions that they are replacing.

"Hypersocial" has no meaningful definition. It doesn't speak to the quality of the interactions, nor to how they affect us in terms of happiness and quality of life. Those are the real measures that matter, not the number of micro- interactions we have through looking at text on a screen.

</comment><comment><USER10> The questions, are online connections actually social? Maybe more nuanced definitions are needed in the future. A big part of the benefits of social interactions is the physical parts that show positive benefits for health, like touch, hug,... when one gets hypersocial it is missing a set of dimensions that ordinary old school social interactions come along with.

<comment><USER11> Online interactions are just different. Yes they are not the same as IRL interactions, but they can be made around a shared interest, particularly something that might be hard to find where you live. So they can be more important.

</comment></comment><comment><USER12> Phones have enabled a shift toward high quantity, low quality social interaction.

</comment><comment><USER13> Imagine, a device that lets you connect in real time with any person in the world, making us _more_ social? Can't be.

Although it would be nice if we were all a little better at putting them away while interacting face to face. Or maybe I'm just boring and take too long to say things. It's hard to compete for attention with thousands of invisible people whose full time job it is to be entertaining

</comment><comment><USER14> I guess technically speaking we may be more social, but the number of times I see it used as an excuse to avoid face to face socializing makes me skeptical. People on their phones at dinner, standing in line, sitting on the train all could be making conversation with others around them, but it so much easier to just grab the phone.

<comment><USER15> Maybe that's because in the online world, you often _know_ the interests of the other person before you engage in a conversation.

Perhaps we should have this in the real world too. Or perhaps we need a combination of tech + real world communication, e.g. where you can see the profile of the people in your vicinity, so you can start a real-life conversation.

</comment></comment><comment><USER16> This story follows the same narrative as similar stories about fast food: It explains unhealthy behavior as a simple "evolutionary accident" where otherwise useful evolutionary urges are simply misplaced in today's industrialized world.

I don't think that theory holds up when a lot of today's product design is not only acutely aware of those urges but _actively tries to exploit them_.

E.g., yes, today, we are able to produce almost arbitrary quantities of fat and sugar-rich food. We could also produce food with different nutritional composition. Yet design for fast-food skews heavily towards heavy on fat and sugar and not much else - because obviously this kind of food will sell best, thanks to the evolutionary urges mentioned in the article.

The same thing happens on the internet - social networks actively waggle the carrot of rewarding social interactions to maximize engagement with the network.

</comment><comment> wu-ikkyu Being too hyper social inevitably leads to anti social behavior due to diminishing returns. In order to have deep, meaningful, long lasting relationships one must necessarily conserve their attention and forgoe social interactions with others.

</comment><comment><USER17> I don't see the ideas as mutually exclusive. Hyper-social in cause, perhaps, but the effect is incredibly increased antisocial.

TLDW; hypersocial sounds like a rebranding of the idea of social media</comment>


We own you: the sad story of startups - <AUTHOR> https://medium.com/mega-maker/we-own-you-9a97819ad292#.7ng5iwqvn <comment><USER2> Not bad advice.

There's a famous quote by a prominent businessman (maybe Jack Welch?) to the effect of "At the end of a workweek, you get your paycheck, and then you and your company are even." Of course, equity and stock options cloud the picture (likely in favor of the employer, since they have the informational and experiential advantage). But a good thing to keep in mind nonetheless.

Disclaimer: I've never worked for a startup.

</comment><comment><USER3> _" Increasingly, companies are demanding cult-like devotion. Do whatever it takes; sacrifice whatever you've got."_

Companies can only demand that as long as there's a supply of employees who are willing to give it to them.

Maybe it's those same companies who are complaining about how hard it is to find good people these days?

I think that in a healthy relationship, the employee is no more devoted to the company than the company is devoted the employee. Just how devoted are companies to their employees? Under the U.S. system of "at will" employment, your employer can fire you without cause and without warning. And it happens all the time.

</comment><comment><USER4> _And when you've lost your flavor,_

 _we'll spit you out._

This is the part people forget about most.

</comment><comment><USER5> "But since starting my professional life 17 years ago, I've seen many friends who "gave it all" as employees, only to be spit out when they were no longer needed."

What should one expect from a working relationship? Companies are there to make a profit, plain and simple. You are one of the many resources that allows them to do that.

"use your social network to promote the company, recruit friends to the team, go to events in the evening, and use your personal equipment."

Companies may expect this, but I will never give this much to a company..unless it's my own or I have a significant share. You just need to learn to say no. If enough people do this, companies won't expect it.

My advice is to only do this when you need to prove yourself/get your foot in the door/you are trying to build some experience because you are first starting out.

"All of this would be fine if employees benefited from their sacrifice in the same way their bosses do"

Employees don't benefit a much, because they often times either aren't making key decisions, don't have as much money or reputation on the line. You get rewarded more for a larger risk or a unique ability.

Would you open up a credit line in your name in exchange for a percentage of the company? If the company tanks, you owe that money to the bank.

This is what pretty much all business owners go thought and most employees aren't willing to risk.

"Bullshit! A business isn't a bloodline. A business is a business, and anyone who treats it otherwise will be disappointed."

Totally agree. This is a way to make it difficult to quit and guilt you into staying when things get rough.

"If your company gets acquired for $30 million (good luck!), your 0.1% is worth $30,000 (at best). Acquired for $1 million? You get $1,000. Crash and burn? 0.1% of zero is zero."

The problem with numbers like this is that every situation is different. A company that takes in tons of VC and is overvalued and then sold a few years later, will pay out to the VC first.

You also need to learn to read contracts (or get a lawyer to do it for you) and never sign something you don't understand or want. I take the emotion out of business and it makes things much easier.

"At least a startup gives you a "lottery's chance" of being rewarded as an employee."

If you want a chance to make millions, don't work for a startup, create your own. The risk is much higher, but so is the reward.

"I don't think you should give your best ideas to your employer."

I agree here too. I always saved my best ideas for myself and now run a profitable company with those ideas. My old boss is bankrupt.

"Create a side-project. Do something independently. Carve out a piece of your life, and mold it your way."

Be careful though. Many companies (especially in silicon valley) lay claim to all of your work.

I personally won't sign contracts like this and will specifically list all of my current businesses/side projects as my own and get it in writing. It's never really been a problem for me.</comment>