A photo is crashing some Android phones - <AUTHOR> https://www.bbc.com/news/technology-52891650 <comment><USER2> Curiosity (stupidity?) got the better of me and I ended up awake until 2am fixing this last night on my Pixel 3a.

I was fortunate enough to have developer mode & USB debugging enabled, which allowed me to install some code to clear the wallpaper using the WallpaperManager [0].

Sadly it wasn't as simple as pushing the code to the phone and running a command to execute it. When the device boots, it would crash _almost_ instantly and reboot into recovery mode after attempting to show the wallpaper a few times. This meant I couldn't put my passcode in, which meant Android refused to run the application I made to clear the wallpaper.

The ADB (Android Debug Bridge) tool [1] lets you replicate user input for the connected device, so you can basically swipe the screen / enter keys from the command line. I was able to use ADB to swipe up on the lock screen and enter my passcode. This was a start but wasn't enough, as the crash was happening before the wallpaper deleting app could be started.

I figured the unlock process was taking too much time, and found out after Android 8 (Oreo) you can actually use ADB to change or remove your passcode [2], provided you know your existing passcode. After I removed my passcode I was able to reboot the device, and run a single ADB command to swipe up on the screen and delete that cursed wallpaper.

And no it wasn't worth it, but I enjoyed the challenge

[0]. [https://developer.android.com/reference/android/app/Wallpape...](https://developer.android.com/reference/android/app/WallpaperManager)

[1]. [https://developer.android.com/studio/command- line/adb](https://developer.android.com/studio/command-line/adb)

[2]. [https://android.stackexchange.com/a/194779](https://android.stackexchange.com/a/194779)

<comment><USER3> Times like this are why it would be really nice for google to allow a root shell for developers when booted in recovery mode or something. Trying to fix this from userspace in the short window you have before the systemui crashes... what a silly avoidable nightmare.

<comment><USER4> You can root your phone, but then you lose SafetyNet which means that things like banking apps, etc. won't work. For "normal" developer access there's adb which does have some special privileges (nowhere close to actual root, but better than nothing), but using it to change screen background settings would be quite clunky. Even using the adb shell to delete the file would run into restrictions on general storage access that newer Androids have.

<comment><USER5> Magisk has an option to force enable passing SafetyNet, plus hide Magisk. If you combine those you can have root and still run banking apps and Google Pay like normal.

[https://www.didgeridoohan.com/magisk/MagiskHideSafetyNet](https://www.didgeridoohan.com/magisk/MagiskHideSafetyNet)

<comment><USER4> Magisk Hide is an unreliable workaround, since remote attestation of the running OS could be required at any time to pass SafetyNet. Even the author of Magisk Hide is well aware of this.

<comment><USER6> Could you explain that more, I didn't understand your response

<comment><USER7> See this tweet chain from the Magisk author. It seems Google might enable remote attestation at some point like they did for a short period during this tweet, defeating MagiskHide.

[https://twitter.com/topjohnwu/status/1245956080779198464?s=1...](https://twitter.com/topjohnwu/status/1245956080779198464?s=19)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> I wrote a lot of the Skia color management code involved here, and I think maybe I can clear some things up? I'd be happy to answer any questions you might have, either here or on [https://bugs.chromium.org/p/skia/issues/detail?id=10301](https://bugs.chromium.org/p/skia/issues/detail?id=10301) where we've been trying to think about how much Skia's involved with the root cause of this bug.

There's no "Skia color profile" per se. When Skia's asked to write a JPEG from a pixel buffer tagged with a color profile (SkColorSpace), we auto-generate an ICC profile programatically from the parameters that describe the color gamut and transfer functions we use to represent those color profiles. That's what the code in this file is up to: [https://source.chromium.org/chromium/chromium/src/+/master:t...](https://source.chromium.org/chromium/chromium/src/+/master:third_party/skia/src/core/SkICC.cpp)

So this profile is one of infinite possible profiles that'll have "Google/Skia/..big long MD5.." somewhere in them.

This profile in particular looks like it's probably describing the ProPhoto color space, which is very, very large and uses imaginary colors outside visible light to increase its gamut. While the JPEG itself is always storing values in range in the ProPhoto gamut, when you convert that to another gamut (say, to match the display, or to sRGB) it's very easy to end up with logical color channel values less than zero or greater than one, which do make a kind of sense, but not to code that expects colors are always sRGB bytes.

It's unclear to me what gamut the colors being read in that Java code are in, and that'd very much affect what the appropriate values for that LUMINOSITY_MATRIX should be. Those are the correct values to get the luminosity for sRGB colors (though I think what's being calculated here is subtly-different gamma-encoded "luma" instead), but they're not likely a sound way to get luminosity if the image is in any different gamut. A typical strategy is to convert any image you load to the display gamut early, since you'll need to do that eventually to display it. And it's more and more common that phone display gamuts are not sRGB, usually something wider now like Display P3.

<comment><USER9> From the Skia bug report:

> out of bounds write in Java

Isn't Java supposed to be a language safe from these kinds of bugs? At the very worst it throws an exception, which should be caught and dealt with accordingly… How can that crash the whole phone?

<comment><USER10> Every time there's a new programming language which claims to be "safer" than existing ones, I look at what they do differently. In some cases, they've come up with a new way to restrict computation so that undefined/error cases aren't possible. In many cases, though, their solution is more along the lines of "don't do that", often with syntax that discourages (but doesn't forbid) it.

The trouble is that it's really easy to say "access the 10th position in a 5-element array". It's possible to make a programming language that doesn't allow you to say this, but it either makes it really awkward to do anything with arrays, or simply pushes the error somewhere else -- or both.

<comment><USER11> Well, if this process had been written in C, this may have been a security issue, so Java is still an improvement.

<comment><USER12> Being able to deny a victim access to their phone just by having them set a given wallpaper definitely IS already a security issue.

<comment><USER11> OK, fair enough. But you know what I meant. :-)

</comment></comment></comment></comment></comment></comment><comment><USER13> _"Restarting the device in safe mode (by holding down the volume button during boot-up) did not fix the issue."_

So, lesson learned: in safe mode, do not use a background image that the user set.

<comment><USER14> Ha. Perhaps I'm misremembering, but I think I remember this behavior (not using the user background in safe mode) back in Windows 95.

<comment><USER15> It also removed the IE thing which showed icons or some stuff like that... Wait, that was in 98.

<comment><USER16> Active Desktop. [https://en.wikipedia.org/wiki/Active_Desktop](https://en.wikipedia.org/wiki/Active_Desktop)

<comment><USER17> Was that the feature that would occasionally replace your desktop background with an error message?

</comment></comment></comment></comment></comment><comment><USER18> Granted we understand "brick" to mean the device cannot boot, but this comes pretty damn close on some phones, it seems.

> "After setting the image in question as a wallpaper, the phone immediately > crashed. It attempted to reboot, but the screen would constantly turn on and > off, making it impossible to pass the security screen," he noted.

> Restarting the device in safe mode (by holding down the volume button during > boot-up) did not fix the issue."

If restarting doesn't fix it, and not even safe mode will allow you to change the wallpaper to get around it, what method of recovery is left for the affected user? Factory reset from recovery mode?

<comment><USER4> It depends. If the bootloader is unlocked, they could boot a custom recovery and alter the system image to try and insert a workaround (such as deleting the buggy library and dealing with the resulting breakage). If the data partition is fully unencrypted, they can even delete the offending file straight from recovery. On a bootloader-locked, fully encrypted device (the default nowadays) they'd be SOL and have to use the stock recovery or bootloader to force a factory reset - not only would that involve obvious data loss, but they would even have to deal with FRP afterwards.

<comment><USER19> You can also delete the offending file with a fully encrypted main storage, since twrp supports decrypting and mounting the storage on demand.

<comment><USER4> > since twrp supports decrypting and mounting the storage on demand.

It advertises that support, but I've never really seen it work. It seems that modern FDE on Android is such that you can only really "decrypt" from the system environment itself, not from different code - and it's not clear how to fix this.

<comment><USER20> >It advertises that support, but I've never really seen it work

works for me. it really depends on whether your TWRP distribution implemented it properly. AFAIK android phones don't have a mechanism to bind encryption keys to a system state (similar to sealing keys to PCRs for TPMs on PCs), so I don't think your theory is correct.

</comment></comment></comment></comment></comment><comment><USER20> Relevant code in AOSP: [https://android.googlesource.com/platform/frameworks/base/+/...](https://android.googlesource.com/platform/frameworks/base/+/refs/tags/android-10.0.0_r35/packages/SystemUI/src/com/android/systemui/glwallpaper/ImageProcessHelper.java#134)

<comment><USER21> And the comment in Color.java:

      * @return A float value with a range defined by the specified color's color space

<comment><USER22> Using the sum of three floats to index an array?

<comment><USER23> What could go wrong!

<comment><USER22> It looks like this comment is not right. There is:

      public static int blue (int color)

Anyway this thing has range [0, 255] and adding three of them together as an index of an int[256] doesn't seem like it would ever work regardless of the colorspace.

<comment><USER8> Red, green, and blue have been scaled by .2126, .7152, and .0722, which add up to 1.0 exactly (even in single-precision float), and if those values really were all in [0,255] range, the maximum value that could be produced by this math is only 254, due to rounding.

I think what's happening here is that the image is in a format that's holding those original red, green, and blue values in a format that can hold values outside logical [0,1].

Update: sorry, the comment below me doesn't seem to have a 'respond' link so I'll just edit one in here. I totally agree with you it's good practice to document your invariants in code, but in practice it would result in the same thing... an unhandled failure with nothing better to do than crash the process. In a way (if you squint) indexing into an array of size 256 is itself documenting the invariant that the index is less than 256. It's just that the invariant itself is wrong.

<comment><USER22> On my planet we write those invariants in code, such as

      CHECK(Color.red(pixel) < 55);

Or whatever.

<comment><USER20> You mean an assertion? I'm not sure how that would help. The code is still going to crash, and unless you tested for that specific case, it's not going to show up in testing either.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER24> I actually looked into this when I saw it in the original tweet. I tried with a current Android 10 emulator, crashed SystemUI. Tried with the latest build of AOSP, was a-ok. Whatever the issue was, looks like it got resolved already in either the Android color library or the ImageProcessHelper for the wallpaper (the piece of code that was initially crashing with an out of bounds error). I haven't spent much time looking into exactly when/where it was fixed, though.

Quick edit to add that, despite this, I do not believe those changes have made their way into most devices. It seems the error stemmed from the possibility of returning a value over 255 when a histogram was calculated from the addition of color values. As stated in the article, this seemed to result from the use of the Skia color profile in particular. I do not know about other color profiles. The code mentioned by gruez was what I got when the emulator was crashing.

<comment><USER25> This could explain why it might not have shown up in testing.

It's not just that the image had a non-sRGB colorspace, it's also that the pixel values in this specific image were out of the expected range.

<comment><USER26> "Out of expected range" values should be the very first thing to test for...

<comment><USER27> And maybe it was; maybe the colour space aspect also was.

Testing combinations of edges is not so common/obvious.

</comment></comment></comment></comment><comment><USER28> Citing a comment I can find anymore:

      For everyone who tried it and wants to recover phone without clean wipe. remove these files (I did it with twrp)

      /data/system/users/USER_ID/wallpaper_info.xml
      /data/system/users/USER_ID/wallpaper_orig
      /data/system/users/USER_ID/wallpaper

      it resets your wallpaper to default one

</comment><comment><USER29> According to the linked theory from @evowizz, _any_ photo with an unsupported colorspace would cause this issue. Seems like someone would have noticed before? Maybe in QA or at least during a beta instead of 9 months after launch?

<comment><USER30> What you see right now is the normal Google QA process.

They have literally billions of beta testers, who are even paying for the privilege.

</comment></comment><comment><USER31> The lack of quality control in the Android SDK is pretty impressive. It is by far the worst SDK I've ever used. Hell, even simple think like hiding/showing a keyboard requires a ton of code and checks. In 2020.

<comment><USER32> It is out of control.

I actually think between the HAL layer, OEMs, chipsets and 3P ecosystem it is very difficult to dig out of the hole that Android has built. Too much was put into short term thinking on annual releases and gap closing with Apple. While Apple planned APIs years out for end to end products, Android had to blindly copy APIs and everything is far less elegant. Android isn't working. It isn't capturing the smartwatch ecosystem well (Fitbit) and it isn't capturing the TV ecosystem well (Roku).

The net impact is harmful to developers. We don't get the reach and compatibility we were promised. We have very fragmented ecosystem to develop for. We have specific device SDKs we have to use to tap into novel hardware. I can't complain enough.

Android had a huge opportunity to define the next evolution of compute platforms on top of the linux kernel and it has kind of blown it.

I think there are even signs Google leadership sees this and is investing in a portfolio of strategies such as CameraX, Pixel, Flutter/Fuschia.

With the Huawei situation too, I think the general health of the Android ecosystem is some of the worst it has been. Globally I think we are going to see even more fragmentation.

We need something that ties this all together. It's not going to be a full blown OS layer, but something to manage the madness for 3P devs.

<comment><USER33> I find so tragic that Android is worse than J2ME in regards to fragmentation, worse than Symbian/iOS/Windows/Maemo/Jolla in C++ support, at every Google IO we get the best practices rebooted.

Oboe and Vulkan are very good examples how clunky everything is.

Here we have two API that are supposed to be relevant for the platform (real time audio C++ framework) and next generation 3D API support, for which we get told to clone github repos, compile everything from scratch and do the integration with the applications ourselves.

Comparing this with iOS SDK and XCode templates is just feels like having to nuke it all.

I have been moving away from NDK to WebGL 2.0 / WebAssembly, as it is good enough for my interactive demos and Chrome team at least seems to be a bit more sane.

<comment><USER34> I've made some WebGL/WASM experiments, too - getting my UI and 3D to the browser. Any references for running this on Android smartphones? (I want to make an app, not a website)

<comment><USER32> WebGL/WASM sounds like a good approach to solve fragmentation. Things will get even better once WebGPU is supported as a Vulkan substitute.

<comment><USER33> The irony of WebGPU, is that we will be able to get it via Chrome and frameworks like BabylonJS, while the Android team is not willing to provide something similar to Java/Kotlin devs.

Sceneform seems to be dead, and Filament is nothing more than a tech demo.

</comment></comment></comment></comment></comment></comment><comment><USER35> Remember those iOS text handling bugs? Fun.

</comment><comment><USER36> I wonder whether it would be a bad idea to have a "dev" mode where exceptions are thrown and a "production" mode of compilation where every single statement is wrapped in a try-catch block with a default behavior. For example:

        histogram = getHistogram();

should be wrapped automatically in:

        try { histogram = getHistogram(); }
        catch(Exception e) { console.log(e.toString()); histogram = DEFAULT_HISTOGRAM; }

Something like:

        y = a / b;

should be wrapped in:

        try { y = a/b; }
        catch(Exception e) { console.log(e.toString()); y = 1e999; }

Wrap every function call like this, and just don't let Java exceptions bring down an entire system in production especially when a lot of the time it's just a petty UI issue.

Obviously never do it in development though. But odd UI behavior instead of crashes might make a bunch more users happy which is ultimately what matters.

<comment><USER37> It seems that all you'd need is a single try-catch around the high-level operation. I inherited a system where all the errors were swallowed and it was a nightmare. If something failed it was impossible to tell why.

<comment><USER36> Yeah, I agree that the developer shouldn't do that in the source code. I'm more thinking of a compilation mode where the system tries to consistently do something just _slightly_ smarter than give up when there is an exception, and that is strictly only for production use.

A divide by zero error on a button's width shouldn't cause a spacecraft to give up and abort its mission to the moon. That wouldn't happen, but it's just a figurative description of what I would like. It's ridiculous for an OS to go into a boot loop because of a color histogram. A better behavior would be for the background to be set to an array of NaNs, and the background renderer to fail gracefully to a plain black or white background.

</comment></comment></comment><comment><USER38> Another article, which includes the wallpaper in question and the reason why it crashes the phone.

[https://techxplore.com/news/2020-06-wallpaper-image- android....](https://techxplore.com/news/2020-06-wallpaper-image-android.html)

</comment><comment><USER39> One more argument why do we need more (and more) fuzzing on a regular basis.

Basically everything where we can pass some specially encoded date (read as format or protocol) can be made with bugs and edge cases not covered by test or by intent look (how to say it properly in English? :)

So yeah, fuzzing.

</comment><comment><USER40> Tangentially related but that might interest fellow readers, you have multiple ways to make a valid image crash a device, one example being making a png bomb [1]. This is similar to a zip bomb, the file will by expanded to order of magnitude more bytes than its compressed size when opened, which might throw an oom error or fill up the disk quickly.

[1] [http://www.aerasec.de/security/advisories/decompression- bomb...](http://www.aerasec.de/security/advisories/decompression-bomb- vulnerability.html)

</comment><comment><USER41> Admittedly I haven't been following this story, but now that I see it on HN, am genuinely curious whether they were able to rule out that hardware is involved?

Also curious to know if perhaps there are flaws in the image format's spec that are being exploited?

</comment><comment><USER42> Oh wow, I set this on my Pixel 3 and started immediately flashing on and off. It reset and allowed me to do a factory reset, and now it works. That's crazy, don't do this.

To be clear, this was on my old phone not my main phone, so I didn't mind testing it.

</comment><comment><USER43> The article title is "Android: Why this photo is bricking some phones", which more accurately reflects the experience for the overwhelming majority of affected users. Would be good to update that.

</comment><comment><USER44> One of the biggest and most high profile software companies in the world can't reliably read image files on their flagship phone.

People are scared of AGI. This sort of shit scares me more.

</comment><comment><USER30> TL;DR: color profile in the metadata could not be interpreted by some phones. When you set that picture as your background it can cause your home screen to hang.

Samsung fixed this with an extremely eraly June security update. I think it took less than a week.

<comment><USER45> I wonder if Samsung will release this security update for phones released 3 or 4 years ago...

<comment><USER30> This was not a real security issue, but in general they update even old flagship devices for critical security issue.

IIRC, last time they had a really bad bug they updated some 4-5 year old Notes.

</comment></comment></comment><comment><USER46> I'm looking at this title and totally not willing to click on it... they don't include the actual photo I would hope.

<comment> Al-Khwarizmi They do, although they say the bug only happens if you set it as wallpaper.

I wouldn't click from a phone just in case, though.

<comment><USER47> I clicked it from one of the affected phones and nothing happened. Saved it, looked at it from the gallery... Nothing.

Seems like the crash is in some wallpaper-related code: [https://news.ycombinator.com/item?id=23404772](https://news.ycombinator.com/item?id=23404772)

</comment></comment></comment><comment><USER48> FYI, it is not bricking phones, but that doesn't make a good headline.

It is making some of them unusable, requiring a hard reset.

<comment><USER49> > It is making some of them unusable, requiring a hard reset.

Well that's still a " _soft brick_ " right?

</comment></comment><comment><USER50> Fun fact, there are also images that can cause some human beings to crash. Namely those that induce gamma oscillations such as black and white bar patterns.

It would be interesting to train a generative NN on human EEG response to create images that produce novel or unusual effects on the viewer.

<comment><USER51> There is McCollough effect, but it requires a long exposure to "crash" one's vision. Are there some examples of these patterns? (Beyond epilepsy-inducing blinking, ofc)

<comment><USER50> [https://pubmed.ncbi.nlm.nih.gov/28486114/](https://pubmed.ncbi.nlm.nih.gov/28486114/)

</comment></comment></comment><comment><USER52> Is that Squaretop Mountain in the Wind River Range?

</comment><comment><USER53> a photo I took on iphone x11 pro crashes my android when trying to set it as a background, wonder if this is related.

</comment><comment><USER54> Opening the picture in Windows Photo Viewer (the old on introduced in Windows 7) throws this error: "Windows Photo Viewer can't display this picture because there might not be enough memory available on your computer."

Other Windows included apps, like Paint, Paint3D and Photos open it just fine.

<comment><USER55> Paint is like the Notepad of Artwork apps. It can handle anything.

If notepad doesn't open it, nothing will.

</comment></comment><comment><USER56> Article says crash, not brick. Brick is not recoverable.

<comment><USER57> Soft bricks can be recovered from.

<comment><USER56> Neither the article nor the headline say soft brick. Besides, "soft brick" is just someone not wanting to admit that brick has an understood definition but they like the word brick and want to use it.

<comment><USER58> Does brick have an understood definition though? I think this is the millionth time I see this exact discussion about a news story using the term differently from the one true definition. That doesn't seem very understood to me.

<comment><USER59> It's so rare these days I really don't understand why people fuss over the definition.

It's almost impossible to brick anything with software, and even in hardware unless you damage the PCB itself you can usually recover if you tried hard enough (e.g. Even if you fry a $1500 FPGA you could technically reflow a new one and pray the bitstream is OK if you need it fixed _now_ \- although I'd rather you than me)

<comment><USER27> Technically you could also lay out new components and copper trace on an actual brick, too.

I've always understood it to mean 'broken beyond software or high-level firmware repair'. i.e. if not actually a blown component, something needs to be reflashed which has an inaccessible JTAG header or something, rather than something 'higher level' like recovery images over ADB & USB.

</comment></comment></comment></comment></comment></comment><comment><USER60> Bricking? I would say that a wipe can fix it.

</comment><comment><USER61> Crashing, not bricking. Can we update the title to remove the editorialization?

<comment><USER62> I have no idea why you are being down voted

<comment> ezequiel-garzon My guess: because there is no editorialization here, since the BBC title also says "bricking". The title _must be editorialized_ if you want to change it. Again, my guess. I used my upvote!</comment></comment></comment>


Space Invaders: A Burglar's Guide to the City - <AUTHOR> https://lareviewofbooks.org/article/space-invaders/ <comment><USER2> I never studied literature and so never became desensitized to its particular brand of ridiculousness, which can be fascinating in small doses.

Between the original author and the reviewer, "reshape our understanding of the built environment" "burglary activates a different awareness of space" "interrogations of urban design and architecture" "alternative form of architectural criticism" ...etc. (stops skimming)

I was never much good at papers in school because I can't bullshit (plus I somewhat don't fall for it well, making it somewhat hard to believe others will eat it up). To the outsider, it seems ... ermmm... inventive in a way, like something you wouldn't have thought to say yourself, but probably if you have the humanities degree it starts to look like a well-worn set of mix-and- match cliches like the commonly used primitives in any field.

<comment><USER3> I spent a second or two thinking about the quotes you used, and I disagree. They're all true and expressing abstract concepts that I find hard to simplify. That last one is definitely pushing it though.

<comment><USER4> "interrogations of urban design and architecture"

this.

it'd take me paragraph(s?) to convey the concept of design systems having personality (be it of a single designer, or the relationship/history of the city/building/whatever-scale) and questioning "facts" and probing various things. some things push back, some things give; sometimes you peel back layered patchworks of systems.

when traveling, i love walking around and intentionally getting lost and trying to "listen" [1] when visiting a new town/city -- i've always considered this my "greeting" or "polite conversation" with a city.

if the above is a conversation, then something more brutal or invasive is an interrogation. i've done enough construction/renovation work that i have a solid grasp of residential building codes and their changes over past 20 years, and a more corse understanding for past 50+ years. when starting a project, there's a "slightly invasive" probing that takes place to understand what era(s) of building codes you're dealing with and what you can exploit or what may be an obstacle.

so, yeah, i find "interrogations of urban design an architecture" to be a extremely efficient and dense encoding of knowledge.

[1] smaller or older cities, walkable.

</comment></comment></comment><comment><USER5> A Burglar's Guide to the City is a good read. I have recommended it to a number of people. Two weeks ago while visiting San Fran I went to a security meetup and mentioned the book. One of the individuals pulled out the book and said he was reading it. Then he turned to a page that mentioned his name and noted his contribution to the book. Small world. One of my favorite subjects in the book is Nakatomi Space[1].

[1] [http://www.bldgblog.com/2010/01/nakatomi- space/](http://www.bldgblog.com/2010/01/nakatomi-space/)

<comment><USER6> The technique goes quite a way back--it was used extensively in the urban fighting in WW II, and I believe that the US troops used it in Buena Vista during the Mexican War.

</comment></comment><comment><USER7> He talks about a game called "Super Bad", but I believe he meant Super Hot. [http://superhotgame.com/](http://superhotgame.com/)

<comment><USER8> Also interesting that he neglected to mention GTA V which has several heist missions that seem inspired by a few real life LA heists (including the hole through the vault floor via sewer caper).

</comment></comment><comment><USER9> I read the book two weeks ago. It was decent I guess made me more aware of some things I've been thinking about peripherally anyway.

Pretty light overall though. If anyone wants I can mail them my copy for cost of shipping.

<comment><USER10> I would like to read it please. My address is 5620 jackson farms drive nw, lilburn ga 30047

</comment></comment><comment><USER11> > _Or consider Bill Mason, an ex-burglar Manaugh profiles, who became so adept > at deciphering municipal building codes that he could mentally construct the > layout of an apartment simply by scanning the placement of exterior fire > escapes._

My weird hobby as a kid was looking at the windows of our apartment building and figuring out which ones belonged to which apartments. I wonder if I narrowly escaped a life of crime.

</comment><comment><USER12> I thought for a moment this was about the french artist "Invader".

[http://www.space-invaders.com/home/](http://www.space-invaders.com/home/)

</comment><comment><USER13> Isn't this something that some MIT students do to their campus?</comment>


Linode is having an outage? - <AUTHOR> Irc bots just disconnected. Site inaccessible. SSH/DBs down. Linode's website is down. <comment><USER2> Just called them, they seem to be aware of the issue.

Merry Xmax everyone btw.

Edit: Huh, why was this post flagged? I don't understand.

</comment><comment><USER3> ~100Gbit attack against dallas infrastructure, router crashed/doesn't have enough BW to announce IPs and therefore the whole netblock is nullrouted.

<comment><USER4> Where did you hear this?</comment></comment>


Personal OKRs for Success - <AUTHOR> https://mohitkhare.me/blog/personal-okrs/ <comment><USER2> I'd posit this quantitative approach is harmful not only to one's personal life - turning yourself into a robot, forgetting that life is more akin to a dance than a project with a budget and a deadline. Something that you do to enjoy even though it has no apparent goal.

Analogy taken from Alan Watts - [https://youtu.be/rBpaUICxEhk](https://youtu.be/rBpaUICxEhk)

I'd also posit that quantitative approach to business is also harmful. This path is taken by companies under stress of scaling - trying to find out a self organizing simple structure. The end result always turns out to be a siloed mess run by micromanagers and people "cheating" the system to satisfy some set of arbitrary metrics and the organization turning into a social laboratory full of instances of Goodhart's law and Cobra Effects.

[https://en.m.wikipedia.org/wiki/Goodhart%27s_law](https://en.m.wikipedia.org/wiki/Goodhart%27s_law) [https://en.m.wikipedia.org/wiki/Cobra_effect](https://en.m.wikipedia.org/wiki/Cobra_effect)

I have yet to seen a successful implementation of it. Usually a Lean and System Thinking common sense look at the organization is sufficient to run a successful team or a company, but only so few are interested when quantitative (micromanaging) approach is so popular and sexy.

Lean and Functional Programming: [https://youtu.be/5s55LA2Renc](https://youtu.be/5s55LA2Renc)

<comment><USER3> Some things work quantitatively, some don't. I like using quantities for athletic training.

If I was training for a marathon I would set numerical goals for how much I would run a week coming into it. If I am recovering from an injury that's even more the case.

Lately my son and I have been learning a martial arts form that has about 80 steps in it. There is a lot new about it for us: I've never done a two-person form or a weapons form before, and he's never trained in a form at all. You learn this kind of thing by breaking it up into pieces: so we have a burndown chart on the wall for it, which I think is a good motivation.

<comment><USER4> Quantitative approach aka "noob gains" stops working fairly quickly even with athletic training

<comment><USER5> "Noob gains" doesn't have anything to do with setting goals or quantitatively measuring progress. It refers to the speed at which unadapted athletes are able to progress (e.g. add weight to the bar, run farther) each workout when they first start training, compared to athletes who have been training longer, are more adapted, and progress slower.

Most professional and highly adapted athletes are extremely quantitative about their training programs, much more so at the advanced stages than in the early stages. They just progress much slower because it takes more training for their bodies to continue adapting.

</comment></comment></comment></comment><comment><USER6> Basecamp first launched when I was in college, and being completely unfamiliar with any project management workflow I thought: "this would be great for managing myself" so I set milestones and wrote entries for myself and project managed my life for a brief period.

It makes life as boring as work.

These methods are meant for teams working towards a common objective, where anything extraneous to the OKRs is considered a distraction. This has its shortcomings (I've met way too many project managers who seem to be so absorbed by metrics they fail to see what is right in front of their noses). It's most definitely useful is this context, but not in life.

Consider: the author has set himself to read 20 books per year. Suppose this is double of his standard. What he will do to fulfill his OKR? He's not going to choose a difficult read such as Ulysses, or an existential crisis inducing book such as Crime and Punishment, he will go for what is more superficial and easier to read, because his goal is not to be transformed by what he reads, his goal is to read 20 books.

The crucial layer of meaning is lost when we project-manage ourselves. Life is more akin to a poem than it is to a project.

<comment><USER7> Our values determine our metrics.

<comment><USER6> Our true values (as human beings, not organizational values) are not measurable. I may want to become closer to my family, so I schedule more time with them. Spending time with them makes it more likely, but it may also go in the opposite direction through conflict.

In paper you have accomplished your OKR, but in practice you are further away from your true goal.

<comment><USER8> That, again, is a result of measuring the wrong thing. The measurement should be "relationship strength" or "spouse/child happiness" not "time spent".

The problem that most of us seem to have is that we're only tracking easy things to measure. Everything valuable is difficult to measure.

Reading a book is _worthless_. The purpose of reading a book is to gain something (learn something, read faster, practice public speaking, etc.). That's what we should be tracking.

<comment><AUTHOR> Agreeing on this! I usually use notes section in KRs to track how I improved after completing this KR. This helps in deciding the way ahead.

Also, this doesn't really apply to emotional relationships for me. Personal OKRs are basically for self improvement which helps me in reaching something I aim for future.

</comment></comment></comment></comment></comment><comment><USER9> At almost 40, I've come to realize that work gives me plenty enough opportunities to track and measure performance as it is. But there's also that part of life that's not work, and I've found that merely _being_ , as opposed to performing, is quite valuable in itself! It's hard to enjoy the moment with my kids, my spouse and my friends when I constantly think of my todos and objectives. I feel by now that the goal is to learn to balance between times of performance and times of non-performance, even multiple times a day.

<comment><USER10> As a 46 year old I second this! Trying to run your personal life with OKRs sounds like a great way to beat yourself up. Also your spouse won't be impressed when you tell her "My goal was to spend 46 minutes really listening to you this week and I actually achieved 52 minutes!"

<comment><USER11> You can base your KR on her satisfaction (as reported on an end-of-quarter survey) rather than on your level of activity.

Try to measure the outcomes rather than the activities :)

<comment><USER12> This guy gets it.

</comment></comment></comment></comment><comment><USER13> Reminds me of this Team Blind post

> My wife and I are competing our annual reviews of each other. One of the > challenges I'm facing this year is we didn't agree on OKRs and I have a lot > of qualitative feedback but don't like how the KPIs look. I'm worried her > annual review of me will be similar. We both aligned that we'd max out > 401ks, move for promotions and end a car lease. But her career moved faster > and we don't have joint accounts so I failed to enter a savings goal. I'm > going to suggest she didn't save enough to see if I can get insight. Also > the household itself did well this year we deceased our order in rate by 15% > while moving to a good mix of organics and non frozen items +20%.

[https://www.teamblind.com/post/My-wife-and-I-write-each- othe...](https://www.teamblind.com/post/My-wife-and-I-write-each-other-annual- reviews-Need-advice-eEzsioRp)

</comment><comment><USER14> Thankfully my company has forgotten about their OKRs initiative. Trying to figure out 10-15 _useful_ personal metrics was stressful and a waste of time. And they rightfully would get bulldozed over and ignored by our actual need to implement new change requests/features.

Not to mention all the "guides" seem to be dedicated to companies that are B2C or already heavily use the word "engagement" or depend on ad clicks or only make sense for the sales/marketing team.

</comment><comment><USER15> We began using OKRs at my job a few quarters ago and it's been amazing. Though there are two very important points to make here, that I don't think the OP included:

1\. Contrary to the article, I would say that OKR's need not be binary (complete or incomplete). We use a 0-1 scale but we consider >=0.7 to be considered "done enough". The reason we do this is to encourage our teams to strive for ambitious yet realistic goals.

2\. Essential to the idea of OKRs is the distinction between outcomes and outputs. An output is the _actual work_ you're going to do, whereas the _outcome_ is the resulting change/effect you want to have. A KR should track the outcome, not the output. When devs first start out using OKRs, they write in KRs like "decrease lines of code by 25%". This is actually an output. An outcome would be "customer spends 50% less time waiting for page load". Reducing the lines of code would contribute to that outcome, but so would many other things. Those are outputs.

Here's a great book on the subject:

[https://www.amazon.com/Outcomes-Over-Output-customer- behavio...](https://www.amazon.com/Outcomes-Over-Output-customer-behavior- ebook/dp/B07QJ1Y8Y5)

</comment><comment><USER16> Obsessing over productivity in your personal life seems like a mistake to me.

Sure, it's good to get things done. But its also important to remember that we are human beings. Quite literally animals living on a rock that is flying through space.

Not every minute of our life needs to be tracked and judged and stressed over. It's perfectly heathy to just do nothing sometimes. It is ok to have an unproductive day, or week, or period in your life.

</comment><comment><USER17> I agree with the other comments that life should have a flow element to it, and that you can accidentally suck the joy out of it with too much structure.

On the other hand, some people have too little structure, and are miserable because of it. I realized this when I had kids: structure didn't make them miserable; in fact, it gave them a sort of calm, and reassurance, and clear expectations.

There's a balance. The "key" part of OKR is important — find the most impactful, highest leverage thing to measure, and focus on that. If you're a student, that could mean getting a good grade in a course that's very important to you. Too many goals can be as stressful as too few.

When I was younger I was perhaps too far on the unstructured side. There were creative benefits of that, but the detriment was ratholing on things that ultimately weren't very impactful.

Ultimately, you have to keep yourself in check. It's important to have open ended, exploratory time with no clear purpose. It can also be helpful to have some clear, _key_ results as an anchor.

</comment><comment><USER18> I rarely wish my personal life was more like work. If you have longer term ambitions approach it as a form of play, not obligation, you'll probably be more likely stick to it.

</comment><comment><USER19> Anyone that's done larger scale project management knows that it doesn't fall into agile or waterfall. You may use waterfall for the larger plan, and agile to track individual projects in that plan. Like when people talk about tactics vs strategy.

I think this use of personal OKRs might work for some people and might be a great tool for focus. This feels like a technique to manage individual projects, in that analogy.

However, I think it would be very easy to find yourself over-quantifying your life and find yourself feeling adrift even though you're succeeding on the numbers.

One thing that is very powerful about the regret minimization framework ([https://www.youtube.com/watch?v=YlgkfOr_GLY](https://www.youtube.com/watch?v=YlgkfOr_GLY) \- Bezos, famously) is that if forcing you to think about _what you want to accomplish with your life_ and _what makes you truly satisfied_. If you know those, then quantifying your progress towards those goals makes sense. If you don't, then it's probably premature to have OKRs. OKRs measure progress towards a larger goal. Don't forget the lesson of The Hitchhiker's Guide, and make sure that you are working towards good goals first.

</comment><comment><USER20> Maybe this works for some people, but to me it looks like a great way to make life as soulless as work. It also looks like it falls into the same trap of objectives set to lead to preconceived key results. From the blog's example, it looks like they wanted to read more and create some open source projects so you find an objective that fits those key results, not the other way around. I say this because reading 20 books and creating 2 open source projects are very narrow ways of "boosting knowledge." There are lots of ways to boost knowledge, and there are many different kinds of knowledge. Volunteering in a soup kitchen, as a tired example, is a great way to boost your knowledge of the world outside of your bubble and how other people live. Creating 2 open source projects is a great way to thicken the walls of your bubble. Here's a KR I'd suggest instead to boost knowledge: find a way to do outdoor manual labor twice a week, whatever it is. That will boost your knowledge of something, certainly.

But to each their own, whatever makes you happy. I just know this would make me miserable. These key results look like a way to make your personal life just more training for your work life.

</comment><comment><USER21> Two points that I would change when doing OKRs:

KRs should not be binary. They should be stretch goals. If you're hitting 100% on your key results you need to be setting your sights higher.

KRs should be things you can "influence" and not things you "do". It's the difference between "Get 100 subscribers to my newsletter" and "Write 100 blog posts". Or to use the example in the post, the difference between "Earn a X% return on my investments" vs "Read 3 books on investing". When you create key results around things you do, you run the risk of spending your time focusing on things that do not move the needle on your objectives. Last thing you want is to reach the end of the quarter and find your efforts have not had a tangible benefit. This is the classic "Outcomes" vs "Output".

</comment><comment><USER22> Look the point of education is that people who have travelled the road before you tell you what milestones you should meet - an education syllabus is the distilled "you ought to" of hundreds or thousands of people's lives.

But your actual life is a series of explorations - sure push yourself, but more important than anything is time to build relationships. especially with your kids if you have them.

</comment><comment><USER23> On a more tactical level here's what I do: every week I write what I've done in the past week, and what I plan to do next week. I do not stick too closely to my plan for next week, but do try to do whatever I planned, and more, with the goal of maintaining high usable throughput rather than adhering to the plan per se. I do not use any management tools, and I do not "track progress" in any way. Work is broken down in chunks that take at most a day.

I do this both for my own work, and when consulting for clients (separate lists). For clients the retrospective part is very easy to do, since I track my time there.

This has two major effects:

1\. You sort of already know what to do when otherwise there'd be an urge to procractinate because you "don't know what to do".

2\. You see your actual productivity, which, if you actually sit down and work, tends to be substantial, but doesn't _feel_ substantial. To me it always feels like I haven't done much, until I write down what I have actually done.

</comment><comment><USER24> I used to be a little obsessed over maximizing my own personal metrics. I'd track the number of hours I'd worked, the number of days I'd hit the gym, and even the number of hours I'd spent on hobbies.

Then I got burned out and took a 3 month sabbatical in November last year. And just when I hit the desk again in February, the pandemic stuck. All those elaborate plans and spreadsheets - out of the window.

All this has made me realize that's it's futile to try and optimize existence. It actively kills creativity and joy. And things completely outside your control will toy with your elaborate plans anyway.

</comment><comment><USER25> It's impressive that "OKRs" (inspired by Google in the modern business culture) are so worshipped despite being a management truncheon that helped Google go from being universally loved to being largely despised (killing products that don't meet short term growth KRs, Google+ optimizing for Engagement KRs, generally running the business to hit vanity metrics instead instead of building a quality product and having faith in users to adopt it and customers to pay for it.)

</comment><comment><USER26> @duopixel mentioned that life is more akin to a poem, and I agree with that. OKRs for personal management seem amazing on the surface, but they can be too focused on optimising for goals. I would suggest adopting a mindset like "First Things First" (from Stephen Covey, author of 7 Habits of Highly Effective People) and incorporating OKRs into that instead. I think it would give more flexibility in identifying what your values are in life, and attempting to achieve goals within those values.

</comment><comment><USER27> Does something like this exist that integrates with Google calendar? To keep track of monthly or life goals?

</comment><comment><USER3> OKRs leave a terrible taste in my mouth from experience.

I saw them used at a struggling startup, where it seemed we had just one real goal (e.g. "find product-market fit") rather than a large number of objectives. We were already zig-zagging a lot, and we just didn't need the distraction of creating and maintaining OKRs, never mind yet another tool to create confusion about what was essential and what was not.

My first thought when I heard about it was the book "The Goal" where the protagonist's friend immediately says that a business in crisis has one goal: quantitative methods are important to find and remove the bottlenecks for that goal. (In that a startup hasn't established a profitable business at first, it shares quite a bit with a failing car factory or restaurant.)

Going back to Pareto, social scientists have established that you really can't find a total ordering for the world's utility function. A world where everything else is the same and I am $1 richer is a better world (partial ordering), but you can't compare that objectively to a world where you got $1 and I didn't.

This connects to a group of results (such as the Arrow Impossibility Theorem) that show that social science is limited in the way that mathematics is limited by Godel's theorem, the halting problem, etc. There is no voting system, economic system, etc. which provably produces "just" or "correct" results and in institution design we are stuck with limiting the damage that can be done by bad people.

A world where I hit 10 out of 10 OKRs is better than any in which I fail OKRs, in the real world that I hit 5 out of 10 it is hard to compare that to other 5 out of 10 outcomes that I could have had if I had made different choices.

There are some jobs that you can break down into pieces, say a supermarket cashier, the store has a model of what makes a good cashier, they have control charts at the front or in the break room for each of them on two metrics, one of which is the scan time (tied to the profitability of the business), another is the % of times you hit the "No Sale" button to open the cash drawer between customers, stop the scan clock, and cheat on the first metric.

That's profitable thinking because somebody thought it up a long time ago and the store manager knows it and the checkout manager who trained you knows it, and I thought it was fun when as a teen I could try but never beat certain middle-aged women who reminded me of my mother.

To expect every person to make a quantitative model of their work and have their manager review it, etc. is ridiculous. Many people don't think that way but do great at their jobs. People who have PhD's in quantitative thinking can also go into the weeds (e.g. either their first response is what I gave you above, they will pick one thing to maximize, present a Pareto Frontier of choices that is somebody elses problem, or just will go in circles until they get lucky, or learn the first answer the hard way.)

If they can pass as a neurotypical they'll get control of their systematizing urge and bullshit it the same way the sales person and art director do and get back to doing work done.</comment>


What do I tell the average Internet user about this? - <AUTHOR>

Here: http://techdirt.com/articles/20100325/0403568713.shtml
And the offending appliance: http://www.wired.com/threatlevel/2010/03/packet-forensics/
I've got hundreds of clients who use the Internet, but are not - as we would say - Internet savvy.  What do you think I should tell them (and what will you tell YOUR customers) when the idea that ANY government agency can spy on supposedly "secure" connections hits the mainstream?  I have some ideas, but you, my colleagues and superiors frequenting HN, must have some more insight... <comment><USER2> If I'm missing something, please tell me -- but the whole scheme relies on obtaining a fake SSL certificate. This type of attack has always been possible with a fake SSL cert. I don't see how this little blue box changes anything.

<comment><AUTHOR> It seems to me that one of the primary problems is that law enforcement agencies don't need a warrant or subpoena for the SSL certificate. Where's the accountability?

<comment><USER2> Agreed, but again, what's changed? This problem has always existed, and it's getting some airtime now because someone made a little blue box to that makes it a bit easier to configure.</comment></comment></comment>


The Hidden World Of Girls - <AUTHOR> http://www.npr.org/templates/story/story.php?storyId=124122126

<comment><USER2> Despite a lifelong fascination with the topic, I will not be tuning in.</comment>


Self-assigning Method Call Syntax (C#) - <AUTHOR> https://twitter.com/IvanKahl/status/1286592209433878529 <comment><USER2> Would there be issues with IEnumerables deferred execution?

e.g.

        var xs = new List<int>{1, 2, 3, 4, 5};
        xs.Select(Inc)
          .Where(IsEven);

If I run that, nothing happens, neither Inc or IsEven is called... Its not until the results are realised that they will be called. If Select was writing back to xs, would this break?</comment>


Did launching a web startup become 10x cheaper between 1998 and 2011? - <AUTHOR> http://christophjanz.blogspot.com/2011/02/launching-web-startup-became-10x.html <comment><USER4> Yes it's cheaper, but I'm a bit surprised at the comments. I was doing PHP in 1997 using msql and a bit later mysql (98?). Shared hosting wasn't as robust as it is today, and it wasn't as cheap - usually $20-$25 for something decent.

I 99 I started leasing a dedicated server - 200mhz with 128 megs for $100/month with decent bandwidth and transfer for my needs (10 gig/month to start with). I was able to put together quite a lot of projects and host them for that $99/month.

So, yes, undoubtedly things got cheaper, but not everyone was having to shell out $50k just to get any website up. I actually did a number of projects that would sometimes get sustained traffic (from usatoday, yahoo finance, etc) and had little problem on hardware that was costing perhaps $500/month.

Yes, it was the era of large VC funds pouring money in to lots of hardware/licensing - of course some people paid because it wasn't their money in the first place.

During the same period, I was also working at a company that had several multi-million dollar sites in development - massive budgets, hardware, project teams, etc. Heady times for sure. I got to see both sides of the fence at roughly the same time. Clients that had the millions would go to the agencies or hire top talent. Clients that didn't would still get their stuff done - <USER2> wasn't as 'all or nothing' as people like to remember.

<comment><USER5> Same here.

MySQL was a viable option for us -- in fact, it beat Oracle in just about every benchmark we could dream of. Sure, it didn't have referential integrity, but we didn't need it.

Also, we were using Apache with a few scripts, no need for vignette or any other weird stuff.

Things are getting cheaper, but they were always reasonably cheap if you knew what you were doing, AND didn't try to follow buzzwords or have full ACID properties for your instant messaging status updates.

</comment></comment><comment><USER6> It's much, much more than 10 times cheaper now.

In 1998, you pretty much had to use commercial software if your site had any kind of traffic. That usually meant an Oracle database, and Oracle would only really scale vertically, so you had to spend even more _up front_ on hardware that was powerful enough to scale.

Implementing Oracle on Sun wasn't something that most people (even good programmers) could do themselves, so they hired consulting companies, which cost even more.

Now, you _might_ pay $5-10K to outsource an iPhone app. Then, you'd easily pay $100K just to get your database implemented, and easily that again for licence fees for your web software (Vignette anyone?).

Now, you pay $20/month for a basic EC2 setup, knowing you can scale it out horizontally. Back then you'd pay $50K _up front_ for Sun hardware that would support the traffic you might get.

I don't know anything about the example given (DealPilot.com), but I do know that now days something that could run on shared hosting in 1997 could be hosted for close to free [1] now. That's still more than 10x less that $100/month.

I would also point out that developing an app for the iPhone costs $99 if you do it yourself (which appears to be how they built DealPilot.com), so that is _still_ more than 10x less than $100/month over a year.

Lets compare costs for a year:

1997: $100/month = $1200, plus $3000 for server = $4200 (I assume there were hosting costs for the server, but I'll assume they were similar to the $100/month for shared hosting)

2011: $20/month for EC2 hosting (being conservative here - EC2 would let the company start off a lot cheaper than this and scale expenses as revenue grew) + $99 Apple fee = $339

[1] Free hosting examples include: Google AppEngine up to its free tier, Amazon's free EC2 offer. There are numerous examples of < $5/month virtual servers available, too.

<comment><USER7> I think people often forget the value inherent in shared hosting. I host a lot of stuff with Dreamhost. I'm probably paying on the order of 25-50 cents a month per domain. I can setup a new domain and wordpress in about 5 minutes with a few clicks. Now that dreamhost supports rails3 it's an absolute dream. (no pun intended). mod_pagespeed? one click. They optimize everything and I pay a low monthly fee (<$10/month). I'd estimate about $140/month for comparable performance on EC2. Dreamhost's MySQL systems blow the doors off anything I've seen on EC2, and backups are free. (I haven't explored EC2's super high end packages)

If something takes off I'll buy a dedicated server for it, but if you're starting a company, get a Dreamhost account for $10/month and they throw the domain in for free. You can buy yourself two years of hosting runway for $200. If you max your dreamhost account you're well on your way.

I don't even bother paying for github, just throw git on my dreamhost account. (They have dedicated SVN services as well)

Also, I just got about a dozen notifications today that dreamhost had upgraded all my wordpress sites to 3.0.4. I don't do anything they take care of it. Someone breached an account? I get an email.

The only time I've ever run into trouble with dreamhost is an old old e-commerce site that needed MySQL4. I could get the ancient version of PHP it used working but couldn't get MySQL4.

<comment><USER6> Yeah, I have a dreamhost account too. The other features are excellent - things like SVN hosting, and they have a special account you can backup hundreds of Gbs of local files to.

It might not be the fastest, but you can't beat the value, especially if someone you know can give you a discount code (30OFFER is mine. I think I get some money off my bill if anyone uses it.. )

</comment></comment></comment><comment><USER8> Oh _hellz_ yes. I was there. Like rhizome says, it's a bigger factor than that; you can host stuff in the cloud now for _nothing_ when we had to cohost a used Sparcstation for, as I recall, $450 a month. That was 1996, and we could only do that because we knew the hosting company in Bloomington.

I glommed space on that machine for my own stuff for free - but I still had to pay $20 a month to _host the DNS_!!

<comment><USER9> $450 a month isn't that much for an investor. It's nothing compared to salary.

But I guess that the old Sparcstation could only handle a tiny load. Scaling it up to thousands of customers would have been very expensive.

<comment><USER8> Scaling? Well, fortunately, the online population was a lot smaller then, and we were targeting a niche (machine tools) - we still had some scaling issues, but nothing at all like you'd have to worry about now.

But yes - if we'd had to, it would have gotten expensive pretty quick.

</comment></comment></comment><comment><USER10> The basic question is whether what you need to get to a competitive level today is more labor (or better labor) and less capital than it was then. It seems to me that the answer almost has to be "yes"; there was no iPhone, no Android, no AJAX, no Comet, no Django, no memcached, no Varnish, almost no CSS, JavaScript didn't work, and Perl was your only option on the server side. Nowadays, knowledge gives you a much bigger slice of what you need to compete.

Also, lots of web startups then couldn't get by on a shared-hosting account or a used Sparc 20 in a colo, because it cost so much more to render a dynamic web page or to store data. And lots of people were paying Solaris licenses, Oracle licenses (MySQL didn't exist, and Postgres was still pretty flaky and slow), Netscape server licenses, and didn't F5 start selling BigIPs for load- balancing about that time? And your domain name cost $100 a year.

<comment><USER11> Well, both MySQL and PHP appeared in 1995. My got my first paid web development job in 1999 and we already had MySQL and PHP in production.

<comment><USER10> My memory of 1998 is still pretty fuzzy, but I thought MySQL was still pretty new at the time. (And of course it wasn't free software, but you didn't have to pay for it.)

</comment></comment></comment><comment><USER12> I love how all over the map the comments are.

There are so many vectors for comparison, it's ridiculous to try to generalize it. Seriously, different startups today cost several orders of magnitude different amounts _today_ based on what they are doing.

To make any kind of reasonable comparison, you have to look at specific costs. Sure, processing, memory and bandwidth are way more than 10x cheaper, but applications might eat up a lot of that with additional complexity. Open source software, modern browsers, the rise of REST APIs, and the relatively saturated and savvy userbase mean that some apps today are _infinitely_ better than they were 12 years ago (because they were previously impossible). On the other hand, people costs aren't any cheaper, the optimal size of a dev team hasn't changed, and you'll still need to expend the same amount of effort to compete regardless of how much better all technology products are overall.

</comment><comment><USER13> Also, in 1998 if you had a budget of a few million you didn't need to think about commodity hardware, so you called sun and blew some cash. Investors wouldn't take you seriously if you had a ramen profitable bare bones 2011 style operation!

<comment><USER7> Web was a capital intensive business then. Now you can do a web startup for less cost than a hotdog stand. Seriously, one year of hosting costs on the order of a business license. By 2000 costs had dropped dramatically.

</comment></comment><comment><USER14> I'd say more than that. The article didn't even mention the cost of a T-1.

</comment><comment><USER15> Back in "the good old days" you wouldn't dream of creating a website using anything but Java code and hosting it on your own server sitting in the back of your office: That required grabbing a $100k a year coder, a sys admin at at least $75k and costly hardware (and rent). These days you'd write the code in a language like PHP and outsource everything else with a cost of under $10k.

Something else we also tend to forget is that in 1998 the mere act of writing HTML was an overpriced and highly sought after skill in the hands of a very few. These days anyone from a child to a great grand parent can author a webpage without thinking about it by using Facebook.

<comment><USER5> Ahhm.

In the good old days, (1998), no one used Java on the server side. Java Applets were still not dead, and Java on the server was still not really born.

Apache SSI and perl were kings. AOLServer+tcl was probably the best available (though only known and used by a small group).

Java? We're not talking about the same 1998

<comment><USER16> _Apache SSI and perl were kings._

I think Matt's Script Archive was the face of that popularity. It still exists today <http://www.scriptarchive.com/>

<comment><USER14> Hah. At the very least problems with his formmail.pl gave many sysadmins job security for a solid 10 years.

<http://www.securitytracker.com/id/1001108>

<comment><USER16> Oh, definitely. If I had a dollar for every time I got burned by formmail.pl...

</comment></comment></comment></comment></comment><comment><USER17> With Google AppEngine all you need is a domain and a text editor. No sysadmin required and scales into the millions. Learn Python, BigTable and go create your startup, you have no excuse now.

</comment><comment><USER18> The R&D costs are still the same.

Sure, today you can develop prototype or MVP at fraction of the costs in 1998, but it's only 10% of total costs. The 90% is maintenance and support - <USER3> today it's not cheaper than then.

It can only be cheaper if founders willing to work for free. But this doesn't scale - sooner or later you need to hire employees, which will be demanding market priced salaries.

So, why then angels and VCs pushing entrepreneurs to do lean startups? The answer is simple: it allows them to reduce the risks, at the expense of entrepreneurs.

<comment><USER10> The interesting phenomenon is that these days you need a lot more "venture labor" in proportion to your "venture capital", so the labor — the founders and early employees — can extract a better deal relative to the capitalists.

It's true that eventually a growing business will take on people who demand nothing more than market-priced salaries, but the people you need to get off the ground won't be satisfied with that.

</comment></comment><comment><USER19> "why did startups raise so much VC at the end of the 1990s"

VCs pushed them hard to get users at any cost and ipo, since you could do so easily without profits.

</comment><comment><USER20> More like 50x.

</comment><comment><USER21> I just launched a site that I thought I needed $500,000 for in 2004. I launched it for free and did all the work myself. Thanks appharbor!</comment>


Twitsper, Group Tweeting App, Could Change Twitter As We Know It - <AUTHOR> http://www.huffingtonpost.com/2010/11/19/twitsper-group-tweeting-a_n_786027.html

<comment><USER2> If you have a group of people that all follow the same user, you can get semi- private group messaging by just @reply-ing that user. Others can see it if they go look for it, but it doesn't pollute the timelines of users who wouldn't care about the message.

For instance, in my coworking group, we can all prefix our tweets with @{coworking}, which we all follow. We can all see each others' replies to this common account, but Twitter filters it out for our followers who don't also follow that account.

</comment><comment><USER3> Isn't this exactly the sort of service that the recently-launched "Path" provides? [1]

[1] From TechCrunch: "Path is designed to share photos with only your closest 50 friends" (<http://techcrunch.com/2010/11/14/path-wrong-way/>)

In addition, Arrington goes on to mention the following, which I would venture to say also applies in this case:

 _> I am going to make another prediction. The types of photos people are going to share on Path by and large are going to be the same as the photos you see already in more public photo-sharing apps: meals, drinks, friends, kids, cats, dogs, and the random dross of daily life. Knowing that it is "private" and "safe" is not going to change much of anything._

</comment><comment><USER4> Those who don't know IRC are doomed to reinvent it... poorly!

</comment><comment><USER5> "Guided by professors at University of California-Riverside, computer science and engineering PhD students ... built Twitsper ..."

I don't see any inherent research value in this, so it's a little concerning that they had to be guided by professors in order to build this.</comment>


The US Finally Has a Defense Agency Devoted to Cybersecurity - sahin-boydas https://futurism.com/cybersecurity-us-defense-cisa <comment><AUTHOR> Better two decades late than never I suppose.</comment>


The Emerging Emerging-Markets Crisis - <AUTHOR> https://www.guggenheiminvestments.com/perspectives/global-cio-outlook/the-emerging-emerging-markets-crisis <comment><AUTHOR> > _For many EM countries, this pandemic will quickly escalate from a health > crisis to a humanitarian crisis, and ultimately to a solvency crisis. > Political stability will be the last domino to fall._</comment>


A polite rant on mobile UX - <AUTHOR> http://blog.hipwerk.com/a-polite-rant-on-mobile-ux/

<comment><USER3> > The so-called "ow zone" is a zone that is hard to reach with your thumb, > like corners of the screen.

The image that goes along with this point demonstrates the areas that are hard to reach for right-handed users, ignoring that ~10% of people are left-handed and have trouble reaching the opposite corners. Your design shouldn't assume that two particular corners are bad and the other two are fine, _all_ four corners should be used for uncommon options only.

<comment><USER4> I'm right handed, but I use my phone with my left hand. Most of the time because I need my dominant hand to do something more complex. I don't know if "handiness" really determines the hand in which you hold your phone.

</comment></comment><comment><USER5> "Android is Android"

I don't like the fact that Google's apps, all of them, feel foreign on iOS and OSX. Chrome has its own PDF renderer, settings pane, maximize behavior (before Yosemite), other little things. The iOS apps feel like the Android ones.

Google seems to be creating its own little OS inside of every other OS and the baseline is Chrome (OS). Wasn't there an effort, or talk about, to have Chrome do its own thing in Windows 8? This is why Material Design is important to Google. It targets the lowest common dominator, web browsers, and seems like it runs the same on a powerful computer or low-spec'd phone. While Material looks good, I feel that they may have held back a little because of browser limitations (you cannot do overlay blurring like iOS, for example).

Anyway, a lot of people love the common feel of apps across platforms. People seem to really like that about SublimeText and Chrome. I personally don't. I thought it was in poor taste when Apple made Safari and iTunes behave as if it were on OS X when running on Windows and I think Apple even had its on OS X-style update windows for the windows apps.

It's a fine line. As a developer Id rather code once and ship than to figure out all of the little idiosyncrasies for every platform. As a certain type of user I want apps to act like the other apps on my platform of choice, most users probably don't care or notice though.

<comment><USER6> I don't care much about native feel. When the things I like in a platform aren't preserved (cmd-comma for preferences), I get annoyed. When the things I dislike (OSX maximize) aren't preserved, I like it.

Overall, I think a little convention breaking is good. First, code once is a genuine advantage. It means faster releases across more platforms and more benefit to users. Second, it generates a little internal competition. If more apps break OSX maximize and users like it, maybe Apple will change it.

In the best cases, the freedom to invent the wheel yields gradually improving wheels.

<comment><USER7> > In the best cases, the freedom to invent the wheel yields gradually > improving wheels.

Except on mobile we have a bunch of reinvented wheels of varying non-round shapes and they all suck, leaving the user to guess what weird combinations of touching, tapping, swiping, double fingered tapping, etc will perform the desired action for this particular app.

</comment></comment></comment><comment><USER8> > Network data access costs a lot of money in some countries

Very much this. I live in a country which has country wide LTE coverage in populated areas. While the network is fast, data is very expensive. Here 1GB of data in a bundle is around 35 USD, where as back home I can get 25GB for the same.

I have mobile data turned off for most apps because of this. Everytime I open one (even if it works perfect offline) iOS pops up "Mobile data is turned off for XXX".

<comment><AUTHOR> Thanks. In the past I downloaded some large files and I had to pay heavy money for them, so, as a developer, I will keep this in mind for a long time :)

</comment></comment><comment><USER9> I couldn't agree more with point one on the 'ow zone.' I really can't understand why since ICS, google insists on putting so many important UI elements at the top of the screen, even as screens are getting bigger and bigger.

<comment><AUTHOR> That's right. I have a few more thoughts on reasonable screen sizes, maybe I'll write another blog post on that topic as well.

</comment></comment><comment><USER10> > Depending on your target audience, strive for accessibility, create layouts > that can be used while e.g. driving, try to make your application adapt to > the environment (for example mind the time of the day)

Spotify (at least the iOS version) does this both wrong and right.

When you browse for music, the app offers playlists based on the time of day. This is great, as the time of day has a lot of influence on the mood you'll want your music to convey.

On the other hand, player view got one thing wrong. In this view, you can swipe down anywhere to exit the player view - as the player is "minimized" when you're browsing for music. However, swiping down anywhere really means _anywhere_ \- even when you're trying to skip the current song, and your finger happens to move down a little (maybe because you're driving), it minimizes the player rather than skipping the song. The minimized player is a smaller touch target than the playback icons, which makes returning to the player view and ultimately skipping the song extra-hard.

<comment><AUTHOR> Thanks for the example. One of the motivations behind this article was to draw attention to the handedness of the mobile user and to the fact that the mobile user's attention is usually divided, the mobile user is usually 'multitasking' while using a smartphone. Under such circumstances, the user could easily miss a button that is not placed in the best location.

</comment></comment><comment><USER11> Spotify has a massive UX flaw.

To access the options for a track there is a button on the right hand side, this is also where the scroll menu appears. I often find myself half way up the playlist when I wanted to queue a song.

<comment><USER12> On Android? That's where I experience this same infuriating problem.

</comment></comment><comment><USER13> At what screen size will the "ow zone" problem become moot because it's impossible to use a phone with one hand? Are we already there with phones like the Galaxy Note 2 and iPhone 6+?

<comment><USER14> If you double-tap the iPhone 6 home button, it moves the content of the screen down so you can reach it with your thumb.

<comment><USER7> That doesn't sound particularly discoverable. That sounds like a power-user keyboard shortcut for what should be simple functionality.

<comment><USER14> Most of the touchscreen functions are not discoverable. Pinch-to-zoom, long- press, swiping with multiple fingers, etc. It's very easy to do though, not what I would call a power-user thing. Remember there is only one physical button on the front of the device, and this is one of the things that it does.

<comment><USER7> Yes, I misuse "power user" to mean "someone who reads the fine manual" or "someone who does a websearch to learn about nice features".

<comment><USER14> At least for some features like pinch-to-zoom they included very clear examples in the massive ad campaigns. I don't remember seeing this feature in an ad but it wouldn't surprise me. At least it's on this page [https://www.apple.com/iphone-6/design/](https://www.apple.com/iphone-6/design/)

</comment></comment></comment></comment></comment></comment><comment><USER15> Sidenote: at the top is a "tl;dr" link to a summary of key points at the bottom. The link is a named anchor #toolongdidntread. When you click it, the page scrolls down to the bottom but the location doesn't change to the anchor. That means you can't hit "back" to get back to the top of the page.

It's just a small thing, but I find the cumulative weight of little touches that break basic browser functionality for marginal aesthetic reasons really start to grate on me.

<comment><AUTHOR> Thanks for the observation. I'll fix this UX issue :)

<comment><USER15> True to your word. Nicely done. Thank you!

</comment></comment></comment><comment><USER16> I haven't held a phone with one hand since 2011. I do mean that literally has I've owned a 5.1-5.2" phone since then. Therefore don't use my thumb to interact with it at all.

The whole "The 'ow' zone" section assumes small phones, small hands, and right handed users.

<comment><USER17> Just because you don't doesn't mean that nobody does. Ever tried to use a phone two-handed while holding onto a subway pole? Or walking home with groceries? Or holding your kid's hand?

<comment><USER16> > Just because you don't doesn't mean that nobody does.

The article claims though that everyone does which is what I take issue with.

<comment><USER17> > The reason behind this term is that in many cases Mobile Users hold their > device with one hand, and perform actions using their thumbs.

Many, not all. It's enough of a problem for enough people that developers should pay attention to it.

</comment></comment></comment></comment><comment><USER18> The standard android and iOS navigation controls are directly within the "ow zone". Application "up" in the top left, system "back" in the bottom left. App switcher in the bottom right. The "go/search" button on the keyboard, bottom right.

</comment><comment><USER19> Article is fine, but:

One of the worst examples for the "above the fold" image: a) it is pixelated like crazy and to big to comfortably read its contents, b) the headline is really hard to read and find, because it is white text on a background of white text on black...

<comment><AUTHOR> Thanks for pointing that out. I will change it to something that fits better.

</comment></comment><comment><USER10> The part about Android actually applies to all mobile operating systems - <USER2> would all rather you'd use their native UX language than invent your own.

<comment><AUTHOR> That is correct, the user is used to a platform's behavior, and, in my opinion respecting the native UX language will keep that specific platform's user happy.</comment></comment>


Ask HN: How to react to a potential privacy breach? - <AUTHOR> I currently have my taxes done by an accounting firm in the UK and as part of their service they electronically forward across physical letters from the HMRC (tax department). Recently I have received an email containing a letter about my taxes being late, along with a similar letter addressed to another company with a few details such as the delay, interest, total amount and their corporate tax UTR.<p>My question is, what is the correct response? I have currently just informed my accounting firm about their mistake. <comment><USER2> Even good companies make mistakes. If they were receptive to you telling them and addressed it with you then I'd be likely to give them a pass. Only time this would differ is if I knew the company had a history of sloppy privacy controls etc. Most likely this is a human being that was stuffing envelopes and when they got to your letter they accidentally folded the other companies letter and sent it to you unintentionally (or it was given to them that way).

My personal view, people often expect perfection until it is their own mistake, I wish people would give others (including companies) the same benefit of the doubt they'd like to receive when they make a mistake. Not saying you aren't but assuming they at least apologized and said they have addressed it I don't think there is any reason to do anything else. Of course, if you know this company is sloppy, first why would you use them, but second then it is more fair to raise this issue more publicly. But unless you want your every mistake judged the harshest way possible, I say accept people (who work in companies) will make honest mistakes, address it with them and move on unless it is chronic or abusive.

<comment><AUTHOR> Hey thanks for the reply! Yeah I totally agree in terms of no one is perfect and mistakes are made.

My thought pattern was more around whether I was/am meant to reach out to the party whose letter I got to inform them so that they can make a decision on how to respond, as it doesn't impact me personally at all.

<comment><USER2> I think it is a personal choice, I don't think either is right or wrong in this case. To be fair, my take on this would be telling them could be more trouble for you then it is beneficial to them, partially depending on the companies size. If the company reacts poorly to the news it could mean lots of frustration and/or headaches for you, and in that way I'd be selfish and just destroy the document and never mention it to minimize my distraction potential.</comment></comment></comment>