"Stop reverse engineering our code" - <AUTHOR> https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t <comment><USER2> Wow. Really?

This single blog post is strong evidence for why you should never, ever buy an Oracle product, and if you are running anything written by them, why you should plan to migrate away.

Now, the culture of consultants in the Oracle sphere of influence is pretty toxic and money-grubbing. I can imagine companies being badgered into paying security weasels big bucks to analyze software with tools that cough up a zillion false positives, whereupon the weasel looks like a hero and is paid a bunch of cash, the customer panics and demands that Oracle fix a pile of non- existent vulns, and some department buried inside Oracle doesn't know how to deal. Whereupon the weasel skates off to another company to run the same scam: rinse, repeat, and this blog post.

In which case Oracle should simply call it out: "Please don't send us crappy automated scanning tool reports from the shitty security weasel consultant you hired because those reports are useless, and the same weasels have been sending identical ones in, monthly, for _years_ , and you are being ripped off." But Oracle never passes up the opportunity to express contempt for its customers, nor can it admit to being wrong.

Better to avoid that whole ecosystem.

<comment> bmir-alum-007 Stanford was taken to the cleaners to the tune of $1.5 x 10^8 USD in the deployment of Oracle Financials and related products via endless "consultant implementation" charges that didn't really deliver much value, were rarely on schedule or on budget. Oracle's enterprise calendaring program was totally inadequate and had UX that made most point-of-sale systems look effortless by contrast. Also, the assets managing app, Sunflower, was another dud. The only thing Oracle Database had going for it was no crippling license activation (license scofflaws are/were sued or fined into oblivion worse than M$FT), which one could say was equivalent to MS SQL. Unlike MS MSQL, Oracle DBMS has/had bazillions of support patches to apply to run a real production box, analogous to the previously separate Sun's Solaris patchsets.

Btw: For smaller enterprisey shops, either MS SQL or Postgres are the way to go. Often multiple similar components are needed because different apps have firm requirements that only support one or another; but generally try to avoid this because supporting too many heterogenous components is expensive (laborious)... hence the prevalence of local "standards." Deploying everything with cfengine3 or puppet can help reduce the manualness and nudge vendors into repeatable, idempotent deployments rather than clicking on inane GUI installers like an animal.

ProTip: Don't let consultants "provide" oversight / free-reign for their own projects, budgets, etc., that's like the wolf guarding the henhouse. The client must hire their own project managers, have clear accountability/authority paths to their management and know exactly what they need (avoid endless upselling). Or lots of money will be transferred from idiots to crooks (enterprise caveat emptor).

Edit: fixed grammar

<comment><USER3> > to the tune of $1.5 x 10^8 USD

Was it really necessary to type it like that?

<comment><USER4> For general sanity: $150,000,000

<comment><USER5> To be pedantic, 1.5e8 carries additional information about accuracy: $150,000,000 ± $5,000,000. By contrast, 1.50e8 would be ten times as accurate, and so on.

Of course, accuracy is hardly relevant here.

<comment><USER6> s/accuracy/precision

Sorry, I don't usually try to be pedantic, but when the conversation is already about nitpicking, I think it's necessary.

Significant figures are precision, not accuracy. Accuracy is "being in the ballpark". Precision is "tight groups".

<comment><USER5> I'm sorry for the confusion. English is not my first language, and I resorted to [https://en.wikipedia.org/wiki/Accuracy_and_precision](https://en.wikipedia.org/wiki/Accuracy_and_precision) to pick between "accuracy" and "precision".

<comment><USER7> To put it another way: "pi is exactly 3" is extremely precise, but not very accurate.

<comment><USER8> The very next task of mine

is a new value of pi to define.

I think I'll use 3

it's much simpler you see;

than 3.14159

<comment><USER9> You've simpified pi, that's fo' shore.

But rivalry says "level-up score".

With competitive drive,

It's yet higher I strive.

The value I'll use shall be four.

<comment><USER10> Well played

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> So, I disagree with the poster on a bunch of things here (no surprise, really).

But: this is authentic. This is what we (i.e. hackers) are always claiming we want. Someone speaking her mind, shooting from the hip, etc. Not an anodyne blob of corporate-speak: this is an opinion, stated pretty clearly, and backed up with fighting words.

You'd expect: "Our legal team has advised us to remind consultants that they are bound by any and all terms and conditions to which their clients have ... etc. etc. etc."

You get: "Otherwise everyone would hire a consultant to say (legal terms follow) "Nanny, nanny boo boo, big bad consultant can do X even if the customer can't!""

Here we have someone who clearly loves the company and the product with a passion, defending both against what she sees (very wrongly, in my opinion) as criminal misuse and waste of resources.

I'll take one of these posts and argue its merits any day, over a block of mealy-mouthed corporate crap.

<comment><USER12> You can be authentic and speak your mind without being arrogant, insulting, and condescending.

In terms of tone, I wouldn't hold this up as a good example - it distracts from any legitimate argument the writer may or may not have.

<comment><USER13> I think a lot of blog posts like these get triggered by some acute event which pushed the writer over the edge, and it's expected this will shine through in the text. The rest is probably due to living in an employer-typical bubble.

If I was an Oracle customer (which I will never, ever be) I would appreciate the honesty. This honesty enables me to make purchase decisions as well, better than megabytes of legalese would have. In this case it's not a really surprising attitude given the company, but I really wish more vendors would be as open about the nature of their intended relationship with their customers.

<comment><USER14> You cannot swear you will never be an Oracle customer. You buy a service from a third party, the company get bought by Oracle, you are a customer now. In many instances in B2B systems, it is a lot more pain to migrate away than sending a check...

<comment><USER13> Not sure jumping on such a _minor point_ is a productive use of our time, but just for the sake of clarification: sure I can, personally. You have no basis for disputing my intention. I have never in my life made a decision to purchase a service that could only ever be provided by a single company, and with good reason I believe. Over my contracting years, I have also gained enough insight into the dynamics customers have with providers such as Oracle, enough to avoid this kind of lock-in at all costs in my own decisions.

</comment></comment></comment></comment></comment><comment><USER15> Seems like the original blog post was deleted, here is the archive - [https://web.archive.org/web/20150811052336/https://blogs.ora...](https://web.archive.org/web/20150811052336/https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t)

<comment><USER16> Glorious. Somewhat surprised it was taken down, though.

<comment><USER17> I'm more surprised it was posted!

(at least in ~current~ as-it-was form)

<comment><USER18> I am not at all surprised that oracle would memory hole something that escapes PR control.

<comment><USER19> "Stop reverse engineering our blogs!"

</comment></comment></comment></comment></comment><comment><USER20> > Q. If you don't let customers reverse engineer code, they won't buy anything > else from you.

> A. I actually heard this from a customer. It was ironic because in order for > them to buy more products from us (or use a cloud service offering), they'd > have to sign – a license agreement! With the same terms that the customer > had already admitted violating. "Honey, if you won't let me cheat on you > again, our marriage is through." "Ah, er, you already violated the > 'forsaking all others' part of the marriage vow so I think the marriage is > already over."

What a thoroughly nasty comment. She is comparing _her customer_ with someone who is cheating on their spouse. Disgusting.

<comment><USER21> The scorn for customers in general is palpable. Why is Oracle even allowing this person to be a voice for their brand?

<comment><USER22> > Why is Oracle even allowing this person to be a voice for their brand?

Because her text will probably only infuriate people that will arguably never be Oracle customers?

<comment><USER23> > Because her text will probably only infuriate people that will arguably > never be Oracle customers?

As a sysadmin with customers who run oracle, and who put some stock in what I say, I can say I am more likely to warn people away from oracle in the future. While in some companies, tech purchasing decisions are made by suits with little or no input from techies, that's not universal.

<comment><USER24> If Oracle won't sick the sales people on your upper managers if they even get wind that someone at the company want's to move away, you're just not a large enough customer and Oracle doesn't give a shit if you move.

</comment></comment></comment></comment></comment><comment><USER25> This is a marketing layup for any FLOSS ERP company (or the PostgreSQLs of the world). Basically "by all means check our code for any issue you may find. We'll gladly accept any suggestions for code improvements you may have."

This post is an absolute nightmare/facepalm. Basically my takeaway is "I guess I don't want to buy Oracle software". It's really mind blowing that this is the position of a major software company in this day and age. I mean I guess I shouldn't be shocked since it is in the EULA but man I'm kind of speechless (this clause has to be illegal in some countries, too).

Edit: as an aside as a bad guy this would make me very interested in reverse engineering Oracle products. If they disallow it for their customers the reaction times to any security issues will be lower and it will be pretty valuable to find bugs in their products.

Edit2: Seems like the blog was cracked. At least the "About" on the side seems to indicate that.

<comment><USER26> If you dump a 400 page output dump of some static analysis tool on a FOSS project, not much will happen either. They will probably challenge you to find the actual issues yourself and enter bug reports.

<comment><USER27> Yes, agreed. Especially if, after checking out the first 100 or so, all of them are false positives.

But the big difference is that it's realistic, allowed and in many cases warmly welcomed if you submit actual problems.

</comment></comment></comment><comment><USER28> Wow. _Someone 's_ been hitting the Kool-Aid pretty hard.

I've seen this institutional hubris first-hand. The unshakable belief (typically by nontechnical management) that all of the smartest people in the world are employed _here_ , working for _me_.

It always ends badly.

<comment><USER29> Indeed, it does tend to end badly, and the best example is a company that ended up being bought by Oracle. The arrogant tone of this post reminds me _very much_ of the flurry of blog posts that came out when ZFS and DTrace were first introduced. Remember "The Last Word in File Systems"? That kind of arrogance, complacency, and impatience with interlocutors is mildly annoying to developers elsewhere. It's more than annoying to customers, and to sales people who feel unsafe pushing products whose developers continually undermine them. That's why Sun is no more. Oracle might want to consider that before they start relying on this kind of astroturf to convince anyone of anything.

<comment><USER30> I don't think the particular kind of arrogance that Oracle has goes away except by being killed. Heck even once the former sales guys are homeless under a bridge I doubt they would see the connection, they'd still be spinning yarns about when they worked for the greatest tech company ever.

<comment><USER29> Ditto for the engineers. The kind of engineer who contributes to a culture like that in the first place will also be constitutionally incapable of accepting that their _own_ behavior contributed in any way to the demise.

</comment></comment></comment></comment><comment><USER31> The submitted title ('Oracle CSO: ~"Only we can do security, trust us and do not reverse engineer"') breaks the HN guidelines: it's editorialized (whatever one thinks of the article), and it's a quote-looking-thing that isn't a quote, so misleading.

Please don't do this. The HN guidelines ask you to use the original title. If that's really not suitable, a subtitle or some representative language from the article is ok. But putting your own spin on it is not ok. HN's goal is to let readers make up their own minds, and for that we need accurate, neutral titles.

We've changed the title to a representative phrase from the article, and can change it again if someone suggests something better.

<comment><AUTHOR> apologies, my fault.

</comment></comment><comment><USER32> This is exactly the problem with legality of RE and penetration testing. "You broke the law by wasting our time, violating your license agreement." I understand author's points. Not very good points, disappointingly.

No matter how interpersonal she puts it. It makes me not ever want my system to rely on a company that threatens and belittle customers for protecting themselves.

If I bought a fridge for my house, I found a listening device and a pinhole camera in the fridge. Just because the company has a clause I am not allowed to open up the fridge, it doesn't mean I shouldn't.

Well, the company might have found the devices. Indeed maybe nothing customers can do until the company fixes it. Keep telling customers they are not allow to look for flaws it just ridiculous. Yes, it's your product, but this is my home!

<comment><USER33> > Yes, it's your product, but this is my home!

My stance is that EULAs are bullshit, period. If you purchase a product, it is yours, and no one should be able to dictate how you use it.

<comment><USER34> Unfortunately courts seem to not share your stance, it seems.

<comment><USER35> Courts of which country? There are a lot of countries out there, some of them allowing reverse engineering (especially in Europe for example).

<comment><USER32> I read up on some of DCMA stuff, it does seem to allow some degree of reverse engineering in U.S..

</comment></comment></comment></comment></comment><comment><USER36> Reverse engineering is legal in France for research and computer security ([http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTE...](http://www.legifrance.gouv.fr/affichTexte.do?cidTexte=JORFTEXT000000266350&categorieLien=id)).

<comment><USER37> Sure, but this is a contract matter between two private entities. Oracle can still revoke your license for doing it.

<comment><USER38> I'm pretty certain that national law takes precedence over what someone put in a contract.

Example: It works like this for tenancy agreements in Germany. Your landlord can say that you're not allowed to change the locks all they want, and even if it's in the tenancy and you signed it, it's still null and void.

<comment><USER39> >I'm pretty certain that national law takes precedence over what someone put in a contract.

Yes but only if the law says that you can't create a contact that signs away that right.

For example, in the USA you can reverse engineer. Totally legal. But you can also sign away your right to reverse engineer. That is what a contract is, signing away your rights.

But the US could also pass a law saying it's illegal for a EULA to prevent reverse engineering.

So just finding a law that says reverse engineering is legal, doesn't mean a court won't hold you to a contract that prevents reverse engineering.

That said, it's probable that some countries have banned contracts that prevent reverse engineering.

</comment></comment></comment></comment><comment><USER40> I don't really see how a lot of the responses here match with the original blog post. People seem to be airing a lot of long-standing grievances about Oracle rather than responding to the specific post on its own. Viewed on its own, the post can basically be summarized as "Please stop treating our products like they are open source. They're not, and it is against the license agreement to reverse engineer our stuff to find the source code."

A _lot_ of people think open source software is a much better methodology than proprietary, highly-protected source code. That's fine, there are a lot of good arguments there. However, it doesn't make sense to throw a bunch of other, barely related insults at a company when really, all you're upset about is that their code is not open source. Criticize _that_...that is what you're upset about (at least so far as this specific blog post is concerned)

<comment><USER41> I don't think it's the lack of open-source code that is causing the grievances but rather the tone of the blog post and the overall theme of "Our IP is more important then your security concerns, no we don't care if you are a core bank".

Microsoft, SAP, VMware all have closed source software that is very prevalent in enterprise, often in entrenched positions just like Oracle. Sure they aren't exactly all peaches either but atleast they have a decent way of responding to security problems or plain bugs.

They also don't wield their license agreement as a weapon against their customers, they only use it to make sure they get paid.

<comment><USER40> The blog post doesn't make me think of license-agreements-as-a-weapon. Oracle's position is probably the strictest I've seen anyone be in favor of software IP protection. They are not adversarial, they are supremely protectionist (presumably because they think their software is so great that other people want to copy it). That protection (possibly over-protection) is the core of the disagreement, and the source of the article's tone and inherent frustration on both sides.

Oracle thinks it is self-evident that protection of their source code is paramount (i.e. as closed source as possible), other people disagree both with their priorities and the very idea of absolutely forbidding any deep analysis of any kind outside of Oracle itself. It still seems like a debate about the degree to which the source code is "closed." For Oracle, it is absolutely closed, while many of their competitors are more lenient (i.e. slightly less "closed".)

To be clear, I think Oracle is being silly with their over-sanitized and idealistic views regarding their intellectual property. The other companies you mentioned (Microsoft et al) have much more reasonable approaches and agreements.

</comment></comment></comment><comment><USER42> The arrogance is titanic. And her legal team apparently forgot to explain to her that certain jurisdictions permit reverse engineering and decompilation under certain circumstances irrespective of what Oracles license agreement says.

</comment><comment><USER43> I laughed at this line where she tries to prove her point by touting that Oracle already found a bug that a security researcher reported to them (but wasn't fixed yet):

"(Small digression: I was busting my buttons today when I found out that a well-known security researcher in a particular area of technology reported a bunch of alleged security issues to us except – we had already found all of them and we were already working on or had fixes. Woo hoo!)"

<comment><USER44> heh, 'alleged'...

<comment><USER45> "They weren't real vulnerabilities, because we knew about them!"

</comment></comment></comment><comment><USER46> There are too many points to discuss... it's really quite insane especially on the backs of Java exploit after Java exploit.

But what I really don't get is this bug bounty hateathon. If it's only 3% of bugs (currently WITHOUT incentives like a bug bounty), then that's really not that much money... and in return you get more cred, something you might use for recruitment, and the off chance that you might increase that 3% versus something going on the black market. Even more so, how much could this really cost!? And Oracle has how much money?! If you can't spend that on a bug bounty when you're security is just so awesome as the post contends, then something is really in trouble.

<comment><USER47> The repeated Java exploits You're referring to are exposed when using Applets in a browser ... This was conventionally recognized as a bed idea in about 2006. You simply shouldn't allow Applets to run - no matter what. I think you'll find the rest of the Java platform more secure than most, especially since the OpenJDK foundation was formed. I'm not here to defend Oracle in any other way but they've done a reasonable job of advancing the Java platform since it was acquired.

<comment><USER48> There is nothing wrong with signed java applets. There is no difference between that and downloading and running (a signed) application.

<comment><USER7> That's only true if Java's signature validation isn't vulnerable (or at least is no more vulnerable than the signature verification for a normal OS).

Searching around, it looks like there was at least one vulnerability like this, in which Java failed to check certificates for revocation, and at least one exploit was found in the wild signed with a stolen, revoked certificate that Java still accepted.

This is especially fun because Java at least _tries_ to sandbox unsigned applets, but signed applets get a lot more privileges.

</comment></comment></comment></comment><comment><USER49> Is it just me, or is the childish, mocking tone in the OP simultaneously baffling and totally befitting of the point they're trying to make? I understand that they're frustrated by the repeated submission of automated security vulnerability reports, but blanketing it entirely as "reverse engineering" and responding to it like this is... a strange approach.

Did someone at Oracle actually think that this was the best way to make this point?

<comment><USER50> The previous post on the blog has a similar tone too [https://blogs.oracle.com/maryanndavidson/entry/is_your_shell...](https://blogs.oracle.com/maryanndavidson/entry/is_your_shellshocked_poodle_freaked)

<comment><USER51> The formatting in that post is... interesting.

I'd blame the CMS before the author on that point though.

</comment></comment></comment><comment><USER52> Original has been deleted, cached version available:

[http://webcache.googleusercontent.com/search?q=cache:ntXM0Rl...](http://webcache.googleusercontent.com/search?q=cache:ntXM0RlghUUJ:https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER53> And just in case: [http://pastebin.com/raw.php?i=fAh2fcfn](http://pastebin.com/raw.php?i=fAh2fcfn)

</comment></comment><comment><USER54> > Generally, our code is shipped in compiled (executable) form (yes, I know > that some code is interpreted). Customers get code that runs, not the code > "as written." That is for multiple reasons such as users generally only need > to run code, not understand how it all gets put together, and the fact that > our source code is highly valuable intellectual property (which is why we > have a lot of restrictions on who accesses it and protections around it).

Your JDBC driver IP isn't that valuable, just give me the damned source code so I can figure out why my Postgres copy out stream is blocking when I insert it into your copy in stream.

/rant

</comment><comment><USER55> >Ah, well, we find 87% of security vulnerabilities ourselves, security researchers find about 3% and the rest are found by customers.

They admit more security vulnerabilities are found by customers than security researchers and still they release this smug "fuck off" toned blog.

</comment><comment><USER56> This is one of the finest pieces of Postgres marketing I can recall seeing in recent times. They've made the case for open source better than anyone in 2015.

(We're in the midst of an Oracle->Postgres conversion right now. It's going wonderfully. I strongly advise you to look into it, bet you'll find it way easier than you think.)

(One of the nicest things about it: we give every app its own cluster of two PG boxes, because you can just do that instead of running a centralised monster box with an expensive license. It turns out that just _everything not having to play nice with others_ makes stuff stupendously easier to manage.)

<comment><USER57> How do you arrange your PG clusters, are you using streaming replication?

<comment><USER56> Failover pair with a primary and standby. The primary streams write-ahead log records to standby as they're generated. Some script gaffer-tape to watch for primary failure and fail over. I think we haven't ever yet actually had to invoke this though :-)

This was all cobbled together following the docs. There are almost certainly better ways to do everything we've done so far.

The Postgres is just 9.3 out of the Ubuntu 14.04 repo. Oracle was STUPENDOUS overkill for what it was actually being used for, but MySQL wasn't up to the job.

The heavy lifting for the conversion is done using ora2pg [http://ora2pg.darold.net/](http://ora2pg.darold.net/) Then there's a pile of faff and twiddling and unit tests and so forth. See also [https://wiki.postgresql.org/wiki/Oracle_to_Postgres_Conversi...](https://wiki.postgresql.org/wiki/Oracle_to_Postgres_Conversion)

<comment><USER57> Sorry for late reply, thanks for the info! Interesting to see what others are doing.

</comment></comment></comment></comment><comment><USER58> I like it that Oracle openly publishes this kind of blogs. I would personally never work for a company which expects me to develop anything using Oracle gear. It's simple. I can always find another company that doesn't and that pays the same or better. That is also why I suspect that someone who works in those circumstances really has to, because he has no other options.

</comment><comment><USER38> To me, this reads like a post explaining the benefits of free software by demonstrating the disadvantages of using proprietary systems. A bit hyperbolic at that, though.

RMS would have a field day.

</comment><comment><USER59> It sounds like they've confused a) users submitting results from static analysis that wastes time, b) users submitting demonstrable vulnerabilities, and c) license agreements.

a) is bad, and the users should just be turned away. b) is good and far better than selling them on the black market. c) is... who cares it's a license agreement.

<comment><USER60> She's mostly focussed on (a), it seems, and I can understand the frustration - all too often we get lengthy missives from client consultants along the lines of "Ran scanning tool. Suggests that the version of PHP.net you are using is vulnerable to LSASS and STUXNET vulnerabilities, our client is terrified, pay me off to make the pain go away." We get a genuine vulnerability reported once in a blue moon.

(b) is good, but her point that them spending their time doing static analysis of oracle's software is a monumental waste of time is perfectly valid, if their root password is password and the firewall is just some sheetrock in the basement.

</comment></comment><comment><USER61> Can some infosec person speak to her strongest claim, that static analysis gives "basically 100% false positives" and wastes the team's time?

<comment><USER29> The statement itself is basically 98% false. I've been a Coverity user since very early days, and have used a few other static-analysis tools as well. Every such tool that I've seen runs multiple separate kinds of checks. Yes, the false positive rate for some of those checks can be alarmingly/annoyingly high. OTOH, any software developer with half a brain can see that other checks are much more accurate. Some are darn near impossible to fool. If you focus on those, you can find and fix a whole bunch of real bugs without too much distraction from false positives.

Her statement gains 1% truth because Oracle might already have picked the low- hanging fruit, and any more reports they get really are full of chaff. I find this unlikely, but it's _possible_. She gets another 1% for this.

> A customer can't analyze the code to see whether there is a control that > prevents the attack

That's actually a pretty decent point. Anyone who has actually studied static- analysis reports for any length of time has probably encountered this phenomenon. For example, you might find a potential buffer overflow that's real _in the context of the code you analyzed_ , but the index involved can't actually be produced because of other code that you didn't. Or maybe a certain combination of conditions is impossible for reasons related to a mathematical property that has been thoroughly vetted but that the analysis software couldn't reasonably be expected to "know" about. Ironically, these kinds of "reasonable false positives" tend to show up more in _good_ programmers' code, because they're diligent about adding defensive code handling every condition - including conditions that aren't (currently) possible. In any case, while it's a good point, it's applicable rarely enough that it doesn't really support the author's broader position.

<comment><USER62> This is diametrically the opposite of my experience with source code scanners.

I think the impedance mismatch here might be that you're a software developer, and we're talking about security teams.

I don't know that anyone is arguing that static analysis is useless for developers. If you're intimately familiar with the code you're working on, there are probably a lot of ways to make static analysis results both valuable in every edit/compile/debug cycle, _and_ an important part of your team's release process.

But when you're close to the code, it's easy to forget how much of the tool's output you're ignoring (either literally, by just skimming past findings you know don't matter, or implicitly, by configuring the tool to match your environment or subtly changing your coding style to conform to Coverity's expectations).

Security teams can't generally do this. They're stuck with the raw output of the barely-configured tool. The results of static analysis in these circumstances is nonsensical: memory leaks, uninitialized variables, race conditions, tainted inputs reaching SQL queries, improper cleanup of sensitive variables, 99.9% of which aren't valid findings, but all of which look super important, especially if you're consultant with 6 months of experience charging $150/hr to run Fortify on someone else's code, then petulantly demanding a response for every fucking issue the scanner generates.

They're fine dev tools, but they are _terrible_ tools for adversarial inspection, which is what Davidson is talking about.

<comment><USER29> If somebody's paying a consultant hundreds of dollars an hour to run a static analysis tool and forward the output, without applying a developer's skills in between, they've been defrauded. Static analyzers are coding tools, much like compilers. Their input is code. Their output is pointers to code. True adversarial analysis, or any other endeavor involving static analysis, requires something extremely close to a coder's skill set. I guess if I believed otherwise then I might be tempted to take Davidson's side too, but that's not the case.

<comment><USER62> Now you see where she's coming from.

</comment></comment></comment></comment></comment><comment><USER63> >We will also not provide credit in any advisories we might issue. You can't really expect us to say "thank you for breaking the license agreement."

Well, Apple does (for jailbreak exploits).

>I am not dissing bug bounties, just noting that on a strictly economic basis, why would I throw a lot of money at 3% of the problem

Uh ... You don't think that percentage will increase if you offer bounties?

<comment><USER64> >>I am not dissing bug bounties, just noting that on a strictly economic basis, why would I throw a lot of money at 3% of the problem >Uh ... You don't think that percentage will increase if you offer bounties?

And if it doesn't, well, they don't pay out much. It's not like bug bounties consist of just throwing money at random people and hoping they find vulns; you pay for results. That's sort of the point.

</comment></comment><comment><USER65> The post seems real, by comparison with other articles in the blog: in particular similar silliness and dislike for security advisories in [https://blogs.oracle.com/maryanndavidson/entry/is_your_shell...](https://blogs.oracle.com/maryanndavidson/entry/is_your_shellshocked_poodle_freaked) and similar anti-reverse engineering stance in [https://blogs.oracle.com/maryanndavidson/entry/mandated_thir...](https://blogs.oracle.com/maryanndavidson/entry/mandated_third_party_static_analysis) and [https://web.archive.org/web/20140123033110/https://blogs.ora...](https://web.archive.org/web/20140123033110/https://blogs.oracle.com/maryanndavidson/entry/those_who_can_t_do)

</comment><comment><USER66> Is that post for real? [https://twitter.com/dinodaizovi/status/630972473945817088](https://twitter.com/dinodaizovi/status/630972473945817088)

<comment><USER61> If you read her previous posts you'll see it's the exact same tone and writing style. I think the claims of hacking are a way for people to express their incredulity and not meant seriously.

<comment><USER67> I hope you didn't "reverse engineer" her blog post. She's going to call up a judge and say "Nanny Nanny, Boo boo." (her own words).

But in all seriousness, if the Chief Security Officer of Oracle sounds like the letters to the editor of my University Paper, why doesn't a company that big have someone from PR edit or co-write her posts?

<comment><USER61> One terrifying possibility is that this is the edited, watered-down version of something even worse.

My guess is that she's senior enough to veto attempts to salvage her prose.

</comment></comment></comment></comment><comment><USER68> When I read this, I thought for sure it was just a lower-level engineering manager. I can't believe she's the _Chief Security Officer_ , and that someone with a Wharton MBA could write something so unprofessional and full of disdain for your customers.

</comment><comment><USER69> There is just no upside to this kind of response. Surely for any tech company that has reached a certain size, the only workable approach is to recruit an appropriately sized security team and politely welcome and respond to each and every security report received, triage them as quickly as possible and fix the ones that are found to be real vulnerabilities. Even if you aren't happy with the motives or the methods they employ, they are potentially finding flaws in your products for you.

</comment><comment><USER70> Is this woman aware that static analysis is a non-negotiable requirement for filing your 510(k) if you do anything vaguely medical the FDA has to look at? Not that I would willingly choose Oracle for medical device applications, but the cognitive dissonance here is amusing. Pax vobsicum indeed.

<comment><USER71> They do use static analysis. However, they do not let third parties analyze their source code. Which shows even more hubris, because they're all but saying, "only we're smart enough to analyze our code."

</comment></comment><comment><USER72> Except, uh, in plenty of countries, those anti-reverse engineering clauses are void as a matter of public policy.

And in any product that uses LGPL code, for example, it's actually a license violation to forbid customer modification and reverse engineering for the purpose of debugging those modifications.

(Though, admittedly, everyone always violates this term)

</comment><comment><USER73> > I am not dissing bug bounties, just noting that on a strictly economic > basis, why would I throw a lot of money at 3% of the problem

Aren't the issues not found by Oracle the problem? I'm amazed that stil 23% of the externally found security issues are reported by researchers, the incentive to responsibly disclose security issues to Oracle isn't really big. It sounds like a cumbersome process with potential legal consequences.

There also are researchers(, maybe after a first bad experience about an EULA,) that sell security issues to the grey/black market. Is there any data on how many Java zero days are exploited in the wild before being fixed?

Changing your stance and being grateful for responsible disclosures and only using your EULA to threaten and sue the __bad __people can potentially save __everyone with java installed __from a few zero days at zero cost.

<comment><USER74> I agree with that point, and think it hits at something bigger. Having a bug bounty doesn't just say 'we give out money for bugs'. It also says 'we have a thought-out programme for handling serious user-reported problems, and we won't reprimand or dismiss you for sharing them'.

</comment></comment><comment><USER75> Don't worry, if you won't let your paying customers check for security holes, there are plenty of people in China who are going to do it for you instead.

</comment><comment><USER76> Mary Ann Davidson's testimony on "cybersecurity" (2009) [https://www.whitehouse.gov/files/documents/cyber/Congress%20...](https://www.whitehouse.gov/files/documents/cyber/Congress%20-%20Davidson- Oracle-SFR_10Mar09.pdf)

</comment><comment><USER77> It seems to have been removed, here's a pastebin of the original post: [http://pastebin.com/bbMshdU1](http://pastebin.com/bbMshdU1)

</comment><comment><USER78> Just today I was arguing for not moving something off of Oracle. No one's really happy the thing in question is on Oracle, but it is live in production and most of the time does what it needs to. It ain't broke. Changing to "something else" carries way too many unknowns for my comfort level.

If I'd read this last night... I still would've argued the same thing, but I would've been really unhappy about it.

</comment><comment><USER79> I read the blog, but now it's returning a 404? Did they take it down?

If so, then somebody at Oracle realized that post reflected poorly on their organization. Perhaps there is some hope for Oracle yet.

<comment><USER80> Their IT probably have an automatic preemptive policy of 404'ing any pages that become "popular"\--any such content is is pretty much guaranteed to reflect poorly on their organization. False positives can always be waved away by a euphemism for a transient technical error ex post facto.

</comment></comment><comment><USER81> This explains so much about the sorry state of Oracle security. I hope Litchfield lets loose on them again.

</comment><comment><USER82> Whew. I've never read something from a company that was so insulting to it's own customers. I'd wager a bet that they won't be keeping their job for long.

</comment><comment><USER83> Oracle pulled the original post - here it is on pastebin [http://pastebin.com/wkk8b7FJ](http://pastebin.com/wkk8b7FJ)

</comment><comment><USER84> While I admit that I didn't read the whole post (to me it was a wall of text full of complaints going around the same point, always saying the same without too much variation), I really don't get this obsession with reverse engineering. Yes, their license agreement states that it can't be done. But you deploy _code_ , executable code, but still code. Code that people can understand, if they go through the process of analyzing it.

While I don't endorse breaking the agreement (which was properly signed and "celebrated", as lawyers say), I find it funny in the first place that they're selling a glass container and say "you can't look into it, just use it".

I prefer the honesty of free software/open source projects that sell customer support to this business model (which is also adopted by others, not just Oracle). However, if I were already bound to it, and couldn't pay the cost of migration, I understand I'd have to stick with it.

It's also amusing that people/organizations seriously believe they can reverse engineer something as complex as a database engine and "fix it" without acces to the diagramas, docs, tests, source code, build environment, etc.

</comment><comment><USER85> I worked in Oracle SOA product(BPEL) for 2 years. We had to do migration from 10g to 11g because Oracle wasn't supporting 10g version anymore. While migrating we came across a lot of issues that worked fine with 10g but failed in 11g. So we raised a lot of service requests with Oracle. Most of those got rejected by Oracle as they were not high priority meaning there were terrible workarounds existing for them. They only bothered fixing those ones without which we can't work(I guess they had to or my company would have sued Oracle). We ended up writing a lot of horrible work around just to make existing code work.

Yes we did not reverse engineer that code even though I feel it would have done lot of good for us. Not to mention the tool set provided by Oracle is utter crap as in it barely works on its own.

So I am not at all surprised that Oracle have that kind of mentality here. In all our communications with Oracle I felt they never really actually cared for what we the customers really want. All they actually care about it protecting their investments.

</comment><comment><USER86> Link is giving me a 404. Anyone got a mirror?

<comment><USER87> [https://web.archive.org/web/20150811052336/https://blogs.ora...](https://web.archive.org/web/20150811052336/https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t)

<comment><USER88> Just in case a robot.txt kills that

[http://pastebin.com/rcPSyRnR](http://pastebin.com/rcPSyRnR)

<comment><USER89> Would archive.org typically honor a robots.txt for a resource it already retrieved? I never understood the intent of a robots.txt to be retroactive.

<comment><USER7> Apparently yes, it would: [https://archive.org/about/exclude.php](https://archive.org/about/exclude.php)

</comment></comment></comment></comment></comment><comment><USER90> Not sure if trolling/hacked or serious. If later, I guess, many tech savvy (read 'hackers') people, will accept this as a challenge.

</comment><comment><USER91> The article seems to have been taken down from the Oracle site.. I leave this from an unclosed tab for posterity:

[http://pastebin.com/hU1mg1K9](http://pastebin.com/hU1mg1K9)

</comment><comment><USER92> Noticed that obscure death threat in the beginning? I'm not surprised to see it in a post about licenses.

</comment><comment><USER93> This makes me want to reverse engineer Oracle code immediately.

</comment><comment><USER94> Apart from the legal stuff and a lot off egocentric 'we can do it better', she has one point. There are many companies giving a lot of money for security, manually scrubbing all exploits that come out, create their own patches. While some lack the basic security guidelines. I think this money can be better spend upstream, to create tools so they can test patches for exploits better and create a faster security update release pipeline, so that all downstream and customers can rely on the security releases and that it can be released quicker to everyone. (Controversial: Maybe even adding automatic security updates to the package itself, like wordpress did, so that customer cannot be on a release with exploits)

Though saying to your client that they cannot reverse engineer to look for security problems, is totally not done! What is next? "Exploits will not be fixed, because the users has signed an agreement that they will not hack?"

<comment><USER95> _She_ has that point (Mary Ann).

</comment></comment><comment><USER96> If you look back at the author's earlier blog posts you'll find similarly- minded thoughts: [https://blogs.oracle.com/maryanndavidson/entry/mandated_thir...](https://blogs.oracle.com/maryanndavidson/entry/mandated_third_party_static_analysis)

</comment><comment><USER97> Oracle JRE is literally one of the more vulnerable pieces of software underpinning the web and computing as a whole.

JRE CVEs: [http://www.cvedetails.com/vulnerability- list/vendor_id-93/pr...](http://www.cvedetails.com/vulnerability- list/vendor_id-93/product_id-19117/Oracle-JRE.html)

It's been 5 years since Oracle took over Java, so they can't claim it was left over.

Oracle's security record is terrible by all accounts, so how can their CSO justify anything in this blog post?

ORACLE product list CVEs: [http://www.cvedetails.com/product- list/product_type-/firstch...](http://www.cvedetails.com/product- list/product_type-/firstchar-/vendor_id-93/page-1/products-by- name.html?sha=2a9718c5c6139d3034698d7627abb350713f75e4&order=3&trc=256)

</comment><comment><USER98> What a bully! Reminds of someone at work, especially with this line: "I do not need you to analyze the code since we already do that, it's our job to do that, we are pretty good at it".

This makes me want to climb the empire state building, beat my chest like a gorrilla, and yell "Let me do what I know best!"

</comment><comment><USER99> Mirror: [https://archive.is/iz4H2](https://archive.is/iz4H2)

</comment><comment><USER100> In the first paragraph the writer insinuates that she'd like to kill people who drive too close behind her.

Any subsequent valid points she makes - and there aren't many - are undermined by this bitterness.

Heightened emotion so often enables effective communication, but it doesn't do any favors in this post.

</comment><comment><USER16> No matter how valid her points are, the tone is inexcusable in a public-facing blog, especially when discussing customer behavior. I recognize the strong points of Oracle's offerings, but let's not pretend that there is not competition from other, open software.

</comment><comment><USER101> Some media flack must've clapped eyes on that and had a VERY bad morning. The post has since been taken down, but here's a copy: [http://pastebin.com/RQA90EEb](http://pastebin.com/RQA90EEb)

</comment><comment><USER102> I'm not sure what the author's argument is here. Is me reversing simply a nuisance and waste of Oracle's time? Is Oracle trying to obtain security via contractual obscurity? I see lots of comments here proposing that Oracle is protecting its IP, but I don't see evidence for that in the article (maybe its elsewhere, though).

I wonder if Oracle would send one of those reminders to a customer who analyzed an attack by an attacker who "broke the license agreement" by reversing the customer's copy of some Oracle software.

</comment><comment><USER103> Did anyone notice that the post contains Microsoft Office Word metadata?

[http://hastebin.com/daxiyaguma.html](http://hastebin.com/daxiyaguma.html)

</comment><comment><USER104> Reason #78,429 to join the I-hate-Oracle-club [http://forums.thedailywtf.com/forums/17.aspx](http://forums.thedailywtf.com/forums/17.aspx) [https://what.thedailywtf.com/t/please-stop-poking-holes- in-o...](https://what.thedailywtf.com/t/please-stop-poking-holes-in-our- cardboard-security/50505)

</comment><comment><USER105> > A. The customer signed the Oracle license agreement, and the consultant > hired by the customer is thus bound by the customer's signed license > agreement. Otherwise everyone would hire a consultant to say (legal terms > follow) "Nanny, nanny boo boo, big bad consultant can do X even if the > customer can't!"

Really? What if no money changes hands?

</comment><comment><USER106> That's why everybody sane should avoid using Oracle or Microsoft for the sake of mental health.

</comment><comment><USER107> 404 Error now

[http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t)

</comment><comment><USER108> The author must have been undergoing some bad moments so far. The post seems just the outcome of a more complex series of inputs. Most points are not valid from my own personal point of view but still may have been good points if written in a more objective way.

BTW, the post is gone.

</comment><comment><USER109> If you read what else she's written, static analysis is kind of her Moby Dick.

</comment><comment><USER110> Oracle seems to be like MS in that their reason for existing is that they came to be at the right time at the right place, and has pulled every trick in the book to pull up ladders behind themselves.

</comment><comment><USER111> They took it down. Mirror?

<comment><USER97> Wayback machine: [https://web.archive.org/web/20150811052336/https://blogs.ora...](https://web.archive.org/web/20150811052336/https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t)

<comment><USER112> Who's the author?

<comment><USER97> Chief Security Officer for Oracle, Mary Ann Davidson

</comment></comment></comment></comment><comment><USER113> This appears to have been taken down, I'm directed to a 404 page

</comment><comment><USER114> Oracle took down the blog post. Link is now returning a 404.

</comment><comment><USER115> Doesn't antivirus software do static analysis?

</comment><comment><USER116> Love security by obscurity

</comment><comment><USER117> Also, she loathes Keynes :(

<comment><USER118> That was her one redeeming statement in that blog post. :)

</comment></comment><comment><USER119> It's been deleted. Here's a mirror: [https://web.archive.org/web/20150811052336/https://blogs.ora...](https://web.archive.org/web/20150811052336/https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t) \- and while it's full of cringeworthy analogies, such as breaking a contract is _just like_ cheating on your spouse, there's also, well, "logic" that defies conventional wisdom:

Q. But one of the issues I found was an actual security vulnerability so that justifies reverse engineering, right?

A. Sigh. At the risk of being repetitive, no, it doesn't, just like you can't break into a house because someone left a window or door unlocked. I'd like to tell you that we run every tool ever developed against every line of code we ever wrote, but that's not true. We do require development teams (on premises, cloud and internal development organizations) to use security vulnerability- finding tools, we've had a significant uptick in tools usage over the last few years (our metrics show this) and we do track tools usage as part of Oracle Software Security Assurance program. We beat up – I mean, "require" – development teams to use tools because it is very much in our interests (and customers' interests) to find and fix problems earlier rather than later.

That said, no tool finds everything. No two tools find everything. We don't claim to find everything. That fact still doesn't justify a customer reverse engineering our code to attempt to find vulnerabilities, especially when the key to whether a suspected vulnerability is an actual vulnerability is the capability to analyze the actual source code, which – frankly – hardly any third party will be able to do, another reason not to accept random scan reports that resulted from reverse engineering at face value, as if we needed one.

Q. Hey, I've got an idea, why not do a bug bounty? Pay third parties to find this stuff!

A. <Bigger sigh.> Bug bounties are the new boy band (nicely alliterative, no?) Many companies are screaming, fainting, and throwing underwear at security researchers __ __to find problems in their code and insisting that This Is The Way, Walk In It: if you are not doing bug bounties, your code isn't secure. Ah, well, we find 87% of security vulnerabilities ourselves, security researchers find about 3% and the rest are found by customers. (Small digression: I was busting my buttons today when I found out that a well-known security researcher in a particular area of technology reported a bunch of alleged security issues to us except – we had already found all of them and we were already working on or had fixes. Woo hoo!)

I am not dissing bug bounties, just noting that on a strictly economic basis, why would I throw a lot of money at 3% of the problem (and without learning lessons from what you find, it really is "whack a code mole") when I could spend that money on better prevention like, oh, hiring another employee to do ethical hacking, who could develop a really good tool we use to automate finding certain types of issues, and so on. This is one of those "full immersion baptism" or "sprinkle water over the forehead" issues – we will allow for different religious traditions and do it OUR way – and others can do it THEIR way. Pax vobiscum.

</comment><comment><USER120> Why? Is Oracle "sacred" or something?

<comment><USER82> The author did refer to the act of reverse engineering their code as "sinning". So yes.

</comment></comment><comment><USER121> [http://ismaryanndavidsonfiredyet.com/](http://ismaryanndavidsonfiredyet.com/)

</comment><comment><USER122> 404 now... looks like somebody's gotten word of it...

</comment><comment><USER123> FOUR OH FOUR, Guess it's over....

</comment><comment><USER124> I don't understand why everybody is mad about this post, oracle has proprietary software that is bound with a license.

In that sense I don't see why people do not moan about having to pay a rent because your tenancy contract that you signed says so...

Long story short, its a right of a SOFTWARE mostly company to protect its software, open source is not always the solution and reverse engineering something, consumes way more energy for the problems it actually solves.

<comment><USER125> > open source is not always the solution and reverse engineering something, > consumes way more energy for the problems it actually solves.

You think customers are reverse engineering Oracle products _for fun_? They're doing it because there's a problem somewhere, they've filed a bug report and not got a satisfactory result, and so they have to go pay an expensive consultant to try and track down the problem for them with no source code.

Even if none of the other arguments for open source were persuasive, this situation with Oracle alone would be enough to convince many people of the wisdom of choosing an open source vendor.

<comment><USER126> What's wrong with reversing for fun? It's how progress of technology happens.

<comment><USER125> I think reversing for fun is great! But it's pretty unlikely that Oracle customers are doing it for this reason. Instead, I suspect their reversing is borne of desperation.</comment></comment></comment></comment>


Does getting the down vote privilege change how you use HN? - <AUTHOR> <comment><AUTHOR> I am close to getting the number of up votes on my comments to be able to down vote other comments. There was a point that I really cared about it because, well I am human and there are comments that I just want to rage at (or are just off topic, lame, etc). Does having that privilege change you see HN? When you have that right are you less likely to use it?</comment>


Ask HN: How to monitor a rack of mac minis - <AUTHOR>

We use a lot of mac minis for iOS testing. What do you all use to monitor system resources such as CPU, Mem, Bandwidth etc. I have looked into using graphite but collectd is very painful to setup for OS X <comment><USER2> I'm using Xymon ( example: [https://www.xymon.com/servers/servers.html](https://www.xymon.com/servers/servers.html) ). I found it didn't take much work to add a client to the monitor and the default set of reports was enough.

There's supposed to be an OSX client, but I haven't used it.

</comment><comment><USER3> You could look into what Imgix does, they have a datacenter full of Mac mini's.</comment>


GitLab 8.11 Released with Issue Boards and Merge Conflict Resolution - <AUTHOR> https://about.gitlab.com/2016/08/22/gitlab-8-11-released/ <comment><USER2> GitLab keeps surprising me with the consistency and quality of their releases. They are really putting GitHub on the spot at the moment and I for one love the competition in this space

<comment><USER3> Great to hear and thanks for the work you're putting in to support GitLab for Danger. The other day a colleague said "DANGER IS AWESOME".

</comment></comment><comment><USER4> I've recently moved to pushing all my open source code to both GitLab and GitHub, but using GitLab for actual issue tracking, continuous integration, build tests, etc. I've found GitLab's integrated toolset to be superior to what GitHub currently offers, and in truth there isn't really anything I feel like I've been missing (some tools like Code Climate are only free for GitHub accounts, but it's easily resolved by just using both).

Plus the GitLab team has just been killing it with each release, and it just feels good to use open source (and be able to open issues, vote on improvements, track changes for the upcoming release...). Free private repos is just icing.

Setting up a project for both just takes a few initial commands to configure git:

      git remote set-url --add --push origin firstname.lastname@example.com:account/repo.git
      git remote set-url --add --push origin firstname.lastname@example.com:account/repo.git

Then pushing to origin will always push to both. I also add a github and gitlab remote in case I only want to push to one as well.

<comment><USER5> > some tools like Code Climate are only free for GitHub accounts, but it's > easily resolved by just using both

Are you doing a read only mirror to GitHub for this?

<comment><USER4> Effectively. My project still gets pushed to GitHub and lives there, but I've disabled every feature I could (you can't disable PRs, but it's easy enough to redirect PRs over to GitLab).

Code Climate can still happily read from the GitHub project and I can add the badge to the README if desired, which is visible on both GitLab and GitHub.

And since origin pushes to both, they are rarely if ever out of sync.

And by using GitLab I get GitLab CI instead of Travis (which is quite nice), GitLab's amazing Issue tracker and board, which blows GitHub away, more fine grained control over merging (no more forced --no-ff merges if you don't want), Issue and MR templates, an activity stream, far more control over your project's settings... really I can't say enough good things about my experience with GitLab over the last ~6 months.

<comment><USER6> GitLab can actually keep your GitLab and GitHub repos in sync automatically! Check out the "Mirror Repository > Push to a remote repository" option in your project's settings.

</comment></comment></comment></comment><comment><USER7> Congrats on the release. Haven't tested this version, but have tried recent versions and if there's one thing that I think GitHub still runs circles around GitLab it's accessibility. If you don't believe me, try firing up a screen reader and see which you find easier to navigate with your eyes closed. In some cases you'll run smack into a brick wall with GitLab. So if there's one area where massive improvement is needed (and would be appreciated) it's accessibility. Happy to help on this front, but I know for a fact there's already several open issues relating to accessibility for GitLab.

<comment><USER8> This is one of the few points I have to criticize as well. GitLab's design is a bit too chaotic for me. It's missing visual dividers in a lot of places, especially in the issue tracker. Also GitHub feels better on horizontally smaller screens.

<comment><USER9> Also having that big header plus tabs just grabs most of the vertical space in the screen, very bad decision now that most of the screens have way more horizontal space.

</comment></comment></comment><comment><USER3> We're super proud of this release. As always, we're here for any questions or comments.

<comment><USER10> The issue boards are a big deal, so congrats on getting that out!

I've said this before, but one huge thing you guys could do that would draw in a lot of companies to Gitlab EE is if you supported custom issue fields [1][2] with various field types. That feels like a pretty logical place to go from here, so I hope you guys are strongly considering it.

[1] [https://gitlab.com/gitlab-org/gitlab- ce/issues/8988](https://gitlab.com/gitlab-org/gitlab-ce/issues/8988) [2] [https://gitlab.com/gitlab-org/gitlab- ce/issues/14884](https://gitlab.com/gitlab-org/gitlab-ce/issues/14884)

<comment><USER11> Thanks! Let's continue the conversation about custom issues in [https://gitlab.com/gitlab-org/gitlab- ce/issues/8988#note_141...](https://gitlab.com/gitlab-org/gitlab- ce/issues/8988#note_14175765)

</comment></comment></comment><comment><USER12> The "Gitlab doesn't handle big commits" bug is still a thing, and the two issues open for it are still open (and have been for months).

8.11 overhauled the diff backend, which works great! But the front-end still chokes up and freezes because the default appears to be 1000 files worth of diffs. This still pegs my CPU and hangs my browser when the page tries to render.

The second time loading the page is always fast (maybe something caches somewhere), but the first time is slow and chews the heck out of my poor PC. :(

Any chance we could get some sensible limits on the amount of information shown in a diff? Nobody is going to wade through 1000 files of diff in a web browser, so there's no reason to jam things up trying to render it.

[https://gitlab.com/nrclark/dummy_project/commit/81ebdea5df2f...](https://gitlab.com/nrclark/dummy_project/commit/81ebdea5df2fb42e59257cb3eaad671a5c53ca36)

edit: also, clicking the "Plain Diff" button breaks Gitlab

</comment><comment><USER13> Is it a matter of taste or Github's UI indeed looks more professional than Gitlab's one? I've tried to switch from GH to GL hosted for my personal projects multiple times and no luck. I like the fact that Gitlab is open- source and it has a lot of features but I still don't feel comfortable using it. Any opinions and preferences on GH's UI vs. GL's UI?

<comment><USER14> GitHub has a better container in their CSS. GitLab defaults to letting text lines be overly long and this just makes the whole thing feel uncomfortable even if you think you don't mind it. Otherwise, I think GitLab is largely alright UI.

<comment><USER15> Hey thanks for the feedback. We are certainly working on it. Feel free to contribute to the issue. [https://gitlab.com/gitlab-org/gitlab- ce/issues/13680](https://gitlab.com/gitlab-org/gitlab-ce/issues/13680)

</comment></comment></comment><comment><USER16> I migrated to using GitLab.com from GitHub for all of my publicly-hosted repos and use a self-hosted instance for some other projects as well. I love that I don't have to compromise features or usability when opting for the free software alternative.

<comment><USER17> I was considering going self-hosted too, but then gitlab.com got a _lot_ faster (thanks!!)

<comment><USER11> Glad to hear you're noticing the speed. We still have a lot of improvements in the pipeline. [https://gitlab.com/gitlab- com/infrastructure/issues/59](https://gitlab.com/gitlab- com/infrastructure/issues/59) We now host 2 repo's on Ceph, we'll move GitLab CE shortly and transition all the rest after that. [https://gitlab.com/gitlab- com/infrastructure/issues?scope=al...](https://gitlab.com/gitlab- com/infrastructure/issues?scope=all&state=opened&utf8=%E2%9C%93&label_name%5B%5D=ceph)

</comment></comment></comment><comment><USER18> With both GitHub and gitlab, I wish there was more work in making it easy to create pull requests without having to click around on a website.

I'll often check out software, notice something small that I can easily fix, and spend 5 minutes fixing and testing it. But then I have to spend another 5 minutes going on GitHub, forking the repository to my profile, going back into my shell, changing the URL for origin, pushing the change, going back to GitHub, creating the pull request on the project, and then going back to my profile and deleting the fork that I have no interest in maintaining. This should be so much easier.

That being said, I run Gitlab under a small docker box and I couldn't be happier with it. It's so darn easy to setup. Grats to gitlab team.

<comment><USER6> Depending how small the fix is, you can edit a file in any project right from the GitLab interface, and a fork and merge request will be created automatically in the background! The only thing left to do is to remove the fork after the MR has been accepted.

<comment><USER19> This doesn't really help for anything except for content editing (e.g., markdown). Consider the above example: the original poster now has all these files they've changed on disk. The best case scenario now involves opening all those files up one by one and pasting them into the browser's textarea. (Can you change multiple files this way and wrap it up into a single atomic commit? Whatever the case, this actually results in a lot more pointy-clicky, not less.)

A patch is a unit of change. Historically, that's the type of unit that the open source world has operated with. The only reason we're having this conversation right now is because GitHub decided to build on top of pull requests instead of patches for lock-in reasons. GitLab has no such motivations, so it's silly to continue following them, especially since Git has had native support for patches from the beginning.

Just support patches already.

</comment></comment></comment><comment><USER20> Another excellent Gitlab release -- I'm super excited to hear about the addition of issue boards. Please replace Jira and github at the same time.

I <3 Gitlab

<comment><USER5> I hope this is the intention. I'd love to migrate off Jira. Presumably like others, it's the reporting and accounting features for management purposes that have kept us tied to it.

</comment></comment><comment><USER21> Congrats to the Gitlab team for pushing this out the door so quickly!

Back when we built one of ZenHub's [1] first features — task boards inside GitHub — we believed strongly that development teams needed a single source of truth in order to move faster and communicate better. That belief has underscored everything we've built since. It's awesome to see further validation for this philosophy here with Gitlab!

[1] [https://www.zenhub.com/](https://www.zenhub.com/)

<comment><USER11> Totally agree with the single source of truth. I think ZenHub is very well done.

</comment></comment><comment><USER22> What's the reasoning behind the different characters in slash commands?

        # Why
        /milestone %milestone
        /label ~foo

        # Instead of
        /milestone milestone
        /label foo

<comment><USER6> Both of those formats also work in comments outside of slash commands, are automatically linked to the respective entity, and label references are rendered as pretty labels, with their color and description tooltip.

Using those characters also enables autocomplete in the Markdown textarea.

In the web interface, they are very convenient, but they are not required, so when using slash commands with reply-by-email, you can leave them out and write exactly what you have under "Instead of"

</comment></comment><comment><USER23> A tiny question: does this mean a workflow in which only one user would be able to merge a specific branch (say: master) is only available in the enterprise edition? I imagine this is quite a common workflow, even at smaller companies or non-profits. This essentially forces you to use an entire repo per user to do code review, even though oftentimes you wouldn't need this when you can restrict branch access to a specific (set of) users.

For example, I'm active at a small non-profit computer shop at the campus of my university, and we develop our own stock managementsystem inhouse. This would be a very interesting feature even for non-enterprise users like us, because that'd allow for easy code reviews without having to fork the repo.

<comment><USER6> CE does support restricting branches to specific roles: Master and Developer. In your case, I would suggest giving this single maintainer the Master role (which they already have if they're the owner of the project), making everyone else a Developer and configuring the master branch to only allow pushes (and merges) from Masters.

</comment></comment><comment><USER24> GitLab looks very tempting, congrats to their team.

Question: I would like to migrate from Github to Gitlab, but can not really move. Is there some bridge, which would mirror Github repos (with Issue tracker and pull requests) on Gitlab?

<comment><USER25> While you _can_ import data such as issues we do not have any automatic mirroring system for this in place. We do however have repository mirroring, but this _only_ mirrors the repository data.

<comment><USER11> We're discussing a full sync in [https://gitlab.com/gitlab-org/gitlab- ee/issues/904](https://gitlab.com/gitlab-org/gitlab-ee/issues/904)

</comment></comment></comment><comment><USER26> I have yet to understand where this kanban board stuff makes sense. Apparently, the Agile philosophy [0] introduced this to the software development world. Most implementations (Gitlab, Wekan) seem to miss central features (limits, cycle time stats).

I guess those boards serve as a issue tracker extension for short term development? How does that improve the process? Why do you need that on top of an issue tracker? Replacing the issue tracker is probably not idea?

[0] [https://www.atlassian.com/agile/kanban](https://www.atlassian.com/agile/kanban)

<comment><USER27> The visualization and instant-modification of kanban boards is really appealing from a task/issue management perspective. It shouldn't replace issue tracking, it can serve as a frontend to portions of it.

<comment><USER28> And prioritization, Cards get ordered by priority instead of 100 items all market "urgent, fix yesterday".

</comment></comment></comment><comment><USER29> Merge conflict resolution seems like something incredibly obvious to have, that yet is a pretty unique feature for the web UI. I've done a lot of stuff with GitHub's web UI, and I pretty much hit a wall any time I do something that's going to create a merge conflict, since I never really bothered to learn Git CLI. I saw GitBook did something similar to this a while ago, but that's for books, not code.

</comment><comment><USER30> I just migrated our companies repos away from Bitbucket to GitLab. The whole process was super-easy. Really happy so far!

<comment><USER31> What made you pick Gitlab over Bitbucket? Both can be self-hosted, but I'm not sure yet which one to choose myself. We do use Jira/Confluence internally so we might want to stick within that ecosystem but I hear very good things about Gitlab. I believe both integrate well with Jira as well and support smartcommits. What were the advantages for you?

<comment><USER32> Great to hear you're already using JIRA and Confluence. Adding Bitbucket to the mix will give you access to a bunch of great integration features.

We've been working on making it easier for the entire development team to collaborate and give them the right information at the right time. Here is a selection of features that I think you will find useful:

JIRA's Release Hub, to let you know if you're ready to release or not: [http://blogs.atlassian.com/2015/04/jira-6-4-release- confiden...](http://blogs.atlassian.com/2015/04/jira-6-4-release-confidence- sanity)

The development panel, to turn every issue into a dashboard for it's development work: [http://blogs.atlassian.com/2014/03/visualize-development- jir...](http://blogs.atlassian.com/2014/03/visualize-development-jira-6-2/)

Automated issue transitioning, because it's easy to forget to move that issue to "In Review": [http://blogs.atlassian.com/2014/08/jira-6-3-untangle- develop...](http://blogs.atlassian.com/2014/08/jira-6-3-untangle-development/)

Hope this helps. For a good overview, you can also take a look at the documentation that outlines the above integrations: [https://confluence.atlassian.com/display/BitbucketServer/JIR...](https://confluence.atlassian.com/display/BitbucketServer/JIRA+integration)

</comment></comment></comment><comment><USER33> Gitlab has a really great set of features and I appreciate the open and professional development style very much. It's very resource-hungry, though. At one point I just gave up and switched to Gogs. Less features, sure, but very fast, even with many users.

<comment><USER11> Yeah, if you want to use less resources Gogs is a great option. Did you know out team member Kim works on Gogs fulltime? [https://about.gitlab.com/gogs/](https://about.gitlab.com/gogs/)

<comment><USER34> Fascinating. I'd understand why GitLab and Gogs might not be competing with each other, but why invest in Gogs? How does that benefit GitLabs the company?

<comment> stp-ip Keep your friends close but your enemies closer.

Joking aside. Most likely to get a foot in the door on competition and on git related features written in Go, which might supplement or replace parts of the infrastructure within Gitlab. They already use Go for the CI runner part and as a smart, Gitlab aware proxy.

<comment><USER11> We want to prevent a not invented here mindset. And we'll work on import export functionality. By the way, GitLab already uses GitLab Workhorse written in Go to do much of the heavy lifting. I would say it is more then a proxy. This project is unrelated to Gogs.

</comment></comment></comment></comment></comment><comment><USER35> My job would _never_ cotton to putting stuff on Github, so GitLab existing and being of such high quality has been fantastic. Really been impressed with it.

<comment><USER11> Glad to hear that!

</comment></comment><comment><USER36> This is great [https://www.youtube.com/watch?v=UWsJ8tkHAa8](https://www.youtube.com/watch?v=UWsJ8tkHAa8)

</comment><comment><USER37> I'm seeing this as Gitlab working towards their Jira killer. With Mattermost also in the omnibus edition this is rather ace. Congratulations to the team!

<comment><USER11> Thank you!

</comment></comment><comment><USER38> congrats for the new release, here my critic (don't take me wrong, I use and love gitlab for so long, and the other features of 8.11 are really awesome)

* merge conflict resolution: It definitely looks cool and make conflict resolution _BY MERGING_ easier than any other way i know BUT most of the time I want my co-worker to resolve conflict BY REBASING (i.e as if they had branched just right now) , following the principle that you merge from specific to generic. So though I definitely agree most of people don't care, but for larger team/project where you often need to make archeology and dig inside the commit history , the "master merged into feature branch" makes the commits tree look weird

Outside of this, it's maybe only me, but most of the team I've worker with where using a scrum-like taskboard (like [http://taiga.io](http://taiga.io) ) instead of a kanban-like, is it planned to be added/provide the option or (which I perfectly understand) do you plan on focusing on kanban and letting third-party project for those who prefer scrum ?

<comment><USER11> Hugo already mentioned the rebasing option in [https://news.ycombinator.com/item?id=12339492](https://news.ycombinator.com/item?id=12339492)

As for the Kanban board, as far as I can read in [https://www.cprime.com/2015/02/3-differences-between- scrum-a...](https://www.cprime.com/2015/02/3-differences-between-scrum-and- kanban-you-need-to-know/) the only difference with a scrum board is that you can set a maximum number per list. Feel free to create a feature proposal for that, I've already heard that request before today.

<comment><USER38> hmm yes you're right, I was mislead by the name of each list on the blog post, it's true that nothing prevent me from naming each column "new" , "in progress" , "ready for qa", and "done" , my bad. this + burn down charts (like proposed in [https://gitlab.com/gitlab-org/gitlab- ee/issues/91](https://gitlab.com/gitlab-org/gitlab-ee/issues/91) ) would really start for us to make gitlab embrassing the full life-cycle of our products.

As for resolving conflict by merging, thanks I didn't know EEhad this feature.

<comment><USER11> Cool, thanks for asking and glad to learn we're on the right path.

</comment></comment></comment></comment><comment><USER39> Shouldn't the video start with "We make software by turning issues into ideas", not the other way around?

We're always trying to promote this idea of "don't sell the product, sell the problem you're solving" and your opening statement completely tips that on its head.

Not knocking GitLab in any way, I love your product and have used it for a while. Amazing work. Just me being a pedant ;)

<comment><USER40> > Shouldn't the video start with "We make software by turning issues into > ideas", not the other way around?

They're using "issue" as in "issue tracking", not "issue with how the world works". In this sense, you take an idea and write it down as an issue, which can then be discussed and implemented.

<comment><USER39> Fair enough, though ambiguity doesn't help their narrative. If I questioned it, I can't believe I am the only one.

</comment></comment></comment><comment><USER41> I'm glad there's starting to be a good amount of choice in this realm of tools!

I've actually just lately been looking into a new all-in-one package like this for our company. Git hosting, code reviews, issue tracking, wiki, and nice project management features all in one place. My current systems-under-test are Phabricator and Jira.

Anyone have an opinion on how GitLab compares to those two?

<comment><USER6> We compare GitLab with a bunch of other tools on our website: [https://about.gitlab.com/comparison/](https://about.gitlab.com/comparison/). We don't have a section on Phabricator yet, but if you end up trying both GitLab and Phrabicator, please consider writing down some of your observations!

Like all of our website (and our product, as a matter of fact), we accept merge requests to improve that page: [https://gitlab.com/gitlab-com/www- gitlab-com/blob/master/sou...](https://gitlab.com/gitlab-com/www-gitlab- com/blob/master/source/comparison/index.html.md)

<comment><USER41> Thanks for the reply!

I'll see if I have time to evaluate yet more tools very thoroughly , but if I look into GitLab I'll definitely hit you with something for that page :)

one thing that jumps at me from those comparisons is that mostly all of them are against other tools that are mainly for repository hosting. Is it intentional, and similarly the main idea of GitLab itself?

<comment><USER11> We are mostly compared to those tools, that is why we added those sections. I think it might get unwieldy if we added non repository hosting tools too.

</comment></comment></comment></comment><comment><USER42> So excited for this release! These guys are killing it on features!

Also noticed the speed/performance improvements lately.

Great job, GitLab!

<comment><USER11> Thanks Alfred!

</comment></comment><comment><USER43> Awesome! Really awesome features. Time to persuade my boss to move to Gitlab now.

Just need some data on the latency and reliability. so far, I only found [https://status.gitlab.com/](https://status.gitlab.com/). need some historical data now.

<comment><USER11> [http://stats.pingdom.com/81vpf8jyr1h9/1902794](http://stats.pingdom.com/81vpf8jyr1h9/1902794) shows it for the last 7 days. If you want to have higher uptime also consider [https://githost.io/](https://githost.io/) that we run.

</comment></comment><comment><USER44> This is awesome. Is it possible to have a central set of issues per group? Many (real-world) projects have issues that span across multiple (GitLab) projects. I guess one could create an "empty" project for issues, but this is hacky. Thanks again.

<comment><USER11> Great suggestion. With milestones you can already aggregate issues on a group level, but it makes sense to have a group level issue board too. I created an issue in [https://gitlab.com/gitlab-org/gitlab- ee/issues/911](https://gitlab.com/gitlab-org/gitlab-ee/issues/911)

</comment></comment><comment><USER45> My first impression of the Issue Boards is that it reminds me of Trello quite a bit! I happen to like Trello, and whether or not this new feature was Trello-inspired I'm excited to give it a test run.

<comment><USER3> We were definitely inspired by awesome software such as Trello and Asana. We've woven it into GitLab and have some iterations to go before it's exactly what we want, but we believe we've shipped something useful so far.

Would love to hear your feedback and suggestions for improvements.

</comment></comment><comment><USER46> How do we use the mattermost features on gitlab.com ?

<comment><USER6> Mattermost is not enabled on GitLab.com, in part because it's not prepared for multi-tenancy, and in part because it is shipped with the GitLab package specifically for people who want to have a self-hosted development and collaboration environment. If you're fine with using hosted tools, there are plenty of great hosted chat tools out there!

<comment><USER47> DouweM, it is possible though to do this. Although a good seamless integration would require some extra work from our end. I've proposed this in an issue[1]. It is not planned though, at this time.

[1][https://gitlab.com/gitlab-org/gitlab- ce/issues/21251](https://gitlab.com/gitlab-org/gitlab-ce/issues/21251)

</comment></comment></comment><comment><USER48> An awesome release! Waiting for Koding to be enabled on gitlab.com ..

</comment><comment><USER49> GitLab's been going at it for quite a while now, congrats for another awesome release! And keep up the great work guys, it's much appreciated!

<comment><USER3> Thanks aban! Any feedback?

<comment><USER49> You guys are awesome!

For my 2¢, it would be really great to see some "official" love for Haskell at GitLab :) E.g. having Haskell tools installed on shared runners would be pretty nice!

I'm also curious to know the state of functional programming at GitLab. I know you guys mostly do Ruby, but would you be open to employees using functional languages or frameworks for work? (e.g. Elm, Elixir, Haskell and other exciting functional stuff)

<comment><USER11> We used Haskell for a dependency of our Omnibus packages before but it turned out to be very hard to install on many platforms.

Anyway, we don't install any tools on shared runner, we recommend you use a docker image and/or the scripts to do that.

We mostly do Ruby for the web app and Go for the heavy lifting [https://gitlab.com/gitlab-org/gitlab-workhorse/](https://gitlab.com/gitlab- org/gitlab-workhorse/)

Now that we plan to ship with Cog we need Elixir for the first time. Help with [https://forum.mattermost.org/t/help-wanted-cog- integration-f...](https://forum.mattermost.org/t/help-wanted-cog-integration- for-mattermost-in-elixer/2099) is appreciated.

</comment></comment></comment></comment><comment><USER50> Anyone notice that Github is getting dog slow lately? When browsing source trees it used to be lightning fast. They're trippin'.</comment>


Nokia N900 and the case of the best unboxing ever - <AUTHOR> http://www.engadget.com/2009/12/21/nokia-n900-and-the-case-of-the-best-unboxing-ever/

<comment><USER2> That was cute.

I usually find "unboxings" kind of creepy. I like gadgets too, but fetishizing the _boxes they come in_ is weird.

<comment><USER3> Nah, it's a way of living vicariously. If you can't get the item yourself, at least you can see what it's like.

</comment></comment><comment><USER4> This is a well-targeted advertisement. Too bad they couldn't find some real use for such a box, e.g. A handy dock station for the phone.

</comment><comment><AUTHOR> I'm just linking this for the first few minutes of the video (the rest is a pretty standard unboxing with a few little surprises).

</comment><comment><USER5> Talking about reducing waste.

</comment><comment><USER6> Figlet output sighted @ 1:26 :-)

</comment><comment><USER7> A tale with pictures:

[http://www.benjiegillam.com/2009/12/n900-the-tale-of-the- ind...](http://www.benjiegillam.com/2009/12/n900-the-tale-of-the- indestructible-box/)</comment>


Nissan launches its Tesla Powerwall competitor - <AUTHOR> http://www.theverge.com/2016/5/12/11662144/nissan-home-battery-pack-xstorage <comment><USER2> Unless the Gigafactory will offer similar pricing to external entities as it will to it's own company (Tesla), I think it's going to be really hard to compete on cost with Tesla in the battery market and still be profitable. At least that's what I would assume given very little to no specialized knowledge of batteries and the battery industry.</comment>


US should get rid of cash and move to a digital currency says Nobel prize Stiglitz - <AUTHOR> https://www.weforum.org/agenda/2017/01/the-us-should-get-rid-of-cash-and-become-a-digital-economy-says-this-nobel-laureate-economist <comment><USER2> Another big brother, academic, statist who thinks that every transaction should be tracked by the government. Just horrible people.</comment>


Client-side implementation of Reddit's ranking algorithm - <AUTHOR> http://nith-reddit.appspot.com/

<comment><AUTHOR> Simple Reddit clone implemented for a lecture I held for university students. It runs on AppEngine and the source can be found here: <http://bitbucket.org/uggedal/nith/src/tip/nith-reddit/>

Novel feature: I implemented the hot algorithm in JavaScript. When stories are voted up/down they are resorted client-side.</comment>


Ask HN: How would you be convinced to try out a new product as an enterprise? - <AUTHOR>

I have launched my startup Poucher (http://poucherapp.com) and I am daring to ask a business question in Hacker News (considering most of them are related to technologies)
We are currently at the phase of speaking to restaurant owners. Our primary contact method is cold calls and later we proceed with a 20 skype chat (video call, if possible).
What I would like to ask on behalf of the business team is, if you were a restaurant owner (actually a potential customer in general) what would it take for you to be convinced to try out that product.
Questions
1)Would you have to see the sales person in a real meetup, or would you be convinced if the product was good enough? 2) Would cold call leave a negative impact on you?
Any answer would definitely broaden our vision and improve our approach methodology we apply to potential customers. <comment><USER2> In my own experience with restaurant owners where I worked in-person and live product demonstrations go a very long way.

Also _follow-up, follow-up, follow-up_</comment>


Beautiful Job Description: Intrinsically Motivated Full Stack Product Hacker - <AUTHOR> http://codeascraft.etsy.com/2012/06/15/intrinsically-motivated-full-stack-product-hacker/

<comment><USER2> Cute, but maybe a little _too_ out cute.

> You are prone to quixotic behavior.

They are looking for people who are prone to irrational, unrealistic behavior? It makes for nice prose but I have a feeling that some of the personality disorders that could be described by their phrasing wouldn't be particularly welcome.

> Full-stack.

What stack?

No really, you're hiring me for the full stack. _What is the stack?_

Would I ever be writing a line of CSS? Or JavaScript? Or Ruby? SQL?

At least they say "Largely PHP" a little bit later, but that makes me wonder just what their definition of full-stack is.

I appreciate pleasant writing for the sake of it, but there's a lot of information they could have imparted but chose not to. I wonder if they'd respond favorably if I actually replied in kind. Do they really want quixotic behavior? Is being scant on technical details an OK thing for a technical job posting?

I'm tempted to send a cover letter talking about how the best CSS (would I be writing CSS?) is made with oil paint and that I wear a tea cozy for a hat. I could claim to have independently discovered punctuation and talk about how I navigate code by wind chime.

<comment><USER3> re Quixotic Behavior: We want people who are comfortable taking a stand on an issue and going off on a mission to solve the problem. Not every great idea seems reasonable before people see it working.

re Full-Stack: We're looking for people who design and build full systems from low to high levels. Some have made their career working just as a front- or back-end hacker. We want to meet people who wouldn't dream of letting someone else take half their work or who would be comfortable throwing part of the problem over the fence. People that are a good fit probably don't care that much about what the stack is beyond some reasonable constraints.

If you end up sending that cover letter there's a chance that we'd all be amused enough to read your resume.

<comment><USER2> At the risk of being rude, that additional description leaves it just as open- ended and confusing.

Is everyone at Etsy amazing all every part of your stack?

Suppose I've done most everything except zero database work in my life, should I apply? Or is that not full stack enough?

What if I've done everything but high level design work? Not full stack enough?

What if I've done everything including design work but realized I'm not that good at it, so I hired out design for my projects? What if I determined the reverse with low level database stuff?

What if I have written the full-stack of a few webapps but always used Rails, and haven't ever touched any of the low level bits?

What if I've done only database and web design and have never really touched PHP? Or did PHP but never did any JavaScript? Good enough?

I know what your reply to me is going to be, you'll say by all means, apply, etc. But that's not what I'm trying to point out here. I think that your listing and subsequent clarification might suggest to many that all of the above are inadequate, and I imagine you may be turning off several (very good) candidates that doubt their own full-stack-worthiness, merely on account of the term here being so nebulous.

In other words, to any given pair of eyes that fall upon the ad, all they know is that you want everything.

<comment><USER4> Full-stack here seems to be about mindset not skill set.

I have a different criticism: it's hard to own the stack without being empowered to change it, to make wholesale changes. And that's hard to do as software grows and ossifies, as deployment gets more uncertain. To do full stack right you need to limit team size, I think.

</comment></comment></comment></comment><comment><USER5> Question for HN, how do you generally feel about the 'Intrinsically Motivated' requirement?

I'm deeply motivated about a great many things that are important to me, but helping to implement or maintain someone elses idea isn't one of them.

For a price I'd be happy to turn up and give you eight hours of hard work per day. I take pride in my work, am passionate about improving my skills and would do my best to translate them into tangible benefits for your organization.

But my motivation for doing so would be mostly based on a financial arrangement, in other words, extrinsic. Does that someone like me shouldn't apply for a job posting like this or am I misunderstanding?

<comment><USER6> Recently I saw a post that quoted

      Derive your self-worth from the process not the output.

The first you control, code quality, integrity, professional communication with team mates etc. The second is not entirely within your control and should not lead to anxiety.

Anyway, I would want to hire someone like that - more intrinsically motivated, than someone who is focused on building Facebook for dogs for an IPO.

I would pay good money, but not expect commitment to the mission, just commitment to intrinsically good code and practises.

That's my take

</comment></comment><comment><USER7> On a side note, now I understand why HN doesn't allow comments on job postings. This is a tough crowd.

<comment><USER8> It's not a tough crowd at all, the comments are all extremely reasonable and should be insightful to the job lister.

HN really should allow such comments, it would often help companies get feedback about why they are not finding the people they think they need.

</comment></comment><comment><USER9> Well, I enjoyed the classics references. Had to look up Manichaeism (<http://en.wikipedia.org/wiki/Manichaeism>)

</comment><comment><USER10> If I am intrinsically motivated, why would I work for somebody?

<comment><USER11> Because you can get behind what they do.

I like making things for people. At Etsy, for example, I like that the sell side of their audience are independent makers. I could easily imagine doing some user interviews, discovering something in their experience that can be improved, and then going out and making it happen.

Working with others can be preferable to working alone in that it's a lot easier to release something that helps a large audience. Because I'm not an idiot I would insist they pay me fairly, but my primary motivation would still be helping the users.

</comment></comment><comment><USER12> Etsy is a terrific company for development, especially for continuous delivery and how to build great systems. Their tech blog is excellent: <http://codeascraft.etsy.com/>

</comment><comment><USER13> Yes, a beautiful job description. However, for me these two statements are inherently contradictory:

"You consider critical thinking to be among your core competencies."

"But technology is a means and not the ends for you, and you don't flinch at the idea of writing largely PHP for a living."

I interpret this as "think critically, but don't criticize the technology choices we have already made."

Yes, technology is a means, but that does not mean that it's something to just mindlessly accept. This is particularly true in the realm of software where there are so many technological possibilities to choose from.

<comment><USER14> Well, they've ostensibly put tens of man-years into their architecture. I don't think any amount of critical thinking can change it significantly...

<comment><USER13> I'd never preemptively judge what could be done with an architecture without looking at it first. There are always creative possibilities, so if their is something wrong with their technology choice (not saying there is), then I wouldn't preemptively rule out being able to do something about it.

Of course, maybe sarcastic presumptuousness is what they are after? Why not send in your resume?

<comment><USER14> Oh, I'm sorry, I didn't realize my estimation was binding.

You saw a job posting and assumed that they treat their technology choices as unassailable and immutable, and I pointed out that it may not be economic for them to change their entire codebase. You seem to have turned this discussion into an argument about their codebase having a problem and requiring action. Who's being presumptuous?

<comment><USER13> "You seem to have turned this discussion into an argument about their codebase having a problem and requiring action. Who's being presumptuous?"

You are, and in a very ironic way. I never said their codebase had a problem. I don't know anything about their codebase. It might be just peachy.

Look at it this way. What if someone was hiring you to build pyramids by lifting each stone using only the narrowly prescribed box of using your own power (since "that's how we've always done it" say), they might also say that your focus on horses and pulleys was a wasteful obsession about means instead of ends and that you shouldn't flinch about dragging each stone yourself all day every day. They might think you are just wasting your time tinkering when you should be moving stones instead, but the truth is that your means are the only human way to reach those ends.

But again, their codebase might be perfectly fine. The thing is, I don't like to be told that I have to accept that it is before I've looked at it myself. They can have a really good hacker who will keep his head down, pump out code, and not question past decisions, or they can have critical thinking, but not both.</comment></comment></comment></comment></comment>


Would you pay for this task management application? - <AUTHOR>

We have just launched a task management application that we think is different. We are wondering if people would be willing to pay to use it. Can you please give us some feedback?
Website: http://taskk.it Overview: http://youtu.be/ZZM3wvySPes Why we built it: http://taskk.it/blog/2-introduction-to-taskk Other cool stuff: http://taskk.it/blog
Summary: Taskk is the task management application that tells you what to do next. Place your lists and tasks in priority order and tell Taskk how much time you have today, tomorrow, and into perpetuity. Taskk will build efficient days worth of work and show you when everything will be addressed. Something change? Drag, drop, collaborate, and share your way to the most accurate view of your workload yet. <comment><USER2> I watched the video and it looks very impressive.

Towards the end of the video you mentioned Taskk would be good to see if you have enough time to take on a new project. If the tasks are standard for each project, could the user create a new list from a template he/she previously created?

<comment><AUTHOR> That is a great idea. We don't have templates but I love the idea of quickly dropping a template in, hitting update_plan and seeing how it looks. Adding this to our taskk list of things to do! :)

</comment></comment><comment><USER3> Yes,

This looks like a very interesting concept.

Is there a possibility to define locations? Like: "school", "city" which I can fill with the corresponding locations.

And taskk could then group my tasks according to where I am?

I can really see this becoming very, very useful :)

<comment><AUTHOR> Thanks for the feedback. We don't have the ability to do what you mention above yet but we are thinking about it.

<comment><USER3> That would be great. However the idea alone is enough to keep me hooked.

Just recieved my Beta invite, creating taskks right now :)

<comment><AUTHOR> Awesome! Let us know your thoughts!

</comment></comment></comment></comment><comment><USER4> just watched the video. nicely done! is there a way to specify explicit ordering? so, if task1 takes three hours and task2 takes 10 minutes and must follow task1, can i keep the service from putting task2 before task1 when it is creating a schedule for task execution?

<comment><AUTHOR> Yep, we take all that into consideration as well as task dependencies, not_until dates, force_dates, and sequential scheduling. As well as collaborative lists.

</comment></comment><comment><USER5> YES!</comment>