Bobby Tables - <AUTHOR> http://blog.cleancoder.com/uncle-bob/2017/12/03/BobbyTables.html <comment><USER2> If I could downvote topics, this would get one.

We have an API for that. It's called prepared statements.

We also have a lot of other APIs that try and do away with SQL, and fail in one of two ways. The first is people write code like personDAO.fetchAll().toList().size() - admittedly you can make the same mistake with SQL but I haven't noticed this quite as much. The second way is that SQL is a very powerful language once you combine cursors, grouping, inline views etc. and I haven't yet met an ORM libary that can come close. So you're back to fetchAll() and do the work on the web server if you think SQL is a scary language that you don't want to touch.

<comment><USER3> Couldn't agree more. Just recently I've used SQL to write a "lock and fetch" data query in one relatively simple instruction reducing the application logic complexity considerably.

By the way can anyone recommend a good book on advanced SQL (not a specific DBMS)?

<comment><USER2> There was a HN topic on this about a year ago: [https://news.ycombinator.com/item?id=13417326](https://news.ycombinator.com/item?id=13417326)

The problem with "advanced SQL, not a speficic DBMS" is the more advanced you get, the less overlap there is between different dialects. MariaDB/MySQL for example didn't support WITH until the 10.x versions (WITH RECURSIVE was added in 10.2.2 according to the site) and it still needs an explicit alias for SELECT ... FROM (SELECT ...) style constructions. SQLite can't do RIGHT/FULL OUTER JOIN etc.

Karwin's SQL Antipatterns is a good book for a "second look at SQL" but I wouldn't really call it advanced yet. The manuals for postgres and MariaDB, while written as manuals and not tutorials, contain a lot of useful information and a fair part of it applies to most relational databases.

Performance tuning is even more specialised. Although I've been praised as a consultant before now for simply adding an index to something, my experience is mostly on the MySQL side of things - I don't think it would be hard to beat me in an "advanced postgres" quiz.

</comment></comment></comment><comment><USER4> Is this a joke? I've never met someone who had a hard time with safe query parameterization.

It's wrong to say sql can be replaced with "an api", it does not have the same flexibility, power, performance, etc. And would drastically slow down your development. Also, what is "the api" going to use? Text files?

It's better to teach people to practice safe SQL than to require abstinence.

<comment><USER5> I feel like this is a blog post from 2003 or something, and the audience is PHP developers who are writing inline SQL statements.

</comment></comment><comment><USER6> Proper SQL parameterization is a great example of where library/language design has a lot to offer.

For example, in Java

        // IMPROPER
        PreparedStatement statement = connection.prepareStatement(
          "SELECT * FROM users where email = '" + email + '"'
        );
        statement.execute();

vs

        // PROPER
        PreparedStatement statement = connection.prepareStatement(
            "SELECT * FROM users WHERE email = ?"
        );
        statement.setString(1, email);
        statement.execute();

The first code is easier and simpler than the second code -- especially if have lots of parameters, or if your queries start mixing arbitrary data and variable parts of the SQL. So people are sometimes going to write the first code.

\---

In contrast, Scala has more sophisticated facilities than Java. I contribute to [https://github.com/lucidsoftware/relate](https://github.com/lucidsoftware/relate) where the example would simply be

        // GOOD
        sql"SELECT * FROM users WHERE email = $email".asSeq[User]()

It's just so easy that no one is ever even _tempted_ to do the wrong thing. Use developers' laziness to your advantage, not your detriment :)

You can keep the full power of SQL (index hints, hand-tuned locking, DBMS- specific features), without constantly fighting the propensity towards SQL injection.

<comment><USER7> Django ORM is also less error-prone than the Rails example shown:

        User.objects.get(email=email_input)

Raw Python DB-API, on the other hand, can easily be misused, as I've see on several occasions.

</comment></comment><comment><USER8> This is a brilliant suggestion! We should also stop using HTML to prevent HTML injection, and stop using XML to prevent XML injection, and stop using the stack to prevent stack overflow.

(Actually, using an API _to build_ SQL, HTML, and XML, instead of doing string substitution, is exactly the right way to prevent ___ injection, but that's not quite what this says.)

</comment><comment><USER9> > What would replace SQL? An API of course!

Turtles all the way down. At some point you have to use some sort of data access language.

Providing an API instead of using SQL queries only works if you have a fairly limited number of different procedures to be called and data structures to be returned. Otherwise you'll end up with a combinatorial explosion of API methods and input values.

If you view your SQL database as mere data storage that approach could be valid. If however, you're working with complex relational models and data processing providing an API is a pointless endeavour.

I've seen (legitimate, mind you) SQL queries which were more than a hundred lines long and in turn called multiple additional embedded queries. Some of those queries used groups and window functions alongside with normal tabular data. Good luck with providing that as an API!

<comment><USER10> Only a Hundred? I have seen some that where over a 1000 in BT's CSS system

</comment></comment><comment><USER11> I know of at least one language[0] that makes SQL injection impossible, by simply type-checking SQL alongside with the rest of your application, but I'm not sure Uncle Bob would like using it[1].

[0] [http://impredicative.com/ur/](http://impredicative.com/ur/)

[1] [http://blog.cleancoder.com/uncle- bob/2017/01/11/TheDarkPath....](http://blog.cleancoder.com/uncle- bob/2017/01/11/TheDarkPath.html)

<comment><USER3> For anyone interested in how it looks like: [http://impredicative.com/ur/todomvc/todomvc_db.ur.html](http://impredicative.com/ur/todomvc/todomvc_db.ur.html)

It seems DELETE FROM requires WHERE... Good idea :)

<comment><USER11> Far more important IMO are the following features:

(0) The type checker ensures that database and application types are synchronized. It's literally impossible to query inexistent tables, inexistent fields, or assume they have a type that they in fact don't have.

(1) Tables can be private to a module, just like everything else in an ML dialect. This allows you to establish "table invariants" that other modules cannot possibly break. If this still sounds too abstract, here's a concrete benefit: You can dernormalize private tables, without risking other modules putting them in an inconsistent state. If I ever go back to programming ERP systems, I would love to do it in Ur/Web.

<comment><USER3> Do you mean the type checker that runs during compiling connects to the database? Seems interesting but on most of my projects there were several environments so it wouldn't solve all problems. A similar, but simpler solution for other languages would be to generate types from the database schema before compiling.

Do you have a sample code of these table invariants at hand? I'd gladly take a look...

<comment><USER11> > Do you mean the type checker that runs during compiling connects to the > database?

Okay, it doesn't go that far. But the compiler produces the table creation scripts. So, if your build process includes running said scripts, then database and application types are guaranteed to be synchronized.

> Do you have a sample code of these table invariants at hand? I'd gladly take > a look...

Imagine a general ledger that's guaranteed to never go out of balance, no matter what third party modules do that interact with the accounting subsystem, because the only module that can directly manipulate accounting tables is the accounting subsystem. Guaranteed by the type checker.

I haven't implemented such a thing in Ur/Web, because implementing accounting systems from scratch is a frigging lot of work, most of it utterly boring, and nobody has paid me to do it. But it's feasible, and the ML module system is the reason why.

</comment></comment></comment></comment></comment><comment><USER12> This is a really poor article, that doesn't give reasonable advice. SQL injection attacks are a big risk, for sure. But SQL persists because it's incredibly useful. "Stop using SQL" is completely pointless advice.

Meanwhile, in the real world, every interface/API/protocol/whatever has the potential for being exploited to do things that weren't intended. You may as well say "stop using computers!"

</comment><comment><USER13> _" What would replace SQL? An API of course! And NOT an API that uses a textual language. Instead, an API that uses an appropriate set of data structures and function calls to access the necessary data."_

Isn't this similar to what frameworks and libraries such as Jooq do? They provide data structures and function calls where you pass in the user inputs, and the library will safely construct/execute prepared statements. However, I still think of them as being SQL based tools. Is this what Bob is recommending, or does he have something completely different in mind?

</comment><comment><USER14> "And if you make absolutely certain that no text that crosses that boundary going towards the SQL engine has any SQL in it. Then you will absolutely prevent SQL attacks."

Not to mention your app will be extremely inflexible and likely slow beyond all hell. This is exactly what was done at my current work. The query overhead of the ORM system is 10x slower than the actual runtime of the query. 10 times slower. For overhead. Unnecessary overhead. For an engine that is completely inflexible, unusable, and increases development time by 2-10x (Doctrine 2 ORM if you're curious). Really, this is the worst advice I've ever seen on HN. People have been creating such systems as the author describes for years and they have all failed in comparison to SQL. SQL prepared statements, on the other hand, are available to all languages and prevent injections. Other than specialized systems or DBs like Linq and Datomic, the only decent, solid relational database access systems I've ever seen in my life all relied on SQL.

I really can't even imagine what the author is referring to at this point. Should I build out my own Linq or Datomic like layer for every app? Should I use an ORM with the right architecture that hopefully won't slow my app 10x with its overhead? Should I just write a new DB from scratch? The article says to build an API. Well how is said API supposed to access the DB? Clearly, the author hasn't thought this out at all.

<comment><USER15> What he wants is to stir up some controversy so that an executive is convinced that his engineers are doing things wrong and will bring him in to "fix" things.

His part about pushing that stuff down the stack reads to me like: "read my latest book!"

</comment></comment><comment><USER16> Clean code and clean architecture are great books. I find sql injection from kids fresh out of college all the time in php but to be honest I really can't tell the difference in that rails code. At work I've build a query helper function that takes a query string and a array of bindkeys/bindvalues and everyone must use this, easy logging, easy security etc...

In this articles defense something SHOULD have been done instead of all the books that came out of their years that start off teaching sql injection and then barely mention injection near the end. It is a bit silly we still hear of this problem and the ongoing amazon s3 open links. The solution is typically some start up but the original software should have fixed its own problem, why did we end up treating database queries as low level and as powerful as letting users toss in assembly code.

<comment><USER17> The unsafe Rails code accepts a string as argument and copies it as is into the SQL code. The safe statement accepts a map and transforms it into SQL code using all the safety features made available by the underlying database driver. It's what your helper function seems to do.

A solution would be banning any string argument, maybe except the inevitable one for fin_by_sql.

The post probably argues for databases exposing directly their inner API. Let's suppose there is a standard. I bet that there would be still ways to write vulnerable code.

</comment></comment><comment><USER18> is he trolling or what? You want an API.. it already exists.. Stored Procs, parameterized queries or ORMs which will use parameters........

<comment><USER19> Just another senile moment of our beloved uncle...

</comment></comment><comment><USER20> I was considering purchasing this author's books (Clean Coder & Clean Code) but after reading this unintelligible garbage, I'll pass.

<comment><USER21> Question to fellow coders:

Can anyone comment how, if at all, these books are different from classics in the field, such as The Practice of Programming, The Elements of Programming Style, The Pragmatic Programmer, or Complete Complete?

I can't think of anything new that another book on writing good code could say, that hasn't been said already.

That's why I haven't looked at these books yet. It feels to me these books are like another book about Newtonian mechanics, there just can't be anything new.

Thoughts?

<comment><USER20> Some quick research led to a number of threads that were fairly critical of this author: "his writings are only here to promote himself, his books and his consultancy" and "a windbag" and "self-aggrandizing".

[https://news.ycombinator.com/item?id=14664210](https://news.ycombinator.com/item?id=14664210)

[https://www.reddit.com/r/programming/comments/mpusp/9_things...](https://www.reddit.com/r/programming/comments/mpusp/9_things_i_learned_from_reading_the_clean_coder/)

[https://www.reddit.com/r/programming/comments/3q5n9q/just_fi...](https://www.reddit.com/r/programming/comments/3q5n9q/just_finished_reading_this_clean_code_robert_c/)

</comment></comment></comment><comment><USER22> > What would replace SQL? An API of course!

That literally describes all of 'NoSQL'. Everyone is adding SQL back into their nosql systems, because it's insanely useful. Since anyone remotely interested in databases knows this, I can only assume this is a kind of weird joke.

</comment><comment> GuB-42 Argument by ignorance.

The safe/unsafe example is obvious to me, and I don't even know Ruby. The unsafe cases have parameters, the others have not (they just build a string). And anyone who knows the basics of injection should know that building a string to be evaluated is naturally unsafe and should be done very cautiously.

The author makes it as some obstacle that is impossible to overcome, like you have to know some arcane symbols and magic. These things are basic operators. They are similar in most languages and any professional programmer should have a pretty good intuition on the matter.

Here is the reasoning :

User.where("email = '#{email}'") : unsafe / the variable is between quotes, it should be a red flag

User.where("email = '%{email}'" % { email: email }) : unsafe / again, a quoted variable, bad. The "%" operator looks like a string manipulation operator rather than a argument.

User.where(email: email) : safe / uhm... looks like a language idiom, need to look that up

User.where("email = ?", email) : safe / a common way of doing prepared statements, seems OK. Unlike with the "%", the "," seems to imply that "where" is going to process the arguments, which is good.

User.where("email = :email", email: email) : safe / another common way of prepared statements, again, the "," implies several arguments.

What happen here is that too many people decide to switch off their brains. The "unsafe" forms are a relic, but some guy do it that way because it is how it used to be done, and some other guy copy because it "works", then another, then another, etc... No one in the chain seems to question the practice, even though safer and more convenient forms exist. Having a new API won't help, because if people are not even bothered to learn the safe way of doing SQL, there is no way they will use that API.

And sure, hiring inexperienced programmers, not giving them proper training, and making sure they can't take the time to actually understand what they are doing doesn't help...

</comment><comment><USER23> There are APIs around SQL that are pretty good in avoiding SQL injections; for example SQLAlchemy (a Python ORM) allows you watch pretty much any SQL query without writing literal SQL. You can use raw/literal SQL, but it's buried pretty deep in the docs.

Having a textual representation (with placeholders, of course) has some advantages I wouldn't want to give up:

* learn once, use it everywhere

* it's independent of the host language

* it's a reification of a query or an action, which is very useful for logs (like slow query log), debugging and the likes

</comment><comment><USER24> Wait, I thought that Uncle Bob said that programmers should just be 'professional' and stop being sloppy instead of reaching for tools that can help them

[http://blog.cleancoder.com/uncle- bob/2017/10/04/CodeIsNotThe...](http://blog.cleancoder.com/uncle- bob/2017/10/04/CodeIsNotTheAnswer.html)

</comment><comment><USER25> Now that we are on the topic of prepared statements, does anyone know how to do "SELECT * FROM WHERE x IN (list of values...)" properly? As far as I know, you cannot do it with prepared statements (as they can only be single values) and you are forced to roll your own escaping mechanism.

<comment><USER26> ANSI SQL and Postgres has had an array type since forever, MSSQL has table variables and types, other SQL databases have similar if not perfectly ANSI standard features (well probably not MySQL)

</comment></comment><comment><USER27> There is only blame in this article. I kept scrolling bellow when he mentioned API, hoping for an elaborate answer. Nothing just complaining.

</comment><comment><USER28> Give the author (a bit of) credit for this much, though: His title seemingly alludes to [https://xkcd.com/327/](https://xkcd.com/327/) but he never mentions it, perhaps taking it granted that his readers will be familiar with it. Maybe the title was designed to attract attention; if so, it worked, at least with me.</comment>


ShopSavvy Comes To The Iphone - Turn your Iphone into a Barcode Reader - <AUTHOR> http://blog.kelseygroup.com/index.php/2009/11/18/shopsavvy-comes-to-the-iphone/

<comment><USER2> I didn't realize the iPhone didn't have such a tool. I installed ShopSavvy the day I got my Droid, and I use it constantly.

More impressive, however, is Amazon's ability to find products based on a photo.

Interestingly, neither ShopSavvy nor Amazon correctly identify the Michael Crichton trade paperback "Prey" (both substitute a different product), but Amazon immediately found it when I used the 'photo search'. It does very well on book covers, even obscure/less popular ones. For instance, I got my Loeb book identified in about 5 minutes. I'm waiting for it to identify a highlighter (label visible), post-it notes, and Blistex (Label visible). Properly identifying non-packaged goods will be amazing.

Edit: it's identified each of my products perfectly using the "take a photo" so far. I haven't gone super obscure yet, but I haven't stayed just in the mainline.

<comment><USER3> The Amazon identify-by-photo feature uses Mechanical Turk (ie, real people). Try taking a photo of a handwritten note with something like "show me a book with an author whose name starts with K" (Nothing too complicated or tough to solve-the pay is very low per hit)

This can occasionally lead to amusing results when you send in photos of things which are not products, like people. A photo of a friend yielded the Freaks and Geeks DVD, and a photo of myself brought back the book "Asian slim secrets: the natural method for weight loss proven by billions of Asians" Note that these results vary a lot by who takes the MT hit; usually a picture of a face will yield something like a photo frame.

<comment><USER2> I figured the not-immediate matches were Mechanical Turk. But it's pulling results on some searches seemingly immediately after I snap the photo.

I'll have to try out your suggestions.

<comment><USER4> Some time ago, someone posted to HN a service that could basically find images based on an input image. It worked very well, so it could be that.

</comment></comment></comment></comment><comment><USER5> It has had a barcode reader / price comparisons based on the barcodes for some time now. <http://redlaser.com/> In fact it was the #2 selling iPhone app for quite awhile.

<comment><USER6> Not only that, having used both, RedLaser is by far better at scanning.</comment></comment>


Hundreds allege sex harassment, discrimination at Kay and Jared jewelry company - happy-go-lucky https://www.washingtonpost.com/business/economy/hundreds-allege-sex-harassment-discrimination-at-kay-and-jared-jewelry-company/2017/02/27/8dcc9574-f6b7-11e6-bf01-d47f8cf9b643_story.html <comment><AUTHOR> heh, i already stayed away from them like the plague, mainly out of concerns for gem sources and inflated prices.. this article does not help.

<comment><USER2> When I was searching for an engagement ring I started at Kay, as I think many people do. The stones are low quality, overpriced by 20% or more (which is impressive when you're buying something as artificially overpriced as a diamond), and the service is generally good but not great.

I ended up going to a private/independent jeweler and getting a much higher quality piece compared to anything Kay _had_ , let alone what they had that I could afford.</comment></comment>


Jack the Ripper letters written by the same person, forensic linguist concludes - <AUTHOR> http://www.manchester.ac.uk/discover/news/jack-the-ripper-letter-mystery/ <comment><USER2> I did my master's thesis on authorship verification, which is exactly this problem (deciding if two texts are written by the same author).

I experimented with clustering, SVMs, neural nets, etc for a long time, and got mainly disappointing results.

Even when "modern methods" give very high confidence scores, the problem is very messy and complicated, and usually the training data is different enough from the actual data (in supervised learning scenarios) as to bring the result into question.

I don't have access to the paper, so can't say much more, but I've seen a lot of very good-looking results that are in fact questionable.

Still a fascinating problem!

<comment><USER3> From the abstract[1]:

> After compiling the 'Jack the Ripper Corpus' consisting of the 209 letters > linked to the case, a cluster analysis of the letters is carried out using > the Jaccard distance of word 2-grams. The quantitative results and the > discovery of certain shared distinctive lexicogrammatical structures support > the hypothesis that the two most iconic texts responsible for the creation > of the persona of Jack the Ripper were written by the same person.

So it seems to be a combination of cluster analysis and manual linguistic reading of lexicogrammatical structures. It would be interesting if these studies were done as blind studies, with another letter from the period (or a convincing known fake) was also used as control. Do they find those shared distinctive lexicogrammatical structures in the control too, because they're looking for them now? Does the cluster analysis give significantly higher confidence to grouping the possibly-real letters, compared to grouping one possibly-real letter with the known fake?

Those would make this more interesting and less questionable, especially for a first study into this.

[1] [https://academic.oup.com/dsh/advance-article- abstract/doi/10...](https://academic.oup.com/dsh/advance-article- abstract/doi/10.1093/llc/fqx065/4824843)

</comment></comment><comment><USER4> Is this the same discipline that thinks Columbus was from Northeastern Spain?

[https://en.wikipedia.org/wiki/Origin_theories_of_Christopher...](https://en.wikipedia.org/wiki/Origin_theories_of_Christopher_Columbus#Catalan_hypothesis)

Toilet paper.

<comment><USER5> Andrew Wakefield, the man who published the fraudulent "vaccines cause autism" paper, was a medical researcher. Do we then discount all other medical researchers?

<comment><USER4> There are absolutely huge problems in medical research regarding statistical strength and p-hacking. But, I get your point.

In this case, copy cats of Jack the Ripper were trying to emulate his (her?) ideolect. So one expects the entire exercise to be hopeless and the conclusion holds no predictive value.

<comment><USER6> > In this case, copy cats of Jack the Ripper were trying to emulate his (her?) > ideolect. So one expects the entire exercise to be hopeless and the > conclusion holds no predictive value.

The letters in question were sent before the first letter was published. How would a copycat know what to emulate before the first letter's publication? It was also found that the latter letters were not very good at copying the original author's style. This is all in the article.</comment></comment></comment></comment>


Is it ok to answer these screening questions for a programming job? - <AUTHOR> https://twitter.com/Root3d/status/916640177891680256 <comment><USER2> Looks like pretty standard interview stuff. It's just trying to get you talking so they can see if you communicate well and if they like you.</comment>


My Journey from Israeli Military Intelligence to VP of R&D - <AUTHOR> https://linearb.io/blog/7-secrets-learned-on-my-journey-from-israeli-military-intelligence-to-vp-of-rd/ <comment><USER2> You have to be an expert in every person on your team job in order to be an effective manager? Not so sure about that part. But I love the hands on automation work he did when he started the team. More managers should do that.

</comment><comment><AUTHOR> Love the "secrets" Nadav shared with Dan: The #1 characteristic of a great team: They make other teams around them better.</comment>


"Whites as Minority": The Racialized Narratives of Demographic Change (2018) - <AUTHOR> https://nonprofitquarterly.org/racialized-narratives-demographic-change/ <comment><AUTHOR> I'd like to highlight this quote from the article: "fear that white people would become a minority and thus be treated poorly, because that's how you treat minorities"

It then goes on to mention ways, derived from literary analysis, in which becoming a minority is nothing to worry about. I suppose we will see if the US will be the first where it turns out this way in practice.</comment>


Top EU court overturns US data transfer agreement in Facebook case - <AUTHOR> https://www.dw.com/en/eu-us-data-transfer-facebook/a-54194377 <comment><USER3> Max Schrems[1]: "The Court clarified for a second time now that there is a clash between EU privacy law and US surveillance law. As the EU will not change its fundamental rights to please the NSA, the only way to overcome this clash is for the US to introduce solid privacy rights for all people – including foreigners. Surveillance reform thereby becomes crucial for the business interests of Silicon Valley."

"This judgment is not the cause of a limit to data transfers, but the consequence of US surveillance laws. You can't blame the Court for saying the unavoidable - when shit hits the fan, you can't blame the fan."

[1] [https://noyb.eu/en/cjeu](https://noyb.eu/en/cjeu)

</comment><comment><USER4> The judgment is here: [https://noyb.eu/files/CJEU/judgment.pdf](https://noyb.eu/files/CJEU/judgment.pdf)

Start at page 28 if you want to skip the recap of EU law, or start at page 35 if you want to skip the details of US law and surveillance programs as recap by the Irish court who referred the ruling.

<comment><USER5> > MrSchrems, an Austrian national residing in Austria, ...

It's a bit sad that people have to fight this war on personal title.

<comment><USER6> Schrems has a history of doing this. [1]

It's mainly odd to me that there aren't more privacy / consumer protection groups doing the same things he does.

[1] [https://en.wikipedia.org/wiki/Max_Schrems](https://en.wikipedia.org/wiki/Max_Schrems)

<comment><USER7> European privacy and consumer support groups are mainly after lawyers' fees. They mostly make money by notifying misbehaving companies of their misbehaviour, collecting fees for the (usually unwanted, but enforcedly payable) notification ("Abmahnung" in German).

Dieselgate was started by such a group.

The system is not all bad, but incentives are against stuff like this being litigated by the usual privacy or consumer support groups, because you just can't collect fees from the legislative branch...

<comment><USER8> Which groups are you talking about?

</comment></comment></comment></comment></comment><comment><USER9> I work in a sector with a requirement to keep data out of the US. It is VERY hard to find providers who can promise not to do this. Even when servers exist in the EU, many provider's contracts have clauses that allow transfer to the US, as they have staff there who may access the data.

I can see company legal departments taking this ruling to prohibit transfers, even with a DPA in place, and causing havoc around the EU.

<comment><USER10> I worked on fintech projects in Europe, with German banks as our main clients. Their requirements went as far as refusing any service that would have their support teams (or part of it) located in the US. It was quite challenging to fulfill their demands, and increased the development and maintenance cost by A LOT, but definitely possible.

And once you have a working system and solutions in place that becomes a quite good sale argument.

And yes, the EU is really lacking providers that can follow those requirements. At some point Microsoft had a German cloud completely distinct from their other offering and managed by Telekom, but they stopped a few years ago (and it wasn't really in a production ready state IMHO...).

<comment><USER11> >I worked on fintech projects in Europe

I don't see the problem, buy HP Enterprise Hardware (Support is based in Czech Republic), install Suse for example (but not RedHat), ask a Data-center of your wish, place your Hardware there make your own 'cloud'...profit?

<comment><USER10> As I said, it's definitely possible. We did create and maintain our own clusters. That's way more expensive and time consuming than using existing offering from public clouds, and you are in your own in case of issues. Your competitors who don't have that kind of requirements can build and iterate on their products way faster.

<comment><USER12> This. Worst-case you end up being forced to use some terribly implemented private cloud solution which ends up being even more expensive and time consuming than deploying your own hardware.

<comment><USER13> k8s to the rescue ;-)

<comment><USER10> I don't know if you're joking or not, in the case of those fintech projects I've been part of a migration to k8s. That was already in progress 3 years ago when I joined the company, and it wasn't completed when I left beginning of this year.

Managing your own k8s in production isn't a simple task at all :(

<comment><USER11> That is true, i was asked to implement k8s in 6 month, they said so i have plenty of time to find all problem (i try'd really hard not to start laughing)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Privacy Shield is dead, long live privacy shield.

I wonder how many attempts it will take for this deal to be considered legal before the US actually has to do something to hold up their end of the deal. The US government would scream in rage if Germany would ever demand the ability to order Microsoft or Google to hand over information about US citizens in complete secret, yet the EU wil gladly take the word of the US government that it won't happen.

The EU also has plenty of incentive to encourage keeping data within the boundaries of its member states. Making it difficult to use American tech giants as a lazy quick fix for data storage instead of looking at local alternatives only helps limit the amount of money taken from the European economy. With the scandals and state of the current US government I find it hard to believe the EU will be able to draft a new agreement like this with the US without compromising on the rights of their citizens.

<comment><USER15> > Privacy Shield is dead, long live privacy shield.

Apologies for being pedantic, but "The king is dead, long live the king" is referring to two distinct uses of the word king. It is equivalent of "The old monarch is dead, long live the new monarch".

So for this to work in your case it would need to be:

"Privacy Shield is dead, long live new-replacement-law"

But without a replacement law, the phrase just doesn't work.

<comment><USER14> My point was that there will probably soon be a new, similarly lacking Privacy Shield with a similarly silly name (Secure Data Exchange Act? Privacy Protection Plus? Data Protector Agreement?).

We don't know the name of the new law yet, but Privacy Shield was quickly implemented because the agreement before it was deemed insufficient, and the same will likely happen again.

</comment></comment></comment><comment><USER12> The idea would be to align the commercial interests of US cloud service providers with the privacy interests of EU customers.

From the EU citizens perspective, the ideal outcome would be for US cloud service providers to pressure US authorities to limit their surveillance of EU citizens and provide some kind of privacy guarantees. Here's to wishful thinking...

<comment><USER16> Google, of all companies, was a major supporter of California's CCPA (Cali's GDPR-like legislation) last year.

Cynically I suppose it was to ensure they'd at least have a say in what the CCPA covered... and to hurt their rivals (Facebook, etc).

<comment><USER17> GDPR was supported by the biggest EU corporations as well - not much could help them more :-)

<comment><USER18> The idea the GDPR as a regulation helps established companies 'who can afford a gdpr team' more than joe the shoemaker is a weird meme..

GDPR hurts large companies that abuse data; the actual legislature is one of the most proportional regulations I've ever seen.

You have the right to store peoples personal data if it's used and not processed for non-implied purposes (IE; generating profiles of people after sale) and not sold to another company.

So when someone throws up a big "GDPR NOTICE" and you have to press the big "i agree" button, it behooves to read it; because that's often not required for the service, it's what's required for the company to sell on your data.

Joe the Shoemaker can take your email address or phone number and call you, he's not going to have a hard time under GDPR.

If you're abusing data, you're going to have a hard time- and that's good.

<comment><USER19> There are two factors at play here; both you and the GP are making points that are correct.

1) As you say, "If you're abusing data, you're going to have a hard time- and that's good." Companies that are built on selling your data (e.g. data brokers in the marketing / finance industry) or sharing it without your consent (e.g. Facebook with Cambridge Analytica) will have to stop those practices. GDPR working as designed, win.

2) For business models that are viable under GDPR, then at the margin GDPR is going to prevent small companies from entering the space, to the benefit of larger companies. Your example of Joe the Shoemaker is the trivial case. What if your business has a need to collect PII, banking information, perform Know Your Customer checks, and retain that data for 5 years under the US Banking Secrecy Act? Or collect electronic personal health information? Or submit to any other conflicting regulatory regime? You're missing the fact that lots of businesses have a legitimate need to collect more than just an email, and that other regulations directly conflict (per country) with GDPR. In these cases, adhering to GDPR is more than just slapping a GDPR dialog onto your email submission modal; it might require a significant amount of time talking to expensive lawyers to figure out how to comply with all of the applicable regulations.

This is the basic dirty truth about regulation; large companies can typically afford to lobby to make sure the regulation isn't going to ruin them, and then they can afford to implement the regulations even if they are very complex. After implementation, regulation like GDPR becomes a moat. Consider how hard it is to start a company in highly-regulated spaces like finance or healthcare. Though I don't claim that GDPR is as deep a moat as those industries' regulation, it's the same idea. The regulations as a whole can still be net-positive to society, but the risk is that when regulators (and those commenting on regulation) don't understand the real costs of complexity, it's easy to pile on rules that have the opposite effect than intended.

Note, a common misconception about Google is that it sells/shares your data; it does not in general do that. Google sells targeted ads, and your data is Google's competitive advantage; Google built Gmail, Android, and a host of other products in order to get data that others cannot; your data is Google's moat. GDPR just talks about sharing your data with other companies; Google is fine under the GDPR. Sure, the death of Privacy Shield might make Google's various international entities less able to share data, but the fundamental business model they follow of collecting first-party data on users is alive and well.

<comment><USER20> > Or submit to any other conflicting regulatory regime?

I'm pretty sure the regulations have a catchall "you are allowed to store the data if legally required to" for exactly these kinds of issues. Need to store the data for 7 years for tax purposes? Fine.

<comment><USER19> Sure, Article 6, section 1c ([https://gdpr- info.eu/art-6-gdpr/);](https://gdpr-info.eu/art-6-gdpr/\);) processing is lawful if "processing is necessary for compliance with a legal obligation to which the controller is subject"

I think (like the GP) you're oversimplifying though.

Have you ever had to determine what is considered a "legal obligation"? It's not fun. Much to the distaste of us engineers, it turns out that most laws are not written in an unambiguous fashion; many (like HIPAA) are very vague in places, and rely on precedent or tribal knowledge about how the regulator in question tends to interpret things.

So yes, if you have a clear, unambiguous requirement to keep Personal Data, then you don't need to lawyer up. If you work in an industry with complex regulations, then you're going to need lawyers and/or consultants to tell you how to resolve the conflict between GDPR and those regulations.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> As a EU citizen I'm glad about the decision, I don't have any confidence any more that data stored in the US is secure and that the US can be depended upon.

Also important to point out how much of this goes back to Max Schrems activism over the years and noyb ([https://noyb.eu/en](https://noyb.eu/en)). This is a huge win achieved with relatively few resources. Staying engaged is worth it.

<comment><USER22> Since many major EU countries share their classified intelligence and surveillance systems with the US (and the reverse) this seems more like political speech than reality. The real reason is to preserve what's left of tech in the EU but that doesn't exactly sound as good.

Almost all major countries have surveillance programs. They are perhaps necessary to preserve national security. The hope of democratic countries is to have enough checks and balances on those powers to keep them limited to national security interests and to prevent abuse.

<comment><USER23> There is a difference between sharing information (where you control what is shared) and letting the other party have all the information and look at it by their own. The fact that EU shares intelligence with US is less of a problem as long as EU citizens have a somewhat confidence in their government and security services. It is a big difference from letting US process all private information about the EU citizens and by that enable US to rummage around as they wish without having to obey laws or regulations in EU.

<comment><USER22> I don't think you understand - the systems themselves are shared.

This isn't 'let's decide to let X country know Y'. If it is on the eyes network (and tons of things are) everyone gets it per the multi country agreement.

<comment><USER24> And there are no more FVEY members in EU with UK dropping out.

<comment><USER22> Yeah if you arbitrarily limit it to the five eyes agreement for no reason. See nine eyes and fourteen eyes - EU US intelligence networks.

</comment></comment></comment></comment></comment></comment><comment><USER25> I'm missing the point of why the USA would not just stop this weird spying on everybody. From China I'd expect nothing more but the USA? They're supposed to be a decent country.

Then we would not need all these super unpractical counter measures.

<comment><USER26> Did people already forget all about the 2013 leaks? Do you actually think that the EU is not complicit in the same surveillance practiced by the US?

> For example, Der Spiegel revealed how the German Foreign Intelligence > Service transfers "massive amounts of intercepted data to the NSA", while > Swedish Television revealed the National Defence Radio Establishment (FRA) > provided the NSA with data from its cable collection, under a secret treaty > signed in 1954 for bilateral cooperation on surveillance...

How is my data any more secure on a German server than an American server? Some asshole is snooping on it anyway, and the NSA gets access by extension.

<comment><USER27> People forget that the reason this happens is that most countries have laws against spying domestically. They usually don't have laws prohibiting them from taking data from other spy agencies spying on their own country. So the cheap and easy workaround is you let your friends spy on you for you. It's usually pretty critical for counterintelligence anyway. As the first place an enemy tries to get into is the counterintelligence department.

<comment><USER28> This is the important part that is glanced over. It's very much a situation of tit for tat but we can be hopeful that rulings like these aren't just lip service. Schrems has been a positive force for privacy in the EU.

<comment><USER27> From corporate spying yes. However GDPR contains specific carve outs for national security, Police, etc.

</comment></comment></comment></comment></comment><comment><USER29> Dumb question: can someone explain to me the implications on startups and side projects? Does data mean, any data? If I'm reading that correctly it's illegal to allow EU users to use any website with a DB that isn't hosted in the EU. That can't be correct, can it?

<comment><USER30> It's _personal data_. Which is defined in the GDPR as:

any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person

<comment><USER29> I'm sure the true answer is ambiguous, but "personal data" by that definition seems to imply almost any form of account creation. For sure, that seems to imply you can't use email addresses as identifiers. Maybe it implies that so long as the data isn't de facto joinable with side data (phone numbers, email addresses) it may be ok.

</comment></comment></comment><comment><USER31> Worth also remembering that at the moment the UK is still negotiating with the EU and hasn't got a data protection adequacy agreement in place. At the same time it is domestically pushing for increased surveillance laws and powers for GCHQ etc. That issue in many ways is going to be just, if not more, tricky.

</comment><comment><USER6> Already on the front page, with more comments: [https://news.ycombinator.com/item?id=23856988](https://news.ycombinator.com/item?id=23856988)

Both submissions are very shallow articles though.

</comment><comment><USER32> This was long overdue.

Let's hope they won't come up with a new name just as they did last time when Safe Harbour was abolished.

This thing was an insult to EU privacy laws.

<comment><USER33> after "Safe-Harbor"and it's successor "EU-US Privacy-Shield" I suggest..

the "Trust-PACT"

P - privacy A - acknowledged C - confidentiality T - <USER2>

It's not only an insult of EU data protection laws and the EU basic rights charta.

Not only are the big US cloud providers evading taxes and stiffling competition in the EU, they are also instrumental to US hegemonial ambitions. All your data (and taxes) belongs to us. That's whats going on.

I wonder how long the standard contractual clauses will hold, I don't see how they are doing better.

<comment><USER34> This judgement also validated SCC. Basically they are ok because they are underpinned by "the receiver country need to have proper privacy protections".

So the SCC is legit. You just can't use it with the US.

</comment></comment></comment><comment><USER35> Is there some kind of "we are in the EU and understand our data will be stored in the US and can be surveilled" consent box?

What about platforms that connect people from all over the world? Yeah you can store EU users' data on an EU server but what if a US user checks out a EU user's profile. Or are we supposed to completely disconnect each continent?

<comment><USER15> You work to the most restrictive set of rules. EU users data is stored in places that comply with the rules in question, that could be the US, if the US complies with EU rules.

If US user wants to interact with EU content, then they need to comply with relevant EU rules. They might not have to give the same level of enthusiastic consent, but the data of their interaction should still stored in EU compliant manner.

<comment><USER36> That's not quite correct. It depends entirely on what jurisdiction/s you fall under, where you do business.

If you're a US entity you can freely store EU data on US servers entirely without EU permission or consent, and do anything with it that you want to (within US law), so long as you don't operate within the EU. For exactly the same reason that you can safely ignore GDPR if you don't operate in the EU.

If I build a service that runs its servers only in the US, in nearly all cases I don't need to concern myself with EU laws. I'll be operating by US laws. I can allow EU users to sign up and use my service and store their data in the US. There's nothing the EU can do about that.

The EU will have to enable a draconian Chinese firewall to stop this. They have no power or influence to dictate to the world such rules, so the only thing they can potentially do is put their own people in a safety box and lock them off from the rest of the world.

<comment><USER37> This is wrong?

It doesn't matter where your servers are, if you offer a service to people in the EU and you store their personal data, you need to safeguard that data and comply with GDPR.

It's a law, so it can be enforced through mutual international treaties.

However, common sense prevails in the EU and especially with GDPR, so no one will go after you because you use Google Analytics and didn't give an option to opt-out. But if you start collecting personal addresses, emails and phones disguised as a charity doubling their contributions and then sell that information to callcenters abroad for tax scams and upload it to 4chan, then yes, EU's reach will be tested.

[https://gdpr.eu/compliance-checklist-us- companies/](https://gdpr.eu/compliance-checklist-us-companies/)

[https://gdpr.eu/companies-outside-of-europe/](https://gdpr.eu/companies- outside-of-europe/)

<comment><USER38> This doesn't make any sense to me. So I'm German, I go to Thailand. I buy a Jet Ski to be used solely in Thailand? Is that Jet Ski under EU law now? Why is it different if I virtually go to Thailand?

or don't like the purchase aspect? Okay I go to Thailand and rent a car. To rent the car I need to give them my personal info. A copy of my passport, a copy of my international drivers license. If we follow the same logic that Thai car rental company somehow has to treat the PII under EU laws.

The EU has no jurisdiction is Thailand and the Thailand car rental company should not have to do things differently just because the person renting is from a different country. That they happen to be online, like say I reserved the car while in Germany before my travel, seems like it would have zero barring on this.

Can a restaurant in SE Asia take a reservation from an EU citizen? They need to store PII to do it. How does the EU send their enforcers over to that mom and pop restaurant to make sure their reservation system is protecting that EU citizen's PII?

I'm not trying to argue it's okay to use PII. I'm instead trying to understand how these laws actually work because they seem basically impossible to enforce or even implement.

I see the link above tries to cover this. Unfortunately it covers it in nonsense and doublespeak.

> Suppose you run a golf course in Manitoba focused exclusively on your local > area, but sometimes people in France stumble across your site. Would you > find yourself in the crosshairs of European regulators? It's not likely. > _But technically you could be held accountable for tracking these data._

<comment><USER7> The law applies to your non-EU company when you target EU citizens and people currently physically in the EU. E.g. if you sell goods and offer shipping to the EU, GDPR applies to you. If you do not ship to the EU and do not offer services to EU residents, GDPR doesn't apply to you.

There are some areas in need of examples:

For your restaurant in Bangkok that takes a reservation from the EU: not covered by the GDPR because they don't target EU residents, that a resident used their reservation page is incidental and an exception.

For some purely-online service, if you somehow target world-wide or all speakers of an official EU language, GDPR applies. That means your french language online newspaper in New Orleans is affected, if they have an international section. If it is chinese language, you are fine. Geoblocking helps.

<comment><USER38> That's not what the EU guideline says above. See the Manitoba example

<comment><USER7> Yes, there is a grey area as the guideline says, and "targeting EU residents" is interpreted very widely. We will have to wait for the courts for an exact interpretation there.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER39> Hmmmmm. If Apple can get away with providing a less secure version for China they could probably get away with creating a more secure version for Europe..?

</comment><comment><USER40> This is bad news for everyone in the EU who has data in the US and uses the Privacy Shield act as the protection guarantee. We do that currently for some data processors, and I'm a little intrigued about what we'll do with all of our US-based data now.

<comment><USER41> It might be good news for EU consumers. There's no technical reason for most vendors why customer data of EU customers has to be stored in US data centers.

<comment><USER35> I mean you can store EU users' data on an EU server but if any US users are allowed to communicate/look at EU users then obviously the data is going to travel across the ocean. Maybe I'm reading too much into what constitutes as "personal-data" but last I checked they had broadened that a lot. What happens if I view a EU user's linkedin profile from the US - isn't that all personal data? I hope there's at least an informed consent opt-out for this.

If not, it's not super clear to me what the work-around is other than completely isolating the continents.

<comment><USER42> >What happens if I view a EU user's linkedin profile from the US

How can you see a private profile if it is private?

</comment></comment></comment></comment><comment><USER43> Hum. I'm in the process of starting up a Wireless ISP in Europe. I was looking at using a large piece of management software provided by a Canadian company, hosted in the US. This is starting to feel like a bit of a bad idea.

I was already unimpressed with their "no one has ever asked us about GDPR" response.

I can totally see an ISP getting heavier regulation in this regard too, given it is providing infrastructure.

Maybe I'll code it all up myself while I wait for the dedicated fibre to come through.

<comment><USER41> Any reason why it has to be hosted in the US? Hosting is so standardized, it's hard to argue why it can't be moved to the EU.

<comment><USER43> It is a SaaS product and I guess that was just what made sense to them at the time.

They say they have a lot of EU customers, but something doesn't add up. Either they don't have a lot of EU customers, or their EU customers are ignoring GDPR, hosting locations, and (in my case) regulations on invoicing software.

Maybe those customers are just saying, "ah, it'll be fine, let's not worry about it." Which probably isn't a bad approach for small companies.

I suppose my choice comes down to: Do I want something off the shelf, slick, a bit expensive, and may or may not screw me in known ways. Or do I want something custom, slow to build, a bit clunkly, can adapt to my needs at the cost of my time, and won't screw me in known ways.

Of course, both may screw me in unknown ways :-)

Anyway, thanks for listening. This is mostly me just thinking this though.

<comment><USER44> SaaS management system for WISP seems weird to me. From what I know from the local WISPs their internal systems need to be very robust and independent from internet connectivity, so when the network or Internet connectivity goes down, they are still available to quickly resolve the issue.

<comment><USER43> Yes, I can totally see how that makes a lot of sense.

</comment></comment></comment></comment></comment><comment><USER45> At the political level this is going to fuel the conflict between USA and EU. Gas pipeline, data privacy - times have changed forever it seems between USA and EU.

<comment><USER46> I don't see a conflict. European countries have had consumer protection laws that are different from those in the US and US companies have had to comply. This situation is no different.

The EU wants privacy & security guarantees that US companies can't deliver and special deals with the US government can't really fix that. But I'm sure US companies will adapt eventually.

And this goes in both directions of course. For example European banks have to be really careful in dealing with US citizens due to laws like FATCA.

<comment><USER47> > For example European banks have to be really careful in dealing with US > citizens due to laws like FATCA.

Their fix is of course to require you to check the "I am not a US citizen" box.

<comment><USER48> I don't know if that's sarcastic, but banks are scared to hell to deal with US citizens. They won't ask you to fill the other box, they just won't deal with you.

<comment><USER49> It is not sarcastic - my bank (ING) has these in the forms, for instance when getting started with their stock buying program.

<comment><USER50> Many banks will not allow US citizens to open accounts for that reason. If they have any US account holders, they will have to report to their tax authority.

</comment></comment></comment></comment></comment></comment><comment><USER51> I don't know why the article claims the decision was "surprising". I work for a US company that is subject to GDPR and we've been expecting this for over 2 years, the only unknown was when the ruling would happen, not if.

</comment><comment><USER52> This has been going back and forth for a long time now. Perhaps I'm being naive, but given light delay, companies already host data about and data accessed by citizens from <insert continent> on said continent, so why don't companies just store EU data in the EU and be done with it? Wouldn't that solve the whole issue, years in court, ambiguous rules, companies/agencies that require local storage, etc.?

</comment><comment><USER53> Good job Euros! Now you need to level up tech sector, get rid of the shackles of Google, Apple, Facebook. Your startups deserve better then the current, anti competitive and worse environment! Your companies could do much better, now is the time and make it happen.

<comment><USER54> It's never going to happen. We're a completely decadent society, and we're essentially out of the IT race at this point.

<comment><USER55> People keep saying this while ignoring the local huge boring IT companies and local subsidiaries of US IT companies.

Does it really matter where the nameplate that indicates where the HQ is? Or does it matter where the profits are taken for tax purposes (Apple appears to be an Irish company, by that measure)? Or where the CEO and board members are domiciled? Where the actual staff sit when they work?

<comment><USER56> So what you're saying is, that as long as there are other places in the world, outside of Europe, that still have a regulatory/financial/mentality/etc framework where new large software corporations can appear and flourish (and then open offices in Europe), then it's all good for Europe. If so, doesn't that seem a bit hypocritical? To have tighter privacy regulations locally but then be happy to accept business/jobs from companies that exist _because_ of no such regulations in other places (or at the time they were established)?

</comment></comment></comment></comment><comment><USER57> Will this have implications for Chinese and Russian services as well? Will the EU go fully local?

<comment><USER30> Not really, because the European Commission has not issued an adequacy decision in relation to China and Russia as far as I'm aware.

Russia is an interesting case, though.

They are bound by the European Convention on Human Rights (although enforcement is... let's say tricky), and they are also signatories to Convention 108 (the Council of Europe "Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data") and they have signed (but not ratified) the protocol to update the convention (223, combined known as Convention 108+).

This - in theory - puts them at an advantage over countries like the US which lack any real privacy legislation.

However 1) Theory and practice aren't the same; and 2) I think it would be an impossibly hard sell for the Commission to issue an adequacy decision for Russia purely for political reasons, let alone practical ones.

<comment><USER57> Oh interesting:

[https://ec.europa.eu/info/law/law-topic/data- protection/inte...](https://ec.europa.eu/info/law/law-topic/data- protection/international-dimension-data-protection/adequacy-decisions_en)

So Russia/China are already in the "further safeguards needed" camp, along with... almost all of the world?

I studied a bit of EU law in law school, but haven't kept up as much as I should. This is a helpful start to dig back in, thanks!

</comment></comment></comment><comment><USER58> This just seems protectionist to me.

I imagine anything the US is doing is being done by spy/sigint agencies within the EU

</comment><comment><USER59> They are really making it impossible to start a small SaaS product. People already don't want to pay $4/mo. for even some of the most popular SaaS products. I'm afraid all this is going to do is cause these small SaaS businesses to run twice as much infrastructure, and then transfer the costs onto the consumers by substantially increasing their prices.

<comment><USER60> As it should be; I want to pay with money, not my data. And I want my spending to stay in my local economy, not to the bottomless pit that is the US.

</comment></comment><comment><USER61> Imagine every country comes up with a similar law restricting personal data transfers. This will render Internet useless.

<comment><USER62> An Internet with no _personal_ data is a far cry from useless.

<comment><USER63> But surely, you'd concede it's far less useful. No international email, social media. No access to foreign websites: IP addresses are personal data [0].

Possibly, service _delivery_ is feasible if you set up a warehouse in both locations to freight forward, but any vendor without the means to operate in each country.

While I expect my EU pals will say "but of course we will never _apply_ the law that way," if this was the intent of the legislation, the legislation looks an awful lot like a nationalist tariff.

[0][https://www.alstonprivacy.com/ecj-declares-ip-addresses- pers...](https://www.alstonprivacy.com/ecj-declares-ip-addresses-personal- data/?cn-reloaded=1)

<comment><USER62> > No access to foreign websites: IP addresses are personal data

The OP talks about not _storing_ personal data, which would mean e.g. not keeping logs of client IP addresses; that does not forbid the Internet.

I agree that a law that literally says or is interpreted to say that my IP address must not cross international borders, forbids the international Internet. But there is no such law.

It's possible to put together an argument to interpret laws in an undesirable or unexpected way. That's what lawyers are for. We have to have some measure of confidence in court rulings, that's part of the system, law interpretation is always being challenged.

> No international email, social media.

To the best of my understanding, the GDPR allows people to opt-in to send personal data. If I send an email to someone in the US, I deliberately share e.g. my name with them; that's legal. If I send an email to someone in Europe, and my and their email providers are companies operating in Europe, they should not transmit or store the email through US servers. That's not impossible. At least that's my understanding.

The problem with social networks is legitimate, and a real problem, but it's vastly smaller than "the Internet".

</comment></comment></comment></comment><comment><USER64> Finally! There is hope for EU, they apparently found some of their balls. Hope they keep 'em.

</comment><comment><USER65> Nobody in the US government is going to scream in rage over the violation of your privacy. The last person who came close is hiding in Russia.

<comment><USER66> > Nobody in the US government is going to scream in rage over the violation of > your privacy.

 _by the US government_. Plenty of people are screaming in rage about China, for example.

<comment><USER42> That is not even close related with privacy or human rights and more about geo-politics.

<comment><USER67> US-EU data agreements are also about geopolitics.

<comment><USER42> Maybe, but there was some agreement and one party is not respecting it, so let's say is not nice not to respect your contracts. Star Trek fans are probably reminded by this rule of acquisitions; "A contract is a contract is a contract… but only between Ferengi."

<comment><USER68> The EU is not some weird hive-mind, it has separation of powers just like the US. It is the European Court of Justice's job to overturn executive decisions that trample on the constitutional rights of its citizens, same as the Supreme Court in the US.

<comment><USER42> I am not sure how your comment related to mine, maybe I was not clar, EU and US had a contract, US is not respecting it and this judges looked at teh facts and said, yeah the contract is invalid so you can't store private data in US using this contract as a base, find something else.

And now US citizens from HN spin this as protectionism or over regulation and just ignore that there was a such a contract and it was not respected, it would make sense then that US guys won't complain if someone else would do the same, but you notice if an app related to China is only suspected of doing something like that the mob demands it getting banned if an US entity has the power to just search and read anyone's private stuff that is not from US then is fine.

I mean US could pretend they won't spy , and then work a bit harder to get the data they need instead of having 100% full access to everything.

</comment></comment></comment></comment></comment></comment></comment><comment><USER69> WSJ: Surprise ruling is a victory for privacy activists

This wasn't a surprise at all. It was very predictable from the beginning for one simple reason: the US doesn't have strong privacy laws and the US government's surveillance apparatus doesn't account for whatever privacy laws exist either. All the gag orders (up to half of all total order requests according to Microsoft 2 years ago), all the tapping of internet cables and "partnerships" with the carriers, all the "fusion centers" with all agencies getting people's data, and so on.

Oh, and best of all, the Privacy Shield said that it was up to the US DOJ to ensure US companies followed EU law. What a joke.

The EU Charter of Fundamental rights prohibits data from being stored in countries that don't provide equivalent privacy protections as in the EU. If you follow this logic, it's obvious Privacy Shield was bound to fail.

An article from 2018: [https://www.hrw.org/news/2017/07/26/us-surveillance- makes-pr...](https://www.hrw.org/news/2017/07/26/us-surveillance-makes- privacy-shield-invalid)

</comment><comment><USER70> Noone in the EU now can sell on Amazon or eBay.

</comment><comment><USER22> > to adequately protect Europeans' data from US surveillance and security laws > and was therefore invalid

Certainly this is more about protection from corporations with the added benefit of preserving what's left of tech in the EU.

Considering the US and most major EU countries share intelligence information with each other and all have surveillance programs I don't know that it would be very effective at doing that no matter where the data is.

</comment><comment><USER70> This means noone in the EU can sell on Amazon or eBay. Noone can use services like WebFlow and other hosting solutions. We'll see what future court decisions say about AWS hosted inside the EU.

<comment><USER70> Everyone who sells on Amazon and eBay has a data protection policy which mentions Privacy Shield to legally work with Amazon. The court says only DPAs work where you make sure that the other party protects data on a GDPR level, which Amazon doesn't do and can't do.</comment></comment>


Ask HN: Any recommendations for live chat and email support operators/agents? - <AUTHOR>

I'm looking for cordial, native-English speaking operators that can work around the clock to provide customer support for my commercial products.<p>Any recommendations would be helpful. <comment><AUTHOR> Nobody? :\</comment>


Dehydrating Eggs at Home (2015) - <AUTHOR> https://www.backwoodshome.com/dehydrating-eggs-at-home/ <comment><USER2> "Eggs dehydrate easily, and most online sources suggest keeping the eggs at 135° F to 145° F for about 10 hours. However this temperature is not sufficient to keep salmonella from forming during the dehydration process, because this leaves eggs in the food safety danger zone for too long."

Umm, no. The food wouldn't be in the danger zone very long, and even if it were the following 9 hours would be more than enough to kill them.

<comment><USER3> Yeah that's what I was thinking. 135F will kill salmonella in under an hour.

From how it's worded in the article, I assume they're just ignorant of how pasteurization works at different temperatures so they're going by the over- simplified recommendation from FDA. I see this same misunderstanding happen periodically on the sous vide forums.

<comment><USER2> Yeah. Probably lots of people who don't know what they're talking about said that and he just assumed they are correct. A thin layer of egg in what is essentially a convection oven is going to heat up very fast.

<comment><USER4> She

</comment></comment></comment></comment><comment><USER5> I like to make large batches of frittata in muffin pans, seal in vacuum bags and freeze. Defrost and nuke as needed. It's less flexible than just eggs, but a great low carb treat. They don't last long around here.

Suddenly "egg bites" are a thing in supermarkets and Starbucks. These are a homemade version without the need for an expensive vacuum chamber.

</comment><comment><USER6> Another way to preserve eggs: [https://en.wikipedia.org/wiki/Century_egg](https://en.wikipedia.org/wiki/Century_egg)

I've never had the chance to try them, and they don't look appetizing, but now I'm kinda curious how they taste.

<comment><USER7> Pretty bad. The white ends up amber and rather leathery. My Chinese friend won't eat them.

<comment><USER8> I don't like them either. My wife adds them to congee and I always fish out the black pieces when I make my bowl. There's just something about it that I can't get passed. It's a little bit goofy because there isn't much (pungent food) that I don't eat. I eat durian and love durian deserts and stinky tofu but I don't mess with these eggs, which are pretty tame comparatively.

</comment></comment></comment><comment><USER9> Dehydrated eggs used to be very inexpensive. I bought a case (6) big cans I think in like 2009 for I want to say around $100. Wow that has changed. I still have most of the case, not sure how long they last. I opened a can like 2 years ago and it had an oxygen absorber and was fine. I got them here. [https://honeyville.com/](https://honeyville.com/)

I highly recommend the 6 grain cereal, it's awesome. [https://shop.honeyville.com/6-grain-rolled- cereal.html](https://shop.honeyville.com/6-grain-rolled-cereal.html) The dried eggs frankly were not as good. I think they were mostly yolks. They were good to bake with.

For what it's worth chickens aren't that cheap to raise anyway. You need a coop and usually food. I'd rather just spend a little and avoid the hassle. The last batch of chickens I had never even made it to laying before they were all eaten by a fox or weasel or something. But free range chicken eggs are very tasty.

</comment><comment><USER10> That was oddly a fun read. And I got a chuckle from the conclusion:

      So is it worthwhile to dehydrate eggs?

      From a cost standpoint, the answer is unequivocally "yes," but only if you keep your own hens to begin with

<comment><USER11> That statement really confused me.

The cost difference between those two scenarios is the purchase price of the eggs, which are what, $2/dozen?

How can such an immaterial expense provoke an unequivocal conclusion?

And how can one ignore the cost of feeding & housing chickens vs just going to the store and purchasing eggs? Store-bought eggs are almost certainly cheaper in absolute terms.

<comment><USER12> You don't get to control output if you own your own hens. If you buy eggs and you have too many eggs, just stop buying eggs. If you own hens and you don't sell/give away eggs, there's no equivalent solution, thus preservation.

</comment></comment></comment><comment><USER13> "Despite the concerns in recent years about cholesterol and other issues"

I grew up in the era where the egg lobby had billboards up saying it was OK to eat eggs once a week. This was after cholesterol and saturated fat was demonized after some docs found peoples arteries stuffed with it. It turned out to be fake science. My parents fed me poisonous partially hydrogenated margarine instead of butter because of that crap. They've recently discovered eating cholesterol is of no concern. You don't have to worry about it at all. Inflammation is the real concern. Saturated fats are the safest fats.

<comment><USER14> Oxidized cholesterol, on the other hand, is not healthy. I would not eat dehydrated egg yolks.

</comment></comment><comment><USER15> You could always use a sous vide device to pasteurize eggs before dehydrating them. Crack them, mix them, throw them in a bag, and pasturize them for as long as is appropriate. Easy.

</comment><comment><USER16> Another fun option for preserving eggs: salt them. I've never used them in a recipe (not sure if they'd work). but they are delicious eaten like charcuterie.

[https://www.google.com/search?q=cured+egg+yolks&oq=cured+egg...](https://www.google.com/search?q=cured+egg+yolks&oq=cured+egg+yolks)

<comment><USER17> If you ever watch Bon Apetit videos on YouTube, they have a series where they did a cured egg recipe. They grated it onto pasta.

[https://www.youtube.com/watch?v=kp6F7jW5cmI](https://www.youtube.com/watch?v=kp6F7jW5cmI)

I highly recommend the whole "It's Alive" series with Brad if you're into preserving your own food.

</comment></comment><comment><USER18> This line got to me.

> _I blended two fresh eggs with ¼ cup of water and pan-scrambled them._

Is adding water to scrambled eggs really a thing that people do? Never in my life have I added water to fresh eggs before scrambling them.

<comment><USER19> yes, some people add a bit of water or milk. In theory the water turns to steam helps make them fluffy, I believe.

<comment><USER20> Yeah, it's definitely a thing, and I put in a little milk myself. But 2oz does seem high.

</comment></comment></comment><comment><USER21> What about vacuum dehydration? It should be much faster than the other methods. Something like a pressure cooker and a vacuum pump shouldn't be too hard to rig up.

</comment><comment><USER22> How about using a sous vide on the powder vacuum sealed eggs after it's dried?

A long enough period at a lower temperature should kill any salmonella no?

<comment><USER23> According to this page (I didn't verify it myself), salmonella is quite difficult to dry sterilize.

([https://www.foodsafety-experts.com/food-safety/salmonella- se...](https://www.foodsafety-experts.com/food-safety/salmonella-secrets/))

> Salmonella is very difficult to kill when it is sitting in dry powders. > Depending on the product you might need to get the product heated to > temperatures above 150°C for at least 30 minutes to achieve a 6-log > reduction if any Salmonella present in the product.

<comment><USER24> Wow, this is news to me. I always assumed there were time-temperature curves for pasteurization & sterilization that applied to bacteria regardless of the medium the pathogens existed within. Food safety is actually pretty complex and often gives me hesitation when cooking sous vide (for instance, botulism spores from garlic can easily survive anaerobic sous vide conditions).

<comment><USER2> I don't believe anyone has ever gotten botulism poisoning from sous vide cooking and people cook garlic/onions that way all the time. I'm sure it doesn't kill the spores but perhaps the heat still kills enough?

</comment></comment></comment></comment><comment><USER25> I was very sure (correct me if I'm wrong) that salmonella are only on the egg shell and could probably be decontaminated by dropping them in boiling water for a few seconds without denaturating the egg white. I really like the surge in dyi/food realated articles on hacker news, keep them coming!

<comment><USER26> I have heard of people using sous vide to pasteurize both the shells and contents of eggs. This guy seems to have a pretty science-based process (see the "Pasteurized in Shell Egg" section):

[http://douglasbaldwin.com/sous- vide.html#Poultry_and_Eggs](http://douglasbaldwin.com/sous- vide.html#Poultry_and_Eggs)

This is admittedly another piece of equipment to add to the process, but I suspect that the intersection of "people who own a dehydrator" and "people who own a sous vide machine" is pretty large.

<comment><USER27> The Food Lab has an article on sous vide eggs, including pasteurizing them with a sous vide circulator:

[https://www.seriouseats.com/2013/10/sous-vide-101-all- about-...](https://www.seriouseats.com/2013/10/sous-vide-101-all-about- eggs.html)

Generally it's a great resource for nerdy cooking stuff.

I use that technique to make my own mayonnaise. I try to eat mostly organic (or animal-welfare certified) animal products, but organic mayo is overly expensive, so making my own is a nice (and super easy) alternative. You can make a jar's worth for about 40 cents.</comment></comment></comment>


How to Make Intelligent Robots That Understand the World - <AUTHOR> https://www.guaana.com/ask-me-more/how-to-make-intelligent-robots-that-understand-the-world <comment><USER2> So he claims that there is always going to be more data than we can process. If we want to move towards building a true AI we need to focus on intelligent learning rules instead ?

<comment><USER3> Thats the case, humans can come up with new learning rules in a shot ... this should mean AI should start to "think"

<comment><USER4> You just have to implement brain learning rules (based on neuroscientists researches), into AI program. PS! Our brain is "plastic" and changes all the time .. somehow you have to add this functionality as well :)</comment></comment></comment>


API for TV Listings in the US - <AUTHOR>

Anyone know of a free API for (US) TV listings or a way to use TV listings in an app without violating anyones copyright etc. From what I understand Tribune Media controls most of it and its pretty costly. Any thoughts? Thanks! <comment><USER2> I have used SchedulesDirect. There are several applications that integrate with SchedulesDirect. The integration is free, but customers/users have to purchase a yearly subscription to obtain the data, $20 / year. It used to be completely free but recently went to a paid model, though they do claim to be a non-profit.

</comment><comment><USER3> what are u trying to make ?

<comment><AUTHOR> A consumer website to help people find and talk about TV shows but I need the TV lineup/times to do it.</comment></comment>


London police's face recognition system gets it wrong 81% of the time - La-ang https://www.technologyreview.com/f/613922/london-polices-face-recognition-system-gets-it-wrong-81-of-the-time/ <comment><AUTHOR> currently on the front page [https://news.ycombinator.com/item?id=20364523](https://news.ycombinator.com/item?id=20364523)</comment>


Ask HN: What is not Agile? - <AUTHOR> Every company boast off that they use agile (the bigger the more), but they never use it well, so who is using agile right? and how some are not using it right ? <comment><USER2> The good idea behind agile is the realization that if you can't plan two weeks of work you can't plan six months of work.

Back in the day I would frequently see projects where a few programmers would work in isolation for six months, then they thought they could put the modules together in two weeks and ship. Usually at that point they had no idea at all of how to set up a clean computer to build the product so they probably had at least another six months to go at this point...

</comment><comment><USER3> Unnecessary ceremonies that are imposed on teams, like forced stand-ups, retros for everything, the Scrum Master role etc.</comment>


The share of U.S. workers in engineering and science fields below 5% - <AUTHOR> http://twitpic.com/8l53sb

<comment><USER2> Nice graphic, but what does it show? Infographics tend to insinuate a conclusion and not state a conclusion. That is not good.

1.In this case the infographic misleads the reader by selectively choosing metrics (foreign-born scientists and decreased percentage of workforce).

2.There needs to be a complete set of metrics, with every metric given equal emphasis, unless you are explicitly stating a conclusion

3\. The most obvious conclusion: "Americans aren't focusing on engineering" is not proven

Here are some scenarios where the conclusion can fail

1\. steady number of scientists, higher number of other professions

2\. drastically lower number of scientists, moderately lower number other professions</comment>


Expert Says Indians Will Soon Be Water Refugees Heading for Water-Rich Europe - <AUTHOR> https://www.vice.com/en_in/article/j5ygy7/expert-says-indians-will-soon-become-water-refugees-heading-for-water-rich-europe <comment><USER2> Water scarcity is not the biggest problem in India. It is gross water mismanagement at every level and public and political ignorance and apathy. The summer this year was extraordinarily hot and our place was under severe water scarcity, but the rainy season hasn't even started and we've already got almost 6 months worth of rainfall for my city. The problem is most of that water is not allowed to go into the ground and recharge the groundwater since almost every single inch is cemented or tarred and it runs-off into the sea or evaporates back. There is sufficient rainfall to meet the needs of most regions on India but due to a large number of causes the water is not conserved or utilised properly.

Some of the causes are deforestation of hill slopes, large, ill-planned dams which are silting over, lack of water micro-management, storm-water drains instead of recharge wells, lack of rainwater harvesting, excessive consumption, encroachment of nearly every water-body, pollution of most of the remaining lakes and rivers etc. etc. It goes on and on. The point is India does get enough rainwater despite very hot summers, but human management sucks abysmally.

<comment><USER3> > the rainy season hasn't even started and we've already got almost 6 months > worth of rainfall for my city.

I presume you're in Tamil Nadu because TN's rainy season is mostly due to the NE monsoon which hasn't started yet. Rainfall in the North-Western regions like Punjab really has been insufficient in past years. In many regions in Punjab it simply doesn't rain in the 'rainy season' anymore. Even in Tamil Nadu, didn't Chennai experience more than a 50% deficit in 2018?[1] When I visited Pondicherry a few years ago, everyone I spoke to said it now rains very little compared to the usual. This year's SW monsoon has seen heavy rains but it seems to be an outlier compared to the past few years.

You are correct that there is gross water mismanagement and unplanned urbanisation. Ironically, Chennai's National Institute of Ocean Technology -- one of whose jobs is to prepare impact assessment reports on 'the implications of constructing on waterbodies'[2] -- is itself constructed on a paved-over former catchment area (and gets flooded as a result).[3]

[1] [https://weather.com/en- IN/india/monsoon/news/2018-12-23-hist...](https://weather.com/en- IN/india/monsoon/news/2018-12-23-historic-low-northeast-monsoon-rainfall-in- chennai)

[2] [https://qz.com/india/563396/chennai-floods-are-not-a- natural...](https://qz.com/india/563396/chennai-floods-are-not-a-natural- disaster-theyve-been-created-by-greedy-town-planners-and-dumb-engineers/)

[3] [https://www.downtoearth.org.in/news/natural-disasters/why- ch...](https://www.downtoearth.org.in/news/natural-disasters/why-chennai- floods-are-a-man-made-disaster-51980)

</comment></comment><comment><USER4> There was a report that the Syrian civil war started with droughts forcing whole regions to emigrate to Damascus and then unemployed farmers starting to march in the streets. I can't imagine what might happen if the same level of drought occur in South-east asia. War? Civil war? Revolution ? The nuclear weapons stored there makes this a danger for everyone on the planet

<comment><USER5> [https://www.nytimes.com/2015/03/03/science/earth/study- links...](https://www.nytimes.com/2015/03/03/science/earth/study-links-syria- conflict-to-drought-caused-by-climate-change.html)

Causes of Syrian war are a bit more complicated than what you say. Marches don't necessarily lead to war.

</comment></comment><comment><USER6> As populations increase and resource shortages of various types become severe, migration and even travel will be shut down. The IT infrastructure and AI will allow trade to continue without travel.

</comment><comment><USER7> Europe's a long way away compared to verdant South East Asia tho

<comment><USER8> It's not just that east Asia is not much welcoming to immigrants, also the opportunities offered are much different. In addition if you have to move away with your family/from your people 1000km you might as well just move them 7000 more and be in a country which also speaks English and that offers social programs, free studies and other benefits.

<comment><USER9> So it's not actually about water.

</comment></comment></comment><comment><USER10> India has 3x the population density of European Union. Surely the problem starts there.

<comment><USER11> Bahrain has 3x the population density of India while Monaco is 56x more dense than India. Yet, the problem doesn't seem to manifest in those countries.

<comment><USER12> And the square foot below me has 575x the density of Monaco and there are no problems here!

</comment></comment></comment><comment><USER13> The British left India with a pressurized, always-on water system. Through lack of maintenance, most of that water system is no longer pressurized--the water comes on intermittently. That leads to the common practice by water consumers of having a pump on their end to fill their local cistern.

Since the originally-British water system was not maintained, it now leaks. So, unlike a pressurized water system--where leaks cause water to LEAVE the system, a non-pressurized system--as Indians now have--combined with the aforementioned pumps, makes it so leaky pipes cause outside filth to ENTER the system. Combine that with the practice of co-locating sewer lines in the same trenches as water lines, means that when the water comes on and individual pumps kick in, causes sewage water to enter the water system and be pulled into people's cisterns. That's why any Indian household like this must use reverse osmosis to make their water potable.

All because the pressurized water system was allowed to go derelict.</comment>


My First Death Threat (2004) - <AUTHOR> https://blogs.msdn.microsoft.com/oldnewthing/20040603-00/?p=39033 <comment><USER2> I think the phenomenon of humans going from normal-to-violent-rage at the most trivial _personal_ slights from strangers (e.g. road rage) is well- accepted...but it's funny to me how slight software mixups (not necessarily bugs or outright failure) can cause the same quick rise in negative feelings, even though it's most definitely not a _personal_ , human-to-human slight. Impotent fantasies like, "I hope the assclown and everyone on their product team who decided to move that button on [whatever GUI you use most] loses their jobs" as if they conspired to screw just you and you alone...Or maybe it's just me when I haven't had enough coffee :). I chalk it up to how sometimes aggravating and dehumanizing it is in modern life to have to use software in the first place, before people start moving the buttons around.

<comment><USER3> I think they have the same root cause -- you're not having a face-to-face interaction with someone where you can read subtle cues. You react to your perception of the person's intent, not their actual intent.

<comment><USER4> That and the fact that anger doesn't compartmentalize well, so the anger from being cut off on the highway might possibly flow into your emails, for instance.

</comment></comment></comment><comment><USER5> I got a death threat while working at Microsoft around 2003. Someone managed to hit the lottery on our phone tree and find me, a lowly software development engineer on Windows CE. This person was _very_ angry and was trying to open a PDF on their new Dell computer. I let them know they needed a PDF reader and I recommended Adobe's product. The person was now confused on top of angry and I was running out of patience after about 15 minutes in a circular discussion. I tried to wrap up the conversation by telling him to try support and gave him that phone number. He snapped and told me he was going to come hunt me and my family down and kill us. I hung up the phone at that point. I really didn't take him seriously, I hadn't given him any identifiable info other than I was an engineer on CE and he just sounded like a very angry person.

I called security and let them know what happened anyway. My office was invaded in about 15 minutes by 3 security folks and a Microsoft investigator. The best part was how big my coworkers eyes would get when they walked by my office and saw me surrounded by security being questioned. That afternoon the investigator followed up and asked if I was still doing ok and let me know the person was calling in from I think Kansas or some other place half way across the country. I told him I didn't feel like it was really a credible threat and that was the last I heard about the whole thing from security.

</comment><comment><USER6> " _... This may not be easy, and I will expect no help from Microsoft in finding out who this person (or persons) was that made this decision, but….eventually I will find out who made this decision, and I will kill them..._ "

This comment was evidently submitted in 1996, 12 years before _Taken_ was released in theatres.

 _edit_ I couldn't help but read this quote in Liam Neeson's voice.

</comment><comment><USER7> FYI, they finally backported XCOPY /H (I think) to the real mode DOS version in WinMe I think, unfortunately too late since they decided to disable "MS-DOS mode" before it was finally released.

<comment><USER8> Did you see after the message, the writer mentions that win95 xcopy always had the switch /H available?

<comment><USER7> That is the Win32 XCOPY (the DOS XCOPY I am talking about was in the DOS stub)

<comment><USER9> Wait, Windows 95's XCOPY had a Win32 version? Huh.

<comment><USER7> It is actually in XCOPY32.EXE (later XCOPY32.MOD), the XCOPY.EXE was a DOS- only stub for if I remember correctly to determine whether it was invoked from a batch file (needed because Win9x still used the DOS command.com).

</comment></comment></comment></comment></comment><comment><USER10> There is no excuse for death or violence threats, but I can understand that people get crazy because sometimes decades of muscle memory (e.g. the vanished start menu, the ribbon stuff in Office/the rest of Windows) get lost or scripts that have not been touched in years have to be updated because of backwards compatibility break.

Software vendors in general really need to invest in BC testing - and run early, public beta tests where real users' feedback is heard. Because big companies ignoring their users frustrate people and it takes only a small company's mess up to tip the iceberg...

edit: It might also be an idea if you have a millions-usages-product and you feel the need to redesign or break BC, you should explain to your (paying!) customers why you negatively affect their lives. Or make the change revertable (an option in a config menu, or just a config.ini entry), so that new users (which you A/B tested your new idea on!!!) get the new behavior, and old users with muscle memory training can continue to use the old way.

<comment><USER11> This is my favourite rant on the topic of software upgrades:

[http://stevelosh.com/blog/2012/04/volatile- software/](http://stevelosh.com/blog/2012/04/volatile-software/)

Boy, how I dislike upgrading Django. Look at all this breakage (and this is only the intentional, documented changes, and only across one release):

[https://docs.djangoproject.com/en/1.9/releases/1.9/#backward...](https://docs.djangoproject.com/en/1.9/releases/1.9/#backwards- incompatible-changes-in-1-9)

I appreciate much more policies like these:

        Suggestions to change the default output of these
        commands will not be treated with patience.

[https://www.mercurial- scm.org/wiki/CompatibilityRules#Introd...](https://www.mercurial- scm.org/wiki/CompatibilityRules#Introduction)

<comment><USER10> > This is my favourite rant on the topic of software upgrades:

> > and dammit the documentation on the project's website is autogenerated > from the tip of its git repo and so it doesn't apply to the latest actual > version

Oh yes. Hell yes. And no way to refer to old docs (suuuper cool if you inherit a project which was dormant for a year and you have to add features)

</comment></comment></comment><comment><USER12> This "threat" was made in 1996 (not 2004 as some other commenters are noting—the _thread_ is from 2004). This is a fascinating view into how things have changed between then and now. Honestly, in 1996 you could make a threat like this and a vast _vast_ majority of recipients would recognize that you weren't being serious. It's a little sad that we've lost so much innocence on the web since then.

<comment><USER13> Yeah, because making death threats is just a "joke" right?

<comment><USER14> It's not necessarily in good taste, and not necessarily universally funny, but yes, it's totally possible to make anything serious into a joke. The usual technique is to bring a lot of absurdity to the situation, which truthfully I didn't see in this post.

On a personal (potentially explanatory) note, my first death threat came from a man aiming a loaded gun at my face. No joke was intended there! I think that experience has left me somewhat unable to manifest concern about threats that aren't backed up with firepower, which probably leaves me more open to seeing the humor.

<comment><USER3> I think it helps that it's not a direct threat to an actual person. The reader gets the feeling that the writer not only will not figure out who made the decision (and, therefore, who to kill), but also won't even bother trying to figure it out.

</comment></comment></comment></comment><comment><USER15> Someone should add [2004] to the title

</comment><comment><USER16> Date: 2004.

Which brings up the question of, was it the last?

<comment><USER17> The threatening message itself is actually from 1996.

</comment></comment><comment><USER18> I expected this anecdote to be from the person responsible for "smart quotes".

</comment><comment><USER19> Death threats are the worst. I got one really serious one from buyer, he went ahead and started to post around things to my family. For B2C it is normal to get bad reviews once in a while, but this was just ridiculous. Getting real death threats is something that can hurt like hell.

</comment><comment><USER9> If you want to read this in the normal, beautiful CSS, go here:

[http://blogs.msdn.com/b/oldnewthing/archive/2004/06/03/14758...](http://blogs.msdn.com/b/oldnewthing/archive/2004/06/03/147583.aspx)

For some reason there's two different URLs for the blog.

<comment><USER7> I think they are migrating to a new blog system. You will see that the latest post you can read using the old URLs are about a week ago.

</comment></comment><comment><USER20> The *'d out name matches my name. There's a chance I wrote this as a very trolly teen. I wish I could see the full name.

</comment><comment><USER21> Fun fact: if you want to see files as they copy, the command is

      xcopy /dickher

</comment><comment><USER22> lol, this existed since dos 3.2, back when windows 1.0 was a command-line executable really.

</comment><comment><USER23> Relevant XKCD: [https://xkcd.com/1172/](https://xkcd.com/1172/)</comment>


Show HN: Apparently you can't just go online and make flashcards, so I made one - <AUTHOR> http://oflashcards.aws.af.cm

<comment><AUTHOR> Tried to study for one of my classes and I couldn't find a site to make flashcards, so I threw this together in about 3 hours.</comment>


Ask HN: If a t-shirt includes a logo (FB, AT&T) is it automatically infringement? - <AUTHOR> I want to make a t-shirt that shows my dissatisfaction with some companies and also in support of others. Basic example for simplicity:
"Vote Yes DuckDuckGo"
"AT&T Sucks"
Is it infringement to use a logo/symbol on a shirt as fair use as long as it is clearly not representative of the companies service/product? If a logo is not useable would text equiv; e.g. AT&T instead of their branding, be useable?
Does it matter if the t-shirt is for sale vs. personal use?
Thanks <comment><USER2> What jurisdiction are you/the publishers in?

Some thoughts not constituting legal advice:

If a logo is an RTM then probably the company name is too.

Usually the important line is "commercial" vs non-commercial; that said in USA, at least, use of a trademark doesn't become infringing just because it's used commercially.

If you're just wearing a tshirt you made with "AT&T sucks" on it will anyone who cares at AT&T ever see it, if they sue for damages what's their claim going to be based on - like are you intending to cause substantial damage somehow?

You could be less cagey about your specific intentions if you want actual applicable "opinion".

<comment><AUTHOR> Thanks. I am in the US. I am not being cagey intentionally, but I am frustrated and workshopping ideas.

I am considering literally an "AT&T sucks" t. I am going to likely get more creative and do political cartoonish art but I don't have a lot of concrete ideas yet.

I am considering selling these shirts to encourage people to vote with their wallets and inform them about potential negative side-effects of supporting these companies.

</comment></comment><comment><USER3> It's not _automatically_ infringement, depends on many things. Not going to speculate on specifics, as IANAL.

<comment><AUTHOR> thanks. Just curious if I could produce and sell from the US and have a logo or name on the shirt. As noted above political cartoon style art and a message</comment></comment>