The Great and Beautiful Lost Kingdoms of India - <AUTHOR> http://www.nybooks.com/articles/archives/2015/may/21/great-and-beautiful-lost-kingdoms/ <comment><USER2> India is many things. Depending on where you are, stunningly beautiful, dangerously dirty, or both. My first trip to Mumbai, when all I knew was the US and bits of Europe, was the first truly culturally significant and mind opening experience of my life.

Modernity had brought with it trash and pollution of an unprecedented degree, and poverty, culture, corruption, and overpopulation do nothing to improve the situation. Open sewers line city streets that wind directly through ancient relics because the city had been continuously occupied and built up and upon since that time.

I mention this mostly because of the cultural significance of India, and the danger it faces in losing those cultural artifacts if they are not given the respect and care they deserve. Much of the culture, while incredibly peaceful and inviting (witnessing festivals in the slums of Mumbai, paid for by people scraping together their pennies, caring more about their community than their personal situation was... I still don't have the right words for the emotional experience), knows nothing of preservation and conservation.

I don't know the answer to any of this is... It's just something I think about whenever I read about ancient India.

<comment><USER3> >>the cultural significance of India, and the danger it faces in losing those cultural artifacts if they are not given the respect

A very interesting city (Mumbai).

A recent bill for development of mumbai is caught along the same line.[1]

As for cultural festivities you mention in mumbai, its largely driven by political intentions.Mumbai is largely multi-cultural and every community wants to rival another.Its also driven by xenophobia amongst the local marathi-speaking.Am not sure how long such a model can withstand but things seem to be changing slowly.

Much of Mumbai's core infrastructure like water-lines etc are more than a 100 year old, they are crumbling.Corruption rids quality out of any recent project,these don't last long either.

Population and long commute for work (under crowded conditions i.e.) are very common too!

The one biggest difference is the people , who tend to change the outlook.They help each other and treat strangers better than most indian cities i've seen.People make all the difference.

[1]:[http://scroll.in/article/717914/loss-of-heritage-open- spaces...](http://scroll.in/article/717914/loss-of-heritage-open-spaces-and- coastline-why-mumbais-development-plan-is-so-controversial)

<comment><USER2> That's an insight I'm unable to have, from the outside looking in. Thanks for your perspective :)

</comment></comment></comment><comment><USER4> One can see why long form writing is becoming less popular: apparently all it takes to be published in _The New York Review of Books_ is a tangent-laden, skin deep romp through the author's limited comprehension of a particular subject (in this case 'Indian' regional cultural influence).

Much known history is ignored, and generalizations phrased as truths quite apart from the historically grounding reality that nation-states are essentially modern creations, particularly amongst the politically fast-flux, linguistically and culturally varied regions of the world such as most of the Himalayan and Brahmaputra-valley borderlands.

PS. And the downvotes begin. "Oh, how wonderful the echo-chamber of junket- laden arts world, and their on-high post-colonial exhibition curators!" I wonder if they scammed a trip to Bali or something. FWIW, I translate original texts in some of the areas discussed and am on personal email contact with at least one of the major authors of the cited texts - the extent to which the author misses the point is amazing.

<comment><USER5> Can you point us to a better article?

<comment><USER4> The second cited source (Wade et al) looks a good read but I would not trust it implicitly. Lumping all South Asian influences on Southeast Asia in to a single text (leaving out China, Tibet, Iran, the Middle East and Africa) seems an exercise in artificial scope.

Remember that 'Southeast Asia' itself is a vague distinction, particularly in the north. Half of Vietnam was Hindu until the 15th century, Burma never really existed (and to some extent still doesn't), similarly direct contact from the Pala Kingdom with Nanzhao is well evidenced by surviving images, documents and unmistakably Hindu carvings well within the borders of what is now modern China. Then there are each of the attested or probable seafaring dynasties (eg. Chera, Chola, Gupta, Nanda, Pallava, Pandya) and their various activities and records, in some cases many of which still exist, the establishment of kingdoms or fiefdoms of varying longevity (influentially Funan, but also in Burma, Thailand, Malaysia and Indonesia), comments on those from visitors (many in classical Chinese), and the sum of archaeological work.

Remember also, quite apart from the textual evidence, that mtDNA evidence now points to the peoples of significant parts of coastal China (eg. Shanghai region) having migrated north from Southeast Asia and not really being 'Chinese' at all, and irrefutable linguistic evidence shows Madagascar was settled by Austronesians who presumably sailed all the way from Southeast Asia. What all this means is that the period of recorded history does not intersect very much with much of the early period of cultural and linguistic exchange, therefore take everything you read with a grain of salt.

</comment></comment></comment><comment><USER6> Unfortunately there is nothing about these stories in Indian academic books. It is all about invaders from the west.</comment>


Causing ZFS corruption for fun, profit, and quality assurance - <AUTHOR> https://datto.engineering/post/causing-zfs-corruption <comment><USER2> ZFS volumes can also be backed by files. In this case, the volumes can be corrupted by opening the backing file in a text editor, and perform a search/replace. This is simpler but of course less interesting :-)

Another interesting article I've mentioned in another post, is a demonstration of ZFS' self-healing capabilities: [https://blogs.oracle.com/timc/demonstrating-zfs-self- healing](https://blogs.oracle.com/timc/demonstrating-zfs-self-healing).

<comment><USER3> Being able to back volumes by files is an amazing feature for testing. I've lost count of the number of times I've done this to prove some documentation works before applying it to the actual storage array in question.

</comment></comment><comment><USER4> Some device-mapper virtual block device types also provide ways to simulate error conditions. For bad block errors there is dm-dust.

[https://www.kernel.org/doc/Documentation/device- mapper/](https://www.kernel.org/doc/Documentation/device-mapper/)

</comment><comment><USER5> This was an interesting read! I hope they do a follow up article on how they automatically manage the rest of their recovery process.

<comment><USER2> If with "recovery", you intend recovering that file, it's not possible, since all the copies available in the mirror are corrupted.

In this case, the recovery (repair) of the system (that is, to bring it to a clean state) simply consists in deleting the file (see [https://docs.oracle.com/cd/E26505_01/html/E37384/gbbbc.html#...](https://docs.oracle.com/cd/E26505_01/html/E37384/gbbbc.html#gbctx)).

If there was an intact copy of the file available in the mirror, then one doesn't need to do anything, as ZFS is self healing: [https://blogs.oracle.com/timc/demonstrating-zfs-self- healing](https://blogs.oracle.com/timc/demonstrating-zfs-self-healing).

<comment><USER6> Presumably they're referring to Datto's recovery process (i.e. recovering automatically from secondary or tertiary backups), as opposed to just the ZFS mirror.</comment></comment></comment>


Will There Be a Java 7? - <AUTHOR> http://asserttrue.blogspot.com/2009/03/will-there-be-java-7.html

<comment><USER2> I didn't think I'd ever say this, but the stagnation or even slow death of Java wouldn't bother me. It's become bloated and seems to lack direction.

Since discovering Reddit (back in the day) and HN, I've discovered so many new languages and platforms to attack problems. I'm consistently finding Java lower and lower on my list of weapons to use in that attack.</comment>


Why Erlang? GDC Online 2012 - <AUTHOR> http://www.slideshare.net/eonblast/why-erlang-gdc-online-2012

<comment><USER2> This presentation is Interesting, but I guess that I already saw many presentations like that. I guess presentations about real user cases with "erlang" will be a more informative.

Something like this:

[http://www.erlang- factory.com/upload/presentations/395/Erlan...](http://www.erlang- factory.com/upload/presentations/395/ErlangandFirst-PersonShooters.pdf)

[http://www.erlang- factory.com/upload/presentations/297/Pikko...](http://www.erlang- factory.com/upload/presentations/297/PikkoServerErlangconference.pdf)</comment>


What's OS do you recommend for non-tech people? - <AUTHOR> Reopening neverending story...what OS do you recommend for non-tech people?
My corp laptop has Win 10 (corp policy), my small business is runing on Ubuntu 18 good for me), wife has own laptop with Win 10, but disk is terribly slow. I've found that disk (os) replication to ssd is impossible. She has some windows only apps so thinking how to solve it. (She don't wanna MAC OS/device). I'd like to avoid buying new device.
Wondering what is the current HN trend. <comment><USER2> I always say they should get Macs. Hardware and software are always well matched in ways that are hard for others to compete. If the hardware is well supported, it's hard to go wrong with either Ubuntu or Fedora. I use a Mac a lot, as does my wife. I have a couple other computers, running Ubuntu and Fedora on well supported hardware from Dell, Acer and Lenovo.

<comment><USER3> Same here. But then people balk at the price. _shrugs_ I'm a technical person and I like it for it's simplicity and it's power.

</comment></comment><comment><USER4> Windows, it works with the most software and hardware. People are used to it and it has the biggest community for support. Its easy to break and doesn't run that well but I have found that true for every OS I use on a daily basis OSx, linux (fedora, centos), freebsd and android they all have a few neat features and lots of obvious problems. All OS suck.

</comment><comment><USER5> It's not clear exactly what kind of solution you're looking for. I would recommend either

      1. Install Linux Mint with xfce. It is very easy to use, is fast, even on older hardware, and has most things that windows has.
      2. Replace your harddisk with an SSD. It makes a world of difference. If an SSD is too small/expensive, you can buy a smaller one and use a supplementary external harddisk for your media (which usually takes the most space).
      3. Back up your files and do a fresh install of your OS. This time, only install things you need, and prefer standalone programs over installed programs.
      4. Buy a new laptop. You can also buy a refurbished hi-end model, which is a bit of a gamble but usually works out well in my experience.

</comment><comment><USER6> ChromeOS. It's harder than Windows to misconfigure/infect/ruin an install, and it can do pretty much everything a non-techy wants to do.

Everything is in the cloud, so they don't have to keep up with backups (and they never do).

I used to recommend Macs.

</comment><comment><USER7> My grandfather only uses Firefox. I installed linux on an old pc with only firefox on it. He is so scared to accidentally download a virus with everything he clicks.

Recently I gave him an ipad, productivity went up x3 and he only uses safari. Tapping is better for him compared to a mouse.

It depends on tech literacy.

</comment><comment><USER8> You don't want to buy a new device, so you can either:

1.) Install Linux

2.) Re-Install Windows

I am not sure what you mean by "replication to ssd is impossible" but in either way I would suggest you replace the HDD with a SSD if the disk is slow, data can always be transfered.

</comment><comment><USER9> >I've found that disk (os) replication to ssd is impossible.

Why should this be the case?

</comment><comment><USER10> Just format that Windows. It will work like a beast once it is done.</comment>


RETREAT OF Protect IP ACT (PIPA) AND STOP ONLINE PIRACY ACT (SOPA) - <AUTHOR> http://issa.house.gov/index.php?option=com_content&task=view&id=950&Itemid=4

<comment><AUTHOR> Well done HN, Tech Community and people of this great country for standing strong and making your voices heard!</comment>


Facebook removes a post about leaving Facebook - <AUTHOR> https://www.reddit.com/r/assholedesign/comments/9k3hxu/facebook_removed_my_post_about_leaving_facebook/ <comment><USER2> Wonder why.

</comment><comment><USER3> Nothing shocking there, Facebook doesn't want you to give ideas about leaving it to others</comment>


Recommended coding style for the Linux Kernel - <AUTHOR> http://www.kernel.org/doc/Documentation/CodingStyle

<comment><USER2> Things I found interesting: * typedefs are discouraged in many cases * goto is acceptable for common-function-exit code * 8 tab-based spaces per indent

I agree with the first two. Careful goto use can be like a destructor for a function. 8 spaces per indent seems excessive to me; esp using tabs since spaces are guaranteed to appear the same in every sane code editor. Although I do love the idea of all my code maxing at 3 indents.

Suggested ~48 line max for function length is also cool. The easiest way for me to force myself to code cleanly is to stick to short files and functions.</comment>


Secure Ideas will not be presenting at DEF CON this year - <AUTHOR> http://blog.secureideas.com/2013/07/secure-ideas-will-not-be-presenting-at.html <comment><USER2> Looks like somebody wants to nominate themselves for a government contract.

A statement such as _" We believe the exclusion of the "feds" this year does the exact opposite at a critical time."_ is just ridiculous. Even more bizarre is the idea of mentioning openness in the (current) government context.

If there is a positive effect between the openness of the hacker community and the Feds then why did we end up with the current situation?

The current situation is incredibly bad so I absolutely support the decision by DEF CON. Even if there is only one single occasion where people stop talking/avoiding a person who is working to close with government agencies this is a success.

People who work for these agencies will always hide behind some "greater good" narrative and avoid taking personal responsibility. My hope is that by getting personally shunned by their former peer group it might help them realize that this is not longer just business-as-usual.

Government loves to really up the public with the us vs them rhetoric so they definitely deserve a dose of their own medicine.

<comment><USER3> > Looks like somebody wants to nominate themselves for a government contract.

Interesting how when the news media baselessly questions the motives of whistleblowers it's a "smear campaign." When someone on HN does it to someone who's vaguely pro-NSA it's the top comment.

<comment><USER4> He's not even vaguely pro-NSA. He's pro-openness. The fact that this is the top comment is sad and its a testament to knee-jerk reactions in echo chambers around the world. There's a difference between the government as an entity and individuals who are employed by them. Feds attending DEF CON aren't really Feds, their security guys like everyone else there. Depending on the context one could be a fed first and other things second but at DEF CON that's not the case and barring a certain group of people turns it into a situation where you're labelled based on what you don't have in common with other attendees rather than being welcomed because of what everyone at the even shares.

<comment><USER5> "Feds attending DEF CON aren't really Feds"

I guarantee you that this is not something the Feds themselves believe.

What makes you think it is true?

<comment><USER4> I'm talking about our identities here. I do some charity work on the board of a non profit. When I give talks and attend events with others in that particular field I am an advocate for a cause like everyone else there, not a developer. To take it even further I'll add some details.

The charity is involved with educating the public about the recent heroin epidemic that's been hitting the country pretty badly. Now lets suppose that NIDA or the DEA was involved with a scandal having to do with letting dealers off the hook or fudging some study. And lets suppose the prevention and treatment community, in response to this, announced that no Feds are allowed to attend our annual event (which is real) where we always invite speakers who work in the area of prevention, treatment, and law enforcement. That would not be the right thing to do. Those Feds who normally come to our events have a genuine concern for the cause and offer valuable insights. By not inviting them the organization may make a strong political statement but its really not doing anything except allowing a small group of people to pat themselves on the back and say "yeah, we showed them". Meanwhile all of our attendees and guests are missing out on valuable insights they may have otherwise gotten had the organization not taken this route.

There are betters ways of making political statements. DEF CON themselves could have tried to do something to address the NSA leaks issue at the event without barring a group of people who most likely don't even consider themselves as Feds when they're in the context of a security convention.

<comment><USER5> My problem is that The Feds are spying on me. If they want to be a part of the solution to that problem, great - they can stop.

</comment></comment></comment></comment></comment></comment><comment><USER6> As a symbolic statement by DEF CON, I like the "no feds" thing. Pragmatically, it probably won't much _much_ difference, since any Feds who want to attend can probably attend and just not identify themselves as feds. OK, yeah, Keith Alexander might be spotted, but the average run-of-the-mill FBI or NSA geek probably isn't all that recognizable unless they wear their official ID or something.

BUT... looking at it from the "keep your friends close, and your enemies closer" perspective, I'm not sure this is a Good Thing. The feds are going to do what they're going to do, regardless of what DEF CON does. Might as well invite them in, pick their brains, and learn as much as possible to help counter their shady machinations.

<comment><USER7> My major problem with the PRISM debacle was less that the NSA stores and analyzes Internet traffic (although it's perfectly reasonable to be upset about it) and more that they were doing it secretively (mixed with some disgust at how much money, energy, and time must be wasted storing and sifting through unfathomable amounts of data).

With that in mind, it's kind of counterintuitive to close the door to conversation when silence was the issue in the first place. It almost seems like a melodramatic romance ("I just need to be alone right now."), which portrays the DEF CON organizers as reactionary and immature.

I also think it creates unnecessary hostility when you disinvite a group of people that everyone seems to know will attend anyway. In fact, it just creates _more_ secrecy.

<comment><USER8> I think the NSA and friends are underestimating the amount of anger out there, and that the Congresscritters will probably try for a reduction of the NSA's budget to punish them for lying to them. The future of the organization might not be in jeopardy (although from the way congressmen seem peeved, it might) but there will definitely be cutbacks across the entire surveillance business.

<comment><USER9> "Congresscritters will probably try for a reduction of the NSA's budget"

Not if the leadership and seniors have anything to do with it. Boehner called Snowden a traitor; he doesn't _want_ to be told what Snowden knows. And Feinstein has defended the programs.

Wyden and Udall are in the minority. Everyone else on the Senate Intelligence Committee heard what those two heard, and there were no words of discontent or reform beyond what those two said. Indeed, most of you probably know their names only because of their faint opposition. They've been speaking as much as they dare for years, which means the rest of the committee has known for years. And yet, nothing.

<comment><USER8> Congressmen have to be re-elected, and they have to show to their constituents that they have done _something_ to protect their privacy... There will be change.

<comment><USER9> Congress at large has the worst approval ratings in years, possibly ever. And yet we keep on mostly re-electing the individuals that make up the body, while in the same breath complaining about Congress.

</comment></comment></comment></comment></comment></comment><comment><USER10> I don't agree with the statement that Secure Ideas makes; they are opting out because DEFCON is supposed to be an open collaboration place, but if the very netsec community doesn't have the balls to stand up to the extreme over-reach of the NSA, then we are farked.

Yes, most of us have known for years the extent of the spying the NSA/USG does -- and I believe it's time to take back some individual sovereignty -- the NSA has all but dissolved this.

For me, this is not a political issue, its a human rights issue. I have no respect for the NSA and its apologists, period.

<comment><USER11> > I have no respect for the NSA and its apologists, period.

Do you lack respect for those people, or their arguments?

<comment><USER10> I have no respect for the NSA and those who work there who perpetrate this surveillance state. So those ___people_ __who have built this.

<comment><USER2> Exactly the right point!

This needs to be personal - especially because we are not talking about some exploited minimal wage earners who have no other options.

But instead about professionals who have made the intentional choice to dedicate 8h+ a day to organizations that set out to destroy privacy and private communication across the world.

</comment></comment></comment></comment><comment><USER12> Don't worry about the Fed's absence at DEF Con, they never attended for the content. They only wanted the meta data.

</comment><comment><USER13> Here's hoping that the free time slots are now filled with talks that discuss ways to escape the surveillance state. Particularly how systems for the use of masses could be erected.

<comment><USER14> Exactly. Democratizing defenses for the average person needs to become the norm. Every person in the world has the right to be free from government surveillance, both domestic and foreign.

</comment></comment><comment><USER15> "We do not want to make this a "political" move"

Bullshit, that's exactly what it is.

<comment><USER16> Exactly, if it was non-political they'd just call up DEFCON and withdraw their talk.

</comment></comment><comment><USER17> Hey, look: Secure Ideas managed to advertise themselves through a blog post and save money by not presenting, all in one move!

What a stellar synergy of marketing and management!

</comment><comment><USER18> DEC CON is trying to retain some aspects of the community it cares about in order to prevent it from completely evolving into a pentagon pony show.

You missed the point completely, your post is a contradiction and way off base.

<comment><USER19> Had to scroll too far down to find this comment. Defcon's argument, which Secure Ideas didn't seem to get, was:

P1) This is a place for those who believe in openness, sharing, and mutual gain.

P2) Feds have been hiding the fact that they've been screwing us all along.

Conclusion: This isn't a place for Feds.

The blog posts states: "...but rather a continuation of openness that this event has always encouraged." But this is exactly why the Feds aren't allowed.

</comment></comment><comment><USER20> this is so awesome by Secure Ideas, and also an awful move by DEF CON. one of the largest problems with current state of technology is that what the fed is doing is possible. hopefully there will be a lot of talk about how to shift towards more secure services such as mesh nets and polymorphic encryption. the feds would have been good resources to talk to, and it's extremely hard to find an opportunity to have the kind of necessary talks outside of conventions like DEF CON.

<comment><USER21> > one of the largest problems with current state of technology is that what > the fed is doing is possible.

I think you meant 'legal' but you accidentally wrote 'possible' instead. Mesh nets and polymorphic encryption don't stand a chance against a supoena and the threat of a lengthy imprisonment/huge fine for noncompliance.

<comment><USER20> I said what I meant. And I think you're implying that the government doesn't use the same backdoors and web surveillance strategies that all black hats (anyone really) has the ability to deploy.

<comment><USER22> The stark difference being that no hacker has the ability to deploy a standing army, a secret police force, or secret courts for issuing secret warrants.

</comment></comment></comment></comment><comment><USER23> Uhm.. the feds do not _share_ or _collaborate_. They will prosecute any of their own who do _give back_. In fact, Keith Alexander came there last year to _lie_ to your face.

<comment><USER24> Sure they do, I've had constructive conversations, advice and even patches submitted by feds (yes, I checked them thoroughly!).

In my experience, vendors leech off the community more than the feds do.

</comment></comment><comment><USER25> Hopefully their talk will be replaced with a Q&A session with NSA reps.

<comment><USER26> That's the problem though. DEF CON doesn't want the NSA to come.

</comment></comment><comment><USER27> I think they make a really good point, which is that true neutrality is something beneficial for the whole community.

Besides, DEFCON's statement was symbolic. If the NSA is watching us constantly anyway, they're going to be hacking us and us hacking them even if we and/or they are not at the conference.

</comment><comment><USER28> Even if the "feds" aren't officially invited to run a booth and take applications, they're gonna show up anyways probably three weeks before the event to install facial recognition cameras and audio recording bugs in all the hotel rooms (;

<comment><USER14> I'm sure that they don't need to. They just ask the casinos and other places to give them all the footage after the fact.

Wouldn't you want to hold a conference like this in a place where all surveillance equipment were not standard so you can spot them as anomalies in the surroundings?

I would imagine that every single person that has attended is on the list of people whose communications are stored indefinitely.

</comment></comment><comment><USER14> By closing themselves to the US "feds" community, do they open themselves up to the larger international black hat community?

I would imagine that any foreign black hat would have reservations about going to DEFCON.

In fact, the DEFCON community probably benefits from diversifying globally by being held in other countries.

I don't know anything about DEFCON, but how diversified is the audience that attends? Historically, have the overwhelming majority of non-fed attendees been US citizens? I would imagine that both Germany and Israel are well represented in the community.

If so, how do they attend without risking being put on a no-entry list at the border?

</comment><comment><USER29> Anyone can attend DEF CON, including feds that leave their badges in their wallets. That being the case, this statement was made for the benefit of exactly one audience: government procurement departments.

</comment><comment><USER30> Drama.exe

There's this thing called sequestration going on that's disrupting the budgets of all the federal agencies.

The feds are cutting budget for ridiculous things like the blue angels.

But they're totally going to be maintaining the budget for hacker cons in Las Vegas.

This is all about street cred for defcon & nothing to do with "taking a break." Jeff Moss is too sophisticated to be throwing away all those relationships. This is a stunt circle jerk.

<comment><USER31> After the GSA stunt a few years ago, you bet conference budgets have been cut. Departments are given a set budget for each conference--if I remember right, the DOE allocates $100k max per conference. Sounds like a lot, but then you see what happened to last year's Supercomputing conference. That's a weeklong conference traditionally attended by many of the DOE's large supercomputing community. $100k does not send many people to a week-long conference. This was enough to cause very notable effects on the conference as a whole; outlets such as The Register even commented on it. I've heard rumors that some companies may not be going this year because without the DOE there, it's just not as valuable for HPC vendors.

</comment></comment><comment><USER32> I wonder how many others (if any) will follow your lead.

<comment><USER33> I think some who have direct or indirect ties to NSA or other government organizations will probably feel the pressure to opt out for DEFCON that increasingly have become anti-government.

<comment><USER34> good riddance

</comment></comment></comment><comment><USER35> They make a good point: DEF CON has not given "concrete" reason for why they banned the feds. They merely allude to "recent revelations".

I am not necessarily opposed to the idea of banning people for bad behavior, but DEF CON should spell out a concrete policy, apply it to everyone, and be specific about the offending actions.

</comment><comment><USER36> Is Defcon worried about fights breaking out or something? You know the 'feds' are going to be there anyway. At least if they were in the open then everyone could give them a piece of their minds and maybe convince some of them to quit their jobs or at least give more consideration to the other perspective.

</comment><comment><USER37> Wow, I got my talk down to "you or one other talk" and wasn't accepted (I did apply late). Tempted to see if they'll let me replace Secure Ideas. I have no problem with the "feds, please stay home" policy.

</comment><comment><USER38> If they didn't 'want to make this a "political" move', why exactly did they write a public blog entry about it expounding their point of view?

</comment><comment><USER39> They just have casino & hotel surveillance run facial recognition on everyone anyways.

</comment><comment><USER40> summary: they will not present, but they will.

</comment><comment><USER41> Pure pretense. They're using the NSA debacle as an excuse to pander to the trend and headline-whore.</comment>


Google and Microsoft Push Websites to Go Password-Less - <AUTHOR> https://www.pcmag.com/news/360582/google-microsoft-push-websites-to-go-password-less <comment><USER2> Couple comments already on "websites shouldn't accept biometrics as a password". They're totally correct, and that's not what is being shown here. This is "websites accept hardware or software generated FIDO logins that have access to them intermediated by a combination of several factors including device presence, session login, and biometrics".

The hard part is making that look and feel like "login with a fingerprint".

<comment><USER3> What happens when I lose or break all my devices?

<comment><USER4> > _What happens when I lose or break all my devices?_

What happens when you use iOS's password generator and manager and you lose or break your phone? Or the same but with LastPass?

You've either synced it or you lose all your passwords.

<comment><USER3> My LastPass vault is protected with a master password. If I lose all my devices, I can restore from online using that. I'm just wondering how that would work in a password less schéma.

<comment><USER2> We (IDPs in general, I can't quite speak to FIDO work) still have other account recovery methods, like email (eg Facebook lets you do fast IDV for password reset if you have a Gmail account associated). Part of this is a turtle tower - there's always going to be some more definitive IDP that we ask you to associate and fall back to, and hopefully that IDP will do the same. Our work (MSFT Identity) on decentralized ID in particular needs to take this into account - who's the last turtle there?

</comment></comment></comment></comment></comment><comment><USER5> While it may be interesting from an ease of use point of view, I'm worried it is actually more of move from Google and Microsoft to get more lock-in on their OS and of the web.

<comment><USER6> Technically, nothing prevents Apple and Mozilla (and others) from implementing this technology into their products.

<comment><USER5> Sorry, I didn't details enough. I mean biometric data are gathered from the hardware through system API. This is where system vendors can restrict things, for example by exposing the API to some framework only (e.g. UWP) or even making them private.

<comment><AUTHOR> Unless system vendors discriminate other browsers from their own browser in terms of the said restrictions, I would say that it is fair game.

Following your example, if Microsoft were to require browsers use UWP framework to utilize the biometric authentication API, implementing the feature to Edge and not to Internet Explorer, would that be problematic?

</comment></comment></comment></comment><comment><USER7> This is nothing new, although there's perhaps no common standard implemented by all the players. However, while the process may be "simpler, securer ways to grant login access" from the users' perspectives, often these sorts of protocols become many times more complex to get right on the server side of things.

Another worry is that this sort of approach will effectively hide the authentication mechanism from the user. So while I may make the choice to use notional biometric login to a Facebook app on my phone, knowing all the risks and compromises that come with having a Facebook account, I may not wish to use a Facebook login for other authenticated services unrelated to Facebook (when I'm confronted with the option to log in with Facebook, I always choose the other option, whatever it is, even if it's "give up on using this system/service").

<comment><USER2> Authentication and Federated login shouldn't become the same thing, and FIDO doesn't move us closer to that. There's not a scenario where this becomes "silently login to Facebook and silently provide consent by clicking login" \- users will still have to consciously click on "login with Facebook" at which point they can use FIDO to login to a Facebook property.

</comment></comment><comment><USER8> Yubico wants people to go "passwordless" too -- and was also at RSA to pitch "passwordless login" [0] -- but wants you to use their new "Security Key" [1] (which supports both U2F and FIDO2) instead.

Personally, I'd be more inclined to go this route (hardware key versus an app on my phone that uses my fingerprint or a facial scan).

[0]: [https://www.yubico.com/2018/04/yubico- rsa-2018-passwordless-...](https://www.yubico.com/2018/04/yubico- rsa-2018-passwordless-logins-developer-programs/)

[1]: [https://www.yubico.com/product/security-key-by- yubico/](https://www.yubico.com/product/security-key-by-yubico/)

</comment><comment><USER9> It sounds like a terrible idea. What if you don't have Android, Microsoft, Apple, or Amazon products, or even a smartphone at all? Smartphones collect too much information and it shouldn't be required to link all that data just to log in to websites.

<comment><USER10> Plenty of sites provide multiple auth options. Like social login or email/pass. There's something to be said for not trusting ever site in the world to know how to secure a password database. In fact, many are outsourcing auth to companies like auth0 behind the scenes.

</comment></comment><comment><USER11> As long as you're still logging into the device using some form of information that can't be collected from you unconsciously its fine. Is that what it is? I hope that's what it is otherwise I'm going to need to buy some gloves.

</comment><comment><USER12> Getting my fingerprints hacked sounds worse than getting my password hacked, I can't change my fingerprint!

</comment><comment><USER13> As others have already mentioned, this article is a bit misleading. However, I'd like to point out the good work that Microsoft is already doing to enable "passwordless" logins. You can log in to your Windows PC with a PIN or biometrics, and you can log into many Microsoft web services using the Authenticator app on your smartphone. The upshot to this, is that you can set a much stronger account password knowing that you won't have to type it in that often. Google and Apple are lagging behind in this space - both require you to type in your full password way too often which leads customers to using weaker, easier to type passwords instead. Still a lot to improve in this space.

</comment><comment><USER14> It has been said many times already, biometric data is not a password it is a login/user name.

<comment><USER15> But isn't it still a stronger form of authentication than the average password?

I would not use it for authentication against the missile launch system, but my ex will probably not chop of my finger to access my Facebook account, nor will random bots trying to access my Gmail account.

<comment><USER16> Yet, she can use 50$ kits to lift and scan a fingerprint from your belongings.

<comment><USER17> She can, but the threat model here is so amazingly different than traditional threat models for username/pw that it is _ridiculous_ to say that biometrics are usernames. Biometrics are biometrics. They are simply different. They have different threat models and failure modes than passwords. They are neither better nor worse.

<comment><USER16> It's an analogy that captures the essence of the problem framed in a way most people can understand it: with biometrics there is no shared secret, just a high entropy, non-revocable and very public UID.

Yes, public in a different model, with a different set of threats, but that's irrelevant to what the analogy is trying to convey.

It's a human trait to evaluate and disseminate new concepts though existing concepts. Everything is unique, if you want to refine or disprove the analogy it's not enough to call it wrong repeatedly, you need to accept that specific frame of reference is suggestive to those who chose it, and formulate your arguments from that perspective.

</comment></comment></comment></comment></comment><comment><USER18> I couldn't tell what data is leaking to the service provider. Are they gathering data on all these sessions?

<comment><USER19> Nothing is free and now you will have to have an account with the service provider and whatever terms and service they choose.

</comment></comment><comment><USER10> It seems to me that biometric passwords are convenient and better than a weak password, but much easier to compromise. Fingerprints can be lifted. Faces can be photographed.

<comment><USER20> more importantly, they can't be changed

</comment></comment><comment><USER21> Biometric can be used as an identifier but not as a password.

</comment><comment><USER22> Biometrics should never be the only means of authentication. They can only be complimentary.

</comment><comment><USER23> Authentication should always require something you know. Adding something you have/possess like a crypto device is a great way to enhance security, but it should always be a supplement to something you know - your password.

</comment><comment><USER24> Passwords are bad. Fingerprints and face-recognition worse.

I'm strongly in favour of very-near-field chips, at < 1cm range preferably. In a wearable form factor, these are replaceable but difficult to misplace or lose.

<comment><USER25> It might be <1cm with this antenna but someone else with a better antenna might be able to read it from 1m...

<comment><USER24> Timing would limit range.

The auth itself is query-response, replay attacks don't work.</comment></comment></comment>


Ask HN: I want to start a News Website - <AUTHOR> Hey there. I have a question: I want to start a news website, how do I do it?
I can code (front end and backend), and I can study topics, learn them, and make them easy to understand for other people.
The problem, however, is that I'm 17. I know that this project probably won't get off the ground simply because of that fact, but I'd love to hear any tips / opinions people have about it. Thanks. <comment><USER2> Why not just use Wordpress with a few add-ons and a theme that looks like a news site?

<comment><AUTHOR> Because I have ideas I feel could shake the news industry up, even if it's just for a small niche of people. I don't really want to be a "me too" site.

<comment><USER3> Your choice of tools (including blog vs custom code, PHP vs Rails, etc) doesn't determine whether or not you'll create a "me too" site.

One could shake up the industry with something that leverages blog software. Another could write an amazing piece of news-displaying technology and not make a dent.

<comment><USER4> +1. As a developer it's easy to take the old "not invented here" attitude, but you don't even know if people will be interested in your idea. Get it out there as quickly as possible with off-the-shelf software first. If it's something people want/need, your users will flock to it for the content. They truly don't care about the tech going on behind the scenes, especially as you're beta testing it.

</comment></comment></comment></comment><comment><USER5> While Hacker News is focused on hacking/coding, that will almost certainly be the easiest part of what you're trying to do.

What will make the difference in whether or not you shake up the news industry is the type of content you create and how you create it, not the software that runs the site.

My advice to you is to get the easiest possible writing platform (that means WordPress) running, and then spend your time writing and putting out those "short, sweet facts." Try and find other people to do this as well.

Then get as many people as you can to read the site and see what they think of it.

</comment><comment><USER6> Work on an example page or design that conveys the essence of what you are trying to create. This core design prototype will help you focus on what distnguishes your project and can be used to get some early feedback. I strongly support youdigging into this project and forgetting about your age. You'll learn more from this than you can imagine regardless of its success.

</comment><comment><USER7> Couldn't hurt to work/intern for a online news site and gain some experience.

</comment><comment><USER8> I dont mean to put you on a defensive but, what makes me want to go to YOUR site. Where will the content come from, users? aggregated? How will the content be shared? Social networking? reddit style?

<comment><AUTHOR> I personally HATE social networking in my news. That is, for example, you going to the Huffington Post and seeing Facebook Connect buttons, as well as Twitter / Google / Yahoo! login buttons.

However I do think that the idea of use aggregation leaking in to the site, Reddit Style, could be a good resource. However that probably wouldn't be a main feature of the site, but likely a sub-section of the site completely separated from the actual content.

</comment></comment><comment><USER9> Can you write? Are you going to scrape other people's information? What kind of information are you interested in publishing?

<comment><AUTHOR> I think I can write, but I certainly don't know if I can in the form of reporting.

The kind of information I'm interested in publishing is non-biased facts. I doubt a news site could function purely on this, but if I could design one I would put a lot of emphasis on bullet points.

<comment><USER10> I've been in journalism for about six years now and have worked on some fairly prolific sites; in that time, I've learned that objectivity is a myth. Don't trick yourself into thinking otherwise.

That said, I'd love to offer advice/guidance on a more specific level if you'd like to chat.

<comment><AUTHOR> What aren't I tricking myself into thinking?.. That I would like to make the news as non-biased as possible, that I'd like to use bullet points, or that I'd like to use facts?

<comment><USER10> Bias is inherent in every step of the news gathering and reporting process. It better to recognize (and perhaps even highlight) this than to expend energy and resources on pursuing that which is ultimately unattainable. Doing so will go farther in creating credibility and trust than operating under the guise of presenting "just the facts."

<comment><AUTHOR> I see what you're saying... So you are saying that because facts are so hard to find, and bias is all over, it would be helpful to point out bias for the sake of clarity? I like the sound of that, thanks for the tip.

<comment><USER10> More or less. Be aware of your weakness, basically.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Your age is only as relevant as you choose to make it.

What kind of coding (languages, systems, projects) have you done so far?

<comment><AUTHOR> I like the sound of that.

I have done PHP / MySQL, and learned Django before jumping ship to Ruby on Rails. I'm now exclusively Rails, but also have toyed with C# in the past.

As for projects, I have many ideas in my arsenal but as of now only one is being actively developed; however it isn't giving me the kind of passion I had when I came up with the idea about a year ago.

<comment><USER11> That's a good enough base for lots of web-based projects; it seems to me like your general "how do I..." question may not have been about how to build your idea with web software, but something else. How to attract early users/contributors, maybe? Or collaborators? Or other attention/support? (Or maybe you are wondering about the mechanics of setting everything like the domain/hosting/server up, in which case you may want to ask more specific questions in other targeted forums.)

I'd say build as much of what you've got in mind as you can. Encourage people to look at it even when it's very rough -- don't disappear for months making something slick/complete. Adjust. Continue.

You may also want to put contact details or a personal web page in your profile here.

<comment><AUTHOR> Yes, my "how do I..." question was retaining to all of what you said. Support, attention, users, contributers.

I know how to do the site, front and back. I know how to host. I know where to host. I was simply looking for feedback on those questions as well as some general feedback on the idea.

And I will do. I'm a long time lurker, and this is my first post.

<comment><USER11> If you're in the Bay Area, a tech-blog-sponsored confab/brainstorming session on journalism in the web era is tomorrow:

<http://www.techdirt.com/articles/20100526/0142359581.shtml>

Might be relevant to your concept, which I'd also be interested in discussing further if only there were contact info in your profile.

<comment><AUTHOR> I unfortunately don't live in the Bay Area. I live in Sacramento, and have had the pleasure of going to the Googleplex, but unfortunately couldn't make it there.

Thanks for the link, though.

</comment></comment></comment></comment></comment></comment><comment><USER12> Go ahead and code up a prototype, then run it by the folks here for feedback.

</comment><comment><USER13> [http://knowledgeisfortheworld.blogspot.com/2010/06/how-i- sta...](http://knowledgeisfortheworld.blogspot.com/2010/06/how-i-started- something-from-nothing.html)

Hope this helps :)

<comment><USER13> Though it won't require much of, I can say any coding experience you can bring up a website of your own in pretty much a day or two provided you have enough content to flood the site</comment></comment>


Avoid distractions and work in your goals - <AUTHOR> https://medium.com/@mati/time-93b89f3f9ae8 <comment><USER2> Good solid points.

Social media is terrible for high time investment with little return. Reduce that time and replace it with things you actually want to do at a deeper level, and your life will be more enjoyable.</comment>


Dice.com Tech Salary Survey [pdf] - <AUTHOR> http://marketing.dice.com/pdf/Dice_TechSalarySurvey_2014.pdf

<comment><USER2> Numbers look a little low to me.</comment>


Samsung's Tizen is riddled with security flaws, amateurishly written - <AUTHOR> https://arstechnica.com/gadgets/2017/04/samsungs-tizen-is-riddled-with-security-flaws-amateurishly-written/ <comment><USER2> Tizen was/is mostly built out of a Samsung subsidiary in Warsaw, Poland. (Several thousand software engineers in total.) I worked with Polish software engineers for a western company that used the same outsourcing method during the same time that Tizen was being built. We had hires from Samsung and they had hires from us.

I think that what I witnessed at our company (which I won't name) is representative for what Samsung saw.

The stereotypical development model was one where individual developers were perceived as lego blocks that could be moved from one area to another about as the project(s) progressed without any regard for the individual contributors accumulated knowledge. Large volumes of contributors ("bug resolvers") were valued over smaller, coherent teams with smarter contributors.

There was also a disturbing amount of machoismo surrounding everything - nothing could be questioned; everything was a of sense pride to someone.

(What I heard from the local engineering managers supports the above.)

<comment><USER2> My assessment after having a few years perspective:

\- There's quite a big span between the average level to high level to top level when it comes to polish devs. Specifically, it goes a lot lever than what I'm used to. It goes high too, though, but those individuals are not necessarily cheaper than a western european employee of the same calibre (probably similar).

\- (Engineering) Management culture is totally whacko and quite a bit behind the western world. I blame the machoismo.

<comment><USER3> There are a lot of good software engineers in Warsaw, working at various companies. However most of companies here doesn't care that much about top talent. They just want to pay an average salary and that's all.

It is very rare that Warsaw devs that write good quality code are compensated appropriately.

</comment></comment></comment><comment><USER4> In Samsung HQ in Suwon, Korea, back in 2010 in the leadup to the launch of the Galaxy device series, each individual OS had its own literal skyscraper in the HQ campus. One for BadaOS, one for Android, one for Windows Mobile. I don't think they communicated at all, as a general rule. Even in the Android one where I was working, the whole floor was nominal software guys but only one knew how to compile the firmware everyone was working on! They actually had to fly in a team of low-level programmers from Samsung India to get the device firmware up to speed in time for the hardware launch. It was an extremely interesting organization to spend a few days in from an anthropological perspective, but I left swearing that if the experience was a vision of the future I wanted no part of it.

</comment><comment><USER5> Should not come as a surprise...

[https://what.thedailywtf.com/topic/15687/code-review- maledic...](https://what.thedailywtf.com/topic/15687/code-review-malediction)

[https://what.thedailywtf.com/topic/15001/enlightened](https://what.thedailywtf.com/topic/15001/enlightened)

<comment><USER6> > > [https://what.thedailywtf.com/topic/15001/enlightened](https://what.thedailywtf.com/topic/15001/enlightened)

Actually it's the author of the rant that comes of as totally uninformed and with unwarranted snark to boot.

[https://what.thedailywtf.com/topic/15001/enlightened/242](https://what.thedailywtf.com/topic/15001/enlightened/242)

<comment><USER7> Not when I read the replies to that reply.

      @Carsten_Haitzler said:

      as for the "you bitch" comment. that does not appear anywhere inside efl at asll. i can only assume you are full of bullshit here as with a lot of the prior "facts" you have disclosed, as a grep through our codebase for efl and elementary shows no such string:

      core/efl.git - EFL core libraries
      evas - change error out from bitch to complain - cosmetic changeHEADmaster
      committer Carsten Haitzler (Rasterman) firstname.lastname@example.com	2015-03-11 12:59:01 (GMT)

      F#*k off.

<comment><USER6> > _Not when I read the replies to that reply._

Even more so after one reads the replies.

Perhaps we didn't read the same reply?

Because the response you've posted:

1) only addresses one of the tens of points in the reply -- the others still being valid.

2) while true, it is still irrelevant from a technical standpoint (not to mention softened in the subsequent version anyway).

3) At worst, the Evas author failed to grep the right version for it. Whereas the ranter, at best, fails to understand C coding, failed to consult documentation that was right there, complaints for valid behavior, cites several wrong facts about the behavior of the code (like the supposed "512" object limit), and closes with the BS "it will take man-years" to build a sample simplistic media player with the lib (using a ready made codecs/media player widget component).

Evas/Eve etc have some questionable design decisions, and not the best documentation. But the original post is full of crap in almost every aspect, and with unwarranted language to boot.

<comment><USER8> Are you an EFL developer or the author? I have read the whole 19 pages of comments, plus the sister thread on os news, and you are the only one that can't understand all the problems in that ball of sh*t apart from the EFL author and his coworker. In any case I would prefer to lose an hand than to work with someone like you for which writing non type-safe C code, with 40 vulnerabilities discovered by a single researcher, is perfectly fine.

</comment></comment></comment></comment></comment><comment><USER9> Maybe Samsung has a running bet with Huawei over how much crappy code you can push to how many devices. Huawei is still very likely winning, as they had that period when they had to rewrite most of their router software after being outed as having stolen Cisco's code. They just plain wrote the same shit, but replaced everything good with about 2 bad things instead.

</comment><comment><USER10> Is it that big industrial corporations are bad at creating code? Toyota, samsung, synaptic.

I'm really beggining to think that code should be left to smaller and medium sized outfits. i.e samsung should buy or hire a small startup to independently develop and grow their next ecosystem. Large enterprises just seem too clumsy pull pull it off unless they wholly dedicate themselves to developing that one piece of technology.

<comment><USER11> The counter arguments include Google, Apple, Microsoft, etc.

I think the big vs small comparison is flawed. I've seen some atrocious code produced by small/medium sized outfits. My fondest memory including auditing code from a 3 person outfit who's code quite literally setup an RPC on the server that executed any string it was sent, verbatim, against a database that handled money.

<comment><USER10> Those counter examples were all software startups. And have very very different cultures to other corporations their size due to their roots.

<comment><USER12> Is Samsung at this point really _that_ different in terms of semantics from those examples though. Obviously they are all unique and Samsung's location makes a big impact on their culture but like they hire a similar intelligence echelon of people right? I don't know much about the internals of Samsung so maybe I'm missing something.

</comment></comment></comment></comment><comment><USER13> I'm very tempted to buy a Samsung TV (primarily for the the low input lag times which makes them good for gaming) and I plan to keep it offline (no WiFi or Ethernet connection), using a Chromecast and a HTPC+Kodi instead for streaming. With that in mind, should I be worried about security flaws?

<comment><USER14> Depends on your threat model.

From TFA: Another attack on Samsung Smart TVs was published last week that used malicious commands embedded in broadcast TV signals.

So, even if it's airgapped, a tv that's been compromised in this way is effectively a hostile general-purpose computer with a wifi card running inside your house.

If this is something you would do for a Klondike bar, then go ahead. I'll keep my dumb TV and my Kodi box, though.

<comment><USER15> Agreed. These "smart" TVs mostly run outdated and buggy software which are difficult if not impossible to update either because of technical limitations or because the manufacturer doesn't care enough after getting your money.

So why bother with a "smart" TV if you're going to be using an external computer anyway. Saving a few hundred dollars to spend on that external computer seems like a better investment. I run a "dumb" big LG TV hooked up to a raspberry pi running Kodi via LibreElec. I'm very happy with the set up in terms of functionality and price.

Edit: the attack via signal is linked from the article, reading now.

<comment><USER13> > _So why bother with a "smart" TV if you're going to be using an external > computer anyway. Saving a few hundred dollars to spend on that external > computer seems like a better investment._

I'm in the market for a 4k TV with low input lag. If you look at input lag tests (e.g., [http://uk.rtings.com/tv/tests/inputs/input- lag](http://uk.rtings.com/tv/tests/inputs/input-lag)) you'll see that every single TV listed there is a smart TV, at least in the 43"-50" range anyway. In fact, are there even such things as "dumb" TVs anymore?

That said, I've done some more research and realised tha the LG UH6 __* range is actually also pretty good for low input lags and runs webOS to boot so I think I 'll go for an LG instead.

</comment></comment></comment></comment><comment><USER16> This doesn't surprise me. A company I used to work for fielded a team at most Pwn2Own competitions, and it was widely regarded as "not good sport" to take on a Samsung phone because they were so bad.

</comment><comment><USER17> Is anyone the least surprised by this?

<comment><USER18> ...Yes? I mean, Samsung is a big enough company with big enough profits to attract talented candidates and also be selective:

[https://www.quora.com/How-would-you-prepare-for-the- Samsung-...](https://www.quora.com/How-would-you-prepare-for-the-Samsung- interview-Can-seniors-share-their-experiences-What-all-must-we-do)

Furthermore, their mobile business is mature and well-known enough that even if they were staffed with complete amateurs whose legacy code was awful, Samsung has been a prominent player for a long time in terms of tech-biz- years. The chances are significant that they have among their ranks a wise- enough manager to realize that it's time to tackle technical debt. Or, in lieu of that, that Samsung would've by now had a come-to-Security-Jesus security fuckup traumatic enough to force a thorough audit and revamp.

Clearly that hasn't happened here so I'm interested in learning the details as they come out.

<comment><USER19> Maybe then security is less to do with individuals and more so company culture ?

<comment><USER17> I would think that's pretty obvious but I guess not.

</comment></comment></comment></comment><comment><USER20> thankfully, due to the Wayland protocol, an attacker will not be able to take a screenshot of the device without direct user input.

</comment><comment><USER21> I was hoping Samsung would do something with Tizen as opposed to Android. Sorry to hear this.

</comment><comment><USER22> Theory: Samsung is just funding Tizen development to gain leverage over Android

<comment><USER23> Wasn't the main reason why they wrote Tizen? Because Google was pushing them around too much?

</comment></comment><comment><USER24> Samsung should have used Intel Appup instead.

<comment><USER25> Symbian! PonyOS! TempleOS! MS-DOS!

<comment><USER26> Meego Harmattan :'(

<comment><USER27> In my alternate dream universe, my Nokia N9 continued to exist and be upgraded...

</comment></comment></comment></comment><comment><USER28> everything i've ever purchased from samsung has broken. i just don't even consider their gear now.

<comment><USER29> They have always had nice hardware and terrible, terrible software - way back in the J2ME days Samsung were the bain of my life.

<comment><USER30> Exactly. I love my galaxy but rooted and flashed it immediately. The bloatware was uncomfortably pervasive, specifically on my carrier. I have other samsung devices, and have had few non firmware issues.

</comment></comment></comment><comment><USER31> I can't believe there are still string overflow bugs. Might be a good idea to invest sometime in Rust. On a side note, I have been looking for a good doc on how I can slowly migrate my existing code base step-by-step to Rust. A total rewrite is out of question, we would rather ship our product step by step. Does anyone know of such a doc?

<comment><USER32> [https://github.com/carols10cents/rust-out-your-c- talk](https://github.com/carols10cents/rust-out-your-c-talk)

[http://blog.adamperry.me/rust/2016/06/11/baby-steps- porting-...](http://blog.adamperry.me/rust/2016/06/11/baby-steps-porting-musl- to-rust/)

<comment><USER31> Thanks!</comment></comment></comment>


Ask HN: Anyone using DigitalOcean for production? - <AUTHOR>

Hi HN,
I want to move the production server for a site I work on to DigitalOcean's NYC2 data center because Linode's Newark, NJ data center has been having a bunch of network issues. Is anyone here using DO for their production servers? I'm concerned about reliability since they've been growing so quickly.
Thanks!
Kevin <comment><USER2> I've had my share of downtime on DO's NYC2 datacenter but I've also had downtime on Linode. Overall Linode has been more reliable for me than DO. Moving to DO won't result in eliminating outages forever. With Linode's most recent round of server upgrades the machines they offer are superior in performance when compared to DO. Unless you absolutely must have your server in the New York area I'd just move to a different Linode datacenter.

</comment><comment><USER3> I can only tell you from the last 30 days. I am in NYC1. I've had perfect uptime on my production server except when I had to patch for heartbleed.

</comment><comment><USER4> As of now DO has much lower uptime than Linode. You will need to find different provider, different DC or wait few more months for DO to mature more.</comment>


Show HN: Stalemate – Merge Pull Requests Faster - <AUTHOR> https://stalemate.io/ <comment><AUTHOR> Hi HN. We made Stalemate because we wanted a dashboard which makes it easy to see the relevant pull requests and what needs doing to get them ready to merge.

We've been testing Stalemate with a few companies here in the UK. It's ideal when you're working across multiple repositories on a single team (e.g. when you have code split out into libraries on a project).

Stalemate is good for teams who use relatively simple issue/task tracking such as GitHub issues, trello et al. It's not a great pairing with tools like Jira however because there are better ways to surface the information that Stalemate does in Jira.

There's no magic here - just a really useful way to surface the data you already have in a way that makes it really easy for developers to see PRs needing attention.

We'd love feedback! Thanks</comment>


Google might release a new laptop and tablet that run on a completely new OS - <AUTHOR> http://www.businessinsider.in/Google-might-release-a-new-laptop-and-tablet-that-run-on-a-completely-new-operating-system/articleshow/54529745.cms <comment><USER2> I'd personally love to see a new OS come into play, I just really wouldn't want it built around a single company if that makes sense? I wouldn't mind so much if one company bank rolled the initial design if it was open source and once made pubic was too licensed and profited as open source software so that development communities around the world could not only inspect it, but also contribute, improve and redistribute freely, think android but without being built to be so Google centric.

</comment><comment><USER3> Linux based I would assume?</comment>


Ask HN: Do you know someone whose passionate about cooking? - <AUTHOR>

Would appreciate if you can refer them to me. I'm trying to validate our customer problem hypothesis.<p>Thanks email@example.com <comment><USER2> send me an email, i know a few pro chefs and can knock an idea around for you

</comment><comment><USER3> send one to me too, my gf is pretty passionate ill pass it along

</comment><comment><USER4> Me.

</comment><comment><USER5> Me.</comment>


Department of Health spends £10.1 million on IT security architects - <AUTHOR> http://www.computerworlduk.com/news/public-sector/3249336/department-of-health-spends-101-million-on-it-security-architects/?cmpid=sbycombinatoranguyen <comment><USER2> £2.5 Million a year for four years isn't that bad for what is mostly a £10 billion IT programme.

It's easy to come up with a headline with big numbers in it, but it's more difficult to put it in perspective.</comment>


The CEO of RevolutApp on Slack: "Why Aren't You Working on Weekends?" - <AUTHOR> https://twitter.com/phillipcaudell/status/1101081229351415808 <comment><USER2> I appreciate the CEO being direct. It gives you a chance to find another job before you get fired.

<comment><USER3> Honestly, I can't tell if you're being sarcastic, but I really think you're absolutely right. Some people really like working in that environment. Personally, it's not for me, but at least the CEO is upfront about what he expects. Really, he's being a good leader in that respect. I wouldn't want to work for him, but he's clear about what he wants which a lot of people in management miss.

 __EDIT __

Let me explain why this is good. First as your boss, I 'm not your friend. I'm not your pal. My sole responsibility is to ensure that I communicate clearly and effectively what needs to be done and make sure it happens. That's it. Does this mean, I'm not compassionate? No, of course not, but what it means is that I am tasked having uncomfortable conversations about things that need to be done and to make it understood. Have I asked people to work nights and weekends? Yes. Several times? Yes. Do I like doing it? No. This is the job. If you want to quit over this. No hard feelings. I make it clear that this is what we have to do. Have I fired people for under performing? Yes. Do I feel bad about it? No. That's my job. I feel bad, when I have to let someone go, because we don't have the money to keep them. When management says, "lose two heads, because we want to cut costs," and they were good employees. I feel bad then.

Working weekends sucks, I agree, but sometimes you have to. If you've never worked for a company that is on the brink of bankruptcy, you really don't understand what it's like to have to lay things on the line. The CEO is being honest about consequences. We honestly, don't know the situation from that blurb. It sounds like he's being an ass, but there maybe an underlying reason for it. (Probably not, but you never know.) Whether you choose to keep going is your choice.

A previous company I worked for, was on the brink of going out of business. Only a few of us knew (out of 200+ employees). We had a shortfall of money and we didn't know if we were going to make payroll that month. They didn't want to tell anyone (in fact I was instructed not to), but I knew, because I knew several of the executives. I pushed my staff, and myself for those three weeks, because I knew that if we didn't bill, the company could quite possibly go under. People say working weekends crosses a line. Knowing that your co- worker (or employee) may get evicted from the country, lost their house, etc., because you didn't do your job for those couple of weeks, I can't do that. That's crossing a line for me.

<comment><USER4> On the other hand, there is a lot of toxicity in there. If your bonus is zero no matter how work you hard, and you are encouraged by the CEO to "push" your colleagues (some of which are working on weekends), it's a terrible company to work for, no matter what pay they offer (of course it's good, otherwise the CEO wouldn't have the balls to treat his employees in this way as everybody would just walk out).

<comment><USER5> It is a type of Social Engineering. Politicians are using this all the time. When one group is e.g. on strike, they ignore the 'problem' and wait until other affected groups start throwing rocks at them. Classic example of teachers striking everywhere on the planet. Politicians know that parents will revolt at some point.

This is a shitty CEO and an equally shitty HR director imho. You got problems with deadlines/projects?

Do a root cause analysis, find out what is wrong, fix THAT wrong thing. Don't ask Alice to threaten Bob!

<comment><USER6> _> Do a root cause analysis, find out what is wrong, fix THAT wrong thing. Don't ask Alice to threaten Bob!_

I'm cynical enough to assume that the KPI targets, deadlines etc. in this case are deliberately set beyond reasonable expectation to use as leverage when coercing people to work for free. Management in that case is not incompetent, just scum.

</comment></comment></comment></comment></comment><comment><USER5> Self note: never do business with the person that says: Bonus more important that weekend family time.

If projects are behind, re-group, re-train, re-focus. Waving the whip and telling people "work on the weekends" was never my style (to instruct or to receive).

<comment><USER7> Not only that, but by not having a consistent schedule, for example 40 hours a week, makes it impossible to know how long an upcoming feature is going to take. Because there are people who are willing to do those herculean tasks in the ridiculous timeframe and then burn out. So mangement never really learns anything and continues pushing features at the same pace. It is in your companies best interest to have a predicatable schedule.

</comment></comment><comment><USER8> It takes experience to know why this doesn't work and some CEOs / CTOs / PMs / etc get there faster than others.

I was involved with a company once (larger than this one) where something very similar this happened.

They threatened layoffs. What happened was that the team became immediately LESS productive. Effectively instant burnout. If not from the hours than from the loss of morale.

One of the biggest "mistakes" is they told everyone when the layoffs would happen so all the top performers had better jobs lined up for that next Monday. The really high performers phoned it in just enough to not be fired early and took their severance package when they were inevitably laid off.

Personally, I tried not to phone it in. But I actually lobbied to be laid off (there was a significant group of people that wanted to keep me). I built up my vacation time (in the US it becomes due to you as cash when you leave) and got a month severance on top of it plus a 20% raise. And I timed my start date for a week after getting laid off just to have some rest. I was a key player on the product team... the other key players left too and that entire product died a couple months later.

It takes a while for people to realize that workers will stretch or compress their work to meet the schedule. If you expect them to work weekends they will just do the same amount of work just over 7 days instead of 5. Conversely, some studies have shown a four day week has no negative effect on productivity.

Thinking to meet KPIs you throw more hours at it is a sign of a "leader" who hasn't figured that out yet. Maybe by their 5th startup they'll get it.

Edit: As an aside. I too have asked my team to work weekends occasionally (I'm a CTO not CEO but same premise). It always goes like this:

> I'm really sorry to have to do this but we really need you to put in some > extra time on the weekend to meet the deadline next week. Pick a couple days > next month to take off and we'll let you take them off without using your > PTO. Thank you, I really appreciate it! As a company we'll try to make sure > this doesn't happen very often.

<comment><USER9> Perhaps try giving them 4 future days off in exchange for working two weekend days. Weekend days are more valuable than weekdays because your family is free from work/school and there are more events.

</comment></comment><comment><USER10> RIP RevolutApp with such CEO leadership you are doomed to fail. Nikolay Storonsky - you will lose your best people and drive RevolutApp into the ground.

EDIT: just read a wiki on Nikolay. It all makes sense - his dad is a high up in Putin's enterprise machine (Gazprom - russian gas related entity) = part of the corruption machine. Not surprised that the son has such morals and how he treats other people is probably coming from his dad.

Regular folks are just lowlife slaves and peasants that exist to enrich him and his business (this is the way an average russian oligarch thinks).

<comment><USER11> Their CFO seems to be sick of weekend 'work' too:

[https://techcrunch.com/2019/03/01/revolut-cfo-peter- ohiggins...](https://techcrunch.com/2019/03/01/revolut-cfo-peter-ohiggins- resigns/)

<comment><USER10> "Storonsky also responded to the Telegraph story with a blog post that denies any wrongdoing. He claimed Revolut suspended the use of "a more advanced sanctions screening system" and instead reverted to a previous one."

haha they stopped flagging "certain" suspicious financial activity for a period of time. Its a well known fact that russian politicians and oligarchs launder their money through European banks... How "convenient" that they stopped flagging certain transactions..

Did his Dad or his Dad's buddies have to funnel some money through Europe?

</comment></comment></comment><comment><USER12> I am very pro work life balance and think anything over 35-40 hours per week will just lead to eventual burnout and reduced performance.

Having said that, I can't bring myself to be too bothered about this tweet. At least the expectation is clear: hit your KPI goal or else.

If you were to find yourself behind, you could either work harder, lobby to change the goal, lobby for more resources, pivot your strategy, or start looking for a new job. This guy is being a dick by threatening weekend work or the dole to push people to hit their numbers, but there are worse management sins.

<comment><USER13> But what if the KPIs are unreasonable? I would say they are, given that it seems multiple teams are failing to meet them.

<comment><USER14> > But what if the KPIs are unreasonable? I would say they are, given that it > seems multiple teams are failing to meet them.

Yep. Unless the employees are slacking off in their work week (I have no reason to think this is the case) this seems true _by definition_.

</comment></comment></comment><comment><USER15> So the strategy is this: Assemble teams with a low salary, then offer the withheld salary as bonus promises as an excuse to have people working on weekends and justify firing. Yes, that sounds like something it'll work for long term and is not toxic at all for the employees.

</comment><comment><USER16> Seen a lot of comments trying justify it, so check this which is where the pic comes from: [https://www.wired.co.uk/article/revolut-trade-unions- labour-...](https://www.wired.co.uk/article/revolut-trade-unions-labour- fintech-politics-storonsky)

They were using hiring process for free unpaid work to reach those sweet KPIs... much worse.

Each applicant was expected to bring 200 new paying customers to go to the next phase. Any problem yet?

</comment><comment><USER17> Ok, won't use Revolut again.

<comment><USER18> Can you recommend an alternative?

<comment><USER19> Bunq[1] is an alternative to Revolut with a banking license in Netherlands. I personally don't trust N26 from the technical point of view[2], and Monzo is available to the UK residents only.

[1] [https://www.bunq.com/](https://www.bunq.com/)

[2] [https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money](https://media.ccc.de/v/33c3-7969-shut_up_and_take_my_money)

</comment></comment></comment><comment><USER20> I have never been very productive when trying to do knowledge work for more than 4-5 hours a day and more than about 28 hours a week. When I start working 50+ hours a week my productivity drops below what I would have gotten done in a 20 hour week, Things become harder, you get less creative, you start brute forcing your solutions. You write bad code or documents. These are things you typically learn with experience.

</comment><comment><USER21> People aren't robots they need breaks, vacations, time to decompress, time off when sick.

<comment><USER22> >People aren't robots they need breaks, vacations, time to decompress, time off when sick.

It's worth remembering that the only reason employees get these concessions is because unions and governments forced companies to do so under threat of (sometimes direct) violence, and that part of the "disruptive" philosophy of modern startup culture is an attempt to undermine and roll back these gains in labor rights under the pretense of free-market efficiency.

<comment><USER23> It is worth remembering the real reason there is a limit of 8 hours a day for work is because of a man called Henry Ford, that studied seriously productivity on his company's 300.000 workers and got to the conclusion that 8 hours a day means maximum productivity.

This man along other industrialists started to lobby for 8 hours a day and they got exactly that.

</comment></comment></comment><comment><USER24> The rational response when those receiving the message are not compensated with exactly the same, non-dilutive equity share class as founders, is explained in Urban Dictionary [1] from the Goodfellas movie [2]. Pay peanuts, get monkey effort. If KPI's were negotiated simultaneously with compensation, then perhaps there might be some more negotiating leverage equity between parties and a more honest appraisal and synchronization between goals and compensation, but standard practice is compensation is negotiated on a lagging basis compared to how often KPI's are established/modified.

The whole applicant's-must-book-sales-for-free schtick was so trashy they pulled it [3] once it came to light.

[1] [https://www.urbandictionary.com/define.php?term=fuck%20you%2...](https://www.urbandictionary.com/define.php?term=fuck%20you%20pay%20me)

[2] [https://www.youtube.com/watch?v=8L4HHPTiZN8](https://www.youtube.com/watch?v=8L4HHPTiZN8)

[3] [https://www.crowdfundinsider.com/2018/10/140531-digital- bank...](https://www.crowdfundinsider.com/2018/10/140531-digital-bank-revolut- takes-heat-for-clumsy-hiring-ploy-asking-applicants-to-source-200-new- accounts-to-be-considered/)

</comment><comment><USER25> >I noticed that several product owners / team leaders

>are significantly below targets

>and still do not work on weekends to catch up.

The CEO addresses it specifically to the middle management (POs/TLs) and not line employees.

Given that, the vocal outrage, and the calls on Twitter for the line employees to unionize are both unproductive, and also misleading. Way to discredit your position.

<comment><USER26> Those people shouldn't work on weekends either. If the only way you can make your KPI's is working middle management to death, you as a leader are making serious mistakes in management. If you can't build a working infrastructure for people and be able to sustain and grow your business on a 40 hour week (except for emergencies, unforseen things), maybe your product or company model is not that viable.

We really shouldn't encourage this type of work ethic in any way or on any step of the ladder.

<comment><USER27> This is exactly how i feel about all this too. Metrics not met? Sounds like you need to hire more people. How often I've seen management shirking and sending the management THEY should be doing to the next level down...

</comment></comment></comment><comment><USER28> Money laundering is totally OK as long as you do it on a large enough scale /s: [https://www.ft.com/content/527fe170-3b79-11e9-b72b-2c7f526ca...](https://www.ft.com/content/527fe170-3b79-11e9-b72b-2c7f526ca5d0)

<comment><USER5> ML is bad. My apologies, but I fail to see how this is connected to Revolut CEO.

Edit: Oh SNAP! :) Ok now I read it, a parallel HN discussion: [https://news.ycombinator.com/item?id=19279746](https://news.ycombinator.com/item?id=19279746)

</comment></comment><comment><USER29> Data Engineer from Revolut here. Feel free to ask me anything. To comment on the topic, my team was never ever told to work late hours or weekends.

Opinions my own.

Main thread here: [https://news.ycombinator.com/item?id=19309597](https://news.ycombinator.com/item?id=19309597)

</comment><comment><USER30> You have to wonder how agreed upon these targets really were. Perhaps milestones are being missed because they were driven top down and were never realistic to begin with? Developers with ownership are more likely to work to complete their goals. If they aren't then that's a symptom of problems, not the cause.

</comment><comment><USER31> It reminds me that I once worked for a manager who sets deadlines on Mondays instead of Fridays, so you still had the weekend to finish it.

As with any such managers, the deadlines are set by their own optimistic guesswork, not by the people actually doing the job (and knowing how to do the job).

Did I mention I workED for that manager?

</comment><comment><USER32> Another example of this executive behavior previously discussed here: [https://news.ycombinator.com/item?id=1455750](https://news.ycombinator.com/item?id=1455750)

</comment><comment><USER33> I hate the idea of working on weekends...

This guy was only talking about people significantly behind on their projects, for what it is worth.

Of course they can be behind because they are wasting time or because the project requires too many man hours.

<comment><USER34> Do you visit the gas station and shop on the weekend? Or is working on the weekend something only the poor should be forced to do.

Of course I think you mean to say "the idea of a 7 day work week is stupid"

<comment><USER35> Thanks Dr. Pedantry.

</comment></comment></comment><comment><USER36> Now the question is: what are the good alternatives to revolut?

<comment><USER37> Starling or Monzo

</comment></comment><comment><USER38> Related: Revolut and Monzo are still amazing products. After moving to the US they make it quite impossible to use revolut or monzo (it's expensive as fuck to top up). I've looked into simple/varo/chime but they look pretty bad in comparison to Monzo, they are also reserved to Us citizens only so fuck people with a greencard. I have chase/capitalone/schwabe and their app are just stuck in the past. I really wish Monzo would work here :/ anything I'm not aware of?

<comment><USER39> Use TransferWise to move USD to your GBP account? Or even more, use TW's borderless account?

You swap a bright pink/orange card for a bright lime green

<comment><USER38> Whats tw?

<comment><USER40> TransferWise.

</comment></comment></comment></comment><comment><USER41> This tweet is the exact reason I choose to live in the UK, and not the US, when it came to pursuing my career in financial services.

I do not believe that the US approach—in many sectors, but particularly in finance—of putting your career before your family life is a good use of the unknown and limited time we have on this planet.

That said, I am an entrepreneur, and the buck stops with me, so if I need to work weekends than I will juggle that obligation while still being there for my son.

Part of my reason for this approach is based on what my father once told me, that in life you'll juggle a lot of important balls, your career ball, your family ball, your health ball etc. The gist was, life is a juggling act, but his final word on it was something along the lines of, "Your family ball is made of glass, and if you drop it, it could shatter so much that you will never be able to piece it together again."

Obviously what is happening in an employee's life will have an impact on their work life. Saying things like, "if you miss your KPIs than you're fired" isn't going to motivate your staff, especially the ones who need to up their performance. Firing people who don't perform creates a situation where staff members will live under fear and that doesn't usually create great customer experiences.

And this leads to another point, if you are a good leader, you should never be in a position where you need to remind people that they need to work weekends if they are behind or they will get fired. He's the CEO, the buck stops with him. If he communicated the problem they are solving, the company's mission, and put in the right culture, hired the right people, you don't need to say such things.

IMHO a good 'Culture' would have the following values:

1\. Spartan Wall – We win the battle for our customers by protecting/taking care of each other.

2\. Obsessive Customer Empathy – We are our customers' biggest advocate.

3\. Unfiltered Brutal Truth – Feelings, rank, politics NEVER have priority over truth and what's right.

4\. Proactive Problem Solving – When we hit problems, we do not put our hands up, we find a solution.

5\. Laser Focus – We only keep to the problem and the mission.

6\. One Destination, Autonomously – While we work loosely together, we all have the same mission and we are all in it together.

I bet you all the money in the word Nikolay Storonsky—the CEO of Revolut—doesn't actually understand that a CEO's job is to create the environment to find, motivate and retain people who are focused on the problem the company is solving, believe in the company's mission, and are a fit for the company's culture. IMHO venture success is the result of building an organisation that does this.

I wish Revolut all the luck in the world but the fish rots from the head!

<comment><USER42> >This tweet is the exact reason I choose to live in the UK, and not the US

Why are you stereotyping work ethics among __western __countries? That 's clearly wrong because most of them have the same structure. Believe it or not the worst work environments exist in "poor" countries like India, or Pakistan, or even Balcan countries like Romania. White collars are suffering there that's why their only dream is moving to USA or Germany.

</comment></comment><comment><USER43> If people are behind the expected performance due to excessive workload or poor higher-level management, then this is unacceptable.

If people are behind the expected performance due to incompetence, wasted time or poor self-management, then this is reasonable.

We are all adults here.

<comment><USER44> I think this is absolutely wrong and, frankly, sickening. It is never OK for a superior to ask or even imply that employees should work overtime (barring jobs with very disproportionate impact). Incompetence on the part of an employee is not punishable by overtime work unless they want to do that on their own volition. You work with them to solve their problems. If you can't do so without requiring that they work overtime (again, unless it is of their own volition), then they are not a good fit for that job. Anything else is inhumane, disrespectful, and out of touch.

<comment><USER45> I'm as offended by the CEO's attitude as the rest, but this seems like a way over-the-top response. It is literally NEVER OK for a superior to ask an employee to work overtime?

Insisting that your employees work weekends for months on end is obviously unacceptable. Asking your employees to work occasional overtime in certain circumstances hardly seems monstrous to me.

</comment></comment></comment><comment><USER46> main thread: [https://news.ycombinator.com/item?id=19279829](https://news.ycombinator.com/item?id=19279829)

</comment><comment><USER47> In his defense, he tied kpis to bonuses.

</comment><comment><USER48> Culture starts at the top.

</comment><comment><USER49> Is it like a rule that these "rising star unicorns" have to be ran by Sociopaths?

</comment><comment><USER50> Standard working hours in China are 9-9 six days per week.

<comment><USER51> And that country is known for terrible working conditions.

Let's very deliberately _not_ do what China is doing.

<comment><USER50> They work that long to _win_. Do you want to win? Or do you want to lose? Business is fundamentally a competition.

<comment><USER52> Getting worked into the ground so some self-entitled person can "win" in "business" on the back of my labor and broken body and psyche, now that's a loss in my book.

</comment></comment></comment></comment><comment><USER53> If you have only ever worked a 9 - 5 work week this may come as a surprise, but in the real world in America, lots of highly paid people routinely work weekends and nights and 12 or even 24 hour shifts. Doctors, Police Officers, Morticians, Firefighters, etc. They use schedules to spread the work and many only get one weekend off a month of totally free time.

<comment><USER20> > Doctors, Police Officers, Morticians, Firefighters

Hold on. A firefighter is on call in the in the firehouse during their shift. The aren't (except in emergencies) working straight 24 hour shifts. I see them at the grocery store a lot during the day. How many teams of software developers are gaming, shopping and sleeping during their shifts?

most patrol officers work 5 consecutive 8-hour shifts followed by two days off, though emergency callouts are part of the job.

I don't know any morticians but I assume that is the same. Doctors are in a different category all together, and I'll bet their shifts and culture surrounding their hours are responsible for many, many deaths.

<comment><USER54> Moreover Doctor's hours are controlled by doctor's themselves. If the mass of physicians would prefer lower salaries and better hours, they could and would achieve that.

</comment></comment></comment><comment><USER50> Never ceases to amaze me how friggin lazy and entitled are the British when it comes to being told they need to work long hours. It's a high growth startup. They are vesting you with stock. Hell yes you need to come in on weekends, bruv.

<comment><USER51> Do you think I'm a walking charity?

That's what an employment contract is for.

If you want me to work on weekends, put that in the contract.

I can then negotiate an appropriate wage.

If it's not in the contract, get lost.

Alternatively propose a new contract so we can re-negotiate my compensation.

If we negotiated for 160 hours of my time / month, then that's what you're getting.

And if you can't wrap your head around that, you are not qualified to run a company and probably shouldn't be trusted with any kind of business transaction at all.

<comment><USER50> I employ 105 people in five countries. 30 in the UK. Feel free to renegotiate your contract when asked to work long hours whilst I contact my recruiter to replace you.

<comment><USER51> If my employer pulled such a palpable show of arrogance someday, you can bet I'd have quit before sundown.

I know it'll probably take you half a year to fill my position, while I'll happily be working somewhere else within the week.

Though from what I gleamed of your personality from your comments, it's likely you wouldn't have managed to get me on board in the first place.

Also did you ever consider that some of your employees/contractors may be running their own companies/business when they're not working at yours?

Do you really think they value your business above theirs?

And even if they don't, do you think they value your company above their family/friends/life?

Do you think your attitude even has a chance of inspiring different priorities? I highly doubt it.

Your company sounds like a terrible place to work.</comment></comment></comment></comment>


Ask HN: Single loyalty card? - <AUTHOR>

Been thinking about an idea for awhile and want to see what people think.
It seems that every company has their own value/club card of some sort. Be it Safeway, Subway, Best Buy or one of the other thousands out there. For the end user, this is a major pain in the ass. There is no way to carry everyone's card with you all the time. Because of this, I just stop taking new cards and it's really a loss to me but I can't fit them all in my wallet (or better yet, I don't need a 8th Subway value card).
Now to me, this is an easy problem to solve. Instead of every company having their own card, why not accept a single network card? One card to rule them all. It's not a magical idea, one central database that contains std. user information and a unique id that other networks can tap into to retrieve data. With a simple system, you could reduce the number of value cards down to one card. Making it much easier for end users as well as increase user participation.
Ok, so one other value a system like this could offer is the ability for smaller mom and pop stores to create their own value card system without having to shell out a lot of money. Using a simple application and DB, they could start offering rewards to customers that buy say the 15 plant from the local nursery and get one free.
Anyway, that's my idea. It just seems odd that with today's technology we can't do something better than fitting yet another card into our wallets. Let me know what you think. <comment><USER2> I've thought about this as well. Although I've never understood why it had to be a special card. But it would be nice to bridge physical store loyalty cards with online store loyalty cards.

You really only need some sort of global ID for the customer right? We'll why not try to make it a standard to use a QR code which stores an MD5 Hash of your email address? This way it can be printed on almost anything by anyone. The first time you visit a store and use it they ask you for your email address and confirm that code is yours and matches. Its also a way to control who gets your email. Then like you mentioned, you host an information lookup/recording service.

The specific thing about the idea that has always intrigued me is the idea of multiple companies knowing about my spending habits at each place. Make you can charge McDonalds more money for access to my BurgerKing buying habits. That would help McDonalds market things much better than just knowing why I buy at their stores.

The best part about the QRCode/Hash concept is that I can make my first one or a new one at anytime. I don't have to fill out some huge form while at the grocery store. I would also love access to my own usage history as a consumer. It could work well with services like Mint perhaps.

<comment><USER3> And then I can make one which is an MD5 hash of your email address and make it look like you buy ... well, all sorts of interesting things.

Also, an MD5 hash of an email address is sometimes reversible. Search the web for the MD5 hash of my email address using duckduckgo.com and it finds a Disqus profile for me, identified by the md5 hash, but if you click 'claim profile' it tells the full email address. And that exists accidentally because I commentented on some blogs using that email address not knowing Disqus aggregates cross-blog comments.

Also, the space of input is vastly constrained, most people will have an @popular-domain address (by definition of popular domain) so @gmail.com, yahoo, hotmail, aol will cover a lot. And the initial bit is probably not random - either names or initials and names or names with numbers will get a lot.

On forums the guess firstname.lastname@example.com is likely to be right for a few people.

In other words an MD5 hash of an email is only pretend secret, so make it clear that it's not intended to be secret and use a QR code of the email address itself, or use some unrelated ID which really keeps the email address secret.

</comment></comment><comment><USER2> I just recently heard about a mobile project called KeyRing. They seem to scan the barcodes from your cards and store them on your phone.

[http://androinica.com/2009/05/07/keyring-app-digitizes- store...](http://androinica.com/2009/05/07/keyring-app-digitizes-store-card- account-info/)

</comment><comment><USER4> I think this is the true business model for Foursquare in the end. Everything else is just the groundwork for it.

</comment><comment><USER3> A multi-company reward card exists in the UK:

<http://www.nectar.com/collect-online/retailers-a-z.points>

<comment><AUTHOR> Do you personally have a card? And if so, does it help?

<comment><USER3> I don't have one.</comment></comment></comment>