Ask HN: Corporate workforce IT Tech skills for future - <AUTHOR> Hello, I'm a middle technical manager at a largh-ish private agribusiness conglomerate.  Not a tech company, but of course we use a lot of tech.  My area is platform, i.e. Windows, Linux, middleware,  and cloud.  Out of our 3K+ servers, probably 90% are currently Windows,but that's somewhat by choice (we could probably run 50/50 with some effort over time).  My observation, based on recent hiring experience, is that the highly technical and stoic Windows workforce may giving way to a highly energetic and creative Linux workforce.  My question: would it be wise to force that ratio closer to 50/50 in order to better position for the future workforce?  Disclosure: we have a few top-talent Linux admins that could take on a <i>lot</i> more servers.  Thanks for your answers. <comment><USER2> I've seen corporate IT environments with memory and CPU utilization highly under utilized. People tend to order a lot more compute power than they need because of the bureaucracy involved with getting it from another department and getting it setup. Where I was before it took at least 6 weeks to get a VM, months if you had any decent sized disk requirements.

Do a proof of concept with your top talent Linux admins to see if there are apps they can reasonably fit into containers running Linux. You may find that the server footprint to actually run things is much smaller. Start with something easy they would recommend to put on Linux w/o development time.

There are probably cyclical applications in the environment that go under heavy load at certain times but then are mostly idle other times of the year (e.g. financial apps at quarter/year end). Prime candidates for this type of thing. If you can get some container orchestration framework running, it will make scaling apps up/down easier.

Through a POC you may find a business case that will save the company some money, or you may find it is a wash. Right now you're at a point where you don't know if there is an opportunity there. Worst case is your top talent Linux admins get to have a fun project to work on.

</comment><comment><USER3> Why change a working systems just to keep up with the cool kids? Windows isn't going anywhere. What's the business case?

From a development standpoint, you could host any new development on Linux but the "energetic and creative Linux workforce" who prefer developing on Linux are using languages and frameworks that work on almost any operating system.

I've been developing on Windows for 20 years and until recently I saw no reason to stop. What changed my perspective is cloud hosting. Every project that I either develop myself or that I'm responsible for have resources attached to it and the cost of choosing Windows over Linux is easy to discern just by running a report. The Windows Tax has now become part of OpEx for the development department instead of capex that's someone else expenses.

I still think Windows is easier to manage (and cheaper to find sys admins for) but almost everything I would have used a Windows Server for is a managed service now.</comment>


Ask HN: Brainstorming Canvas - <AUTHOR> HI Fellow HN readers While working on new products (or just brainstorming) I end up with a lot of scattered information in different file formats and places. I am sure there must be a better way to do it. Tried some tools but couldn't find something suitable, OneNote seems to be the right fit but can't do mindMaps
Is there a tool that can do following bit on one canvas.
Text, Excel, Embed Images, Simple MindMaping, Collaboration
Also, if you can share the process and tools that you guys use brainstorming/Information dumping that'll be great.
(I am on Mac) <comment><USER2> I love OneNote on Windows. I think Microsoft turned everybody off from it by stuffing OneNote buttons all over the place, making it the default printer, etc. But it is really good.

I think piling too many features onto an app like that may make it too cumbersome to use.</comment>


Show HN: Requesting feedback on my side-project chatteranalytics.com - <AUTHOR> http://chatteranalytics.com

<comment><AUTHOR> I built this out of a desire for a simple tool to give insights on user interaction/usability without the need to define and track a ton of custom events for basic web interactions.

I started with a basic real-time stream of common events, used it in a few projects, and gained some valuable information from it.

If there's enough interest for this type of tool, I'll build it out and launch it.

The long term vision is to visualize individual user sessions.

Thanks!

<comment><USER2> Can you share what technologies you're using?

<comment><AUTHOR> Sure, Node.js and Redis to track and store events. The front-end is a small rails app which will manage user accounts, etc.

<comment><USER3> How much back in time do you store data? 30 days?

<comment><AUTHOR> Right now, just the live stream. No historic data.

I want to add historic data in the future.

</comment></comment></comment></comment></comment><comment><USER4> That's a brilliant landing page; demonstrating the tool in-page is all the description anyone needs :)

<comment><USER5> I would recommend detecting if javascipt is enabled on the landing page and putting up an "enable javascript to see how it works on this page" message.

I had javascript off when I got there and didn't realize I was missing something until I read the parent comment.

Also - the service looks useful to someone like me who isn't much of a web designer but has a vanity site and a blog. I should say I am allergic to javascript bloat that slows down load times, so you'd need to keep speed your top priority for me to use it. I used to have adwords on one of my pages but took it off b/c it was the slowest thing on the page.

<comment><AUTHOR> Re javascript: thanks, will do!

Re page load time: I'm using asynchronous loading of the scripts. This allows the page to load fully, and the JavaScript is loaded in the background.

It's not completely cross browser, but speeds things up for people with modern browsers. There may be a similar approach for adwords, but I wouldn't know for sure.

</comment></comment></comment><comment><USER6> Please consider changing the background and font combination. The "DISCOVER HOW PEOPLE INTERACT WITH YOUR WEBSITE" is very difficult to read and the light gray on darker gray text on the left is almost just as bad.

I'm using the latest version of Chrome on Windows 7 if that helps.

</comment><comment><USER7> I appreciate the simplicity of "just paste a small javascript snippet", but for more secure sites I'd like to have some documentation on how to integrate this without sourcing third-party javascript from a page.

</comment><comment><USER8> This is something that I've wanted for awhile. Even better would be recording session data your collecting and then giving a means to play it back so you can actually "see" the what the user does. Maybe using Selenium or something for the playback. This later feature would be killer for business users who would likely find the current event stream a bit intimidating.

I think your right though. Being able to watch 20ish user sessions for particular flows would really help you understand how to tweak things to improve conversion rates.

<comment><AUTHOR> Thanks! That's exactly where I want to take it! It'll be hard to do right, but definitely the vision.

<comment><USER9> I've had this idea for a few months and really wanted to build it. Imagine being able to record every user interaction, seeing their mouse move and following them through pages.

The difficulty lies in replaying activity for web apps with logins, sessions etc.

Anyway, great job implementing this, I think it's a great idea and you should carry it forward!

<comment><AUTHOR> Thanks! You nailed the difficulty right on the head.

</comment></comment></comment></comment><comment><USER10> Looks pretty cool... I like the idea of the one-to-one analytics tool, since other tools don't seem to do this (that I know of, at least).

However, one quick design point is the "Discover how people interact with your website" header is extremely hard to read since it's basically black on gray. Not sure if this is just my monitor's brightness levels or browser (Firefox 4.0.1), but I would recommend changing that up to be easier to read.

Other than that, I'm looking forward to checking it out more!

<comment><AUTHOR> Will do, thanks!

</comment></comment><comment><USER11> This is really awesome. I just hacked together something similar for my website _yesterday_ to show me guests / users activity on the site. Can't wait till you guys open it up, especially if there's an API to stream it on our own dashboards.

One note: after I filled out my info and clicked submit it kept the "what are you looking for" field on the page.

Another note: I included the referrer which I think is going to be pretty useful to know.

<comment><AUTHOR> Heh, I noticed that problem from watching the stream.

I thought it may be nice to keep it there, so people can fill it in if they left it blank, or maybe edit it.

Turns out, people don't expect it to be there, and I saw several people hitting "Send" multiple times to (I assume) get rid of that box. :)

<comment><USER11> Yeah it feels counter-intuitive.

Really like what you're doing, can't wait to replace my dodgy little hack job!

</comment></comment></comment><comment><USER12> Why do I have to enable websockets on Firefox 4? Perhaps using a websocket library that is compatible with older browsers might be a good idea.

<comment><AUTHOR> Mainly just because I wanted to keep it simple for this test, and I assumed there would be enough people who would either enable, or use chrome/safari to get some good feedback.

I'll use the data I get from this test and decide whether I should support older browsers or not.

</comment></comment><comment><USER13> Nice idea and implementation. However my first thought after reading the title here and the domain name was that it was an analysis tool for Salesforce Chatter (<http://www.salesforce.com/chatter/whatischatter/>). You may want to check if there are any trademark implications.

<comment><AUTHOR> Thanks, I'll check into it.

</comment></comment><comment><USER14> Heh, you're fetching some number of events from database and then grouping them. I've clicked a number of times on page, and on reload saw just this single event (x30 or something) instead of list of events.

<comment><AUTHOR> Good catch :)

Yes, for now it's very basic. It'll be better fleshed out when I launch it (grouping on the backend instead of the front end, for instance)

</comment></comment><comment><USER15> I think GoSquared (<http://gosquared.com>) have something of this flavour of interaction as well.

</comment><comment><USER16> Very useful tool. Especially with a large data set you can analyze where people are clicking and the most common paths through a design.

</comment><comment><USER17> Wow, love the design and idea! I might have to use this in my next app!

</comment><comment><USER18> not working with latest Chrome on mac

<comment><USER19> Works fine for me. Ps. this is AWESOME!

</comment></comment><comment><USER20> i am n00b in webdev, but i have a feeling this is pretty useful tool.</comment>


Show HN: SiteZen – Complete Web Design, Hosting and Domain Name for $50 a Month - <AUTHOR> https://sitezen.co <comment><USER2> Tip: Before you start selling web design, make sure your own website is designed well.

In particular the white text on grey background in the form here is unreadable: [https://sitezen.co/designer.html](https://sitezen.co/designer.html)

<comment><USER3> I don't see any white text, but I do see badly semi-centered checkbox inputs: [http://imgur.com/EQBIzts](http://imgur.com/EQBIzts)

</comment></comment><comment><USER4> Looks interesting. A few questions:

\- How do you handle the design process in terms of reviews/changes? Do you just present a design and if the customer doesn't like it then they're out of luck? Or will you make a million changes that drag on forever? (I presume somewhere in the middle... but this is not explained).

\- Do the built sites utilize a CMS of some kind (so customers can edit content after it's been built)? Or do content changes need to go through you (as part of the monthly fee I presume)?

\- On a more technical note: do you have an in-house platform you build on? Or is it all wordpress (or some other open source CMS)? Or are you re-selling a SaaS CMS like Weebly or Squarespace?

\- How extensive can changes be after the site is built? Can I add new pages? What if I want to add a whole new blog section if I didn't have one before? What if I want to start selling products? etc.

</comment><comment><USER5> Can't find an example site to look at.

</comment><comment><USER6> That's massively expensive.

<comment><USER7> I'm guessing this includes the initial design, which would make it ridiculously cheap.

If you're planning on keeping the average customer for 2 years and pay $10 for the hosting itself, that leaves just $960 for the initial design and setup (not to mention 'ongoing updates').

<comment><USER8> Designers get paid by getting a cut of the monthly fee. Sounds like the designer is absorbing the risk of an early cancellation.</comment></comment></comment>


Higher Education: The Next Big, Bad Bubble - <AUTHOR> http://www.byrnehobart.com/blog/higher-education-the-next-big-bad-bubble/

<comment><USER3> Tuition is rising because loans are heavily-subsidized by the government, and universities (especially for-profit universities) are taking advantage.

It's a simple business model - spend a ton on ROI-positive marketing (especially online CPA marketing), get people who can't really afford it to take out huge student loans which they only qualify for thanks to Title IV, get the vast majority of your revenue directly from the government. Saddled with massive debt and useless degrees, the students increasingly default, but that's not the universities' problem - the risk lies solely with the students and the government.

If you want to short education, you could short companies like Apollo Group and ITT Educational Services, as well as the online marketing companies that service them, like Quinstreet. But this is risky, because the bubble's only going to burst when the government gets around to changing policies.

<comment><USER4> > But this is risky, because the bubble's only going to burst when the > government gets around to changing policies.

Out of curiosity, how would the govt change their policy to improve the situation? Should they just stop subsidizing the loans? Or should they let students declare bankruptcy if their promised dream job doesn't matterialize when they graduate?

I think regulating the deceptive marketing should also be considered. There is a huge discrepancy between the advertised ROI and actual ROI. People should be made aware of the actual ROI of a college degree. Then a lot less will be willing to spend $100K to get a piece of paper after 4 year that turns out not to help them much after all.

<comment><USER5> _Out of curiosity, how would the govt change their policy to improve the situation?_

Not subsidizing the loans would be a good idea. Another proposal would be enforcing some transparency/separability.

For example, the govt could demand that colleges break down there costs more granularly than they do - $X for instruction, $Y for the gym, $Z for student activities, etc. They could also demand that all such fees (besides instruction) are optional to the student, and that subsidies only apply to instruction. Colleges waste a LOT of money on irrelevancies, and such a mechanism could reduce some of the waste.

<comment><USER6> _For example, the govt could demand that colleges break down there costs more granularly than they do_

The government already does do this, in mandatory reports to the federal IPEDS database. And a private foundation has published the information on a user- friendly website, so that even if colleges don't report to the public directly how they spend their money, discerning members of the public can find this out by looking it up.

Compare

[http://www.collegeresults.org/search1b.aspx?institutionid=18...](http://www.collegeresults.org/search1b.aspx?institutionid=182290)

to

[http://www.collegeresults.org/search1b.aspx?institutionid=16...](http://www.collegeresults.org/search1b.aspx?institutionid=166027)

for example.

<comment><USER5> Nice database, but not remotely as granular as what I'm proposing. I want colleges to break down all the excludible services and students can pick and choose among them. I.e., a menu of some sort:

        Class/credits $x
        Computer lab access $?
        Yacht Club   $?
        Student Theatre  $?
        Intramural sports   $?
        Latino Center    $?
        Annual Rock Concert $? (Not made up)
        Career services   $?

The govt should subsidize only class/credits, and any colleges accepting subsidies must allow students to pick and choose among the rest. I.e., if you don't want to use computer labs or the gym, you don't have to pay for them. A lot of the cost of college is caused by colleges wasting money on unnecessary frills, and the system I propose would create a downward pressure on the cost of frills.

(Another major component of cost is waste/fraud/abuse/administration, but I don't see an easy way to eliminate that.)

<comment><USER7> I once worked at a software company where a big deal has been made for software + hardware. It was a lot of hardware, and the software was maybe 10% of the overall cost, which was approaching $1million.

Then the company backed out and said they just wanted the software.

All of a sudden, our software became 90% of the overall cost, and hardware was 10%.

All your idea would accomplish is making the credits super expensive and the extras super cheap.

<comment><USER5> I realize that, I probably should have mentioned that the govt would randomly audit college expenses, and their books would have to be made public. If they get caught playing stupid games, no more subsidies.

(We could also create incentives for student whistleblowers too; if the college is caught cheating, they must refund all the students they overcharged.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > 1\. The price of college is continuing to rise faster than the rate of > inflation.

Then maybe inflation isn't taking everything into account? My health insurance cost is rising faster than inflation too. So is health care cost and nearly every service that requires labor and cannot be imported/outsourced. Doesn't that tell you that the true rate of inflation could be much higher than the publicized rate? Rate of inflation includes lots of goods that can be cheaply imported. But you cannot import enough cheap labor with PhD degrees. And these are not included in calculating the rate of inflation.

<comment><USER9> The regulatory framework and special interest groups are probably causing a negative feedback loop.

That, and the AMA don't like to add more doctors.

Also, if we could get rid of the general education requirement, and focus on what Doctors actually need, as opposed to the idea of a liberal education, we could lower the cost of eduction by 2 years equivalence?

This would also lower the cost for other majors too.

<comment><USER10> I don't Doctors without a liberal education. Most of them are narrow-thinking enough as it is.

<comment><USER9> _I don't Doctors without a liberal education. Most of them are narrow-thinking enough as it is._

Would a liberal education really change a Doctor's mind? Seriously?

Most of them are just hodgepodge of fact for doctors to remember and then forget when they get their degrees.

</comment></comment></comment></comment><comment><USER11> This argument is increasingly common, but it misses the actual truth. Sure the difference in salary shrinking will increase the amount of time it takes to pay off the degree, but that is not the whole story.

1) Unemployment rates are inversly propertional to education level. The worst hit by the recession were those without college degrees. Who is going to bet that trend reverses in the near future? If anything the college grads are just going to suck up high school grad jobs they are overqualified for.

2) Type of job/ceiling. A lot of times you can get the same job with or without a college degree (see: Sales Representative), but the college degree usually means a better compensation structure and pathways up in the organization, even if the salary is not a huge difference for the first 10 years eventually the HS degree will reach a ceiling. I've even seen this in accounting between those that are CPAs and those that just have accounting degrees, or at upper level executives who have MBAs vs those that don't.

3) The cost numbers in these articles are invariably screwed up. $200,000 for a college degree? If you are actually price sensative go to a county college for 2 years and then a state school for 2 years. Total cost would be <$60,000 for the whole thing. In most states you would even have your choice of multiple schools.

My theory was that you should go cheap on the undergrad, if the name of the school matters so much, just go there for graduate school. I'd hire a guy with a grad degree and a state school over a really top shelf undergrad

(hence, state school for me and I just got hired at my job along with a bunch of guys who paid 4x or more for private engineering schools)

<comment><USER12> _My theory was that you should go cheap on the undergrad, if the name of the school matters so much, just go there for graduate school. I'd hire a guy with a grad degree and a state school over a really top shelf undergrad &_

In technical fields, I agree with you. Having a degree often matters to get in the door and avoid hitting ceilings, as you pointed out. But skill in your actual job and (for better or worse) skill in networking and relationships will win out over pedigree in the long run without problem.

It seemst that the situation is different in liberal arts fields though. My wife is a history major and because of her I have many acquantances in the liberal arts. They are all very worried about pedigree, and it sounds like employers looking for that type of employee is also very worried about pedigree. I suspect this is because it is harder (not impossible but harder) to measure productivity and skill in liberal arts than it is in engineering and related technical fields.

</comment></comment><comment><USER13> Better returns might come from ensuring that everyone gets a good kindergarten education.

<comment><USER14> Technically, better money spent is testing children for developmental disabilities in the pre-kindergarten years (0-5) and spending the money to "fix" at that time is a better first step. A problem found in kindergarten might end up costing the government in excess of a million dollars can sometimes be fixed for less than $100,000 if known about earlier. For example, hearing problems can be worked around earlier in life to allow proper development.

</comment></comment><comment><USER15> I hate to sound callous, but this is just an effect of more people going to college today than in decades before. Yes, obviously I want everyone to succeed in life and have a college degree and do well, but obviously this can't be the case. In decades past income disparity (since we're speaking in terms of ROI) existed partly because of the availability and accessibility of the college degree.

Back when degrees were scarce, they were rewarded. Now that everyone and their dog is getting one, it doesn't mean very much. Friends of mine are graduating college and going straight back home to live with their parents. And this is happening in droves. The degree is no longer a differentiating element of their resume.

Don't get me wrong, I'm glad that on a whole, are becoming more educated (let's ignore the fact that this statement has no evidence behind it, and is purely an assumption). That is a good thing. But inflation rarely goes unpunished.

Disclosure: I'm a college dropout, and happily so.

</comment><comment><USER16> Personally I think looking at higher ed is looking at the wrong side of the equation. We're not in an education bubble, but a "bunge"[1] if you will - <USER2> opposite of a bubble - with regard to labor prices.

In other words, people aren't overpaying for education, businesses are underpaying for human talent.

[1] [http://www.johnkay.com/2008/07/02/metaphors-in-free-fall- the...](http://www.johnkay.com/2008/07/02/metaphors-in-free-fall-the-anti- bubble-named/)

<comment><USER5> Why do you believe talent is underpaid?

<comment><USER16> The top 10% of Americans hold an ever-increasing share of American GDP. So I suppose to be a little finer-grained, upper echelons of society overpay themselves and underpay the majority of the labor market, even as they benefit from the fruits of a highly educated labor market.

<comment><USER5> How does the top 10% receiving an increasing share of GDP imply that the bottom 90% are underpaid? If the top 10% are also _creating_ an increasing share of GDP, then that would imply that everyone is being properly valued.

<comment><USER16> That's a tautology though. You're using the method of apportioning contribution to GDP (wages) to prove that GDP is being properly apportioned.

There's evidence of your position, but it's hardly obvious. Personally I believe it to be incorrect.

<comment><USER5> I'm not asserting that wages are being properly apportioned - I'm just pointing out that the fact that the top x% get a greater portion of GDP is not evidence that talent is underpaid. It could easily be the case that the top 10% is the most talented, and the talent gap/rewards for talent have increased.

Income inequality is simply not evidence either for (or against) the claim that talent is underpaid, at least not without information on the distribution of talent.

</comment></comment></comment></comment></comment></comment><comment><USER12> This article make some very interesting points, but I think it speaks a little too broadly at points. It does not sound like there is an overall education bubble, but rather a bubble in liberal arts education and particularly liberal arts education from lower tiered schools.

Even the article points out that engineering majors, especially those from highly ranked schools are doing quite well and that does not appear to be changing. Even on his point in signalling, it may be that having "a degree" will come to mean less and less, but it is unlikely that having "a degree from Harvard (or other prestigious school)" will mean less anytime soon.

</comment><comment><USER17> "But what we can change are the policies that subsidize college. Student loans should be drastically curtailed, especially for the "at-risk" groups (which are also the fastest-growing). Loans to students at for-profit schools have an appalling 40% default rate. While I can't find data for degrees, I suspect that hard science graduates default more rarely than social science graduates (except for education, where the compensation is nothing if not reliable)."

Are you really suggesting that we take away this opportunity from the dis- advantaged?

I may not be willing to give 99% of bumbs money, even for food, but i am completely willing to give money to the government no-matter the cost to make sure that everyone has a chance to seek knowledge. I am almost of the opinion that there is no greater thing a country can do, than to provide a proper education to everyone within it's boarders. ( regardless of race, creed, gender, nationality, or citizenship ) let the world come here to learn, let the world compete to come here to get an education.

yes, we need to make hard decisions in the coming years, but limiting access to knowledge is not one of them.

</comment><comment><USER18> What's the purpose of an education?

I ask this because it's central to the topic. Is it to get a job or is it just to learn? If it's the former, then we can have an ROI conversation, but if it's the later then ROI doesn't really apply.

FWIW, I worked in higher education for over 10 years, and I can assure you that universities don't think it's their mission to train students for the workplace.

<comment><AUTHOR> To the extent that a degree doesn't have some kind of return, it's irresponsible to lend people money as if it works as collateral. Imagine someone with an income of $25,000, borrowing $150,000 _to buy art_.

</comment></comment><comment><USER19> Universities certainly seem to employ a lot more people outside of the businesses of education and research than they used to. Correct me if I'm wrong, but I don't think college used to have "diversity programs coordinators," "counseling and psychological services," and a paid intramural sports infrastructure, to say nothing of steadily larger dorm rooms and increasingly common private bathrooms. My parents teach at a small liberal arts school, and they say that landscaping has skyrocketed out of nowhere into a pretty expensive part of their budget. They also say that they are under constant pressure to hire more "diversity professionals" from regulatory bodies.

A university is a meal ticket for a lot of people, not necessarily just professors, and once some people find a meal ticket, especially one as intertwined with the public sector as higher education, good luck getting them out.

</comment><comment><USER20> Everytime someone talks about college being a bubble, people get offended because they think the thesis says their degree is not as valuable.

That is not the point-- you've got 3 different angles: the opportunity cost vs future income, the actual market price of college debt (think mortgages), and uni tuition vs. overall demand.

I know this because I talked about this last year and caught a lot of flak for the argument. My thesis can be seen here: <http://bit.ly/bUCfec>

<comment><AUTHOR> Excellent post.

</comment></comment><comment><USER21> Fewer and fewer people have been going to school for the money for a while now. My sister has a degree in fine art. I don't think anyone rationally expected that to raise her earning power.

<comment><USER22> That's fine, but the problem appears when people borrow money to finance such a hobby, not realizing (or not caring) that they'll never be able to repay.

</comment></comment><comment><USER23> So long as sciences and social sciences are lumped together as 'a college degree', the advantage and profit associated with a science degree will prop up the expectations of a social sciences degree.

It really does make sense for an experimental physicist to go to college. No matter how bubble-y it may be right now, there aren't many with just a high school degree.

<comment><USER21> ah, but i would argue that if you are trying to maximize your income, becoming an experimental physicist is a horrible idea. You need a whole lot of education, and if you drop out before your PhD, it's all pretty much wasted. I've got a guy who does work for me sometimes who has both a math and a physics undergrad... neither of those degrees gets you a job. My understanding is that even if you do make it to a PhD you are looking at making about as much as a computer programmer or sysadmin with an undergrad or no education.

<comment><USER5> Not in my experience. In general, employers seem to view my math degree as more or less equivalent to a CS degree. I know for a fact that "PhD dropout" is good enough to get you in the door for quant jobs at many banks/hedge funds. Tech startups don't seem to mind either if you demonstrate that you actually like to code and aren't ivory tower (i.e., use grep rather than build your own regex parser).

<comment><USER24> Not my experience either considering I have a Math degree and had no issue finding a job as a software developer. In fact, I've noticed that the Math degree makes managers think of you as smarter. There is a perception of Math degrees as being harder than most other degrees. (I personally think EE is the hardest one out there.)

</comment></comment></comment></comment><comment><USER25> I thought that this was going to be about a slightly different topic.

"Though students at for-profit schools accounted for less than 10 percent of U.S. higher education students overall, they soaked up almost 25 percent of federal student aid in 2008-2009 and contributed 44 percent of the federal loan defaults, according to both Eisman and an independent report by Senator Tom Harkin, Chairman of the Health, Education, Labor and Pensions Committee."

"The Apollo Group, for instance, parent company of the familiar University of Phoenix and the largest for-profit education company, received $1.1 billion in federal loans and grants in 2009, Eisman said in his written testimony to the committee. However, of that total, only 99 million -- or, about 10 cents on the dollar -- went towards instructional costs. The rest, Eisman claimed, was spent on marketing and executive salaries."

[http://www.3quarksdaily.com/3quarksdaily/2010/07/is- forprofi...](http://www.3quarksdaily.com/3quarksdaily/2010/07/is-forprofit- education-the-next-subprime-mortgage-crisis.html)

</comment><comment><USER26> I think government subsidized four year research universities will be overtaken in the US by the community college system which will start to offer four year degrees. We can't afford to pay for professors that might teach one or two classes per semester.

In non top tier private colleges more and more non alumni revenue generating study areas will close. It won't make sense to anyone to spend $200k to get an undergraduate degree in education where you can expect to make $40k per year. Very top tier private colleges won't be hit as hard as their student bodies trust funds will absorb the cost.

</comment><comment><USER24> Maybe they could make the schools partly responsible for false advertising and high costs. Also, there is a serious lack of oversight of universities. Accreditation is a joke now days. There is such a divergence of curriculum amongst reputable schools and it gets worse for the new profit schools.

I'm glad I only had to pay 5K a year compared to others dealing with 10-20K tuition cost for school no even close to the top tier universities in the US. Harvard charging 20K is ok considering the rep you get just having a degree from there. But random private school X? not so much.

</comment><comment><USER27> From the end of the article: "I haven't found a way to short higher education as a whole. If you can think of one, let me know." Any ideas?

<comment><USER28> Actually there's a pretty simple way. Start a guaranteed tuition plan. Parents can pay you today's tuition cost for their child to go to college in 5-18 years. If higher education drops then you make money. If they continue to go up, then you lose money.

You probably need to set aside a pretty sizable chunk though in the very possible scenario that college costs continue to rise.

<comment><AUTHOR> Wouldn't you want to take the opposite trade? To guarantee someone else's tuition at a flat rate (or a flat rate plus interest) and then pay for their classes at the market rate once they get to school?

<comment><USER29> That's what he said. The parents would pay you a flat rate (today's tuition) and you would pay their kid's tuition 10-15 years from now. Assuming the bubble burst before then, you would make the difference in price between today's tuition and the tuition of the future.

<comment><AUTHOR> Yes, you're right; I misread it. Thanks!

</comment></comment></comment></comment></comment><comment><USER30> Is there a business opportunity providing a new signaling credential/certification that hasn't been as diluted as "a college degree"?

(An organization providing such a service would face a lot of temptations to get in on the traditional higher ed gravy train, while it lasts, but its ultimate success through the crash would depend on it staking out a different identity. It would probably also need a strong culture of elitism -- drawing a lot of detractors, and possibly lawsuits once its certifications get used in employment decisions.)

<comment><AUTHOR> There are professional accreditations that work something like that. e.g. the CPA, CFA, bar exam, etc. Those tests usually require you to get some kind of education before you take them, but the actual qualification is granted based on test scores.

</comment></comment><comment><USER31> We need difficult college courses which yield degrees. Its quite simple, really. If the course is hard and fruitful, very few unmotivated people will get through it. And a motivated person is sure to succeed (at least much much much more likely). This way having a degree REALLY will mean something. If 10/1000 graduate from this program, you graduating means that you really did accomplish something great. Also we need a way to snapshot your success. In other words if the school dies, it should not diminish what you did in school. There should be a way other than the name of the school to indicate that you passed through the blazes of academic hell and came out triumphant.

<comment><USER29> I agree, with the caveat that it shouldn't be done on a curve. College should be much harder than it is, but it should be theoretically possible for everyone in a class (of super-geniuses) to graduate.

</comment></comment><comment><USER32> Bubbles are not visible when you are in them. So I guess it is a good bet that when many are saying something is bubbling, it probably isn't.

<comment><AUTHOR> They are, almost by definition, invisible to the _participants_. But you can call a bubble during the bubble, as many people did during the tech bubble or the real estate bubble. It stays a bubble as long as they (or at least their financial bets) are in the minority.

<comment><USER32> I do not think anyone predicted the 2007 crash besides whoever is in the business of predicting crashes. The Prime Minister of the United Kingdom then declared that he had eradicated the cycle of boom and bust. We all felt that it could only get better. Now if some guy is so smart, then perhaps there is something very wrong with our system of selecting the top banker, which is the governor of the Bank of England in this country.

I would like however to suggest that higher education is very different from estate or technology. Higher education is slightly more like electricity or clean water. It is a necessity. The universities may charge however much they like, as may companies which provide electricity, because people simply have to bear it.

Someone who is interested in exploring the world, even if that may be through such a low field as you suggest of sociology or psychology or indeed philosophy, will still be willing to take the grants that states provide in order to fulfil such desire. They think and so they may be right that they will indeed die and the aim as long as they live is to explore the reality of the life that they do choose to live. What is the nature of people, how could we be governed better....

What I am suggesting is simply that there is no bubble in education nor can there be. Whatever the number of people that are educated so the better it is.

Education you see is very different to an eighteen year old than to someone who has gone through life so well perhaps and has the freedom to provide us his wisdom through the internet. That eighteen year old perhaps your have forgotten does not actually quite know yet who he is or the nature of reality. Higher education provides him a good grasp of that.

What I would be much more worried of is the hierarchy in education, the only place where it is feasible and desirable for a communist system to be implemented in as far as providing all with the same standard of teaching and holding them all to the same standard.

As for bubbles, there are no bubbles here. Nor will there ever be. Bubbles happen in the for profit sector. Not in the most basic service besides food and water that humans require.

<comment><AUTHOR> No, there were lots of people who don't explicitly predict crashes, who still called this one. Michael Lewis' _The Big Short_ is a fun overview. _The Greatest Trade Ever_ is also good; the protagonist of that one is a merger arb, not a doom-sayer. And of course, countless people sold when they found prices too high.

It seems very obvious to me that the establishment has to buy into it for a bubble to exist. Prices peak when optimism peaks, so you'll necessarily be able to point to people in authority who were too optimistic. The only alternative to that is a) for prices to undershoot rhetoric (arbitrage opportunity!) or b) for prices to never go down (result: buying is a safe bet, causing a bubble, leading to a crash).

 _What I am suggesting is simply that there is no bubble in education nor can there be. Whatever the number of people that are educated so the better it is._

This is what we call a "Bubble mentality". No P/E too high; it's the Internet! No collateral too poor; it's the ownership society! You clearly don't believe that; you would not be happy if, e.g., we were starving because every farmer decided to finish his Masters in English lit. There is a _right_ amount of education, and it is not _an arbitrarily large amount_. What I'm pointing out is that by every measurable quantity, we're paying more and more for something of less and less value.

 _Education you see is very different to an eighteen year old than to someone who has gone through life so well perhaps and has the freedom to provide us his wisdom through the internet. That eighteen year old perhaps your have forgotten does not actually quite know yet who he is or the nature of reality. Higher education provides him a good grasp of that._

Not sure what you're trying to say. I'm 23.

Education is beneficial. That doesn't mean it's worth trading anything of value for any extra amount of it. It is precisely this kind of thinking that leads to other bubbles.</comment></comment></comment></comment>


If you develop web apps, don't do this. - <AUTHOR> http://sneak.datavibe.net/20110614/please-dont-do-this/ <comment><USER2> The real point is: don't do two-level ACL on websites.

At my previous company we had these "auto-login" links in emails and they are extremely powerful.

But maybe once every six months people would call or write in and say "I forwarded a job posting from one of your email alerts to a friend and they had full access to my account!" and we'd have to revisit the issue again, but the conclusion was always the same - we were getting absolutely ridiculous user engagement from emails because of this feature and this was too valuable to give up.

Before I left the solution I had started to push was to introduce a new intermediate user level - "logged in but not trusted" - to the standard logged out/logged in two-level ACL. The basic implementation would have looked like this:

1) A logged in but not trusted cookie is set on both manual login or auto- login from marketing materials. It allows us to assume that this is user X and they are taking action Y on website Z. It also allows the user to receive the user logged in view where that UX has been tweeked to minimise effort for logged in users.

2) A logged in and trusted cookie is only set on an explicit manual login, and is required to perform _any_ write operation as well as to read certain sensitive information.

Where the practical implementation gets difficult is you really need to refine when to require the trusted cookie - at what point in your UX - to keep the engagement high. It will almost definitely go down, you just want to minimise that.

For an example, say you're a service like LinkedIn. You send emails to your users whenever they get a private message and you want to make it easy as possible for that user to reply because recruiters getting candidate engagement happens to be one of your key metrics. User clicks on the message in their email and instantly gets a login page, they might have been 50/50 about engaging with this recruiter so now that you presented an obstacle they just close the tab and get back to what they were doing. Alternatively, you show them the message from the recruiter and allow them to type up a reply and only ask for a password confirmation when they hit send, and it's possible your engagement will go up.

It requires more thought and is surprisingly tricky to implement once you get past the really easy "read-only" versus "write" type security checks, but it seems to be the way things are going.

<comment><USER3> amazon does that. you can browse the site and it identifies you and your preferences, but when you go to check out or modify account settings, you have to enter your password.

<comment><USER4> ... and it feels really natural. Amazon identifies me easily, but if I do anything that _feels_ like I need my password, it asks for it. Apple's App Store has similar logic, although it bothers me in one place where they ask for your password when downloading free apps.

And then there's Windows Live. Click on anything remotely related to Passport? You need a password (followed by 17 redirects, which is hilarious when managers have sound turned on and you here the "click click click click click" as IE bounces around).

<comment><USER5> _followed by 17 redirects, which is hilarious when managers have sound turned on and you here the "click click click click click" as IE bounces around_

I wonder if someone added a few extra redirects just for that reason. Seems like a quick and easy way to remotely identify coworkers that don't customize or disable their sound scheme _and_ use IE.

</comment></comment></comment></comment><comment><USER6> The reason so many sites prompt for password is for security. Yes, they will also send you an email with a link to reset the password to the same address. However, the difference there is that you will know if someone has changed your Foursquare password and the token used to allow for a password change can be expired immediately after the change takes place rather than offering continued access.

With the OKCupid system, someone that has access to my email (even for a short time) might get continued access to my OKCupid account. I won't know that they have access. With Foursquare, someone who has access to my email can get access to my Foursquare by using the forgot password system. However, when they reset my password, I won't know the new password and there's a decent likelihood that I will realize that someone has broken into my account.

With the forgot password system, it's easy to expire that token as soon as the password is changed. With the instant login system, you can't expire the token after its first use since the email will still be in the user's inbox where they expect it to work. In one case, there will be a URL in my history with the token and if someone is smart, they can just try typing in okcupid.com/l in my browser and wait for the autocomplete with an auto-login token from my history. With the forgot password system, it will be in my history, but it will have expired when I changed my password. So, even if I've signed out of my email and okcupid before letting a friend borrow my computer, there will still be an auto-login token in my browser history that can be exploited.

I'm not saying that there aren't low-security services where this convenience is good. It's more that the author hasn't taken into account that there is greater security in the forgot password system.

<comment><USER7> Not to also forget that if you have automagic login links in the email, you can no longer forward that email to anyone without compromising your account.

Try educating end-users on that one!

<comment><USER8> Simple solution: put a persistent cookie on the computer of everyone who's ever logged in. Automatically log the user in if this cookie is present _and_ the URL is correct. Obviously, the cookie should be unforgeable - e.g. HMAC- SHA1(service_secret_key, username).

<comment><USER9> The only situation you're targeting, then, is when a user intentionally logged out (in non-privacy mode) in the past (because otherwise they wouldn't have the half-cookie). Is it really desirable to log in them automatically in such cases? But then if they're clicking on the link in the first place, one might conclude that they desire is to log-in, so it's just added convenience.

However is it legal under the new EU cookie-act? I mean, after all, this _is_ tracking outside of our website.

<comment><USER8> Lots of people "log out" by letting their session expire; this would merely get them back in the game faster.

I'd expect this to be legal - set the cookie on login.mydomain.com and never use that domain name for anything else - but IANAL.

<comment><USER9> > Lots of people "log out" by letting their session expire; this would merely > get them back in the game faster.

I'd expect, that someone that is going to employ auto-login URLs, is not going to be shy in using 'forever' login cookies anyway.

</comment></comment></comment></comment></comment></comment><comment><USER10> If you create a blog, don't use fixed headers and footers that take up half a netbook's screen.

<comment><AUTHOR> Sorry, I design for 2560x1600. I don't want poor people reading my site.

(That's a joke. I didn't even make the theme.)

<comment><USER11> Joke or not, I have to point out that just because someone's screen resolution is 2560x1600 doesn't mean they have their browser that huge. Personally, my browser is never wider than 1100px. I do usually go as tall as the screen, but on a small laptop...

</comment></comment></comment><comment><USER12> If you want to do this, at least make the login cookie expire at the end of the session.

I had a friend forward me an OKCupid e-mail when they sent mis-matches for April Fools - a few days later I realized that I had somehow been logged in as said friend and was majorly creeped out. Had I been less mature about it there was major potential for trolling said friend - particularly on OKC.

<comment><USER13> Mistakes like this will inevitably occur even with a cookie that expires as you suggest. Not as often as with a non-expiring token, but there are plenty of people who will leave a browser tab up for days at a time, keeping the session alive.

The convenience is tempting but it seems careless.

</comment></comment><comment><USER14> Plentyoffish emailing you your password.

OKCupid sending login token'd links

Notice the trend? When you're a dating website, engagement trumps security in many cases. But if you are a bank or any service with some liability, you're probably going to play it conservative as you should.

<comment><AUTHOR> "Engagement trumps security" holds true for 99% of the sites this audience builds. There's a reason I used Foursquare as an example.

</comment></comment><comment><USER15> The funny thing is that CAN-SPAM mandates 1-click opt-out, and requiring login to unsubscribe is specifically prohibited.[1] So most websites already have code to include and verify auth tokens in emailed links, which they utilize when they are mandated to.

But somehow they haven't figured out that it is in their own interest to do so the rest of the time.

[1] [http://blogs.boomerang.com/blog/2009/06/16/can- spam-2008-uns...](http://blogs.boomerang.com/blog/2009/06/16/can- spam-2008-unsubscribe-provisions/)

<comment><USER16> You can use such tokens to disable email notifications, and still not provide complete access to the account, though.

<comment><USER13> This seems like a good compromise.

Allow immediate access for convenience in some cases, but restrict that access to a specific task until login.

<comment><USER16> Yes, but the scope of access would have to be severely limited, to the point where's there's no real sense in doing it, e.g. you'd have to prompt for settings change, but also probably read/write access to private messages, wall, etc... It'd be a lot of work with little return (the more return, the less security).

<comment><USER13> Yeah, good points.

</comment></comment></comment></comment></comment><comment><USER17> How about two states for authentication: "light" and "fully authenticated"

If I click to the site via link in email, I get to "light" mode. This allows me to see things. Other actions can require "fully authenticated" mode and the transition light => fully requires me to enter my password.

With password reset emails I'd like to have a basic security question (one that I can pick myself).

</comment><comment><USER18> Do what? Create database driven sites that can't handle the load? I get error messages or timeouts when trying to reach the site.

<comment><USER19> Cached copy: [http://www.google.com/search?sourceid=chrome&ie=UTF-8...](http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=cache%3Asneak.datavibe.net%2F20110614%2Fplease- dont-do-this%2F)

(If you use chrome, just prepend any URL with "cache:" instead of posting snarky comments about it :)

<comment><AUTHOR> Thanks for that. My poor old p3 personal page box just about imploded when @newsycombinator tweeted this...

</comment></comment></comment><comment><USER20> A good idea for some situations. There are some obvious caveats:

* Remember email is not encrypted. The links can be intercepted.

* Consider looking at other factors (like IP, browser data, persistent cookies) that will let you know the user is legit before you green light the auto-login.

* Link to HTTPS, not HTTP. The user might be on a shared computer and you don't want login-able URLs left in the history.

* Force the user to enter their password to access sensitive settings or data (like changing email, passwords, etc.)

<comment><AUTHOR> The "click here to reset your password" links are sent over unencrypted email, too. I guess I am being insufficiently clear about why this is no less secure than what exists today.

> Force the user to enter their password to access sensitive settings or data > (like changing email, passwords, etc.)

If they have to enter their password to change their password... then how will the "click here if you forgot your password" feature work?

<comment><USER16> Please don't act as an authority on security when you do not understand how something like a POST request works.

What you're encouraging is forfeiting the site's accounts in standard communication, of which you send many, many more than "Reset your password" emails (which should, but may or may not be triggered by a form that presents at least one security question), and which are fundamentally different than "account security" emails, for the sake of streamlining the user experience, i.e. saving the user from having to log in at all from new devices.

If any users forward any of these mails to anyone else, they've essentially given them complete access to their account--imagine if Facebook started doing that in their "You've received a new message". It's needlessly and inconspicuously compromising account security on a regular basis with no real win. (The idea wouldn't fare well in a proper risk evaluation.)

<comment><USER7> I wish I could up vote this all day.

This my first thought upon reading the article. If people designing websites are making decisions that are not really well thought out (like this), episodes like Sony will continue to happen.

It really makes me sad.

It also makes me angry.

</comment></comment></comment></comment><comment><USER21> You should definitely NOT be putting auto-login links into every email without very careful thought and planning. People routinely forward emails to their friends and colleagues, or copy links and post them on twitter.

It's obvious that a password reset link should not be forwarded, but a monthly newsletter?

</comment><comment><USER16> "Forgot your password" requests usually POST to the web server, not GET (what's usually used in emails). Sending links that give you complete control over the account by default seems like an extraordinarily bad idea--as does allowing users to reset their accounts without any kind of identity verification.

(You could do a POST from an HTML email, but then, in most email clients, the users would be prompted with "You are sending data to the web page. Do you want to continue?" every time they click such notifications.)

<comment><AUTHOR> > "Forgot your password" requests usually POST to the web server

No they don't. They usually just have some sort of password reset token as part of the query string for a standard GET. AFAIK there isn't any good way to POST from the body of an email - do mail readers even do JavaScript?

<comment><USER16> > No they don't. They usually just have some sort of password reset token as > part of the query string for a standard GET. AFAIK there isn't any good way > to POST from the body of an email - do mail readers even do JavaScript?

I think you misunderstood what I was saying. "Forgot your password" requests, as in requests that will lead to the user receiving a new password/ability to reset their password, are usually POST, and are usually on a webpage, not in an email.

Besides, POST requests aren't Javascript. It's perfectly possible to use from inside an HTML email. Usually, though, the most you'll provide in an email is a link (GET request) with a param identifying the user, e.g. the UID, that will lead to a form that asks at least one security question.

Sending out links that essentially unlock the user's account via email _by default_ seems incredibly risky to me, and only provides a minimally better user experience. Just do better session persistence -- then the worst thing that can happen is you need to log in once via your mobile phone.

<comment><AUTHOR> Yes, but after they get that email, there is a second part to the password reset process - generally that user resetting the password (if one is not auto-generated). That uses a single-use token in the GET request to load the "type in your new password" form. The new password is then POSTed.

Dumb sites then require the user to type it in a third time to log in, "smart" ones log them in when doing the update operation.

Most sites don't have any security questions.

<comment><USER16> Even so, you're essentially arguing that equivalent access should be embedded in _every_ email the user receives from the service. Is that worth the small, one-time (session is generated, or password manager remembers the password) improvement of user experience?

</comment></comment></comment></comment></comment><comment><USER22> I think this could be done safely (well just about as safe as sending forgotten password reset links):

1\. Set a short expiry date on the link (1 day). 2\. On first click within 1 day, log user user in and expire link. Ask user if they want to stay logged in (via a subtle overlay at the top of the page perhaps + set "remember me" cookie) 3\. On subsequent clicks within 1 day. If user has "remember me" cookie, log them, otherwise redirect to login screen. 4\. Clicks to link after 1 day. Redirect to login page.

This should be just about as safe as a forgotten password email; they both have an expiry period + 1 time use, meaning anyone intercepting the email before the expiry and before the user clicks on it can impersonate the user.

The only counter-point that I'll make against my own point is that a forgotten password email is sent on demand, i.e. a user requests it, so they are probably more likely to click it immediately (hence expire it immediately).

I wouldn't do this for an e-commerce or otherwise sensitive app, but for something a bit more casual I think it would ok.

</comment><comment><USER23> Someone commented on the original post:

"Or provide a single use single action token that performs one function, like confirm friend. Security doesn't need to be all or nothing."

For extra security this token can be one time useable only.

</comment><comment><USER24> I for one will _not_ be adding this feature to my web app. However, might it be possible to kick in a login process using OAuth/OpenID? The onus isn't then on you to validate the user.

<comment><USER13> This is the way to go imo. For some reason a lot of people have the idea that it's somehow more secure to build your own login system than it is to use Google's or Facebook's. But doing it yourself opens up new vulnerabilities and you'll be reinventing the wheel making all the mistakes that have been tested out of veterans' systems.

The convenience factor is also superb.

</comment></comment><comment><USER25> What about auto-login info in the browser? If you present them with the login form (maybe with username prefilled), and they need to submit the form, they can update their autofill.

<comment><USER26> Exactly. If you use an auto login cookie then the browser will not have the password, so for the sake of saving a user a small amount of time you'll inconvenience them in the long run, and discourage them from using the site.

</comment></comment><comment><USER27> Traditionally if an account reset email is sent out you didn't trigger, it's a huge red flag. With this proposed approach, especially on a location based service like foursquare, getting access through a sniffed seemingly harmless notification email would most likely go unnoticed.

The closest method to this I'd personally implement is a toggle option only, with no further access. Similar to a standard unsubscribe toggle link.

</comment><comment><USER28> Huh, I was just thinking about this the other day, and wanted to rant about it but never got around to doing so. It's extremely annoying when I land on a login page from an email when I clicked to take a specific action. ESPECIALLY when logging in takes me to the home page, and not even to my intended destination.

</comment><comment><USER29> It seems like this calls for a two-pronged approach. If you've been logged in to their site from that browser in that account, then the link from the e-mail should auto-log in (unless it's been disabled for that account). Otherwise, it should prompt to allow an actual login as usual.

This way, you can forward an e-mailed link, and unless they happen to have logged as you already, they don't get into your account.

This probably means a significant amount of attention to detail to exactly which cookies are set, how long they live, and what they mean, but it sounds worth the effort.

</comment><comment><USER30> I'm not sure if I can totally agree with the author. I understand his pain, but email isn't the most secured place. If your email is being "watched" by someone else, then that someone else can access other web services that you own WITHOUT requiring to type passwords! I know that it is very rare to have your email being watched, but in security, even the most rare case should be taken into consideration. It's a trade off between user experience and security. This is something you find very often in software engineering.

<comment><AUTHOR> > If your email is being "watched" by someone else, then that someone else can > access other web services that you own WITHOUT requiring to type passwords!

The person watching your email can ALREADY DO THAT NOW by clicking on the "I forgot my password" link, intercepting the reset email, and then setting a new password and logging in.

<comment><USER31> That assumes someone has live access to your email. If someone has a recent enough dump (or simply a mail you forwarded yourself, because you didn't understand the security implications), then the "forgot password" button does really provide more security than login tokens inside the URL.

</comment></comment></comment><comment><USER32> After reading the article and comments, it appears that what this really represents is a need for more secure email protocols. How would one go about creating and ensuring and end-to-end secure email protocol? It could be done within a domain, but once you send or receive messages outside of your domain it's up to the intermediate and end parties to keep the message secure.

I suppose you could ensure secure communications via encrypted messages and end-clients with the key, but how could such a system be ubiquitous and practical?

</comment><comment><USER33> What's the safest way to do an instant login like this?

First thought would be to encrypt a query param with necessary info and add a few day expiration on the link.

Any good articles on doing this as intelligently as possible?

<comment><USER34> PGP-encrypted emails? It becomes a question of security vs convenience eventually with security considerations (Someone mentioned dating sites are more engagement > security).

There is no 'safest' way with encryption. It's a matter of time before it's breached.

<comment><AUTHOR> PGP encrypted emails? Are you serious?

Those of us that live in the Real World send our regards.

<comment><USER35> Unless your general audience are hackers.

For example, Canonical's Launchpad requires you to sign "code of conduct" with your GPG key before doing certain actions. And, if I remember correctly, they do send GPG encrypted emails for key ownership verification.

</comment></comment></comment></comment><comment><USER36> This is a compromise in security, and it should be seen in the context of the application/domain. I don't think it would fly in the medical or financial world.

</comment><comment><USER37> :facepalm: you don't happen to work for Sony, do you?

</comment><comment><USER38> That's what <http://www.yourpane.com> uses, so that when someone sends you a link you don't have to enter your password to use it.

As a matter of fact, it forgoes passwords altogether, using a secret token to log you in. It also creates an account as soon as you send a link to a friend, so there's no explicit account creation either. This is done to avoid the obvious hurdle, as it allows you to send links to your friends without them having accounts already.

</comment><comment><USER39> A lot of issues like this will be overcome with iCloud's ubiquitous kay-value stores, but sorry those are native apps. This points out yet another way how the web is a broken platform.

</comment><comment><USER40> Down here</comment>


Show HN: a Lispy, embedded Forth - <AUTHOR> https://github.com/codr4life/vicsydev/blob/master/lispy_forth.md <comment><USER2> If it meets the guidelines, this might make a good 'Show HN'. Show HN guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> Good idea, thanks for the heads up.</comment></comment>


Have anyone tried doing 2 startups simulatenously? - <AUTHOR>

<comment><AUTHOR> What if the 2 startups are complementary?

Like say, you are doing a dating site and a social networking site, which was the case for Intermix Media, parent of Myspace

<comment><USER4> Then run them as one company so you can spend half as much time talking to VCs.

<comment><USER5> That's what I'd do if I was in that situation... structure it as separate holding companies for the IP or whatever so you can flip each product individually if needed, but don't unnecessarily duplicate resources. Of course you're probably going to get into a world of fun "internal accounting" taking this approach... you will probably want to "bill" the appropriate holding company for time spent working on that project, etc.

<comment><USER4> You only really need to do enough accounting in order to pay your taxes correctly. You might need more than that if you want to try to go public, but the rest can be repaired retroactively. And if you just sit down with the relevant IRS publications and read through them, you'll find that the tax code isn't as scary as you think it is. A tax return is about as complex as, and makes about as much sense as, a typical Microsoft API.

</comment></comment></comment></comment><comment><AUTHOR> how was it? Do you regret it?

<comment><USER6> I'm working as an employee for one startup and a founder of another, in two totally different business domains (financial software and internet games, respectively).

It's hard. Startups take more out of you than a regular job will, because you can't just switch into maintenance mode. There've been times where my boss has had a demo for an important client one week (making me work nights & weekends for a couple days to get it ready), and then I've gone straight to preparing a launch for the startup.

I don't think I really could've done it differently, though. I wanted to work at a startup so I could get experience & a sense of what I was getting myself into, and this is my first job since college. The day job is essentially funding my startup - it pays better than YCombinator, with similar advice & experience benefits. I thought about switching to a less intensive job at a big company, but I dunno if they'd hire me when I already have a startup on the side. Plus, I have a pretty good relationship with my boss and the IP policy is relatively lenient at my current employer, reducing the chance of IP problems (he doesn't care as long as I'm not starting a competitor, basically).

Overall, I wouldn't recommend it unless you're in a similar situation - <USER2> job out of college, self-funding, and want the training of a startup. If you're older and already have plenty of experience with business, I'd get a job at a big blue chip where nobody knows what anybody else is doing - <USER3> coworker said that Thomson Financial is great for this, almost everybody has their own private business that they run out of their cube because the company is incapable of getting anything done itself. If you can get YCombinator or similar funding, I'd take that: you're trading equity for time, which is usually a good tradeoff. If you can afford to, quit your day job and live off savings (I'll probably do this fairly soon, but I want a little more runway so my startup has a greater margin of safety).</comment></comment>


Cryptostocks - <AUTHOR> https://cryptostocks.com

<comment><USER2> _" The platforms provides features to publish projects, trade shares in the projects and pay dividends."_

Is running an unregulated "stock market" legal in the U.S. (or whatever country this site is based in)? Is buying and selling shares on such a market legal in the U.S.?

<comment><USER3> There was something like this a while back that was shut down: [https://btct.co/](https://btct.co/)

Maybe this is not based in the US though, judging from the British flag on the language selection.

</comment></comment><comment><USER4> Not sure about this one, there are lots of Bitcoin Stock Exchanges of varying trustworthiness. [1]

Bitcoinstarter is also a more entrenched platform for crowd-funding... [2]

[1] [https://en.bitcoin.it/wiki/Category:Stock_Exchanges](https://en.bitcoin.it/wiki/Category:Stock_Exchanges)

[2] [https://bitcoinstarter.com/](https://bitcoinstarter.com/)

</comment><comment><USER5> This is no more than a crypto play on crowd funding, under the guise of a stock market; with effectively no consumer protection mechanisms.

</comment><comment><USER6> Also check [http://www.coinnext.com](http://www.coinnext.com)

</comment><comment><USER7> Let's combine the volatility and speculation of the stock market with the complete lack of regulation and security of the Bitcoin market. What do we get? A bullshit Voltron, that's what.</comment>


Show HN: How to install Keen IO Analytics into Node.js apps in mere seconds - <AUTHOR> https://keen.io/blog/78561215787/how-to-install-keen-io-analytics-into-your-node-js-app

<comment><AUTHOR> Link to the Github project [0] for those that don't want to read the marketing spiel. ;)

Would be great to get some issues and pull requests to help improve it. I'm completely open.

[0] [https://github.com/sebinsua/express- keenio](https://github.com/sebinsua/express-keenio)</comment>


Ask HN: Book Recommendation about Networking - <AUTHOR> Hi,
I want to understand more about networking, tcp/ip, dns protocol. thing about multi cast, nat traversal, how to implement my own toy network stack and the like, lan segmenting, vlan...
Those concepts come up a lot in my work and I just google the hell out of it and connect the dot here and there to figure them out but I lacked a fundamental/core understanding...
I want to fill that gaps in my knowledge by going to books instead of reading articles/blogs
Any good book out there for this?
Thanks. <comment><USER2> I'm absolutely with you on deepening knowledge from books rather than googling. Of course, no one book has it all, but one you might check out is - "TCP/IP Illustrated, Volume 1: The Protocols, 2nd Edition" from Addison-Wesley Professional Computing Series. It's a great series, by the way, worth checking every book out.

</comment><comment><USER3> _Computer Networks_ , Tanenbaum is a standard introductory textbook that's gone through multiple editions over nearly thirty years. It might not be for you, but it's proably a good place to start figuring out what is for you because a lot of what you encounter will be paraphrasing parts of it or using it's abstractions.

And because it's been used so heavily and printed so long, used older editions abound. Which are good enough to get started because TCP/IP and Ethernet and lots of other things are still mostly the same with new stuff layered on top.

</comment><comment><USER4> Very very worthwhile investment of your time.

I dived into the topic two years ago using Computer Networking: A Top-Down Approach ([https://www.amazon.com/Computer-Networking-Top-Down- Approach...](https://www.amazon.com/Computer-Networking-Top-Down- Approach-7th/dp/0133594149))

As someone with about ten years experience in web-dev, but no formal CS education, I found the difficulty level to be just right.

</comment><comment><USER5> Routing TCP/IP, Vols. 1 and 2 are basically the networking bible. You may not necessarily want to go _that_ far into networking, though!

<comment><USER6> This is the correct answer.

</comment></comment><comment><USER7> Here are a couple recommendations.

Interconnections - Radia Perlman. This is a good introduction to bridging and routing.

Networking Algorithmics - George Varghese. This has a lot of interesting content about removing bottlenecks from network devices. I would appreciate recommendations for a newer book with similar content.

</comment><comment><USER8> Not a book but PG's essays are great sources [http://www.paulgraham.com/articles.html](http://www.paulgraham.com/articles.html)

Many of them touch on subjects like network effects on the startup scene

</comment><comment><USER9> I would recommend Ed Harmoush's materials in [https://www.practicalnetworking.net/](https://www.practicalnetworking.net/)

</comment><comment><USER10> I've heard good things about [https://nostarch.com/tcpip.htm](https://nostarch.com/tcpip.htm)</comment>


Building realtime collaborative offline-first apps with React, Redux, PouchDB - <AUTHOR> http://blog.yld.io/2015/11/30/building-realtime-collaborative-offline-first-apps-with-react-redux-pouchdb-and-web-sockets/ <comment><USER2> A couple of comments since I've spent the last month building out this exact architecture.

First, the author doesn't really address security and authorization, in fact they gloss over it. The typical solution with CouchDB/PouchDB seems to be per- user databases. That sounds horrendous to a SQL guy (me), but it turns out that CouchDB can happily handle hundreds of thousands of databases.

In my current application I have found couchperuser very useful. It's an Erlang Couchdb plugin that creates a database with appropriate permissions every time you create an entry in the _users database. (Access to the _users database is restricted to an admin account so is done via a parallel web service.)

If users are accessing CouchDB directly, of course you gotta worry about what horrors they're stuffing into your lovely pristine database. Control over that is provided via Javascript validation functions that are run on every document save. Those are saved into the per-user database at account creation time.

The biggest downside to this architecture that I've found is that there is two sources of truth on the client - the Redux store and the PouchDB database.

<comment><USER3> For the client there's only one source of truth: the Redux store.

The PouchDB store is a side effect of changes to the Redux store, no need for the client to worry about these.

</comment></comment><comment><USER4> I don't understand this obsession with offline support for collaborative realtime apps. There is an idea going around that you can magically sync everything using the same algorithm.

Accurate offline collaboration is impossible without some form of user- assisted conflict resolution - The core problem is that automatic sync algorithms cannot capture the collaborative intent of users.

For example, assume that you have a list of items and two users are interacting with this list while offline. Let's say that one user called 'John' coincidentally deletes all items which start with the letter 'A' but, while also offline, the other user 'Steve' renames one of those 'A' items such that it now starts with the letter 'B'.

There is a problem here, because if John comes back online first; all items starting with 'A' will get deleted. So when Bob comes online, either his rename operation will fail because the system cannot rename a non-existant item or it will re-create the item which John explicitly deleted (but this time with a new name - Which goes against John's intention).

The system can never know for sure the intent of both users so it cannot automatically resolve conflicts (at least not accurately). In some cases, the benefits outweigh the disadvantages but it's important to be aware of those disadvantages and that there are no one-size-fits-all solutions which work perfectly with all kinds of data.

<comment><USER5> Or you design the protocol (or rather, the operations which are applied to the data) so that conflicts can be trivially resolved.

In your example you could have a single operation, SET, which sets a field at a particular address to the given value. User John sends a list of SET operations, all in the form of 'SET "<item X>.deleted" true' for all items 'X' which he wants to get rid of. Steve sends a list of SET operations in the form of 'SET "<item X>.name" ???', which don't conflict with what John sent. The key point is to have stable addresses (eg. never delete objects so that addresses within it remain valid forever). And a small set of fundamental operations on them where conflicts can automatically be resolved by the computer (you get get by for a long time with just SET, and if you have just SET then conflict resolution is trivial).

Note that in that system there is no notion of a 'Delete all users whose names begin with 'A'" operation. That's a very complex operation with very narrow use case. And it requires a lot of logic to handle all the potential conflicts with other such complex operations.

<comment><USER6> That's exactly what CRDTs are all about. The garbage collection problem is a real issue in practice.

</comment></comment></comment><comment><USER7> "But yes, the server has no control over what data is being written. This is why this type of architecture only serves for personal / shared databases, not for public records."

A solution that doesn't take into effect security from the start is pretty limited for any real world usage beyond a simple personal data app in which case why over-architect it in the first place?

<comment><USER8> Yup. I put together a successful proof-of-concept with React and PouchDB / CouchDB, but quickly concluded the lack of granular security was its Achilles heel.

I switched to Meteor with GroundDB for offline support, and haven't looked back.

</comment></comment><comment><USER9> Seems like Meteor can slot in another database next to the current MongoDB+MiniMongo implementation?</comment>


Show HN: Shirt URL – redirect your T-shirt to new content every day - <AUTHOR> https://shirturl.com/

<comment><USER2> Consider using only the character set in NewBase60 to ensure all your URLs are print-safe and unambiguous. If you follow the NewBase60 algorithm it has built-in error correction (e.g. O is considered the same as 0)

Character set: [0-9A-HJ-NP-Z_a-km-z]

More background: [http://ttk.me/w/NewBase60](http://ttk.me/w/NewBase60)

<comment><AUTHOR> I didn't know about NewBase60, so we only allow lowercase and numeric characters, and we picked a font where 0 is distinctly different. NewBase60 looks like a much better alternative, I'll look into it. Thanks :)

</comment></comment><comment><USER3> I like that so much. Thanks, for bridging the gap between the online and the tangible. Feedback: find a way to market it really well, because it would be cool to see lots of people walking around with these. Also, maybe consider "couples shirts" as sometimes couples like to wear shirts that reference each other, a la the classic (?) "I'm with stupid" :) Conferences could be another big win for you -- bulk orders, and maybe you could "include" shirt urls atop another suppliers merch so everyone can be "URLing" their wares on their backs for all to look up. It would be cool to have a "shirt url" spotted-at Instagram feed, like, "post some pics of where you wearing your shirt url, <x> one gets free special edition shirt." x in superlative of your choice :) The name is really good. This whole thing made me smile so I'd say you're definitely onto something if you can make people feel good.

<comment><AUTHOR> Wow, thanks for this :) This is exactly what we thought when we came up with the idea. These are great suggestions. We thought about the benefits at conferences but never thought of couple shirts or shirts referencing other shirts. There's definitely room for creativity in this area. Thanks again!

</comment></comment><comment><USER4> You might consider adding an option to display a QR code on the shirt instead of a URL. It would be really cool if you could also provide the ability to embed a logo/icon into the QR code (a la [http://hackaday.com/2011/08/11/how- to-put-your-logo-in-a-qr-...](http://hackaday.com/2011/08/11/how-to-put-your- logo-in-a-qr-code/)). Would be good for companies.

I was a little disappointed that it isn't possible to order shirturl.com/1337 (minimum 5 characters).

The 'Home' link in the footer is a 404 ([https://shirturl.com/home](https://shirturl.com/home)).

I think you should add a privacy policy.

That said, good luck!

<comment><AUTHOR> Thanks for taking the time. Logo in a QR code looks really cool. We decided to leave shorter codes for later but when we do open them, I'll reserve 1337 for you :) I'll fix the home link right away and add a privacy policy. Thanks again!

</comment></comment><comment><USER5> Wow very cool idea.

As others have mentioned QR code would be cool but maybe hard to accomplish with wrinkles in shirts, etc. If you can get it to work, a companion app would be cool. See someone wearing the shirt, scan the code, see the message. Of course with augmented reality it would be even cooler!

<comment><AUTHOR> Thank you! We were hesitant to use QR codes because there is so much friction with its usage. But I love the augmented reality idea, using T-shirts would be a feasible way to make AR interactions work.

</comment></comment><comment><USER6> Cute idea. I like it.

Dress up your page a bit and drop it on product hunt. Im sure people will love it on there.

<comment><AUTHOR> Thank you. I'm on it :)

</comment></comment><comment><AUTHOR> This is a side project where we are trying a new concept and I would love some feedback. If you want to try it, use discount code 'HACKERNEWS'.

</comment><comment><USER7> I don't think QR-codes wouldn't be an improvement at all. They are ugly and akward. Instead consider printing the URL on the back as well.

<comment><AUTHOR> I agree with you about the QR codes. We currently support printing on the back, but not on both sides.

</comment></comment><comment><USER8> The concept is nice. People at Product Hunt tend to appreciate these kind of things well. Hope you are on track with posting on PH as well.

<comment><AUTHOR> Thanks! I'll post on PH this week.

</comment></comment><comment><USER9> You need to printing QR codes for that, not just the plain text URL.</comment>


Custom Domains on Heroku with Elixir and Phoenix (without SSL) - <AUTHOR> https://medium.com/@jackacarlisle/setting-up-a-custom-domain-name-on-heroku-with-elixir-phoenix-without-an-ssl-certificate-3a7900509801 <comment><USER2> this is let's say not great advice, and that is being friendly;-)

url: [scheme: "https", host: "mysterious-meadow-6277.herokuapp.com", port: 443], force_ssl: [rewrite_on: [:x_forwarded_proto]]

means that if you accessing the server over http it will redirect to the specified host and over https, so setting host: to you yourdomain.com would solve it.

If you have multiple domains you can remove the host: config or do a host: nil - then it will redirect to https for whateverdomain.com that is hitting the server.

all the best</comment>


Ask HN: How much is my domain worth? - <AUTHOR>

Hello all, I own a domain, which we'll call johndoe.co.uk, which I've owned for a long time and no longer use. A company, which we'll call Alan Smith Homes, has been using johndoehs.co.uk in lieu of my domain. I regularly receive confidential email intended for them, signed up by both their own employees and external parties.
This week, I received a signup to a premium web service, which had my email on. I was concerned about my username/password being compromised (but I was sure I wasn't in the Gawker dump...), did a password reset, then found out that the account is probably for one of these people as well.
John Doe is doing quite well, and has offices around the country now, and appears to be coveted winning awards in their business sector. I would like to sell the domain to them, but they have only ever offered to take control of the domain and offer me back email addresses I want! This time, it seems like things might move along, but I doubt they have a realistic expectation of its value. I think the domain is pretty valuable to their business, and would put a higher valuation than I am sure they have on it.
How much do you think a domain to a non-IT company, but well-trading company, where misaddressed confidential email is fairly common, is worth? <comment><USER2> Like anything, it's external value is worth what the highest bidder will pay.

It's also likely that you value the domain at some higher amount than they do.

Someone once told me "serious negotiators make offers". If you want to sell it, I would determine a price and contact the appropriate person at their company with your proposal. Something along the lines of:

Dear Mr. Doe:

As you may already be aware, I am the legal registrant of johndoe.co.uk, which I had originally registered for purpose X. Additionally, I am aware that your company operates using the domain johndoehs.co.uk. I am primarily aware of this based on the increasing number of mis-directed emails and website visitors I receive that appear to be looking for your company.

While I cannot calculate the exact value, it would appear to me that your organization may be losing some business because of the similarity of our two domains. When your own employees mistake my domain for yours it would seem to be a clear indication that much like an elegant logo or catchy advertisement, my domain could offer your business increased visibility to your customer base.

With the above in mind, I propose to transfer ownership of johndoe.co.uk to you for the sum of $XX,XXX. For the sake of efficiency, I will point out that in advance that it is difficult to ever properly assess the true value of a given domain name, and sometimes the value can only be really determined by calculating potential lost sales and the impact on confused or frustrated customers who do not realize that they have used the wrong channel for their communication. While I have no intentions of misleading your customers that attempt to contact you by sending emails that wind up in my inbox, I can also not be responsible for politely redirecting all of these persons to the proper recipient on your end.

If you would like to accept my offer, or discuss the particulars in more detail, please contact me at 555-555-1212, or email me: firstname.lastname@example.com. If this is not a matter you are interested in pursuing, I completely understand and wish you luck in your endeavors.

\-- Cheers, Me.

<comment><AUTHOR> This is excellent, thank you so much!

</comment></comment><comment><USER3> The answer to your question is how much they are will pay.

Also you're in a curious position because if they have filed a Trademark on their name (in US at least not sure about UK) they can file a trademark dispute.

If you came to me and said you were squating on my TM I'd start legal procedures.

Now if they don't have a TM ... Maybe convince them to do a profit share if this new domain rockets them to new search levels. Exact domains have a much higher SEO value. So in truth it could be a win for them. I'd reach out to who ever does their SEO and let he/she be your advocate.

<comment><AUTHOR> Well, TM is not an issue because the domain name is my actual name, so I wouldn't lose a dispute over it.

I didn't ever say I was squatting, all I have done is said that I own this domain, it is mine, I get _your_ email, and I forward it to you because I am nice. I would rather this problem go away for us both, but I am not willing to hand over a domain for less than its value to me.

</comment></comment><comment><USER4> See: <http://news.ycombinator.com/item?id=1547943>

'How Groupon bought thier domain' - should be of help/interest.

<comment><USER5> So any successful website can be acquired by any one by TradeMark the domain name?

</comment></comment><comment><USER6> You should offer to sell it to one of their competitors. That might increase its perceived value a bit.

<comment><AUTHOR> Sadly, as it is a personal name, the only value to competitors would be squatting, which as other HN'ers have rightly said, would put it square in line for losing a dispute with the NIC.</comment></comment>


What did a teenager get out of attending Startup School? - <AUTHOR> http://kulpreet.com/post/1385881768/what-did-a-teenager-get-out-of-attending-startup

<comment><USER2> This is a weird example of something I will deem "content subject scaling". I've come to realize that we often judge content based on not the sole value of the content alone, but actually, the nature of the author who created said content. Here, we are amazed the author is 16 - if he was not an outlier in this sense, this piece would surely not be front-page worthy. Similarly, InDinero founder Jessica Mah is outstanding because of her age, but beyond that, would we _really_ be focusing on her product so often? I have my doubts. On the opposite side of the spectrum, we sometimes view and promote content that is largely throwaway based on the author's known history.

Not to say this isn't okay and it's not worthwhile, but most of the time, these kinds of posts need to be acknowledged as what they are - not things that are really strong contributions to the HN knowledge base, but instead, curiosity impinging posts that ACTUALLY serve as mini-biographies of the people that post them and/or are featured within them - where our REAL interest lies.

So, my point - serve me up the 301 redirect to their about page, stat.

<comment><USER3> Youth is simply one form of power that can be exercised to get publicity, guidance from older mentors, etc. There is nothing inherently wrong with that. Entrepreneurship and engineering are both about using what you have to build what you want.

<comment><AUTHOR> This is actually one of my first attempts at blogging, so I appreciate the feedback. To be honest, I was not expecting to make the front page.

</comment></comment></comment><comment><USER4> As a fellow high-schooler ("one who high-schools"?), I'm impressed! You certainly seem to be doing everything that I wish I were doing right now.

This is new found motivation for me to start working on the Rails app that's been in the back of my head for a while now. Here's hoping that I can sustain that motivation long enough to build a finished product.

</comment><comment><USER5> kulpreet, not all the (ethnically) chinese people in the bay area are Chinese (citizens).

I found that out first hand when I flew into SFO after a year+ in China. There is such a huge cultural difference between people born and raised in the mainland, and those from other ethnically Chinese but non-PRC communities that it's alienating sometimes.

(I want MORE 广州人, dammit! I will forever consider SZ, DG and GZ home; Guangdong pride!)

[Edit:

Added qualifiers to disambiguate ;-]

<comment><USER6> > kulpreet, not all the chinese people in the bay area are Chinese.

I understand what you are saying, but capitalizing a single letter is not really enough of a distinction to rely upon in casual conversation. For example, I will often intentionally describe an american-chinese friend as "Chinese" rather than "chinese", capitalizing the C as a way of signifying importance and respect in the same way you might say The White House or Stanford, rather than stanford. To many, "chinese" simply implies you are too lazy to capitalize the "C". (which is, conversely, why there is an implied value and respect associated with capitalizing)

I hope that makes sense, it is a somewhat amorphous subject and as such difficult to articulate.

<comment><USER5> You're absolutely right. I just wasn't sure how else to distinguish between Chinese (citizens of the PRC), and diaspora Chinese (people of Chinese origin that are not PRC citizens)

Ok, added qualifiers.

<comment><AUTHOR> Actually, I think I'm wrong because I wrote 中国人, which literally implies a person from PRC. I'm still learning Chinese in school and I didn't know how to say "people of Chinese origin" haha

<comment><USER7> This may betray my own ignorance, but I believe 中国人 is perfectly fine for describing oneself even if you are not from the Mainland, such as in my case. I've hung around plenty of 1st generation Chinese folk from Taiwan and conversation seems to still use 中国人 as a general term, not as something specific only to Mainlanders. I suppose if you really wanted, you could use the term "Han Chinese", but that is in fact more ethnically specific than 中国人.

</comment></comment></comment></comment></comment><comment><USER8> I think we sat next to each other during the latter half of the event. Hehe, can't wait to see what you make next ;-).

</comment><comment><USER9> Good summary of what happened at SUS2010!

</comment><comment><USER10> I really like Tumblr theme. Very clean and classy.

<comment><USER11> Well, I find the text to be hard on the eyes.

<comment><USER12> I wondered why that was as well. Then I noticed the blue and red lines and it should be noted that is not a good way to view images on screen: <http://i.imgur.com/r6WI2.png></comment></comment></comment>