Pivotal Tracker will no longer be free in 6 months - <AUTHOR> http://pivotallabs.com/users/dan/blog/articles/1537-introducing-pivotal-tracker-pricing <comment><USER2> I've asked about this on HN before (whether others feel the same way). It makes me feel safer to use pivotal knowing they're going to charge for it.

<comment><USER3> I'm hoping getting some money out of PT would make them act faster on the things most in demand in their user feedback site. <http://community.pivotaltracker.com/pivotal> [It appears as though] they've not been doing anything at all on these fronts for many, many months:

* markdown (code blocks, anyone?)

* editing or deletion of comments

* grouping stories

* replying to comments by email

[Edit: list formatting]

<comment><USER4> I'm surprised how beautiful the UI is in some places while being ugly in other places. I think they ought to redesign the form for editing stories.

<http://skitch.com/benatkin/rkecs/pivotal-tracker-story-view>

Also, why not have an expanded, non-editing view? The <input> elements do take up extra space when just _viewing_ the extra fields.

It seems to me that they're missing some of the finer points of Single Page Application design. I wish I had a good guide I could point them to.

Again, though...they're totally nailing other parts of single-page application design. It's an amazing app that could be made a lot better with some refinement.

<comment><USER5> The recent redesign of the outer pages and the layout was the first phase of a big UX overhaul - viewing/editing of individual stories is next. Working on design for this now, we plan to dive in to implementation in the next few weeks.

<comment><USER4> Great to hear!

</comment></comment></comment></comment></comment><comment><USER6> I'm a huge fan of Pivotal Tracker and I'm delighted they are going to be charing a reasonable rate for this valuable service. Also delighted they are keeping it free for open-source, non-profit and individual use.

However I read that they are going to require you to pay for the upper tiers to use JIRA sync and other such features... wasn't JIRA support built into Pivotal Tracker by the community/3rd party or is this now their own implementation?

It would be wrong, imo, if they were charging a higher tier to use a community built plugin.

 _(why anyone would want to use JIRA is another matter, however)_

<comment><USER7> _It would be wrong, imo, if they were charging a higher tier to use a community built plugin._

The nature of contributing to OSS is that you are spending your time for the benefit of for-profit companies. That is, very possibly, a poor business decision if you are not being compensated directly while doing it. If you aren't being compensated, then you should expect to receive everything the MIT license lists under Section 42: Stuff The End User Owes You.

</comment></comment><comment><USER8> As a recent PT convert, I am really starting to get into the workflow their app allows. It is certainly much better than basecamp or lighthouse.

That being said, they put a heavy penalty on having clients on board as part of the process. I have three projects, five part-time coders, five clients, and 1 virtual assistant to keep it all running. I have to pay $100/month to keep going?

I don't need Jira or Zendesk, so why should I pay $50/month? I could probably setup two $7 accounts and one $18 account and be fine - but then I have to deal with the pain of logging in and out just to do work?

I would happily pay $25-$30 a month, but $100 seems off the mark to me.

<comment><USER9> I think that would be excellent point to make to them, if you haven't already.

<comment><USER8> Thanks,

I did send them an email. Hopefully they will listen, Github did and I think their pricing plans are better for it. I've already upgraded once on github as my needs grew.

</comment></comment></comment><comment><USER10> Heh. Fascinating how they used to say that they could afford to keep Tracker free because their meat and potatoes was "software consulting":

 _How can you afford to offer such a service, completely free? What is your business model?

Pivotal Labs is a software development consultancy, we get paid to build software, from web applications for startups to large-scale enterprise systems. We built Tracker to support our own projects, and now share it with the agile community, but it is not a primary source of revenue for our company._[1]

Wonder what changed?

[1] [http://webcache.googleusercontent.com/search?q=cache:V05_lTO...](http://webcache.googleusercontent.com/search?q=cache:V05_lTOQ9AcJ:www.pivotaltracker.com/help+pivotal+tracker+faq&cd=1&hl=en&ct=clnk&gl=us&client=safari)

<comment><USER11> _Wonder what changed?_

They generally do a mediocre job at best, so their clients didn't renew their overpriced consulting contracts.

<comment><USER12> _They generally do a mediocre job at best._

Interesting. Twitter seemed quite enthusiastic about their two "Pivots": _When we began working with Pivotal last year, we knew they'd be a big help but we didn't expect how much they would contribute to a healthy and attractive work culture._

[http://blog.twitter.com/2009/03/pivotal-means-of-crucial- imp...](http://blog.twitter.com/2009/03/pivotal-means-of-crucial- importance.html)

On the other hand, Pivotal's price is steep, and you have to hire their programmers in pairs: _It's about $15,000 a week for a pair. And so what we came up with was, "Look. You don't have much money..." But we came up with this idea that if we do a six week run, and he gave me a very slight bit discount, so like a six week was going to be $84,000 we could get a minimum viable product up and launched._

<http://mixergy.com/oneforty-laura-fitton/>

Given the price of hiring Pivotal Labs, it sounds like Twitter and Laura Fitton were pretty enthusiastic. I wonder how to reconcile that with what you've been hearing—has Pivotal Labs gone through a growth spurt in the last year or two?

<comment><USER11> Twitter is a unique case in that their engineers in 2009 were even worse than the ones at Pivotal. They still had outages every day, so how good could the "pivots" have been?

But my point still stands as Twitter did not renew their contract...

It's also not what I've "been hearing"... I've had to work directly with Pivotal people.

<comment><USER12> Thank you for your first-hand experience!

I was curious about Pivotal's consulting work, because even very good software consulting companies go downhill quickly when they try to scale. Joel Spolsky described it perfectly: _I don't need to name names, here, this cycle has happened a dozen times. All the IT service companies get greedy and try to grow faster than they can find talented people, and they grow layers upon layers of rules and procedures which help produce "consistent," if not very brilliant work._

<http://www.joelonsoftware.com/articles/fog0000000024.html>

If Pivotal has a nucleus of really talented people, it makes sense for them to become a scalable product company. (Although I'm not really convinced by Pivotal's proposed pricing plans, at least for consultants with several smaller projects going on at once.)

</comment></comment></comment></comment></comment><comment><USER13> This is a little self serving, because I make/sell a PT competitor (<http://trackjumper.com>), but I'm curious - how much _is_ a bug tracker worth to you?

I'm charging $20/month for unlimited everything (users/projects/storage/etc), and can't shake the feeling that some customers find this to be a hefty price tag and others would pay $200 or more.

BTW - I'm glad they're charging - it's a great product and they deserve to make some scratch from it.

<comment><USER14> Split test it dude. Just split test it. My guess is that you would be better off getting more people in the door with a $5 a month account and then having them upgrade to $18 then $50, but for something like this you can't afford not to test test test.

<comment><USER13> You're right. And I will. Just trying to figure out a little about _why_ people might think $8 (or $100 or whatever) is a good deal. What sort of work they're doing - that sort of thing.

The other thing is the feature set seems to be a terrible way to segment users. I'm not sure the price people are willing to pay has much to do with the number of projects/users/etc they need. I'm looking for a way to segment based on willingness to pay, not my own convenience.

For example, one customer was a utility company. They didn't care at all about price. A freelancing shop was skittish at $8. Neither one needed a boatload of features.

</comment></comment></comment><comment><USER15> Ah, the Ning approach

Pricing starts at $7 for up to three collaborators, so does that mean individuals and up to two others? Looks like they'll stay free for public projects, but I don't see any mention of individual accounts save on the pricing page's "free for individual use (no collaborators), with up to 2 private projects."

@rubyrescue: agree with you 100%

</comment><comment><USER16> Interesting timing, as my team was about to start using Pivotal Tracker for our project. Hopefully this encourages them, and the fact that they'll have to pay $50/month after July doesn't scare them away. Not really a big price tag, but any money over free is the hurdle.

</comment><comment><USER17> oh boy,

Have been a very loyal user of pivotal tracker, I have 11 projects with 12 collaborators. The smallest plan I could choose is $50 per month. That was shocking me a bit, before I knew I can archive my old projects :P

<comment><USER18> Then you're getting a lot of value out of it already. $50/month for that many people working on that many projects is peanuts!

<comment><USER19> Well not necessarily. Number of people and projects is easy to measure, but it's far less indicative of value than, say, hours used.

In my past life as a freelancer, I might have 10 or 20 projects going, each with a couple collaborators, but it still only added up to 40 hours of work for me, and the collaborators were negligible.

Now at my startup we only really need one project with 4 collaborators, but we're getting 2-3x the value out of it.

I don't have trouble paying for full-time dev collaborators, but the head count could become a pain point once you roll in various tangential roles such as management, support and sales, etc. I'm not sure the best way to handle this without opening loopholes, but I'm hoping they reach out to some of their users who aren't quite so developer heavy as pivotal labs to discuss options.

</comment></comment></comment><comment><USER20> Some of their math seems a bit off?

"Choose a plan with annual billing on or before February 19, 2011, and receive an additional 20% discount for the first year. That's 18 months of use for the price of 8."

<comment><USER21> Probably meant 12 months for the price of 8.

$7/mo * 12 * 80% * 80% = $53.76 with the discounts. Price of 8 months without the discounts is $56.

<comment><USER22> And then they're probably adding the 6 free months that they're giving everyone into that.

If you pay for 8 months today, you'll be good for the next 18 months. It's a stretch, but not really wrong.

</comment></comment></comment><comment><USER23> Its a great thing that they are starting to charge for their service, but I wish they would charge a certain amount per user with an option to pay for each additional service the team would need.

I just hate paying for more users than I would need or, integration with JIRA.

</comment><comment><USER24> Great! I wish they'd been charging for it earlier; it would have been easier to use on some client projects...

</comment><comment><USER25> That was a long beta test before going life.

They have a good tool and don't have problem paying a reasonable price for it.</comment>


The Brain Needs Animal Fat - <AUTHOR> https://www.psychologytoday.com/us/blog/diagnosis-diet/201903/the-brain-needs-animal-fat <comment><USER2> This article is written by a crusader for meat with a clear agenda of being vehemently pro-meat.

She supports the keto-diet, which has no real basis in history or science, the person she cites actively disagrees with her dietary suggestions. She cites inflammation and healing as side effects, but doesn't describe what gets inflamed, where it gets inflamed, or how.

She also makes a claim that vegans and vegetarianism will lead to mental disorder because of this lower DHA claim. Well where's the data that vegans/vegetarians have higher instances of this? Should be easy to produce right?

She even makes the claim that vegetables have no science to prove that they are healthy.

How did this even get onto HN, it's obviously garbage?

Sources:

[http://www.2ketodudes.com/show.aspx?episode=156](http://www.2ketodudes.com/show.aspx?episode=156)

[https://www.judytsafrirmd.com/myth- buster/](https://www.judytsafrirmd.com/myth-buster/)

[https://www.diagnosisdiet.com/](https://www.diagnosisdiet.com/)

<comment><USER3> At this point in my observation of the diet wars I have concluded that no diet is based in science and everyone is wrong. Like religion.

<comment><AUTHOR> Yup. Have you also observed that the HN community has a vegan/vegetarian-bias?

People here jump to prompt criticism and ad hominem when there is a pro-meat submission. And right now that Burger King vegan burger loaded with questionable ingredients is being lauded as the greatest achievement in nutrition.

<comment><USER4> I dunno about the Vegan BK Whopper. But when apples cost > $1 each, head of cauliflower is $4.99, and yet you can buy chicken, cuts of beef, for the same price or less, something is up. That animal, raised, fed, given medical care, housed for some years. Seems like a lot of built in cost compared to seasonal produce. Either the government is subsidizing it up the wazoo and/or the meat industry in the US is King Kong size. Since it was mentioned, the same goes for the meat in the dollar menu. Ewww.

</comment></comment></comment></comment><comment><USER5> As a former vegetarian (now a pesco-pollo-tarian?) the important of eggs can't be understated. Arguably the one source of animal protein and fats that can be ethically sourced without harming the animal [ _1_ ].

[ _1_ ] vegans disagree on this point, but that's a different debate

<comment><USER6> I'm a vegetarian not a vegan, and thus I eat eggs. But the 'ethically' sourced part is something I'm not that sure about. Sure they can be (and I get them from my grandparents who keep some chickens.. so that's ethical IMO).

If you buy eggs from a shop, I'd say there is a fair chance that the animals are not treated that well.

EDIT: I now realize many others have already made this point in other comments, oopsie.

<comment><USER7> Most of what people think are "ethical" eggs that are sold in stores are basically a scam. Sure, they're _eggs_ , but "free range" can mean the chickens have access to a little door and a puny plot of land for an hour, and "cage free" can mean the chickens never go outside. Pasture-raised eggs are your best bet, and that's all I'll buy, but even I'm skeptical because I've been burned so many times by believing my eggs were ethical.

<comment><USER8> It depends on local regulations, but here in Denmark, organic eggs must meet the following regulations:

-Maximum of 3000 chickens in a flock and a maximum of 6 chickens per square meter in the coops, which must allow daylight in.

-The chickens must have access to perches and nests.

-At least one third of the flooring must be loose bedding, such as straw or sand, to allow the chickens to dust bathe.

-The chickens must have all-year access to outdoor areas with at least 4 square meters per chicken. It must be covered by grass or other vegetation, and must provide shelter from wind/weather. An outdoor area must stand unused every other year, for parasite prevention and to let the vegetation regrow.

-Beak trimming is prohibited.

-Feed must be organic and must include roughage.

While it's not perfect, it's a damn sight better than battery caged hens.

</comment></comment></comment></comment><comment><USER9> > It is difficult to be sure precisely how much DHA we need, as DHA conversion > rates and availability can vary significantly depending on age, gender, > genetics, and dietary composition

Vegetarianism/veganism has the same problems with calcium and B12, as those are typically gotten through animals in omnivore diets. It doesn't mean that vegetarianism/veganism is bad, just that you have to be conscious of your diet. We have a phrase in our house: "You need to eat all the colors." We include a wide variety of foods in our diet, and milk replacement products with calcium.

As a critical thinker, it bothers me when something says "Well, we don't understand what this relationship is or its importance; therefore, you should conclude.." Seems like a hit piece on vegetarianism/veganism more than anything else. Nevertheless, recognizing the importance of certain fats in your body is a good thing.

<comment><USER10> There are plenty of sources of calcium in vegetables, it's not comparable to B12 (which _has_ been found to be produced in the human upper intestinal tract as evidenced by multiple studies going as far back as 1980 [https://www.ncbi.nlm.nih.gov/m/pubmed/7354869/](https://www.ncbi.nlm.nih.gov/m/pubmed/7354869/), despite the claims all over the Internet otherwise. It's just poorly understood why some guts lack it).

The only thing a vegan has to supplement with a proper diet is B12. Eating tofu and fortified soy milk every day gets you most of the way there for calcium (it's set using calcium sulfate as coagulant). I've already had 300mg in my breakfast today by eating oats with fortified soy milk.

</comment></comment><comment><USER11> > The Brain Needs Animal Fat

> Thankfully, vegetarian and vegan-friendly DHA supplements [..] are > available.

Both from the same article

<comment><USER12> lmao that's was my reaction. I've been taking DHA supplements and eating a plant-based diet for over a decade. I thought the article might expose some skeezy marketing ploys on the part of BigVitamin, that I had been buying into all along, but alas.

</comment></comment><comment><USER13> The article is okay. The headline is clickbait nonsense.

The headline implies that vegans should all be dead now, assuming we interpret "need" as necessary to survival.

A more accurate title might be "The Brain Benefits From Animal Fat". But who would click that, right?

</comment><comment><USER14> This article appears to have a clear agenda and does a poor job of hiding it. The conclusions, which might be summarized "animal fats are good and plant fats are bad" also seem pretty feebly supported by the evidence offered. I am not a scientist, but to my eye this shows the marks of industry supported junks science.

</comment><comment><USER15> This is nonsense. As the article itself states, if you're really paranoid about this then just take an algae supplement, which contains plenty of DHA. That's where fish get it. They don't make it themselves. And it doesn't come with all the pollutants you get from fish these days either.

The amount of these fatty acids needed by the brain is quite small and even at low conversion rates can easily be met by conversion from other plant sources too.

Summary of research on the subject:

[https://www.youtube.com/watch?v=XMA5ij- bsKc](https://www.youtube.com/watch?v=XMA5ij-bsKc)

<comment><USER16> > ... if you're really paranoid about this then just take an algae supplement, > which contains plenty of DHA. That's where fish get it. They don't make it > themselves. And it doesn't come with all the pollutants you get from fish > these days either.

The article does note that the bioavailability of this for humans may be very low. We are not fish. We did not evolve to eat algae. If you'd like to be as healthy as you can be, eat meat, sometimes, and don't ignore your body's cravings for fat.

<comment><USER15> The linked video addresses this. Supplements work in this case. Eating meat and fish has a lot of downsides too. For your health, for animal welfare, and the environment.

<comment><USER17> Eating meat isn't unhealthy. The studies quoted often are correlation studies where they don't take into account people who eat red meat probably don't do a lot of things they are told to do and so statistically die more, but it's not from red meat.

Animal welfare is a big one, and only by highlighting the problem and use sustainable farming practices will it work. Note that large scale vegetable farming practices are also bad for the environment, due to mono culture, soil degradation etc. So the best way is to farm both in a symbiotic relationship.

<comment><USER18> Dont equate the evils of animal agriculture with the evils of corporate farming just by saying they are both bad.

I would need to find the study (it might be the one you're thinking of) but a plant based diet is still many, many, more times more sustainable than the current general western levels of animal product consumption. I would need to find the study, but I think for animal agriculture to not have great negative effects would need to be reduced to something like 10% of current levels. Again, I'm not positive on these numbers and would need to find the study.

<comment><USER17> Yes but the point is that we can't survive and be healthy on an vegetable only diet. Our brains and intelligence only came from us eating fatty animal meats.

Just because one might be cheaper then the other doesn't mean it's better. It's more likely worse. If we can reach sustainable farming in all aspects why fight against meat?

In fact grass is the best crop to grow for sustainable farming, it's just we can't eat it. So let the cows eat it, we eat them and it's good all round.

I can pull out links to support sustainable farming too [https://www.primalmeats.co.uk/sustainable-eat- meat/](https://www.primalmeats.co.uk/sustainable-eat-meat/)

<comment><USER19> > _In fact grass is the best crop to grow for sustainable farming_

Depending on your definition of "sustainable." Grass-fed beef produces substantially more greenhouse gas per human-edible Calorie, in terms of global warming potential, than growing the crops that humans eat directly. I think it will be tough to argue that meat farming is sustainable until net global greenhouse gas emissions are at a sustainable level, which is clearly not the case today.

<comment><USER17> Yes but the grasslands the cows graze on will easily mop up all that excess carbon.

And the point of the article is that you can't have plant only edible calories. A calorie of meat is not the same as a calorie of plant. It's just a unit of energy and too simplistic a measure to compare with.

'BUT' – I hear you say… "Cows burp and fart too much which is causing climate change and we can't feed 8 billion people from this 'out of date' system – the world's different now!".

Once upon a time in the USA there used to be a vast area of prairie (pasture) called the Great Plains. This story can be replicated on any of the world's grasslands. This vast grassland was a giant 'carbon sink' with deep soils of up to 15% organic matter and was a rich habitat for thousands of different species of flora and fauna. Even through severe droughts, the plains supported somewhere in the region of 110 million wild ruminants. 50-70 million of those were the giant one-tonne bison – the equivalent to about 2 small beef steers. We now, in the USA, have roughly the same number of domestic ruminants. 1

Wild animals burp and pump too! So how come pre-industrialisation these 'evil' ruminant beasts didn't wreck our climate?

Healthy soils contain soil microbes called methanotrophs that reduce atmospheric methane. So the grassland on which the cattle are grazing can absorb a large amount of the methane they produce. The highest methane oxidation rate recorded in soil to date has been 13.7 mg/m2/day (Dunfield 2007) which, over one hectare, equates to the absorption of the methane produced by approximately 100 head of cattle! 2, 3

'Methane sinks' bank up to 15% of the earth's methane. Converting pasture into arable production reduces the soil's capacity to bank methane and releases carbon into the atmosphere. Fertilising and arable cropping reduce the soils methane oxidation capacity by 6 to 8 times compared to the undisturbed soils of pasture. The use of fertilisers makes it even worse, reducing the soils ability to take up methane even further.4, 5, 6

So to convert pasture to arable land in a 'quick fix' to try and grow more plant-based foods considerably accelerates the climate change situation.

And anyway let's put enteric methane (cow burping methane) into context. According to the 2014 UN Climate Change Convention held in December in Lima, Peru, the analysis of GHG's when converting other gases to CO2 equivalents found that in the US and EU enteric fermentation accounted for 2.17% of GHG emissions. (26.79% of agriculture emissions with all agricultural emissions in total being 8% of total GHG emissions).7

Have you looked into the methane output of rice paddies recently?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> It's too bad that the reactions to this article are so quickly approached as if it's a wholesale indictment of plant-based diets. Maybe it doesn't mean that veganism should be immediately stopped worldwide. Maybe it means there's opportunities to optimize what is already a mostly good thing.

The fact that an individual poster is vegan and, in his opinion, "is fine" is obviously not useful.

The fact that hundreds of millions of people in India are to some extent mostly plant based and are are "Ok" is not useful because a) they are not necessarily 100% plant based and b) what is the definition of "Ok"? They continue to live obviously but who's to say they can't be better? There are plenty of negative characteristics of Indian health - as there are for any population - that could be correlated. If there is a causal link found, maybe it would prolong life and/or life quality.

The assertion that the writer is funded by big meat is not useful. If someone says the sky is blue, the first thing to do is look at the sky to see if it's blue - not question whether or not the speaker is paid by the pro-blue sky lobby.

It's unfortunate to see cultural movements smother science. I'm not saying that this article is science or is even correct science. But until a rational discussion is allowed that even allows such an evaluation we can't know.

<comment><USER14> I think the main problem with the article is that its modest scientific content about the benefits of DHA is buried in a pile of overblown conclusions, assertions that consuming meat products is essential to good mental health, and innuendo that vegetable oils are unhealthy, none of which claims are adequately supported here.

Questions that might clarify the facts surrounding these claims are left conspicuously unanswered and unasked. Likely because the purpose of the article is not to to present the available evidence and carefully draw conclusions, but to support a diet based on animal fats by cherry picking from the science where convenient.

</comment></comment><comment><USER21> ARA has been found to be produced by a lichen, iirc, and so is now available as a vegetarian supplement. (It may or not be vegan, depending on whether you consider lichen animals.)

EDIT: I remember imprecisely. For more information, [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6052662/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6052662/) (2018)

</comment><comment><USER22> Be careful. This article's sole purpose is to help sell decades' worth of toxic fish oil supply that's become worthless in light of more in-depth research. DHA accumulates in the brain with age and dementia as esters of cholesterol.

[http://raypeat.com/articles/articles/fishoil.shtml](http://raypeat.com/articles/articles/fishoil.shtml)

</comment><comment><USER23> Talks given by this person includes "Attention: Is your diet causing your ADHD?" and "Beyond Medication: How to Improve Mood, Attention and Memory Through Diet." I hope you caught her talk at the "Boulder Carnivore Conference" last month!

</comment><comment><USER10> This is nonsense. I've been a vegan for years and do not supplement DHA or EPA. My body converts everything from ALA. My blood levels are great.

There is no such thing as clinical DHA defiency established in the literature. What regulates ALA metabolism is poorly understood, but it seems when you don't get DHA and EPA your body does fine, as evidenced by every vegan alive.

Also there isn't much DHA or EPA in a diet that includes fish. You can't get the 1.5g a day that's recommended by eating fish or eggs in your diet. Yet humans were doing just fine before fish oil supplements.

</comment><comment><USER24> There's a phenomenon known as "rabbit starvation" that is related to this. Rabbit is an incredibly lean meat and apparently you can eat and eat and eat and still be hungry.

[https://en.wikipedia.org/wiki/Protein_poisoning](https://en.wikipedia.org/wiki/Protein_poisoning)

</comment><comment><USER25> Ramanujan was vegetarian, many other geniuses, too: [https://www.care2.com/greenliving/10-genius- vegetarians.html](https://www.care2.com/greenliving/10-genius- vegetarians.html)

</comment><comment><USER26> There are plenty of life long vegetarians in India so this article seems nonsense. I would agree that people should watch their diet and make adjustments but categorically declaring that we need animal fat doesn't make sense.

<comment><USER27> From my travels it seemed that most Indian vegetarians were happy to drink milk, and quite a few ate eggs.

<comment><USER28> It reminds me of a vegetarian restaurant owner in India, who told me he followed the advice of his guru: from the egg comes a chicken (so no), from the milk comes no calf (so yes).

<comment><USER15> Except there is only milk because there was a calf at some point, which was taken away from its mother and sold for veal if it was a male calf or turned into another milk machine if it was female.

Milk cows are forcibly impregnated year after year to keep their milk flowing. All this shortens their lifespan to 4 years instead of their natural 20.

Milk is a product of cruelty.

<comment><USER29> This sounds like udder nonsense

</comment></comment></comment></comment></comment><comment><USER30> Here is the author's personal website if you're interested in more information on the subject.

[https://www.diagnosisdiet.com/](https://www.diagnosisdiet.com/)

</comment><comment><USER31> The article mentions coconut oil which seems to be a big mystery. Some people say it's long chain saturated fat which is bad, but others say it's actually medium chain and good for you.

</comment><comment><USER32> I am a vegetarian, and consume very little animal fat. My brains works just fine. Generally this article goes against massive amount of evidence that vegetable fats just healthier than animal fats.

<comment><USER33> "My brains works just fine"

What if the article is true and you are only using, let's say 80% of your capacity.

It will be fun if you try to make some Sudoku or something similar and test the time, then eat those animal meat and try it out.

eg: When I drink coffee I become at least 20% better solving problems

<comment><USER34> > When I drink coffee I become at least 20% better solving problems

That's intereseting. Is this something you have measured, logged, and accounted for other factors (e.g. via double-blinding etc)?

</comment></comment></comment><comment><USER35> i'm not sure which side has the better balance of evidence, but, FWIW, one argument i've seen on the other side of this discussion is: DHA/EPA are highly polyunsaturated and, at human body temperatures, oxidize more easily than they do at cold water fish body temperatures.

so, by consuming pre-formed DHA/EPA on a regular basis, the argument goes, a human body must bear the burden of dealing with a fat that oxidizes readily and damages other bodily cells.

</comment><comment><USER36> Any anthropologist or scientist worth their salt knew this for years. Cooking meat is one of the main reasons fire was controlled, and anyone who didn't eat meat was usually for religious reasons or during a famine.

I'm just as appalled as anyone else when it comes to the ethical treatment of animals, but to deny that we didn't evolve to be omnivores despite overwhelming evidence is... well it's silly.

<comment><USER37> That's not a very effective argument for doing it _now_.

Whatever drove our ancestral evolution is no longer a major part of our environment. We selectively bred plants and animals, wiped out various diseases and created environmental pressure for others to change, and the development of preservatives and refrigeration and cheap long-distance travel means we can combine foods which our ancestors could never find in the same place at the same time.

Plus the whole 33 year life expectancy at birth/54 year life expectancy if you reached 15 in the Paleolithic.

</comment></comment><comment><USER7> [deleted]

<comment><USER38> Re-read the article.

ALA->DHA reformation has an efficiency of less than 10%. The point that is made here is that you certainly have to ingest a lot of ALA rich food to make that work, and it is not recommended for children at all because of brain development. Furthermore, DHA levels ARE lower in vegans and vegetarians.

So either you claim the human body actually does not need DHA, or you you claim that the body can do ALA->DHA. In the latter case, the article talks about it.

<comment><USER10> DHA levels in blood being lower doesn't mean much if they get enough DHA. Higher blood levels may mean those people consume more than is needed. AFAIK there is no clinical DHA deficiency established by the literature.

Consider that diets that include fish don't get anywhere near 1.5g a day of DHA, and that many humans didn't eat fish at all. Fish oil supplements are a relatively recent phenomenon that came about without any evidence of deficiency.

I don't consume any dietary DHA or EPA and don't supplement. I'm fine, as is every person like me (vegan or not).

</comment></comment></comment><comment><USER39> I love pork chops, steak, lamb and eggs. Nothing wrong eating any meat products. Now I do have issue on how they are raised because I believe it affects the quality of the meat. But you have to be honest with yourselves. These animals have been modified for human consumption. They are not what nature intended them to be. Cows are almost completely different to what they were originally. Chickens are like 3 times bigger than what they used to be. These animals have been made to be eaten.</comment>


List of software product dimensions - <AUTHOR> https://www.ebgconsulting.com/blog/the-7-product-dimensions-a-guide-to-asking-the-right-questions/ <comment><USER2> Thank you, the article is very to the point, easy to understand and interesting. I'd maybe add 'product' and 'maintenance'</comment>


Is there a smear campaign against Zoom? - <AUTHOR> I keep seeing all these popular anti Zoom posts online... some of them raise fair concerns, but the timing and consistency seems weird.
puts tinfoil hat on
Looks almost... squints ... organized.
How did this start? What is going on? Any good detectives here? <comment><USER2> More likely, I think, that lots of devs are being asked/instructed to install it, perform due diligence and are not happy with what they find ...

<comment><AUTHOR> Maybe... hell of a due diligence though. These guys are digging deep into the fine print.

</comment></comment><comment><USER3> I doubt it. There are organic incentives for both these stories to appear and for them to get a lot of attention on HN.

Please see [https://news.ycombinator.com/item?id=22751116](https://news.ycombinator.com/item?id=22751116) for more.

<comment><AUTHOR> I agree with your points

</comment></comment><comment><USER4> related "Ask HN: Why so many negative news about Zoom on HN recently?" [https://news.ycombinator.com/item?id=22743303](https://news.ycombinator.com/item?id=22743303)

<comment><USER3> Thanks; I'll reply there too.</comment></comment>


Ask HN: Do you have separate users for work and personal stuff on your Mac? - <AUTHOR>

Just received a new Mac from my workplace, and I was wondering if it was a good idea to have a user for work/development, and another one for games and other stuff. Any thoughts? <comment><USER2> I had that idea for a while, but I just keep separate spaces (or whatever OS X's multiple desktops are called now). In the end, I didn't find that there would be any conflicting accounts, etc. so I didn't find a need for it. I do usually use separate browsers though, to keep tabs and history separate for work/personal life.

</comment><comment><USER3> I do - the remote access I have requires running flaky Java apps in untrusted mode and that's not something I want to let loose in my personal stuff.

</comment><comment><USER4> I would advise against using a computer provided by your employer for personal activities or storage.

<comment><AUTHOR> Could you elaborate on that?

<comment><USER4> First, when you part ways the machine returns to the employer. Depending on how suddenly it happens you may completely lose whatever personal items you had there.

Second, if there is any conflict and you've used --say-- your personal email to discuss what's happening, they can access it and/or use it against you.

Finally, if you have any personal side-projects they can justifiably lay claim to it because you're using their property for what you may have considered your "non-work" activities.

<comment><AUTHOR> Those are good comments. I have some clause in my contract regarding side- projects and I'll definitely look into how using their stuff affects it. For now, I guess I'll just use it for work and games then... Thanks for your comment.</comment></comment></comment></comment>


Clickpass enables Hotmail, Yahoo, Google and Facebook through OpenID - <AUTHOR> http://www.techcrunch.com/2008/06/26/clickpass-adds-google-facebook-yahoo-and-hotmail-to-its-openid-gateway/

<comment><USER3> Is there any reason why Clickpass is _better_ than the solution of choosing a base password and then simply modifying that based on the websites I visit?

For example, "computer" is my base password, and for [f]aceboo[k] it would be "computer-fk". This isn't how I do it, of course, but it's a similar process that only requires me to memorize one password and take 5 extra seconds to tack on any additional characters.

If someone can justify the number of privacy issues -- and let's be honest here, any determined and skilled hacker WILL compromise these high-value systems -- over my few extra seconds I will glady sign up for Clickpass.

Edit: And just to clarify, I'm not trying to knock Clickpass here, I'm seriously asking about what is the real benefit of this system over mine.

<comment><AUTHOR> Hi Kirse, The value with Clickpass is not just in its privacy and security but how easy it makes it to sign up for a site.

We've found that most people don't want to have to use any password anywhere so we're concentrating on making sure they can get on with what they need to do without doing so and that doing that is easy for a site to support - <USER2> Nixey (Clickpass co-founder)

</comment></comment><comment><USER4> I went to clickpass.com, selected "log in using my Google account", entered the password at the google page I was bounced to, and now see:

"Warning! This website is registered with Google to make authorization requests, but has not been configured to send requests securely. We recommend that you continue the process only if you trust the following destination"

Seems like if you're going to make a business out of this, splatting a big warning like that in front of your users may be something worth fixing.

<comment><USER5> You would be amazed at how much time I have spent trying to remove that warning. But yes, I will fix it!

Here is my question regarding the issue on google groups, just in case any of you have an idea: [http://groups.google.com/group/google-help- dataapi/browse_th...](http://groups.google.com/group/google-help- dataapi/browse_thread/thread/5893816ff68a689e)

I think I am just going to write a python script to do it instead.

<comment><USER5> I have fixed it!

No more warning. Thanks for your patience.</comment></comment></comment>


Show HN: iOS Device info done right - <AUTHOR> https://github.com/Nirma/UIDeviceComplete <comment><USER2> I'm not so sure deciding things based on a hard coded list of models is such a clever idea. It smells like the UserAgent header on the web.

</comment><comment><USER3> Why would you want to change layout on a switch statement? That feels very early 2000s web. Just use auto layout and constraints so that all of the new iPad split screen stuff and any new device sizes comes free.</comment>


Top 5 reasons to outsource software development - vasya-gh https://perceptionbox.io/remote-teams/top-5-reasons-to-outsource-software-development/ <comment><AUTHOR> Outsourcing is for big companies that care more about process (timecards being accurate) than the product detail. For example, governments, insurance companies, banks, etc. These companies are focused on the big picture, not where the buttons go on the UX, how fast the code runs or even how much it costs to run the code.

Many startups have stumbled upon outsource traps --they wind up breathing like a defeated Darth Vader, with "MVPs" developed offshore (not just India, all over Asia, Eastern Europe and South America) that don't even run (screenshots from "that time they ran for a while" and zip files of code), usually tethered to some awful and expensive AWS system that supports a few users (instead of tens of millions --with "elastic scalability"). There is usually almost no money left, (seed) investors are screaming at them, they are having emotional problems from the stress, there is nobody within arm's reach (though I heard of one guy once who actually flew as close to St. Petersburg as he could without entering Russia just to meet with the sales manager of the "team" that ripped him off and surprise attack him.) There are lots of reasons, generally code that was designed NOT to be maintainable by competing "teams", code that looks like a child wrote it and will never scale, code that is missing key components to compile, code that contains "heavy lifting" problems (floating stack corruption, null pointer dereferencing, leaks, etc.) It's hard to blame the line-programmers (excuse me, "developers" lol) either --they are small cogs in a big f'd up system. Startups here on YCombinator, steer clear of outsource traps!

</comment><comment> vasya-gh The best reasons to outsource software development are all tied to business requirements. The same reasons apply to startups and enterprises. Enterprises may be better equipped to hire their own in-house development teams. However, doing so isn't always a wise investment.

</comment><comment><USER2> get ready for a lot of phone calls and arguments (especially over cost) as you debate the meaning of sentences in specification documents.</comment>


Network stack specialization for performance - <AUTHOR> http://dl.acm.org/citation.cfm?id=2535779 <comment><AUTHOR> With conference PDF here:

[http://conferences.sigcomm.org/hotnets/2013/papers/hotnets-f...](http://conferences.sigcomm.org/hotnets/2013/papers/hotnets- final43.pdf)</comment>


MeMeTeSt.OrG – AdVaNcEd MeMeOrY DiAgNoStIc ToOl - <AUTHOR> http://www.memetest.org/ <comment><USER2> Is writing it in mixed case really necessary? Really doesn't make me want to click the link.</comment>


Ask HN: For your side-projects, how do you avoid the 'money' question? - <AUTHOR> I've been working on side projects for the past 3-4 years on whatever caught my fancy and have thoroughly enjoyed experience and the rabbit holes some of them have led me into. I like it and I feel I'm at a point where I want to get more people involved in side projects. But, any discussion about these projects with (nearly) anyone ends with 'How will you make money'. I don't have a way to avoid or answer that question without losing people's interest. I'm curious about how others handle that one.<p>To be clear, I do not work on side projects for money. Neither do I intend to. Thats what my day job is for. I just want to involve more minds interested in similar things that I'm racking my head against. <comment><USER2> Hackerspaces are full of people who do it because its fun.

guerrilla knitters. billboard spraypaint agitators. music makers in pubs. choirs. scratch orchestras. the guy who makes kites or the professor who shows kids how to do astronomy on street corners.

the mens-shed movement is about older people (yes, I know the name is offputting but they aren't all men actually) who are bored and have skilz. Also, not about money.

likewise tool libraries. or, computer upcycler schemes for the unemployed: these are people who do things because they think they are worthy (tm)

It may be you need to lay it out in front, that nobody is going to get rich and very possibly building the worlds first custard-throwing robotic tyrannosaur is going to cost a lot of money, having said which ROAAAAR - Splat..

</comment><comment><USER3> If I were you, I would answer with this eloquent quote: "I do not work on side projects for money. Neither do I intend to. Thats what my day job is for. I just want to involve more minds interested in similar things that I'm racking my head against"

I seriously don't know a better way to put it. Why not use your own words?

</comment><comment><USER4> Many people have side-hustles in which money isn't —at all— the goal. Generally, they like creating stuff (software, bikes, whatever, really) and the process is what they truly enjoy.

Try to find like-minded people at Meetups

<comment><USER5> It's just a language argument, so there's no "right", but to me "side-hustle" implies money-making or at least career-building, as differentiated from, say, a "hobby" or a "pastime" which mostly costs money (or for some people, maybe includes enough transactional stuff to break even).

And then "side-hustles" became fashionable, so people talk about getting into coffee, or beer, or fixies, or ukulele orchestras, or scuba diving - as their "side-hustle".

I "play with" coffee making, electronics, drones, motorcycles, electric bicycles - none of them are a "side-hustle".

</comment></comment><comment><USER6> Have you tried framing it as _pro bono_ or a _not-for-profit project_?

I know of a non profit project that tried to set up a formal non profit corporation and ultimately threw in the towel. It still exists. It still does what it has always done. But there is no board, no heavy paperwork, no budget, etc.

It's run as a website and a collection of email lists, same as it ever was. Trying to turn it into a formal non profit turned out to involve a lot of hassle and, seemingly, little to no upside -- or, at least, not enough upside to make the bureaucratic overhead make sense.

</comment><comment><USER7> Especially side projects can avoid that question, as long as they can stay at the side. I love them for that.

(And I also prefer to take either no money or decent money for jobs for friends and acquaintances. The middle ground just lacks in reward, monetary and in gratefulness.)

It's more difficult for something that you have to invest time in heavily to have any form of success. That's when this question has to be answered and might be the most important one.

</comment><comment><USER8> I work solo on my latest side project, but if I were recruiting others I would think of my side project as a mini nonprofit. How do nonprofits recruit talent despite the (usually) bad pay?

It could be that the utility of working for an organization whose mission they are passionate about outweighs the money they "lose", or it could be something else, but it's a good place to start.

</comment><comment><USER9> Also depends a bit on the thing you work on. But we have used local arts funding for this. It helped us be a little bit more formal, while having a small amount of money for the people helping out. It does comes with its paperwork/obligations though

</comment><comment><USER10> I don't know about you, but I often do side-projects to learn things. It try apply my knowledge into something to understand it. Maybe you have the same reason and you can say it's for improving or maintaining your competence.

Also, perhaps you shouldn't think too muchs about how to justify things you do to others.

</comment><comment><USER11> I have an excel sheet with the following:

Project Name - Project Description - Learning Potential - Earning Potential

The one with a 'Y' in both the last columns are I prefer to work on. They are very rare though!

</comment><comment><USER5> I quite enjoy avoiding "the 'money' question" by doing things so stupid that nobody would ever think it was a "business", or so grey-area that nobody would ever expect me to associate my real name with it...

</comment><comment><USER12> Call it a hobby. A side-project has to sustain itself to be able to continue existing. I think that's what confuses people.

As for the money question , one can just say "i might sell it"</comment>


What is CSS? A simplified introduction to CSS - <AUTHOR> https://freeborncharles.com/what-is-css/ <comment><AUTHOR> A simplified introduction to CSS</comment>


Quill – C++14 Low Latency Logging Library – v1.4.0 released - <AUTHOR> https://github.com/odygrd/quill <comment><USER2> It seems really interesting</comment>


Google, the Wassenaar arrangement, and vulnerability research - <AUTHOR> https://googleonlinesecurity.blogspot.com/2015/07/google-wassenaar-arrangement-and.html <comment><USER2> A couple of items I'd like to add: (I'm Founder/CEO of a busy infosec biz)

While infosec is currently a smaller sector in startups than say social, casual gaming, apps, etc, it's growing furiously and Wassenaar and individual country regs will be top-of-mind for much of the YC community in the years to follow because many of you will be in this space.

I'd like to emphasize one of Google's points: "Global companies should be able to share information globally." With existing laws we are already running into limits on where we can hire and what our own internal staff can send us. So it really is critical for any small or large global org that internal comms are not squashed by this.

BIS's comment period ends today, so if you want to take action, now is the time. As in, before COB today.

One last thing: The Hacking Team compromise and stolen data (including the zero-days they were hoarding) couldn't come at a worse time. It is fuel for the argument that zero-days, vulnerabilities, vectors etc should be tightly regulated and it's really thrown some weight behind the argument to close borders (WRT info exchange) rather than open them. So your help is really needed on this if you think you should be able to have open conversations about technical infosec issues with your colleagues in other countries.

~mark

<comment><USER3> > "Global companies should be able to share information globally."

This is an interesting point, and to me it seems to be pitting global companies against individual countries. This makes me feel uneasy because I feel there's a better chance my government is looking out for my best interests than many global companies are. Am I just being paranoid and naive?

<comment><USER2> That's a really big debate: small vs big government, Keynesian vs Hayekian economics, public vs private sector and so on. I'd say from my side that government and private sector have a role in protecting you.

Government tends to excel at things like air traffic control and lighthouses where there isn't much scope for competition and where competition may harm. Private sector tends to do things more efficiently when competition is feasible.

So both have a role and the role of private sector is an important one. If we pass laws that restrict innovation, the risk is that things that would normally be in private sector will become government roles and won't be done as efficiently or as effectively as they could be.

I'd say at the rate we're seeing attacks escalate, providing the most effective protection we can in infospace is very important. I'm completely ignoring issues like investment opportunities, job creation and so on because I think the core problem we're all trying to solve is to protect individuals and businesses. We need to get that right first and move from there.

<comment><USER4> I'm sorry but I don't see how a private company "protects" you in any way.

<comment><USER5> It doesn't have to be about protection. Just about serving your interests. When my country privatized the phone system, the time to get a phone line installed dropped from 3 months to 5 days (because suddenly they were motivated to get it installed as soon as possible so they could start making money).

</comment></comment></comment></comment></comment><comment><USER6> I have quite an interest in this area too. Here are a few things that may help:

1) Commercial Penetration Testing Software is already controlled. Here's a self-post to reddit on how these controls work and apply today:

[https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_...](https://www.reddit.com/r/netsec/comments/36obxt/what_i_know_about_us_export_controls_and_hacking/)

If you choose to comment; it's helpful to understand the current law and how it works. This way it's easier to know what to ask for.

2) If you use software that may be controlled (for example: pen testing software); this issue affects you. Here are a few suggestions of things you could put in your comment:

[https://www.reddit.com/r/netsec/comments/3dusae/the_public_c...](https://www.reddit.com/r/netsec/comments/3dusae/the_public_comments_on_the_proposed_wassenaar/ct9rjqu)

3) As of last night, there were 101 public comments posted. Most were far below the quality you would hope for a good discussion on HN, let alone a note to a policy maker to request a change. If you have an interest in this area and have something constructive to suggest--the public comment process is your opportunity to do it.

[http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb...](http://www.regulations.gov/#!docketBrowser;rpp=25;so=DESC;sb=postedDate;po=0;dct=PS;D=BIS-2015-0011)

</comment><comment><USER7> >You should never need a license when you report a bug to get it fixed

That hampers people that wish to publicly disclose or sell vulnerability information. This is massively biased in favour of software companies (to some extent, like Google). You should never need a license to disclose vulnerability information, full stop.

>Global companies should be able to share information globally

Why should this be limited to the employees of a company?

<comment><USER8> _Public_ disclosure apparently won't require a license anyway:

> Third, export controls do not apply to any technology or software that is > "published" or otherwise made publicly available.

[http://bis.doc.gov/index.php/policy- guidance/faqs#subcat200](http://bis.doc.gov/index.php/policy- guidance/faqs#subcat200)

(The FAQ also states that information about vulnerabilities, as opposed to how to exploit them, would not be controlled, but I believe Google if they say the legalese is insufficient to establish this.)

I agree that defining boundaries rigidly in terms of companies would be limiting in today's world and especially in infosec.

In general, though, I personally really despise the practice of selling vulnerabilities for the purpose of enabling people to attack others with them - which in practice means selling them to anyone but the vendor, or intermediary organizations like ZDI. True, there are so many ways for this to go wrong... but I cannot join with some of the infosec people who blast any regulations on the industry as inherently harmful, infringements of freedom of speech, useless against the real bad guys, etc. Even as I hesitate to even _think_ in terms of things like 'increased threats' or 'acceptable infringement', or oppose 'absolutist thinking', considering how harmful such ideology has been in other, quite different but analogous realms (surveillance, airport security), and while I have little faith in the ability of a government so hyped up about "cyber" threats to avoid serious blunders, I simply cannot bring myself to find the current almost total lack of regulation in infosec, which you hint at in saying a license should never be required to share information, acceptable.

<comment><USER9> There is a very simple reason why "regulation" in this space will never do anything useful. The cost of entry is very low (an individual can find vulnerabilities without any specialized infrastructure or organizational backing), and the value of vulnerabilities is high. It's basically the war on drugs if drugs could be transferred over the internet. Worse, the majority of the offenders are not in your jurisdiction to begin with, and they never have been or will be.

It doesn't matter what law you pass, you will not stop this from happening. But just because passing laws can't do any good doesn't mean it can't do any bad. Bad laws can still do plenty of harm to the good guys.

The best thing the government could do in this context is to be the highest bidder and then immediately disclose the vulnerabilities to the vendors.

<comment><USER8> As much as I would like the government to make such bids, I don't agree regulation is useless. Sure, no policy can completely prevent zero days from being sold - in fact, this particular policy doesn't even try; it just limits who you can sell them to. But if that means that organizations and individuals who wish to remain respectable and avoid any trouble with the law, however unlikely it is to be enforceable in practice, limit their trade to _quite_ nefarious actors rather than _extremely_ nefarious ones... it's better than nothing.

edit: that is, it's better than nothing if it avoids harming the good guys too much, and as I said, I am skeptical of many of the critical comments that have been made, though, buying Google's, I hope the rule will be amended. Argh, I'm too tired to express myself properly.

<comment><USER9> > that is, it's better than nothing if it avoids harming the good guys too > much

In theory there is an ideal rule with ideal enforcement that will cause less trouble than it prevents. But as Yogi Berra once said, in theory there is no difference between theory and practice; in practice there is.

Here's a example of a serious problem this actually causes. Suppose Nefaristan is on the list of places nobody can sell to. The evil government of Nefaristan will just send an operative to Jordan or Saudi Arabia or whatever nominally less nefarious place didn't make the list, and buy their exploits there. So either way the evil government of Nefaristan will have embargoed exploits to use against against their domestic dissidents. The dissidents need the embargoed patch right away or they'll be found out and executed. But now the stupid law prohibits anyone from giving it to them because they're in Nefaristan.

It's difficult to imagine how a law could fail harder than "helps bad guys send good guys to death camps" \-- but here we are.

Causing serious harm is not better than doing nothing.

<comment><USER8> Having read the definitions of what is controlled in the proposed rule, I'm pretty confident a patch wouldn't come close. And in any case, since the rules don't apply to public software, that only matters in the case of _private_ patches, which aren't really a thing, and would be a pretty big moral hazard if they were.

<comment><USER9> Most patches inherently reveal the vulnerability they fix. Patches not being controlled would be a loophole big enough to fit a whole planet through.

And private patches are a thing. Vendors often distribute an early version of the patch to major customers for validation testing.

Or if you like, substitute "patch" for vulnerability information that enables a workaround. You can defeat Heartbleed by turning off TLS heartbeat support but that information is enough to quickly reverse engineer the vulnerability.

<comment><USER8> Out of curiosity, have you read the actual proposal?

<comment><USER9> The actual proposal is dozens of pages of legalese that would take a team of lawyers a week to decipher. I have no idea what it says because it is totally incomprehensible.

That's half the problem. If you're AT&T or Google you can hire said team of lawyers to tell you what it says, but what is an individual graduate student or security consultant supposed to do?

The other half of the problem is that what it says doesn't change the outcome, because the insolubility of the issue comes from economics rather than policy. There is no policy that will keep vulnerability information out of the hands of the bad guys _only_ , because there is no practical way for most people to even identify who the bad guys are.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Are these governments completely insane? Not allowing security research or even reporting bugs without getting a license is the stupidest thing I've heard in my lifetime. The internet cannot be regulated in this fashion without destroying it completely. The world is not a collection of islands we are all in this together and letting any government stand in the way of safety and security is insane.

<comment><USER11> I don't believe this was intentional. Wassenaar is an arms control agreement - the intention was probably to regulate the sales of weaponised exploits, not basic research. It's an overreach.

<comment><USER12> A lot of research will be very close to weaponised. Just browse googles bug tracker and you will find PoCs for a lot of their vulnerabilities.

</comment></comment></comment><comment><USER13> The problem I have with this sort of arrangement is that the more rules they put in place on lawful disclosure, the more they hamper the good guys who follow the laws and the more of a comparative advantage that gives to the bad guys who can simply ignore the laws.

We really don't want to hand the bad guys any more advantages than they already have, no matter how good our intentions are.

</comment><comment><USER14> Hey there,

if anyone wants some more background on all the negative side-effects of the current regulation, I wrote a lengthy blog post on the problems with the current phrasing of the Wassenaar amendments here:

[http://addxorrol.blogspot.ch/2015/05/why-changes-to- wassenaa...](http://addxorrol.blogspot.ch/2015/05/why-changes-to-wassenaar- make.html)

(Background: I am a security researcher who designed industry-standard patch analysis algorithms / software, built algorithms & a startup for malware reverse engineering that was acquired by Google, pioneered several exploitation techniques, and worked heavily on the recent Rowhammer vulnerability)

</comment><comment><USER15> Wired had a "call to arms" a few days ago over this comment period: [http://www.wired.com/2015/07/moussouris-wassenaar-open- comme...](http://www.wired.com/2015/07/moussouris-wassenaar-open-comment- period/)

</comment><comment><USER16> > Global companies should be able to share information globally. If we have > information about intrusion software, we should be able to share that with > our engineers, no matter where they physically sit.

This statement goes through just as well when applied to missiles, nuclear engineering knowledge, bio-weapons knowledge, etc.

Governments have decided that they wish to use commercial entities as a proxy method for protecting the status quo. If Google wish to challenge that policy then, well, OK. But there is no reasonable argument for making a special exception for "cyber security" over other forms of security-related engineering.

<comment><USER17> The key difference between those technologies and this is that industrial production hardware (centrifuges or specialized biological equipment, etc) are needed in addition to specialized knowledge of the topic at hand. These additional requirements make export controls a lot more enforceable, and why you can, say, send regulators to the site of a nuclear engineering facility and get a reasonable answer about if they have sent nuclear materials to another country.

With infosec this would be basically impossible, since the specialized knowledge and the equipment are both non-physical and intimately entwined.

<comment><USER18> This is not a practical distinction with regard to the legislation.

A word document describing the specification for an export controlled technology is as prohibited from export as the implementation.

Having the word document on a laptop you take to another country is as much a breach of the law as shipping a centrifuge.

</comment></comment></comment><comment><USER19> Global companies can go screw themselves, Google in particular. "People should be able to share information globally." is the motto everyone including global companies should rally behind. The crypto export ban is an apt analogy and it did hinder American companies and benefited everyone else. A good thing too when the NSA started monkeying around with crypto primitives and national security letters. Anything that slows down american tech behemoths and gives room for other european alternatives is a good thing.

</comment><comment><USER20> Previous export restrictions on crypto and certificates gave non-US participants (Mark Shuttleworth) the opportunity to take up the slack and build a business where there were no such restrictions. He simply had to fulfill the demand that existed outside of the US in large part due to export restrictions.

The Wassenaar Arrangement is likely to result in similar unintended effects combined with a similar lack of intended effects.

</comment><comment><USER21> The UK and Australia have already implemented part or all of these agreements. Does Google already hold licenses in these jurisdictions? If we report a security bug to a Googler in these (or other similarly restricted jurisdictions) will they be able to share security bug details with their overseas Googler colleagues?

<comment><USER22> If I understand correctly, the UK and Australian implementations are much narrower, and much less problematic than the proposed US implementation. So presumably licenses will not be necessary in those other countries.

</comment></comment><comment><USER23> I find the "Summary of international crypto controls" at [http://www.cryptolaw.org/cls-sum.htm](http://www.cryptolaw.org/cls-sum.htm) very informative.

It shows that the _export_ controls have been in places for years and that is something that should worry us.

</comment><comment><USER18> It's probably worth remembering that there is an open source exemption. If a piece of 'intrusion software' has been published the export controls no longer apply.

Publish your exploits to github before you send them overseas or travel to the conference to announce them.

</comment><comment><USER24> Aren't cyberarms arms?

Isn't the right to bear arms an 'inalienable right'?

I don't get it. And I don't get why this is a 'privacy' or 'free speech' issue or why corporations, as Google argues, should be exceptions to the law.

<comment><USER25> You should read the whole story before commenting; this is about foreign trade in exploits.

<comment><USER24> Inalienable rights. Not civil rights.

Inalienable rights are human rights - which extend (at least in theory) to foreigners.

I read the story.

But anyway if the Supreme Court ruling holds from Zimmerman it would apply equally well to everything in the article. Of course the Zimmerman case was about foreign exports as well.

Try to be charitable.

<comment><USER24> If the downvoter needs help understanding the historical analogy that makes this above comment make sense: [https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_i...](https://en.wikipedia.org/wiki/Pretty_Good_Privacy#Criminal_investigation)

</comment></comment></comment></comment><comment><USER26> The solution is to ignore the law. Governments have no moral legitimacy and therefore no legal legitimacy.

<comment><USER27> They tend to react poorly to being ignored, though. And as a rule, they're not the ones that fare badly in such a conflict.</comment></comment>


Why do we have to use JSON for data interchange [in Elm]? - <AUTHOR> https://gist.github.com/evancz/1c5f2cf34939336ecb79b97bb89d9da6 <comment><USER2> Title should be fixed to be either one of the original titles:

> _Why do I have to write JSON decoders in Elm?_

or

> _A vision for data interchange in Elm_

The current title suggests the opposite of what the article is about.</comment>


GitHub's CommonMark Markdown renderer is now safe by default - <AUTHOR> https://github.com/github/cmark-gfm/pull/123 <comment><AUTHOR> This is the result from a library I built this monday called safemd ([https://github.com/Hultner/safemd](https://github.com/Hultner/safemd)). It didn't gain much attraction on HN but stayed on top 3 lobste.rs ([https://lobste.rs/s/szw60m/safemd_markdown_renderer_focusing...](https://lobste.rs/s/szw60m/safemd_markdown_renderer_focusing_on)) frontpage items for a full-day.

This caught the attention from kivikakk/Ashe, the primary maintainer cmark-gfm (GitHub's CommonMark renderer) and ultimately led her to change the default behaviour in their upstream library.

Show HN from this monday: [https://news.ycombinator.com/item?id=18222603](https://news.ycombinator.com/item?id=18222603)

I am humbled by the fact that my little project managed to get the default behaviour changed and as a strong believer in safe defaults I see it as a much greater success then I ever think my project could have achived.</comment>