Terraform 0.9 - <AUTHOR> https://www.hashicorp.com/blog/terraform-0-9/ <comment><USER2> I was initially a huge fan but now I hate it. It re-invents so many unnecessary wheels that it is downright obnoxious. There are no loops, if statements, variables. Things that have been in programming languages since day 1. It re-invents modules, badly. Has weird hacks like null resources and external data providers to get around shortcomings in their "declarative" model. And a few other things I'm forgetting. Oh, now they're adding "environments". That's just dandy because they got everything else so right.

Every place I've seen Terraform used invariably runs into these shortcomings and the workarounds range from using Erb and Jinja templates to generate Terraform templates to just ditching it entirely and using home-grown solutions. Terraform should have been a library in an actual programming language instead of a gimped external DSL that re-invents the wheel.

<comment><USER3> It also seems pretty much the same as ansible (which suffers the same problems as you mentioned).

I pretty much agree with you, they should of provided 2 entrypoints IMHO, they can make there DSL and all that and make it (eventually) turing complete and at the same time they should just provide composeable objects in <some> language as well.

I've never quite figured out who the target audience is for these kind of DSL(s), is it people that can't program, or people that can't program well/at all (without adult supervision)?

<comment><USER4> Apparently these people think it makes it "simpler". Well I'm sorry but me looking up how to format things with yaml and no autoformat and no intellisense just isnt good and doesnt make things simple. Even xml with a backing xsd would be better than that, but that's apparently not cool enough anymore.

<comment><USER2> I forgot about the lack of auto-complete and the horrible error messages. At least with a library when I have a syntax error or something blows up I have a debugger and the actual language at my disposal to figure stuff out. No such things are remotely available with all these external DSLs. If even there is any semblance of error reporting.

Several human centuries of effort have been spent on improving these things (syntax highlighting, auto-complete, stack traces, error messages, interactive debuggers, etc.) and then all these DSL authors decide to just chuck it all out. Boggles the mind.

More than a few times Terraform has wrapped an error message from AWS in the hopes of being helpful while hiding all the details of the actual error message and no hints how to rectify things in the DSL.

<comment><USER5> Syntax highlighting and auto complete is available for HCL (The language used by Terraform)

e.g.

[https://plugins.jetbrains.com/plugin/7808-hcl-language- suppo...](https://plugins.jetbrains.com/plugin/7808-hcl-language-support)

[https://github.com/wholroyd/vscode-hcl](https://github.com/wholroyd/vscode- hcl)

<comment><USER6> Which is great and all but like the op said our files are actually jinja2 templates because HCL just doesn't cut it.

</comment></comment></comment></comment></comment></comment><comment><USER7> Huge Terraform fan. The first time it creates VM's, disks, IPs, firewall rules it is like magic. Infrastructure definition should be code, it just makes sense.

If your looking to dive in, I wrote a short introduction blog post on getting started with Google Compute Engine.

[https://blog.elasticbyte.net/getting-started-with- terraform-...](https://blog.elasticbyte.net/getting-started-with-terraform- and-google-compute-engine/)

</comment><comment><USER8> This is great, and solves two ongoing problems we have with TF:

\- The new 'State environment' feature should resolve the issues discussed here: [https://charity.wtf/2016/03/30/terraform-vpc-and-why-you- wan...](https://charity.wtf/2016/03/30/terraform-vpc-and-why-you-want-a- tfstate-file-per-env/)

\- The new locking feature means we don't need to use [https://github.com/gruntwork-io/terragrunt](https://github.com/gruntwork- io/terragrunt)

</comment><comment><USER9> I love terraform! It is one of the few tools I've found that was easy to understand and easy to integrate with legacy stuff, and it very quickly saved me a huge amount of time.

It only took me about 30 minutes to setup a terraform file that could bring up and teardown an entire web stack with a single command. I was so shocked by how straightforward it was that I brought the stack up and down a few times just to make sure it was actually repeatable.

</comment><comment><USER10> We had a tough time with Terraform on AWS. The syntax is undeniably better than Cloudformation and having the concept of modularity built in is a big win.

However, when things went wrong we ended up with cryptic error messages and often when `terraform up` failed, then `terraform destroy` would fail too, leaving us using AWS console to jump in and start clearing up the resources. Particularly painful because AWS has no awareness that your stack came from a Terraform config, so you have to navigate through the subresource menus destroying things one-by-one.

We ended up switching over to Cloudformation. The extra verbosity does suck, but the tooling for running/updating stacks feels far safer. We can review the changeset when we update the stack, view a realtime event log as resources are created, deleted or updated, and best of all we can always tear the stack down from a single point.

</comment><comment><USER11> Amazing platform. We've recently taken about 6 months to define our entire infrastructure in Terraform. We've been using it since version 0.6 and with version 0.9, the biggest feature to come for us is definitely the remote back- end and the remote locking mechanism (which we use Terragrunt for atm). The remote back-ends mean that the state will not longer be stored on the local machine which is obviously a big plus for security as the state actually contains all of your infrastructure information and even secrets. Anyway, huge project and huge potential, so much so, I've made it the headline in my CV! Thank you Hashicorp, keep it coming!

It's allowed us to do the following for our developers:

Full integration with the CI/CD process.

Open a branch, commit it to GitHub, add a special label and you will get a completely new setup, just to test your branch. New application name in the service discovery tool (Consul/Eureka), new RDS instances, new network, etc, etc. Once happy, the developers can merge into dev and the branched version of the infrastructure is destroyed.

</comment><comment><USER12> I cannot recommend Terraform enough for teams that are looking to gut their old infrastructure deployment methods. We used Terraform ~0.7 to build out our EU VPC on AWS. After a bit of pain understanding how to build modules we were finally able to say we have our infrastructure truly in code. We were even able to reproduce our exact infrastructure deployment, with a bit of tweaking, for partner that had strict data privacy requirements. Terraform allowed us to provision a smaller scale deployment of our production deployment on their AWS account in about a days worth of work. We plan on redoing our US deployment Terraform and we we are going to POC their Pro/Enterprise version very soon

If you want a great starting point for learning how to do things the right way [https://github.com/hashicorp/best- practices/tree/master/terr...](https://github.com/hashicorp/best- practices/tree/master/terraform) helped us out a lot.

</comment><comment><USER13> Can anyone compare Fugue[0] with Terraform/Terraform Enterprise.

I'm launching a venture that requires deploying and maintaining cloud infrastructure across the three major cloud providers (AWS, GCP, Azure) and am considering options. Most of our infrastructure is kubernetes but Fugue caught my eye for their AWS deployments. Curious if anyone has used both.

[0] [https://fugue.co/](https://fugue.co/)

</comment><comment><USER14> At lot of the debate here centers on DSLs vs programming languages and I don't want to get into the weeds of that. I did use terraform extensively at a few places and generally if you want to do something simple it does a fine job. When things start getting complex and the team & infrastructure is larger...well, let's just say some warts start coming up. You more or less end up with some type of a wrapper around it.

But in another place we decided to use troposphere[0] and I liked it more (at least for AWS-only shops). A lot more flexibility and you're relying on Cloudformation to do some of the heavy lifting around states. We basically ended up with a tool based on that library which would generate deployable CF stacks (and some other things).

[0] [https://github.com/cloudtools/troposphere](https://github.com/cloudtools/troposphere)

</comment><comment><USER15> How do folks feel about Terraform vs Cloudformation for AWS-only deployments these days? Do we have a clear winner? I remember even a year back there were certain features of AWS that were being made available through Terraform first before you could configured them in CF, so the choice was somewhat non- obvious.

<comment><USER16> Terraform is great but there are certain things that I still use Cloudformation for (simply because you can't do it right now using Terraform). One example is rolling updates on your ASGs. Last time I checked you can't do it via the aws_autoscaling_group resource.

<comment><USER17> For this we have been creating the CloudFormation in Terraform itself. CF is a giant mess to work with.

<comment><USER18> A lot of people including myself have used tools to generate CF or Heat templates in the absence of a need for cross-cloud compatibility that Terraform offers. You can use Troposphere, Stacker, or anything else that can intelligently generate and manage component information as a JSON or Yaml file and get much of the power of Terraform - perhaps more given the option of a full language rather than an external, declarative DSL. I still haven't found an idiomatic, elegant API that can manage all those template references.

The primary advantage Cloudformation has for myself is a lack of need to manage the state that Terraform spends so much effort upon. In fact, Cloudformation does this fairly opaquely but was much more obvious when I tried to deploy a CF stack when S3 was down a while ago - being able to use an alternate state file location would have been handy then.

<comment><USER15> In fact our very own jdreaver wrote a Haskell EDSL for generating CloudFormation templates, this seems to be not uncommon among companies who want to do infrastructure as code with that ecosystem: [https://github.com/frontrowed/stratosphere](https://github.com/frontrowed/stratosphere)

</comment></comment></comment></comment></comment><comment><USER19> This is so cool. I literally found Terraform yesterday and I guess I found 0.9 just before the announcement. I spent the entire evening reading and trying to get it running with Linode.

I've got to say, I always end up falling in love with products with cool names, nice logos, great design and easy interfaces. Terraform and most of the Hashicorps products I've seen tick all of those boxes. I'm amazed at the quality of the tools.

However a question:

The documentation makes it really clear that Terraform is not a configuration management tool. Do I understand this correctly that it means you need another tool like Chef to run all base setup code, like install firewalls, set timezone, install other packages? I've been using Ansible to install a baseline of packages for my servers.

<comment><USER20> yes you need a configuration management tool to go with terraform. terraform is for infrastructure.

</comment></comment><comment><USER21> We're getting into using this on AWS. Plus points: it's awesomely powerful and actually useful. Minus point: the version number is not a lie, this is buggy betaware that deprecates functionality fast without looking back, and if you use it for real work at this stage you are _live beta testing_ both the software and its functionality and will tear out your remaining hair. Even given that, we're sticking with it.

</comment><comment><USER17> Great stuff.

We have been doing "state environments" using different var files and different state files for a while now, while keeping the same terraform files.

</comment><comment><USER22> What's the general pattern for making sharded applications where each machine needs to be distinguishable on that count?

For instance, say you're sharding across three machines. And now you want to up that to four. Each instance of the application is smart enough to do it provided it knows which shard it's in.

We deploy fully baked AMIs containing an application. Do you make separate AMIs per shard? Or do you supply configuration afterwards? Or do you template and generate your plan file each time?

I haven't found anything on this so I'm hoping someone can tell me.

<comment><USER23> I would prefer the image to look identical. Each host is going to have a unique name, and you're going to outsource your routing/discovery to the Client/another service anyway right?

Generally though, if there is some custom config data that must be passed on _BOOTSTRAPPING_ the node, you can use templated values for user-data on cloud- init based systems, or the remote_exec provisioner. This can even include the modified shard name (with count). If you're talking about updates _AFTER_ the machine has been in service, I do not believe this is 'officially' supported by Terraform but it can be done [0]. You may want to look into a proper CM tool w/ idempotency for that sort of thing (Chef, Salt, etc.)

0: [http://stackoverflow.com/questions/37865979/terraform-how- to...](http://stackoverflow.com/questions/37865979/terraform-how-to-run-the- provisioner-on-existing-resources)

<comment><USER22> Oh, no, definitely the former approach. All right. That sounds perfectly all right to me. I was wondering if there was a different way people did things.

</comment></comment></comment><comment><USER24> I'm running a small game on Heroku (Node.js + WebSocket) but I want to migrate it to my own DO/Linode server. However, I know nothing about servers and I'm terrified I will make all kind of security errors. Is this something I should use to mitigate it?

OT but what I really want is a service where I just click a button and they configure the server for me with automated security updates.

<comment><USER25> > _I know nothing about servers and I 'm terrified I will make all kind of > security errors. Is this something I should use to mitigate it?_

Not really.

What Terraform does is to allow you to put all your configuration in (versioned) code. So you can have all your existing configuration, and then change the relevant definitions to Digital Ocean or Linode and make the commit 'Move to DO/Linode'.

Exactly how its configured - security or otherwise - is still up to you though.

> _OT but what I really want is a service where I just click a button and they > configure the server for me with automated security updates._

Why are you moving from Heroku to Digital Ocean then? Heroku is much closer to, if not exactly that.

<comment><USER24> > Why are you moving from Heroku to Digital Ocean then? Heroku is much closer > to, if not exactly that.

It basically comes down to the daily cycling which I have no control over and the low memory on the hobby dynos. My game is constantly reaching the limit and without rebuilding the whole architecture it leaves me with either upgrading to a much more expensive dyno or migrating away.

I also miss just being able to ssh into my machine and do stuff.

</comment></comment></comment><comment><USER26> Well done guys/gals, any product that helps abstract or attempts to prevent vendor lock-in has my vote. Great work as always HC.

</comment><comment><USER27> Someone just brought this up to me, but I don't see the use if you're already using Flynn to deploy Rails apps.

Anyone actually know where this product would fall in the development pipeline? It sounds amazing.

Edit: Okay, got it, it's a configuration management application which only applies if you're manually handling your AWS containers.

<comment><USER28> Hi there,

Terraform is a tool that captures Infrastructure as Code. Flynn appears to be a PaaS, akin to something like Heroku with scheduling capabilities on top. Under the hood, there is some sort of infrastructure that Flynn is deploying to; it's providing an API on top of it to easily manage deployments and scaling. Terraform is the tool that defines the layout and composition of underlying infrastructure resources.

Another one of Terraform's strengths is that it supports multiple providers. Most of this thread mentions AWS, but Terraform also supports GCP, Azure, and DigitalOcean. But Terraform can manage anything with an API, so you can codify things like GitHub teams and permissions, DNS configuration, PagerDuty escalation policies, and so much more ([https://www.terraform.io/docs/providers/index.html](https://www.terraform.io/docs/providers/index.html)).

All of these definitions are captured in code. You can bring that code under management of source control to get peer review, pull requests, or permission models (signoffs) too.

If you are an individual developer happy with Heroku or Flynn, Terraform probably isn't the best choice for you, especially if you do not have a background in operations or you do not want to manage servers. However, most medium->large scale production applications cannot be supported by such technologies and demand a tool like Terraform to manage the complexity.

I hope that clears up the differences a bit.

Disclaimer: I work for HashiCorp, the company that makes Terraform.

<comment><USER4> So why isn't it also a replacement for ansible? I dont understand this artificially limited scope. You set machines up, why not also set up their software and repos?

<comment><USER29> I don't know a lot about terraform, but it sounds like they are very different things? Terraform talks mostly to cloud provider apis, ansible usually deals with running code on the servers themselves.

</comment></comment></comment></comment><comment><USER30> Wrote this recently:

[https://medium.com/@zwischenzugs/dynamic-terraform- environme...](https://medium.com/@zwischenzugs/dynamic-terraform-environments- eabaf01f85df#.2b9djqu48)

is there a 'proper' way to create dynamic environments?

</comment><comment><USER23> Great changes! State environments is the feature that stands out the most for me. Currently, this is done by managing different sets of TF VARs. That's not going away, but this should allow for more nuanced modules.

</comment><comment><USER31> I hope they will fix their VMWare + Docker compatibility. I love terraform, but right now i need to delete manually my VMs to avoid terraform apply crash on trying to capture IP addresses from VSphere.

</comment><comment><USER32> For anyone else annoyed that there's no RSS feed: [http://feed43.com/0475703031862353.xml](http://feed43.com/0475703031862353.xml)

</comment><comment><USER33> I'm not yet ready to jump into docker and the likes, and I've used terraform for setting up the infrastructure for a 3-tiered project and I was extremely pleased with this tool.

</comment><comment><USER34> [https://gitlab.com/tvaughan/terraform-aws- starterkit](https://gitlab.com/tvaughan/terraform-aws-starterkit)

</comment><comment><USER35> [Serious] if I'm already happy using CloudFormation for AWS, and I don't plan on supporting AWS + another cloud, is Terraform for me? Or is it for other use-cases?

<comment><USER36> Hey there, I'm one of the creators of Terraform. Honestly, if you're happy using CloudFormation and you're sticking with AWS, just stick with CloudFormation. Terraform will be around when/if circumstances change and it'll be better than ever by that time. No rush if things are working for you.

The best time to look into something like Terraform is if you begin managing more than just AWS resources. Even so, you can choose to use CF for AWS and TF for non-AWS. Or, if you want to start taking advantage of the higher-level features Terraform is beginning to support.

At the end of the day though, I'm a big fan of working with what you're most expert with until circumstances require otherwise.

<comment><USER35> Hey thanks for the swift response -- you have plenty other stuff to get to, I'm sure.</comment></comment></comment>


Why the number 137 is one of the greatest mysteries in physics - <AUTHOR> https://bigthink.com/surprising-science/why-the-number-137-is-one-of-the-greatest-mysteries-in-physics <comment><USER2> Actually, the number is 1/137.03599913.</comment>


Show HN: New webapp - Digital scrapbook meets time capsule - <AUTHOR> http://capsoul.com

<comment><AUTHOR> I'm happy to share with the HN community our webapp: It allows anyone to capture their photos, videos, webcam, music, text, and even the user's own voice in a digital scrapbook, and then privately send and share their creation with others. The Capsoul can be delivered immediately or scheduled to arrive in the FUTURE. And the recipients get to download all the original assets.</comment>


Plan B - <AUTHOR> http://www.techcrunch.com/2008/06/01/plan-b/ <comment><USER2> Honestly, I have to agree with a lot of the commentators on TC. I am not quite sure what Steve was getting at there. Anyone else feel this way? And if someone did figure out what he was getting get, care to elaborate?

<comment><USER3> The writeup makes no sense. It doesn't even meet basic standards for english grammar and understandability.

From the page: "On Microsoft's side, Twitter needs to end the rivalry between Exchange and SQL Server on the delivery side"

<comment><USER4> wow, and I thought it was just me. Seriously, did he read (and re-read) what he wrote before he published it?

</comment></comment></comment><comment><USER5> My theory is that Techcrunch is experimenting with someone's technology demo for writing Op-Eds with AI.

Either that or the writer took one bonghit too many before sitting down to write.

It sounds visionary but it's really incoherent.

</comment><comment><USER6> Spolsky once dissected a rant by Steve Gillmore only to comment that _"It took me over three hours to research and explain all this, and, as you'll see if you follow closely, Gillmor's entire argument fell apart under scrutiny, so I don't think I'm going to be doing in-depth explanation like this again."_

<http://www.joelonsoftware.com/items/2006/12/23.html>

</comment><comment><USER7> _Mesh abstracts devices and operating systems into objects that can be coordinated and orchestrated to deliver the appearance of a single or composite device. That's the guiding principle behind virtualization, which permits applications to address these virtual devices as single entities while spreading computational load across machines, domains, and business processes._

This is gibberish.

</comment><comment><USER8> Please, no more cross-posts of Steve Gillmor's rambling stream-of- consciousness TechCrunch essays? Or at least include "Steve Gillmor" in the headline, so we know there's no news content?

</comment><comment><USER9> Makes no sense!

Sounds like it came straight out of this: <http://pdos.csail.mit.edu/scigen/>

</comment><comment><USER10> Honestly, does anyone know where Steve Gillmor even came from? I had never heard of him until 2-3 months ago, when TechCrunch started making a play at the "Gillmor Gang", and then gradually started phasing in his posts. As bad as his prose is, he's not much better as a podcast host-- he's rude, unapologetic, and generally condescending to his "guests". You get the same sense from his writing.

</comment><comment><USER11> "In the past, you could measure Microsoft's success by others' weakness"

Do people actually have that mentality?

<comment> E-Ray I don't think people have that mentality to judge anyone base on people's weakness, maybe majority judge them by the percentage profit compare to time?

<comment><USER11> I'm just a bit bugged that someone actually thinks that's how the industry works.

</comment></comment></comment><comment><USER12> I bet Steve Gillmor can't code.</comment>


Apple is still tending its walled garden - <AUTHOR> https://www.theverge.com/2020/8/11/21362820/apples-big-sur-news-xcloud-walled-garden <comment><USER2> Steve Jobs knew since the early days that the secret to repeated profits is lock-in. Walled gardens are what people talked about before using the term "moat".</comment>


Your mobile data sold, without your knowledge - <AUTHOR> https://translate.googleusercontent.com/translate_c?depth=1&nv=1&pto=aue&rurl=translate.google.com&sl=auto&sp=nmt4&tl=en&u=https://www.nrk.no/norge/xl/avslort-av-mobilen-1.14911685&usg=ALkJrhg2E3Kd2UU0k_J_BzxLhiHxavYOcA <comment><USER2> The article assumes that the location data must have been collected because he gave an app permission to access his location. I bet they couldn't figure out which app it was because it wasn't an app.

Cell service providers _can_ and _do_ track your cellphone location. All they have to do is measure the signal strength of your cellphone at different towers, and they can triangulate its position.

[https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty- hu...](https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty- hunter-300-dollars-located-phone-microbilt-zumigo-tmobile)

I'm not familiar with other locations, but in the US, you only have the choice between three cell service providers. _All_ of them admit to selling their own customer's location data to third parties in their Privacy Policies.

AT&T [https://about.att.com/csr/home/privacy/full_privacy_policy.h...](https://about.att.com/csr/home/privacy/full_privacy_policy.html)

Verizon [https://www.verizon.com/about/privacy/full-privacy- policy](https://www.verizon.com/about/privacy/full-privacy-policy)

T-Mobile/Sprint [https://www.t-mobile.com/privacy-center/our- practices/privac...](https://www.t-mobile.com/privacy-center/our- practices/privacy-policy)

Remember, you're _paying_ for these services. But they still sell you out.

I seriously recommend you read the privacy policy for your provider. It seems they collect as much data as possible (not just location, also browsing history and a whole host of other metrics) and share it with as many different parties as possible.

If you are using a cellphone, your location is being tracked. Period. You can't avoid it. Even TOR isn't gonna help you.

<comment><USER3> > The article assumes that the location data must have been collected because > he gave an app permission to access his location. I bet they couldn't figure > out which app it was because it wasn't an app.

I worked on this story (and the others, we're still publishing [1] [2]).

The dataset we bought from Tamoco didn't contain an app name for most of the data. So instead of guessing, we're open about the fact that we don't quite know. Which is sort of the issue here – there's not a lot of transparency around what is collected and by whom.

The Norwegian Data Protection Agency (DPA) has opened an investigation into Tamoco [2] after our first story, and they want to cooperate with the UK DPA.

[1] [https://translate.googleusercontent.com/translate_c?depth=1&...](https://translate.googleusercontent.com/translate_c?depth=1&pto=aue&rurl=translate.google.com&sl=no&sp=nmt4&tl=en&u=https://www.nrk.no/norge/mobilsporing_-8300-mobiler- sporet-pa-sykehus-og-krisesentre-1.15008085&usg=ALkJrhgZ2TqtPraYad9xfMdQ- upJtC-Vng)

[2] [https://translate.googleusercontent.com/translate_c?depth=1&...](https://translate.googleusercontent.com/translate_c?depth=1&pto=aue&rurl=translate.google.com&sl=no&sp=nmt4&tl=en&u=https://www.nrk.no/norge/datatilsynet- opnar-gransking-etter-nrk- avsloring-1.15011535&usg=ALkJrhiYQX4OK8aXpnIVQQKJtYK4LNLffQ)

<comment><USER4> It could be an app - we've had startups approach us to sell location data collected from apps so I wouldn't rule anything out at this point.

<comment><USER3> Feel free to contact me if this is something you want to talk about!

</comment></comment></comment></comment><comment><USER5> Many of the apps that sell your location use location as a critical component of the experience. Apple and Google added a permission last year - only allow access to location when app is running (in the foreground). That change has made a dramatic reduction in the amount of location data available.

Ultimately, free is the culprit. People like to navigate, buy stuff online, see things on a map, get local weather, and so on - especially if it is free. The old adage about if it is free, you are the product probably applies.

<comment><USER6> "Ultimately, free is the culprit. "

False... Plenty of companies take your money and still sell your data.

<comment><USER2> ...such as cell service providers. All of them (in the US, at least) sell your location and browsing data to advertisers.

I would happily pay for a provider that doesn't triangulate my location 24/7, but none exist.

<comment><USER7> (not defending their practices at all...)

They are required to for 911 support.

Obviously they are not required to keep the data, and especially not sell it.

(Minus maybe a sealed NSA directive, though that is pure speculation on my part)

<comment><USER8> In the EU they are required to keep some data by law. No clue about the location data, though.

</comment></comment></comment></comment></comment><comment><USER9> This is one of the reasons why I'm generally not OK with "anonymized" data collection without an explanation of how it's being anonymized. It's almost always easy, often trivially easy, to correlate the data together and basically get a perfect recreation of whatever the original data was back.

<comment><USER10> Anonymization in the data reselling industry is often some form of md5(lower($email)). It's a joke. They even do that for extremely small search spaces like phone numbers. It's still provided at the individual user-level and even if the anonymization is done in a way that's irreversible, you only need to know a single event for a given person and you now have their entire history.

For example, there's a popular email client that scrapes people's inboxes and sells their purchase history to anyone willing to pay. That purchase history is provided on an individual email level and is "anonymized". But if you know your target has this email client installed and you know a single purchase (e.g. a coworker saying "Oh, I bought this awesome coffee maker on Amazon last night!") you can now access their entire individual purchase history backward and forward.

<comment><USER11> > coworker saying "Oh, I bought this awesome coffee maker on Amazon last > night!"

This x1000.

I have seen people invite others to eat lunch at restaurants that only accepted credit cards in order to elicit such a data sample.

<comment><USER12> Wait, what? Please tell us more

</comment></comment></comment></comment><comment><USER13> Wow, this article is really interesting, but one thing I noticed is that the translation is generated and perfect! In fact if the header weren't there I'd have thought it was written by a native english speaker.

<comment><USER14> It's secretly an ad for Google Translate.

<comment><USER15> That is actually a pretty good translation with few mistakes

</comment></comment></comment><comment><USER16> In Soviet Russia, your cell provider sells this data.

Wait, no, that's America. I was thinking of America.

<comment><USER15> Gramma nazi on: you mean Russia or the Russian federation if you want to be precise. The Soviet Union collapsed almost 30 years ago.

<comment><USER17> "in Soviet Russia" is a meme format

[https://en.wikipedia.org/wiki/Russian_reversal](https://en.wikipedia.org/wiki/Russian_reversal)

</comment></comment></comment><comment><USER18> Most likely the users installed one of those free apps that ask for location access. Those apps collected the location, even when not ruining and uploaded for sale.

It is a pity they did not do better forensics on the installed apps. One or more were revealing the location.

<comment><USER19> It would be really interesting if each app was fed a slightly modified location as steganography. Then the sold data could be cross-referenced to determine which companies are selling the data.

<comment><USER20> Sounds like a waste of time to me. If you feed 5 different location streams, you'll just find those same 5 streams for sale.. What a f---ing nightmare we're living in

</comment></comment></comment><comment><USER21> This isn't likely news, for most here.

But it can't be reported enough, for the general public.

<comment><USER22> Yeah, I think this is one of those things where, when the normals catch on, there's gonna be pitchforks and torches.

<comment><USER21> Indeed, but what would it take?

I gather that NRK is the BBC equivalent for Norway, so it's not surprising that Tamoco sold so much data to it. But I wonder how selective Tamoco and its competitors are.

In particular, I can imagine that there's a substantial market for data that facilitates tracking people. Bounty hunters. Repo agents. Private investigators.

But also people who want to stalk others for whatever reasons. If someone could document _that_ application, perhaps there'd be "pitchforks and torches".

<comment><USER22> I don't know what it would take, if anything. I was talking to some twenty- something folks in Berkeley about a decade ago and asked them what they thought of Snowden. They didn't know who he was. When I explained, they dismissed the whole thing. It turned out that they assumed the government was spying on everybody anyway. I don't know what to make of that, I'm just passing along the anecdote.

Anyway, from what I've heard these marketing companies are not very selective at all. More precisely, they _are_ selective but don't dig too deeply. But this is just my impression, not fact.

<comment><USER21> > It turned out that they assumed the government was spying on everybody > anyway.

I've assumed that since the 60s :)

Anyone remember "The President's Analyst"?

</comment></comment></comment></comment></comment><comment><USER23> The NY Times had a similar article recently: [https://www.nytimes.com/interactive/2019/12/19/opinion/locat...](https://www.nytimes.com/interactive/2019/12/19/opinion/location- tracking-cell-phone.html)

</comment><comment><USER24> Previous short discussion about a "foot traffic" vendor [https://news.ycombinator.com/item?id=22704138](https://news.ycombinator.com/item?id=22704138)

</comment><comment><USER25> A vast unaccountable ecosystem of data brokers simply cannot be the way society is forced to feed app developers.

</comment><comment><USER26> Despite the title, it was mostly an article about location data being (no surprise) identifying information.

</comment><comment><USER27> A question for the Android experts: is it possible to block or spoof location data, through a custom build?

Could I have an Android phone running a program that spoofs a long steady drive from Tampa to Butte?

<comment><USER11> Yes, but that does not stop the cell providers from selling your location [1].

You could also run an Android VM in the cloud and RDP to it when you want to use sketchy (edit: free) apps. This approach could have saved Bezos some trouble [2].

[1] [https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty- hu...](https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty- hunter-300-dollars-located-phone-microbilt-zumigo-tmobile)

[2] [https://www.nytimes.com/2020/01/22/technology/jeff-bezos- hac...](https://www.nytimes.com/2020/01/22/technology/jeff-bezos-hack- iphone.html)

<comment><USER28> > You could also run an Android VM in the cloud and RDP to it when you want to > use sketchy (edit: free) apps. This approach could have saved Bezos some > trouble

The article also points to WhatsApp as the infection vector.

I agree that anything Facebook produces is fair game as far as being sketchy goes, but it's not the only messaging platform to have been exploited.

Do we run all messaging services in independent sandboxes in VMs?

</comment></comment></comment><comment><USER29> When I saw Foursquare transition from a B2C to a B2B focused company that is when I finally deleted the Swarm and Fourquare Apps. I still don't fully understand their decision to split Foursquare into 2 apps, but what I did/do understand is that there is alot of money to be made in location data. You just hope that the people in these businesses are ethical people.

</comment><comment><USER30> Isn't data this granular illegal, at least in the US? Obviously trying to make the data anonymous does nothing if you can still see the same user over time - I've only ever seen this data with users put into groups, and data points fuzzed.

<comment><USER26> >is granular location data illegal

Generally speaking, there are no laws against merely possessing data, unless the data itself was the result of a crime.

Maybe you mean selling the data? That's nuanced. It seems to be illegal for phone-companies to sell your real-time cellphone location... but historical data? App developers instead of phone companies? The devil is probably in the details in terms of what constitutes a crime and what is just shady business. See [1] where AT&T sells your location data but insists it's not technically illegal (but claims they stopped selling it anyway).

Many companies try to anonymise this data anyway because it's good business to not piss off your customers.

[1] [https://www.theverge.com/2019/5/17/18629553/att-t-mobile- spr...](https://www.theverge.com/2019/5/17/18629553/att-t-mobile-sprint- verizon-selling-user-location-data-illegal-fcc-letters-public)

<comment><USER31> The article is about Norway, and there are laws against merely possessing data, namely the GDPR. To be specific, "merely possessing" private data (the granular movement data would qualify) by companies for business purposes is illegal by default - there are many options that give a legal basis for processing, and many of them do not require the user's consent, but it's upon the company to demonstrate what gives them the permission to do that, and having no justification (if the company "just has it") means that the processing is illegal. And even if the company has a legitimate reason for processing as such, doing so "without your knowledge" is generally illegal, as even where consent is not required, they are required to _inform_ the data subject about the purposes of processing their private data.

It's not about selling data - purchasing the data or having it or using it also are covered.

<comment><USER26> The above poster's question was specifically about the US.

GDPR does not cover the US. Europe has more privacy laws than the US does.

</comment></comment></comment></comment><comment><USER32> Link in the original language: [https://www.nrk.no/norge/xl/avslort-av- mobilen-1.14911685](https://www.nrk.no/norge/xl/avslort-av-mobilen-1.14911685)

</comment><comment><USER33> Can I legally purchase the anonymized location data of a few thousand Americans, run that through a script which associates coordinates with addresses, and publish the deanonymized results as an art piece like this?

If so, this could be a lot of fun. It would be interesting to see the political backlash, especially if the published dataset includes politicians. Perhaps, in the name of ethics, it should include _only_ politicians, and only those who have voted against privacy legislation. Maybe we'd finally end up with something like the GDPR here in the States.

<comment><USER34> You'd presumably get in trouble because _legality_ is only part of the equation, the other part is how big/powerful you are and whether you have connections in the right places.

Big companies can get away with crimes while the same thing would result in successful prosecution if a little guy does it, so you might very well get in trouble even though you're doing exactly the same thing as an existing company that manages to stay out of trouble.

I however support your idea regardless of its legality (and especially if the data happens to contain details on politicians, the majority of which are responsible for the situation being as-is) and suggest you publish it anonymously (through Tor).

</comment></comment><comment><USER35> The real question is if you gave people a choice of paying an extra $100 a year or having apps send tracking data, most people would pay the latter.

</comment><comment><USER36> Looks like we're moving to a Watch Dogs 2 era faster each day

</comment><comment><USER37> At this point, most people seem to know that their mobile data is being used. And, interestingly enough, they don't seem to care.

<comment><USER38> A broad statement. I'd like to see the evidence that they don't care, especially when faced with the level of detail collected.

I'd say they don't care to know, not that they don't care. Ignorance is not a defence, even if it is temporarily a business case.

<comment><USER39> Almost everyone, I've spoken to about these (including software engineers), know they are being tracked and they don't care. Actually, you know what, not almost everyone, everyone I've spoken to about this.

I've got the reply "if you don't like it, stay off the internet". Well.

<comment><USER40> I do care. More must be done to protect consumers. I have spoken.

<comment><USER39> I agree. I find it utterly disrespectful for all the engineers who are working their asses off to save the free internet when someone tells me to stay off the internet if I don't want to use a Google service. It's that bad.

</comment></comment></comment></comment></comment><comment><USER41> Does anyone know what web framework they're using to get the scrolling storytelling effect? Is this just parallax scrolling?

<comment><USER42> real questions here: [https://stackoverflow.com/questions/24239897/change- image-on...](https://stackoverflow.com/questions/24239897/change-image-on- scroll-position) , [https://www.w3schools.com/howto/howto_css_bg_change_scroll.a...](https://www.w3schools.com/howto/howto_css_bg_change_scroll.asp) , [https://www.geeksforgeeks.org/how-to-change-image- dynamicall...](https://www.geeksforgeeks.org/how-to-change-image-dynamically- when-user-scrolls-using-javascript/) , [https://codepen.io/fabuchao/pen/xwbRaa](https://codepen.io/fabuchao/pen/xwbRaa)

</comment></comment><comment><USER43> You have to be a special case of naive for the collection and sale of data to be a surprise. Talk about living under a rock. As for mobile apps, specifically, you think these shitty apps make money off ads? No, the business model is data. GPS data alone is a multi-billion dollar industry that is growing very fast.

</comment><comment><USER44> What I don't get about this kind of thing is that it's not just shady data resellers you've never heard of. It's also overt, high profile, branded tech companies like Foursquare and Yelp, with huge amassed data sets of foot traffic, wifi scans, battery status, often paired with demographic info or data that can be joined by ad IDs or commercial device graphs.

If these companies are able to keep on truckin' with massive user bases who don't seem to care that the entire business model rests on flagrant violation of data privacy and data reselling, why would you ever expect anyone to care about the long tail of scammy lesser known data resellers?

Companies like Yelp or Foursquare are essentially as scammy as it can possibly be, with the scamminess shoved right in users' faces, with lots of middle fingers and half-hearted sound bytes about respecting data privacy. If users don't react in horror and delete accounts / stop contributing en masse in response to that, why would you ever think an expose about something a further ten degrees removed from the user's immediate experiences is going to cause any reaction?

People just don't care.

<comment><USER45> The fact that Apple Maps integrates Yelp is a big red flag for me, and I think a big hole in their privacy story. It's why I am more comfortable using Google Maps than Apple Maps.

<comment><USER46> The data doesn't come directly from Yelp AFAIK. It goes throught Apple's servers. Yelp isn't queried directly.

Again this is from my memory of MITM proxying iOS.

<comment><USER34> They are still promoting that garbage company though (for a lot of other reasons besides privacy).</comment></comment></comment></comment>


The Language Agnostic, All-Purpose, Incredible, Makefile (2019) - <AUTHOR> https://blog.mindlessness.life/2019/11/17/the-language-agnostic-all-purpose-incredible-makefile.html <comment><USER2> [https://news.ycombinator.com/item?id=21566530](https://news.ycombinator.com/item?id=21566530)

</comment><comment><USER3> I realized how much I love Makefiles when I had to build a go project, dockerize it, push to registry, package it with helm, push to artifactory, and clean up all the mess what was created on the way. The way the already created (touched) artifacts are not created again makes working with Makefiles super easy. Yes, your $FAVORITE_BUILD_SYSTEM knows this too, but while that might not be installed on every host in your dev ecosystem, make is.

Another reason why I got to love make even more is because I didn't have to remember all these diferent tools parametrization, even better, the Makefile itself documented how to use these different parts of the tooling.

"But this should be done in your CI/CD, right?" and yes, it's right, until your colleagues also wan to test and build and dockerize and etc... on their localhost. I wrote the Makefile, tested it thoroughly and guess what, jenkins can also run _make docker_image_ and _make helm_package_ just as fine.

Makefile is an ooooooold but certainly not legacy technology. I haven't mastered it yet myself but it certainly saved already a lot of time and effort for me.

</comment><comment><USER4> Make is great, and I use it all the time for task orchestration.

I wouldn't use a hand-written Makefile as the top-level build tool on a library or program - CMake or Autotools is a much better fit there. But on a build that pulls down and compiles a few libraries and then a final package, Make is a great wrapper around the usual "cd $SUBDIR && ./configure && make && make install" kind of thing I have to do all the time.

Make is just a fantastic tool for managing builds that look something like "Run other some weird project-specific build tool, then take the outputs and do some post-processing and copying." I also use it for automating deployment tasks, and for automating one-off "do some things to a bunch of files" kinds of tasks such as resizing images.

Make is available everywhere, and it's very lightweight. It integrates nicely with the shell. It comes with out-of-the-box tab completion. It provides dependency management, and is more standardized than a pile of "build.sh, install.sh, deploy.sh, etc". You can trigger Make's tasks one-at-a-time and trust Make to deal with whatever dependencies it needs to fill.

Make (especially GNU Make) is a weird language with some weird features. And yes - we can all complain about tab delimited fields and other oddities of the language and tool. The tradeoffs are totally worth it in my opinion. Also, getting good at Make will really level you up in your ability to script and orchestrate shell tasks.

GNU Make 4.3 just came out with some cool new features. I hope Make continues to be maintained and used - it's really a fantastic tool for a lot of use- cases.

</comment><comment><USER5> Make is very nice, but I wouldn't call it language-agnostic. In particular, it has quite a few shortcuts for languages like C and Fortran.

[https://www.gnu.org/software/make/manual/html_node/Catalogue...](https://www.gnu.org/software/make/manual/html_node/Catalogue- of-Rules.html)</comment>


Ask HN: Would you pay a monthly subscription for Firefox? - <AUTHOR>
 Now that we know that Firefox is in danger (and by extension the open web), we as a community must now vote with our wallets - let Firefox fend for themselves and be overtaken by a monoculture, or support Mozilla financially ourselves.
I ask that Mozilla think about having the option for a monthly subscription model. No extra features for paying (e.g $5/month for Firefox), but at least as paying users we will know that it's helping to support the open web and the survival of Mozilla as a whole.
Would you become a monthly subscriber if you had the option? <comment><USER2> I am be happy to support Mozilla financially and make the less dependent on Google. However, I believe charging for Firefox would be incredibly counterproductive, because it would very quickly reduce Firefox market share making them less relevant. I think the route of using value add like the VPN service (still waiting for Europe! ) is the correct approach.

</comment><comment><USER3> We don't "know" this. We know they renewed the $400m US contract with Google. and we know they laid of 250 people but the two do not become "join the dots" to a risk issue for firefox.

We're told there is a pivot. We have not been told FF is being thrown under a bus.

<comment><AUTHOR> The Google contract got renewed? I thought this was all from the fallout because it _didn 't_ get renewed

<comment><USER3> [https://www.zdnet.com/article/sources-mozilla-expected-to- ex...](https://www.zdnet.com/article/sources-mozilla-expected-to-extend-its- google-search-deal/)

</comment></comment></comment><comment><USER4> Why not just subscribe to pocket VPN or one of their other services. It does seem to be mismanagement when you can't make $430m in revenue into a profitable company.

</comment><comment><USER5> No. There's nothing special about Mozilla. There are a thousand browser options. You are very mistaken if you think chrome is the only option.

<comment><AUTHOR> Name all the browsers that don't use Chromium's Blink as it's render engine

</comment></comment><comment><USER6> I would not.

Firefox still invades the privacy of most users. 1\. Install Firefox 2\. Type privacy in the search bar 3\. Google is now tracking you

It embraces dark patterns that invade privacy, whilst criticising other companies for their devices that invade privacy.

Mozilla need to understand how they are part of the problem before I'd start paying for them. As a privacy campaigner, should I pay for a product that invades it by default? It's hard to... I use them because they're the lesser evil.

</comment><comment><USER7> Not while I can use Chrome for free. Mozilla cut their own rope when they got rid of Brandon Eich and caved into SJWs, and they conservatives boycotted No- Zilla.

For $5/month I'd better get features that the free people don't get.

<comment><USER8> People like me would have not supported Mozilla if Eich was still there.

</comment></comment><comment><USER9> yes/$3 a month.</comment>


Ask HN: Always late to the office, is this OK? - <AUTHOR> I am a 21 year old node & web developer working for a small company in the suburbs of large tech city in the US.
Since sophomore year of high school I've developed a habit of running five minutes late to most commitments I make. It's a deep set behavior that I seem to have no grip on.
I like the office I work at. I'm underpaid, but it's comfortable and low pressure. I think this is partially because I get along well with my boss and partially because he knows I could go work anywhere else and make more money.
The only expectation the office has is the one I can't meet, showing up on time. Today I showed up at 9:06 and was told to go home for the day, and to come back on time on Monday.
Are there many programming jobs with more time flexibility that would fit me better? Is running late OK in the industry? Or should I be trying to fix this ~6 year behavior of running late?  Has anyone dealt with similar issues?
Thanks HN. <comment><USER3> > Today I showed up at 9:06 and was told to go home for the day, and to come > back on time on Monday.

This blows my mind. Are you a contractor or salaried? If you are salaried they are idiots (for throwing away a day of work while paying for it) and if you are a contractor I question their ability to require you to show up in the office a certain time...

I personally think that caring about "asses in seats" is a terrible policy and shows your employer doesn't trust you and you should consider moving on to another company. If you are getting your work done as expected then I'm not sure why people care if you are in the office on time.

Meetings are a different story, if you show up late to a meeting your are wasting a lot of time and it feels (regardless of your intent) disrespectful, this you should work on but showing up to work a few minutes late isn't a really issue IMHO.

Lastly this: "I'm underpaid, but it's comfortable and low pressure." leads me to say GET OUT! Don't waste your life making less than you are worth for a boss who is going to get all pissy about 6 minutes. Developers, or at least most, don't "shut off" their brains when they leave the building. Sometimes problems are kicking around in my head long after I've left work and I've solved a number of problems in my off time (not actively working but I can't always fully control what I fixate on or think about). Because of this I don't any bullshit about being at work on time (though I'm normally on time or 10-15min early) or leaving a little early if I need to make another appointment. As long as I'm meeting expectations on the work I'm getting done I don't think it matters if you are a few minutes late every day.

<comment><USER4> I agree with all but your last point, or at least think there needs to be an exception. If you want extra time to do other things then having a low pressure job is nice, even if you get paid less.

I've definitely met my fair share of people who would gladly take a 50% pay cut if they could only work 50% of the time they do. Feel free to replace 50% with 80% or whatever.

</comment></comment><comment><USER5> I noticed that most of the "fuck them" answers here are from people who interpret the situation in the most convenient way, that is to say, pointedly ignoring the general case and focusing on the specific.

OP says s/he's always late. But everybody responding "fuck the boss who sent you home" is explicitly assuming that OP being sent home is an isolated incident instead of part of a pattern. The thread title says _always_ late to the office.

I think failing to show up on time _as a pattern_ is destructive and disrespectful of colleagues. What is kind of amazing is that so many answers here are presuming a pattern (arbitrary and capricious boss) while at the same time overlooking a stated pattern (perpetually late employee).

<comment><USER6> The meeting starts when I get there. Learned it from one of my bosses. Generally but not always he was right. There are times when it matters, those times in most businesses don't occur everyday at 8:59:59. There's a contradiction in declaring 5 minutes so valuable yet wasting 480 minutes by sending someone home.

<comment><USER5> >The meeting starts when I get there. Learned it from one of my bosses

This is equivalent to saying "I am the most important person in the room every time". Even if it's true, it's a destructive and disrespectful message to be sending constantly. And if it isn't true, it's disingenuous on top of being destructive.

</comment></comment></comment><comment><USER7> > was told to go home for the day, and to come back on time on Monday.

This was an Old School gentle warning, use this day-off to think about what you want in your career, and whether this job is important to you. There are plenty of learned hacks to make yourself come in early.

Relative to the relationship with your boss. He may be taking your tardiness as sign that you're not serious about the work. Presumably, he wouldn't mind if you worked late into the evening, especially if you took on additional, more challenging assignments. Suggest reading on Managing-Up> [http://www.forbes.com/sites/richkarlgaard/2014/06/14/12-easy...](http://www.forbes.com/sites/richkarlgaard/2014/06/14/12-easy- ways-to-manage-your-boss/2/)

</comment><comment><USER8> When your time is unscheduled it's not a problem. When you're scheduled to be in a meeting, or working with someone, it's disrespectful and potentially expensive.

If you never work with anyone else it's not a problem - all that will matter is getting stuff done. But when you work with other people it will be a problem. You will get the reputation of being unreliable, and a reputation once acquired is almost impossible to shift. Even devs end up interacting with other people. If you're any good, people will start coming to ask your opinion on things. If it's noticed that basically you're not there when you're expected to be there, you will get a bad reputation, even if you think that ass-in-seat time is irrelevant to getting things done.

And you may think it's unfair, but a reputation for unreliability in turning up on time will spill over into an expectation that you will be unreliable in other matters. That's how things work.

If you freelance or contract and fail to meet deadlines then you will lose clients, contracts, and money.

So it's entirely up to you. People under 30 have a much more relaxed attitude, but ask whether they have the wide range of experience necessary to make a nuanced decision about whether this is important. And will you only ever deal with people under 30?

I wouldn't have made you go home, but I would think twice about trusting you with anything important. If you can't show the discipline to be at work when you're asked to be there, how can I trust you with other aspects of self- discipline?

 _Added in edit: A lot of other commentators are saying "asses in seats is a dreadful policy" which is true, or "Provided you get your work done, who cares?", which is true. But once you are a member of a team, even if you don't formally interact with people in the code you're writing, you still have knowledge and experience that other people might want or need to tap into. If you're not there, you're depriving them of the ability to interact with you. Interactions in a team are not limited to formal meetings and formal pairings. In the best teams, it's the informal interactions that are the hardest for management to understand, the hardest to foster, and yet give the greatest rewards. If you're always late, you can break that._

</comment><comment><USER9> On the one hand you can say it's an overreaction.

On the other hand meeting commitments is a pretty basic life skill, and probably one you should learn. It is no harder to be places at 9:00 than it is to be there at 9:06. Being late often signals to the other people involved that you _do not respect them or their time_. Whether that is true or not, whether you mean to say that or not, that's the signal that is received. It's even used in power games, where the more powerful person intentionally makes the other person wait for no reason.

<comment><USER10> Oh yeah. [https://www.youtube.com/watch?v=c_Ot1OEfk9I](https://www.youtube.com/watch?v=c_Ot1OEfk9I)

<comment><USER9> It's all well and good for every bold young man to think that he is a unique and special snowflake, the "One" who can see through illusions, take the red pill, and become a superhero who saves the world.

In reality, you aren't that special and you have to work with others.

</comment></comment></comment><comment><USER11> You could go work somewhere else with more flexible hours and still have problems because you're always late to work, late for meetings, late for calls. You'll still have trouble with partners, your family, their families, and acquaintances because you're always late for dates, late for planned events, late for family gatherings. Some people won't care, but some will find it disrespectful and think less of you for it. It's a habit I would break for personal reasons.

</comment><comment><USER12> Company cultures are all different. Some are more traditional and value consistent hours. If there is no expectation of working longer hours and you can peace out at 5pm without a thought, then some people are ok with the understanding that they need to be in on time.

However as you advance in your career, odds are you will find you prefer flexibility (because life rarely runs on schedule), and more importantly, you will likely value working somewhere that pays you to get a job done, not fill a seat.

One of my biggest requirements now is having that flexibility--once you have it, it becomes VERY hard to go back. More importantly, it is increasingly common for companies to want you to be there at a fixed time in the morning, but then work unknown late hours. That seems a bit off to me for many reasons.

In any case, it is worth a discussion with your boss as to their expectations and reasons for needing you to be present at a certain time. Don't do it in a way that comes off as questioning their direction, but try to do it in a way to help gain perspective on where they are coming from.

Personally, my brain doesn't switch on before ~10-10:30am, so that's wasted productivity. I learned that I do well at companies that treat their employees like adults who can manage their time and work when they will be productive. As a result, I tend to get in ~10am or a little after, and leave around 6-7pm, and then typically wrap some things up from home for an hour or two at night if needed. I put in the late nights and weekend when it is necessary, and the flexibility my company offers means I don't have to worry about punching the clock or marking a time card...I can simply focus on getting my work done to the best of my ability to deliver the results they pay me for.

</comment><comment><USER13> In my opinion, the punishment doesn't fit the crime. A simple warning, written or otherwise would have sufficed.

With regards to your own habit of being late, to echo what others here have said, it is something that you should fix. At one point I fell in to a pattern and I was constantly late for everything, it took a concerted effort to fix it and I think it was quite necessary.

Generally, being late is seen as disrespectful and an inability to keep your word. I've had people in my life at certain points who would show up up to 20-30 minutes late for some events. At that point I was too rattled by their tardiness to even want to interact with them. I am sure the same can be said about others towards me when I fell into a habit of being slightly late for everything.

Take yourself out of the equation and think about how your behavior makes others perceive you.

</comment><comment><USER14> No, it's not OK. It's never OK to be "running late" according to however that is locally defined.

Even at a place that says, "We don't care when you come in or work at home, just as long as you're on site once a week on Wednesdays from noon to 3 pm," if you show up every Wednesday at 12:30 pm instead of at 12:00, your boss will get annoyed with you.

If there was a particular reason why you needed to come in at 9:05 instead of 9:00 every day, for example a bus schedule, that is a reasonable thing to negotiate.

The correct professional behavior (in ANY industry) is almost never to just ignore what your boss asks you repeatedly to do. The best thing when confronted by something like this is to openly discuss and negotiate the issue.

If you were sent home for the whole day, that sounds like a last warning at the end of a long series of failures to follow the customs of that particular company. If you don't come in on time on Monday, I suspect you will be fired immediately.

</comment><comment><USER6> Time to move on. For two reasons: one is that the habit of running late is tied the place it was developed, the other is that it has been blown out of proportion [1] at your current employer. In addition, if they sent you home for the day, then do they really need you?

Is punctuality useful? Yes, if it accomplishes something. Plenty of business meetings always start late because everyone is always running late. Other meetings always start on time, and running late is unproductive. Factory production lines also come to mind. But in an ordinary professional workplace the important thing is getting the work done.

Finally, Your boss sent you home for the day, you aren't getting along well. So again, it's probably time to move on.

Good luck.

[1] There are circumstances where running late a few minutes is unprofessional, e.g. a critical meeting, but not an ordinary one.

</comment><comment><USER15> Do you have a good reason (aside from habit) for being late to commitments? If not, fix the behavior -- it's annoying and disrespectful in US business norms.

If you have a good reason, explain it to your boss. I managed someone who lived a 40 minute drive away (that was variable) and absolutely could not leave earlier (because of a private issue) -- we had a daily scrum in the morning and he was always late -- he explained the issue and we accommodated.

Or --- get a job that doesn't care when you show up (there are A LOT of tech jobs like this).

</comment><comment><USER16> This sounds like a maturity issue. Grow up. Show up on time.

If they want you there at 9, get there at 9. That's not unreasonable.

</comment><comment><USER17> It really depends on the company and how much the company trusts you.

I'm an employer and if a new employee who has not gained by full trust continually comes in late, then yes it is horrible.

But I do have employees that I really trust. I know they are 100% committed to the business and committed to helping it succeed. They have proven over time that the company is always on their minds. In this case, I could care less if they come in late, work from home, etc. But it does take time.

Also, it is worth noting that losing trust is a lot easier than gaining it.

<comment><USER18> From all indications it looks like OP's boss and coworkers have zeroed out all trust in him. They're _watching the door_ to mark when he's coming in. When people have earned a certain level of trust, this just doesn't happen.

Either that or you're so incredibly valuable and irreplacable that you can afford to take a _fuck-this_ attitude. But I don't know a lot of 21 year-old junior devs that qualify for this. In fact, _nobody_ really qualifies for this anymore, unless it's your name on the door.

</comment></comment><comment><USER19> Yeah most dev jobs are flexible about when you come in as long as you work hard and make the meetings. I am shocked he sent you home for the day. That is crazy. And don't get me wrong I am really annoyed by people who are late.

</comment><comment><USER20> "...and partially because he knows I could go work anywhere else and make more money."

This kind of thinking is the bigger problem. You COULD get hired and you COULD make more money...until you were always late and get fired.

Grow up.

</comment><comment><USER21> I have a tendency (which I think I've overcome) to keep working on something until the last minute so I can sympathize.

There are plenty of times when being late isn't a big deal. When others have to wait for you however, you are signalling that you don't value their time. It is perceived as selfish. I'm not saying that you _are_ selfish, it is just that it can be _perceived_ that way.

If you're lucky, people will start telling you that the meeting is at 8:45 just to get you there on time. Some places lock the door when the meeting starts. I had a friend who would always be late to our lunch appointments. When we instituted "late guy pays", things improved. ;-)

You can try to find a job where your problem doesn't effect others but you would be better served if you just learned how to be on time - at least until "habitually late" becomes a protected class. ;-)

</comment><comment><USER22> At least in the Valley, hours tend to be flexible, at my current position, people walk in between 8 and 11. My team's stand up is at 11 so the rule is be in the office before them, but even then sending an email saying that traffic was bad, or Bart is dumb, or you're waiting for Fedex is okay (the assumption being you'll join the standup remotely and get some work from from home).

With the large companies that have shuttle's the flexibility is because they need to stagger all their busses.

It really depends on the culture and the type of environment though, much more "corporate" positions and cultures would require better on-timeliness, but being told to take the day off for being 6 minutes late seems odd for a developer position.

<comment><USER23> Depends on the company - I had a tech lead who once tried to mandate that all engineers on the team be in by 9:30 here in the Valley at a startup. I laughed when he told me that and said "Good luck getting that to happen" to him. He quickly learned that nobody was going to listen to him on that.

It's not even that I was against going in early - I'm typically in around 7-8 am. I just knew other engineers typically wouldn't.

</comment></comment><comment><USER24> Go find a new job that pays you enough that you're willing to be there on time.

</comment><comment><USER25> Lateness is often considered rude because it shows you don't care about something. If this is a situation where that assumption is correct, then it's time to move on to a new job.

Late for meetings makes you a jerk. If you get your shit done and show up later than some arbitrary "start time" at work... your boss has a right to be like "c'mon dude" but not to penalize you. That's childish and petty, and another reason to move on.

</comment><comment><USER26> I can relate to your situation. My wife, like you, seems to have some sort unshakeable predisposition to be late all the time. I on the other hand am always 5-10 minutes early. You can imagine my grumblings.

Getting up earlier is a question of motivation. Even my wife gets up at the crack of dawn if we are going somewhere special on a holiday. So I would guess that you are not motivated enough to make the effort of getting up 15 minutes earlier. You could fix the source of that problem. A bit of psychotherapy might be all you need.

As per @dropit_sphere, you might be under-motivated because you are under-paid and you probably chill out on the low-pressure environment.

Reading the other comments, you have options:

1\. Take a job where you can set your own hours.

2\. Take a job where you get paid a lot more, challenged and motivated to change for the better, including being on time.

3\. Get your lateness behaviour dealt with.

4\. Don't do anything, wait till you get fired then re-consider 1-3 above.

</comment><comment><USER27> I have the same problem. I've come to learn that my issue is not that I am late all the time because I am lazy or disrespectful or whatever else one may think, but that I don't have a good sense for estimating how long things actually take. And, I am optimistic when estimating.

My solution is to become aware of how long things take throughout the day in an effort to make better efforts at planning. How long is my shower? How long does it take me to get dressed? How long does it take to get to my car and my actual commute, etc. With some real numbers, you can start to be realistic about what it takes you to get to work and so you can work backwards from there to make sure you leave on time. Works for me. I don't miss my train anymore.

</comment><comment><USER28> I developed the same habit in high school. It was really annoying to pretty much everyone I ever had a meeting with (or a class or a date or whatever). I lost a couple of really good jobs because of it. You really just need to change your habits. It's totally doable, too, if you convince yourself that you need a few minutes before the meeting starts to gather your thoughts or whatever.

Just set expectations appropriately and meet them. Show up when you say you're going to, and if you don't, have a damn good reason why you didn't. I have no idea why so many highly paid professionals are saying something other than that.

</comment><comment><USER29> In every single job I have, there is an unwritten rule that you can show up at anytime in the range 9-10:30am as long as you make up for the time. The only exception would be a meeting or something but that it was rare.

</comment><comment><USER30> If you show up late and leave early then expect to get some pushback. If you show up late and then stay late I find most companies don't care.

I generally get to the office at 10:30, but then work a ten hour day.

</comment><comment><USER31> _should I be trying to fix this ~6 year behavior of running late?_

Yes, really, you need to. From the subtext of your post, you seem to be late all the time and unable to fix your behavior. Your boss may be doing you a favor, to force you to reconsider that behavior. If you don't improve, I would expect you'll get fired eventually.

If I run a weekly meeting at 9am and you have been late every single time for the last 6 months, I'm going to be very unhappy. This has nothing to do with whether you do a good job the rest of the time.

</comment><comment><USER32> Not a day goes by without an article about the redundancy of daily standups and about the fact that as a creative worker you can only work best at certain times and in certain environments.

</comment><comment><USER33> Your problem is not that you're late. Your problem is that you lack respect for other people's time.

If you really think there's no need for you to be there at 9am, talk to your employer about it and try to get flexible time. Although I suspect you'll end up pushing it to the limit. In any case, please be aware that people shouldn't be waiting for you and that's highly disrespectful to not show up on time.

</comment><comment><USER34> Being late sometimes is ok but every time for ~6 years ?

When people ask you to come at a certain time they are asking you if they can trust you to be here at that time. By arriving late deliberately you have abused their trust and been dishonest.

This is not a professional problem that you are having, it is a human problem : it is disrespect.

</comment><comment><USER35> Set your clock back 10mins.

</comment><comment><USER36> go back in on Monday, and from now on your start time is 8am. when you get there at 8.06 you're 54 mins early.

relax, walk around and say hi to folks, grab coffee and settle in.

they're sending you a harsh msg, but you're not fired. respect it, yourself and them and get your shit together.

keep going in at 8am until you move on to another company ...then reevaluate in that context.

edit: ps I've had similar problems over the years and it's a struggle. keep trying to get better at respecting other's time.

</comment><comment><USER37> Any programming job that cares about you being consistently 5 minutes late to a 9am start time is not one worth keeping.

</comment><comment><USER38> > Are there many programming jobs with more time flexibility that would fit me > better? Is running late OK in the industry? Or should I be trying to fix > this ~6 year behavior of running late? Has anyone dealt with similar issues?

Yes.

Yes, there are programming jobs that aren't nearly as strict on getting to one's desk at a specific time. This tends to be more the case with small businesses and startups (and big businesses that started off as stereotypical "startups" \- i.e. the "unicorns" of lore) because of the proliferation of an attitude that how much (or little) time spent at one's desk is irrelevant so long as the employee in question gets his/her work done.

Yes, running late is OK in moderation, depending on the circumstance. Running late to a _meeting_ is generally a bad idea (especially if the meeting is non- routine), but a lot of programming positions in particular aren't exactly strict about getting to one's desk on time. However...

Yes, you should be trying to fix this. Regardless of whether or not you're expected to arrive at work before a specific time, punctuality reflects well upon you, and will give folks who interact with you (not just employers, but also friends, spouses, and other peers) an impression that you value their time.

Yes, I've dealt with (and still deal with) similar issues, since I have the same tendency.

A trick I learned from my dad (who - according to my mom, at least - shares my tendency to procrastinate) is to internalize that "if you're not 15 minutes early, you're late". Try to be 15 minutes early to everything; if you had adopted this philosophy today, for example, you would've arrived at work at 8:51 - plenty of time to leave your things at your desk (proving that you are, in fact, at work), grab some coffee from the break room, and even read an HN article or two. If you can't get into the habit, then turn off the "sync clock with internet server" functionality of all your networked devices (phone, computer, etc.), roll all your clocks forward by 15 minutes, and then _still_ try to aim for being 15 minutes early to everything according to your own clocks.

As briefly mentioned, this trick has tangible benefits beyond brain-hackery. If you're walking or biking to work (or some other engagement), it gives you some time to catch your breath. If you're driving, it gives you more time to make sure that you got all your things out of the car. In any case (as mentioned above) it might give you time to grab some coffee or a bagel or something from the break room before starting your shift, or smalltalk with the cute guy or girl three desks over from yours, or - at the very least - <USER2> an early start on the transition from not working to working (which tends to take anywhere from 15 minutes to an hour; this is one of the reasons why pretty much anyone who isn't in a management position absolutely _despises_ meetings, since the interruption causes an abrupt transition from "working" to "not working" (whereas for supervisors, the meeting itself is a transition from "not working" to "working", since their job is to manage their subordinates)).

</comment><comment><USER39> Your employers are idiots.

</comment><comment><USER40> _Today I showed up at 9:06 and was told to go home for the day, and to come back on time on Monday._

Get a new job.

If what you say is true, and you can find work elsewhere, do so. If they're silly enough to throw away 7 hours of productivity over a 6 minute delay, fuck'em.

For a customer-facing position, your happy ass should be in a seat and smiling fifteen minutes before the client shows up.

For development work, though, especially if you aren't coordinating with other people, you should be able to focus on producing quality work quickly.

The time fetishism I've seen is something I mostly see in folks older than their 30s--basically, they don't get that time isn't the big factor it used to be, especially for developers.

<comment><USER41> Yes and no.

Sending them home for being 6 minutes late is totally overkill (unless it's something that has occurred many times, and there have been warnings).

Quitting for being sent home for a day also seems like an extreme reaction, though, especially if you like the job otherwise.

I wouldn't call it time-fetishism, and I wouldn't say it's something limited to "older folks," that seems particularly unfair. I'm 24, and when people couldn't be bothered to show up on time, I was bothered by it as well. And I'm a developer. I know that it's not vital that "you be in by x-o-clock or no work will be done for the day," but it definitely creates a stigma toward the individual who roles in later than the rest of the team.

<comment><USER40> Teams where it's a stigma, especially when we all know that time is fluid and productivity varies widely, even in spite of product shipped are bullshit and are getting eaten, slowly but surely, by flexible companies, remote workers, and Stuff-as-a-Service.

Burn your timesheet, and focus on shipping.

EDIT:

There's _literally_ no good reason, if you aren't facing customers, to sweat time variations, _especially_ if doing so comes at the cost of developer productivity. Just because somebody is used to a bullshit time system tracing _directly_ back to the factory shifts of yore doesn't mean that more enlightened folks should stick with it when better options are available.

<comment><USER41> I'm not arguing for time sheets, or even any form of time tracking. Just that as a team, if we agree to show up to the office at a time, and someone isn't there then, you'll have feelings about it.

The part about teams that operate via timesheet is a bit of a stretch, imo. At least in larger orgs, I don't see the "need" (read: keeping middle-managers employed) for time tracking ever going away.

While I agree with the sentiment that time tracking is pretty useless, I don't think it's going to stop.</comment></comment></comment></comment>


Remote Year: Travel with interesting people while working remotely - <AUTHOR> http://www.remoteyear.com/ <comment><USER2> Looks like the classic MVP page to _test_ if this is a good idea. Seems interesting, but can you imagine the headaches of looking after 100 people, in 18 locations across the globe, in one year?! Coordinating jobs, visas, accommodation, people leaving, getting fired, personal issues, flights, buses, etc. I have taken coordinated trips with 90+ people on the same plain to remote destinations, and it takes _months_ of planning for a single stop. You would need full time handlers.

ps. don't get me wrong, I like the idea, but you are likely going to burn these people out with tons of logistic issues.

<comment><USER3> We are going to have 5 full time staff to handle all of those details.

<comment><USER4> Very cool. How are you handling work Visas? For example, when I moved to the US I kept my job back home but I still need a work visa.

<comment><USER5> You are a tourist working remotely for some company in other country, do you need work visa in that case ?

<comment><USER6> I am a tourist working remotely for my own company while in the US.

 _Technically_ you need a visa. _Practically_ as long as invoices are coming from your own country and the money is going to your own country, nobody will care (or even notice).

Unless of course you make posts like this one in a public forum under a name everyone knows you under. But I am counting on inefficiencies and the good will of fellow hackernewsers. (you'd need to actively get reported for anything to happen)

PS: having an actual tourist/business visitor's visa rather than just the visa waiver (esta) makes things easier and border crossings go much smoother

</comment></comment></comment></comment></comment><comment><USER7> Pretty interesting. This is what I've been doing for the last 12 months throughout Europe, but with a new location every 1-2 months.

At first the organisational details were the frustrating part, but after almost 12 months and 8 cities the lack of longer term friendships is more of a problem.

In regards to "the headaches of looking after 100 people", surely that's something that can be addressed by limiting the scope of services provided? I think handling 1) accommodation and 2) work would be more than sufficient for most responsible people.

<comment><USER8> What are your thoughts on this? \- Remote Working Groups (3 - 10 people) \- New city every month \- Rent entire home via AirBNB \- Keep per person avg monthly rent below 1000 USD

<comment><USER9> Please tell me you are planning something like this?

<comment><USER8> It sounds cool doesn't it? I haven't thought about it before this thread but it sounds pretty easy to put together.

<comment><USER9> Well if you end up doing it, please email me

</comment></comment></comment></comment></comment><comment><USER10> It sounds like a coworking (coworkation?) round the world holiday. Can participants work on other things or are they tied to those jobs that the organisers assign them, I wonder...

</comment><comment><USER11> The wording on the page suggests that you get to live the nomad lifestyle while still maintaining your comfort-zone. I strongly believe that exactly the opposite makes this kind of lifestyle so interesting and worthwhile (i.e. being pushed out of your comfort zone on a regular basis).

I understand that it may sound very compelling to many and I absolutely don't want to advocate against their "product"; just think about what you want. "traveling without any of the risks" also takes away _much_ of the fun, adventures and personal growth you'd experience on your individual, non risk- free journey.

</comment><comment><USER9> I just started to work remotely and I agree that the solitude is easily the worst thing about it. You have to make an extra effort to go out and establish relationships, but even then, if you move around a lot, long-term it is going to be tough.

I think having a group or network of similar minded people would greatly help.

I have actually thought about this a lot, what if there is a network of airbnbs/hostels around the world which a group of remote workers agree upon to be more concentrated? I think co-working spaces do much of it right now, but it can always be improved upon.

<comment><USER8> I have started to experiment with this over the last month. Staying at room shares on airbnb, working in coffee shops/co-working spaces during the day and then meetups at night to network. Doing this with a group would lower costs and keep a sense of familiarity. Do you think a less formal concept of this would work?

<comment><USER9> I think something more focused would be better. The biggest problem for me is not to meet people, but to establish long-term relationships, and that is hard if you are not around them a) frequently and b) long-term.

I do think that something like OP would be too formal, as it doesn't give you the flexibility to deviate, which is why I think a more liquid network of at the start just several locations would work.

Btw, I liked your approach above very much, if you have a majority of the group do that (allowing individuals to divert), this could totally work

</comment></comment></comment><comment><USER12> Nice job!

You got a nice simple idea, created a quick gmail account, built a quick SquareSpace landing page with collection form and now you are on the front page of Hacker News collecting some good data.

This my friends is quick and dirty and it works, if you can hack this idea and get it onto the front page of NH in 30 minutes you will make this happen.

<comment><USER13> Yeah, they didn't even change some of the default squarespace photos.

</comment></comment><comment><USER14> Are the travel costs footed by the remote worker? I'm trying to understand how Remote Year would make money off of this. Kind of like a programmer/recruiter/travel agent all in one?

<comment><USER3> The remote workers all have their own jobs that Remote Year can help them find. They then pay a fixed amount per month to Remote Year, which includes housing, travel, activities, programming and some meals.

<comment><USER15> Would you be willing to add this information to your site? You might find more people willing to sign up if they are better informed. See my above (wrong) conjecture as an example of how little can be extrapolated from what you have on display.

</comment></comment></comment><comment><USER16> There is some missing information on the page I think, such as, what do you get paid, and who pays for accomodation, and, what are the 18 locations?

<comment><USER17> They made it pretty clear that they aren't paying you for your work, but have some help available for securing remote jobs. So I imagine the pay has everything to do with you and your experience.

Anyways, the page seems like a marketing test anyway, just to see if there is any interest.

</comment></comment><comment><USER18> Ok, as a remote worker this sounds super cool and all but I am going to have a minor complaint which has nothing to do with the feature at hand.

"firstname.lastname@example.com"

Really? You have a domain name, couldn't set up "email@example.com"?

Even though I'm sure nothing was meant by that, it makes the whole thing sound incredibly unprofessional and simply detracts from the offer.

<comment><USER15> This could explain it, it looks like their choice for hosting doesn't provide email:

[https://www.squarespace.com/pricing/](https://www.squarespace.com/pricing/)

Still, they could opt for Google's business email so they could use Gmail's backend with @remoteyear.com addresses.</comment></comment>


Enigma is a secure messaging app that respects your privacy - <AUTHOR> http://eijah.com/ <comment><USER2> To those who didn't bother to click the link, it's a proprietary app that has EULA restrictions to stop security researchers from trying to exploit it (basically ensuring that any bugs won't be disclosed to the authors).

I pass.

</comment><comment><USER3> I downloaded via HTTPS link.

v1.0 apk is 13.1 Mbytes.

Calculated/checked checksum via HashDroid / HashStamp, and it matched.

Allowed "unknown sources" installation, installed it, disallowed "unknown sources".

Its using 51.42Mbytes. Uses 2 Permissions: "Full Network Access", "Control Vibration". So it seems to be not intrusive, inside device.

But it fails to run on Android KitKat ! :(

If it could run, then we would know, where its connecting.

</comment><comment><USER4> PSA: Don't get this from the linked landing page, and don't trust the hash. It's an insecure page. Luckily looks like they do have a valid Let's Encrypt on [https://eijah.com/](https://eijah.com/).

</comment><comment><USER5> But... the enigma was broken.</comment>


Higher-Order Parallel Programming - <AUTHOR> https://futhark-lang.org/blog/2020-05-03-higher-order-parallel-programming.html <comment><USER2> So the point is just that Futhark map is faster than numpy map? Presumably because Futhark can ensure it's mapping pure functions?

Why doesn't numpy offer a map_pure method where the user promises to only pass pure functions?</comment>