Banks should let COBOL die - <AUTHOR> https://thenextweb.com/finance/2017/04/25/banks-should-let-ancient-programming-language-cobol-die/ <comment><USER2> The idea that large corporations are simply going to move on from COBOL is out of touch with reality. It really can't be overstated how deeply old COBOL programs are embedded into these corporations. I worked for one that had been using them since the language itself was created, and while they all could see the writing on the wall, the money to do the change simply wasn't there. Not only would they have to do a code change, they would also have to do a hardware change because all of this is running on mainframes. Not only does this cost a lot of money, but it would also take an enormous amount of time. What mid-level manager is going to stick their neck out and push for this? What exec is going to ignore the guaranteed transactions that a mainframe and a decades-old COBOL program can offer simply to secure a solid future for which they may not even be around for?

But as far as training people to handle COBOL, well, that's simple. Look at vocational schools of years past. Why can't you train a random person just how to do COBOL? They don't need to do object-oriented programming or UX theory. They just need to maintain and occasionally update some ancient program that's been rock-solid for longer than they've been alive. It doesn't take a genius, it just takes very specific training. And there are a lot of people that would jump at a chance for some high-paying, steady job that they just need to train for a year or so at night school.

<comment><USER3> Realistically, if, say, one of these big corps/banks with deeply-integrated COBOL systems spent a few years revamping their systems to something more modern and usable today, how much would it cost?

Running mainframes isn't cheap. COBOL programmers aren't cheap. Not being able to improve these systems / innovate with them can cost the business a lot of time/money. And if we're talking COBOL, we're talking at least 25 year old corps.

How long's the ROI on moving over? How expensive does the maintenance of antiquated systems get? It's easy to say that they're rock-solid and never need to be touched, but is that really true? For example, lot of banks today have a lot of absurd UX, often because of absurd internals and I know a lot of that usually is "the system is ancient and nobody really touches it anymore, that's just what it is now".

<comment><USER4> > Realistically, if, say, one of these big corps/banks with deeply-integrated > COBOL systems spent a few years revamping their systems to something more > modern and usable today, how much would it cost?

Success isn't guaranteed, maybe as low as 50%. When you say 'few years' it intimates you don't appreciate the scale of some these systems. In the end, retiring legacy systems isn't a technical problem, it's a product owner, product management, and business problem. The business owners have to make concerted, multi year effort to document their process as implemented, define the replacement, and manage it's (re)implementation. This never happens.

<comment><USER5> > The business owners have to make concerted, multi year effort to document > their process as implemented, define the replacement, and manage it's > (re)implementation. This never happens.

I wouldn't say it _never happens_ , but it certainly takes a couple tries and a lot of time and money.

My employer is _close_ to being off our mainframe(s), but it will probably take at least another 10 years to get rid of the last little dependencies. We've already spent about 15 years (with hundreds of developers) getting to the point where all the major online and batch processes have been reengineered and have very small mainframe dependencies. The mainframe development teams are very small and mostly focused on decommissioning work.

But yeah, it's a massive undertaking. In our case, the business was motivated to pay for it because mainframes just couldn't scale for our main use cases.

<comment><USER6> Any chances we could read more about this somewhere? Sounds very interesting.

<comment><USER5> > Any chances we could read more about this somewhere? Sounds very > interesting.

Very, very unlikely. The company doesn't even have technical writers anymore for internal projects, let alone technical historians. And with the time it's taken and normal staff turnover, I doubt that there's anyone who really could write about the whole effort based on their own experiences.

Basically, it consisted of building of building a new central datastore for our content (that was pretty mature by 2005, when I started). Then hundreds of smaller projects to migrate this or that process to read from or update the new datastore or keep it in-sync with the old one. There was also a lot of opportunistic piggybacking of new feature work onto migration projects or migration work into new feature work. However, I only have the view of a regular developer.

</comment></comment></comment></comment></comment></comment><comment><USER4> I get tired of seeing these same sensationalist falsehoods propagated without challenge. So I shall challenge.

>> We did a piece the other day about how learning the ancient programming language COBOL could make you bank.

>> Which can only maintained by small group of veterans, that grows thinner every day.

>>There are almost no new COBOL programmers available so as retirees start passing away, then so does the maintenance for software written in the ancient programming language.

This is false because there is in fact tons of COBOL talent around (in the US). The waves of offshoring in the '00s left many thousands of unemployed COBOL developers. I personally know of 100's in the local market. A prominent financial services and BPO firm off shored mainframe development, and laid off many 100's here. Most got out of software development all together. This skills shortage simply doesn't exist.

<comment><USER7> >> The waves of offshoring in the '00s left many thousands of unemployed COBOL developers

If you were a developer affected by stuff in the '00s, you're probably nearing the end of your career (unless you'd just started) The problem here is the lack of a NEW talent pool.

<comment><USER8> Age 30 in 2000 is 47 today.

Is 47 really "near the end of your career"?

<comment><USER9> Nearer to the end than the beginning, perhaps.

I always get a chuckle when some hopeful naif writes like they're going to retire at 50 and be done. Most everyone I know who's tried that "gets bored" and goes back to work or starts consulting after a half year trying to find their feet. Those are also the ones who when asked what happened tell you they've got plenty of good years left and are now planning on retiring at 70.

47 is still building steam in my experience.

<comment><USER10> Our company has high turnover on the bottom. A steady percentage of new hires are bored, retired people. :)

</comment></comment></comment></comment></comment><comment><USER11> As someone who has worked in a few investment banks, Perl is a SIGNIFICANTLY larger problem than COBOL.

While verbose, COBOL enforced structure and discipline, and it is very possible for code to be maintained by someone other than the author.

On the other hand in the 90's and early 2000's many critical pieces of software were written in Perl. While it is quite suited as a scripting or glue language, I've seen elaborate integrated systems written in cryptic, unstructured and undisciplined Perl, often with proprietary extensions.

And no one learns Perl anymore.

There is no way to maintain these projects, and in at least two projects I've seen, what should have been a straightforward change lead to a large scale retire-and-replace project.

<comment><USER12> Sometimes the "no one learns Perl anymore" just means that no one is willing to pay a good money for some change that the company wants.

<comment><USER13> Yep. I know Perl (5 not 6) really well and programmed in it for about 10 years. No one I've seen actually wants to hire for it. I'm fine with that because it wasn't something I loved much like the Transact-SQL programming (love Objective-C and looks like Swift will be more work not love).

<comment><USER14> Thats seems true. I have a Perl jobs group on Facebook, and the salaries are a fair bit lower than for Django (which I currently do).

</comment></comment></comment></comment><comment><USER15> > Döderlein says that banks have three options when it comes to deciding how > to deal with this emerging crisis.

Option 4, which is what banks are actually doing to the best of my knowledge, is to train new hires on how to write COBOL.

<comment><USER16> Glad to see someone else pointing this out.

The problem with these systems is that they are very old, and thus do not benefit from many of the more modern developments in the field nor do many quality developers learn the language.

The benefit with these systems, though, is that they are very old. With that age comes completeness. They're battle hardened, thoroughly tested, and a known quantity within the institutions that leverage them.

History is littered with companies that attempted to replace the core of their business with one big project written with newer technology, only to fail catastrophically.

During my first gig with a bank, I was appalled to see the ancient technology in play at the heart of the bank's systems, and the retired developers coming in part time on schedules they set for outrageous hourly rates to do maintenance tasks on that system. Over time, though, I came to realize that this was the most reliable and cost effective solution the bank had available.

The third option listed is what I see happening, but at a much slower pace than the article suggests:

> Basically, Döderlein suggests making light-weight add-ons in more current > programming languages that only rely on COBOL for the core feature of the > old systems. However, the key thing is how the connection to the old system > is made. > Gradually banks will be able to address each and every product > need that they have with new platforms that will replace the overly > complicated COBOL add-ons. This compartmentalizes the banks' COBOL-problem > and makes it cheaper to fix, as it won't have to be done all at once.

It's a glacial pace, but it's being attempted. The heart of the old systems, though, were still untouched last I had visibility into those inner workings.

<comment><USER17> You're correct on all points in my experience. My previous contracting gig involved writing Windows Server based code for a UK mortgage lender that interfaced between the internet based Hometrack valuation service, and a Fujitsu ICL clone mainframe running the core Cobol system for the lender. The key point about that system is that it is the core ledger for all the mortgage accounts, which add up to many billions. It's the golden record of all the mortgage accounts and payments. Replacing it with a new buggy system based on the latest tech could kill the business.

</comment></comment></comment><comment><USER18> The issue with rewriting to newer technologies is relearning - the hard way - all the requirements encoded over 40-50 years. Decision-makers are rightly afraid of the $100M mistake. As some posters here said already, organizations have to slowly phase in newer technologies and phase out COBOL ones.

The track record of Big Bang rewrites is not a good one. A few years ago it was either ACM's CACM or IEEE's Computer magazine that profiled several high- profile failures. The financial and time cost overruns were spectacular.

Banking and Insurance are not the only industries using COBOL. If you're in higher ed and your institution uses Banner, you've got COBOL. During every upgrade, our Banner team has to license the latest and greatest COBOL compiler set from (I believe) Micro Focus.

I have to wonder if a split in technology exists between commercial and investment banking.

</comment><comment><USER19> People who don't know COBOL, IBM Mainframe or the industry write these type of articles.

You want to loose the hardware - there's a solution for that. You want to create modern web services over - there's a solution for that. You want to code in a modern IDE - there's a solution for that.

If the systems that use IBM Mainframe were using Amazon ECS or Azure... the same people would write articles about the lack of reliability of core servers like banking and airlines.

</comment><comment><USER20> PR piece for Auka. A classic example of one of pg's submarines[1].

Auka CEO Döderlein, mentioned a mere 5 times, says there are only 3 options, ignore the problem, big bang rewrite, or bolt on new pieces.

Don't panic! Just call Auka. They have your new piece.

There's no mention of the option we would all pick, a gradual migration, of course.

[1][http://paulgraham.com/submarine.html](http://paulgraham.com/submarine.html)

<comment><USER21> Agreed.

And besides that, banks should do what they want to do. That COBOL software they are running is hardly ever a problem, the problems are usually in the new stuff which has been far less battle tested and is connected to a hostile network.

<comment><USER22> Legacy COBOL systems (hell, a lot of legacy code in general) is a perfect example of the "if it's not broken, don't fix it" mantra. There's an incredible amount of work involved in rewriting legacy code, and when you're talking about doing so in a constantly updating, critical context like financial transactions, it kind of highlights the need to take things slow and carefully. My experience with old legacy systems (20+ year old C in particular) is limited, but it was enough to recognize that just ripping it all out is an awfully ignorant approach compared to a gradual migration of what needs to be replaced.

It's also an incredibly expensive one, especially since it's a recurring situation. No matter how clean and clear you think your code is, or how thoroughly you've commented everything, in a decade or two, someone is probably going to be groaning about it being legacy code.

</comment></comment></comment><comment><USER23> COBOL has been "dying" since the late 70s. Since that time I have seen several languages and platforms come and go. Where I work our core application driving the business is written in COBOL. Estimates are between $500 million to $1 billion dollars to replace it due to the number of systems interacting with it and all the business processes affected by it. For that kind of money the business wants a technology they can hang their hat on for twenty to thirty years. So what are you going to choose? What languages and platforms in widespread use today are going to be around in twenty to thirty years? Here's what I think it will be: C, C++, Java and COBOL Hmmm. COBOL is in that list. So if I think COBOL will still be around in twenty to thirty years and the system is working fine now then what reasons do I provide to the business for spending $500 million to $1 billion for the upgrade? Yeah - I can't think of any either that warrants that kind of expenditure. So COBOL remains.

</comment><comment><USER7> It's not only banks, I took an internship at an insurance company a couple of years ago that had their entire mainframe written in COBOL.

Not only do they have a hard time finding people to replace their retiring veteran developers, but for smaller companies (like this one) that can't afford to pay ridiculous salaries for a top notch COBOL dev, they have to settle for mediocre aging developers that can write COBOL and are on the job market.

These devs are getting paid good money to work on critical systems and aren't skilled enough to properly maintain them. It would be so much cheaper for these companies to pay better devs to do more recent tech. But it's hard for them to get out of that loop. Makes me rethink where I have my money.

</comment><comment><USER24> I wonder what people will say in twenty years about our NodeJS, AWS, microservices and JavaScript systems.

<comment><USER25> Nothing critical (banks, military, factories) runs on NodeJS/JavaScript/AWS so probably nothing. Do you think a lot about some old BASIC Accounting Software?

There are probably only two languages which might face similar problem as COBOL: C and Java. For now they are both actively maintained and used for new projects - so we are fine for at least next 50 years.

<comment><USER26> NodeJS and Javascript yes, but critical things absolutely run on AWS.

<comment><USER27> Running on AWS and doing it correctly so that one of the many regional outages does not cause you an issue is really hard and is a software problem. On the other hand using a system of tested proven code that runs on a system that is redundant by design at the lowest level of component (a mainframe cluster) where the software does not have to have knowledge of the redundancy is a bit simpler.

I really think people miss this very important point. Redundancy is transparent for 99.9999% of the software you run on the old big iron systems. For something like a modern application on AWS you have to know, understand and code for the infrastructure.

<comment><USER26> We're talking about two different issues here. First is the architecture/software of a mainframe system, with all of its redundancy and scaling. Second is the issue of hosting and maintaining your own hardware. On the first issue I'll admit I don't know enough about mainframes, perhaps they provide redundancy transparently to the programmer, but I'm a bit skeptical. Perhaps you simply think the redundancy is transparent because you understand the mainframe infrastructure deeply and internalized it? The second issue I'll push back on.

If you just want to host your servers on EC2, the SLA is 99.95% uptime. So that's about 4 hours of downtime due to outage a year. Put your servers in a multi-AZ autoscaling group and you're pretty solid. Bonus points for having autoscaling groups in more than one region. If you don't want to use any of the other services AWS provides, you can simply use them as a basic hosting service and get pretty amazing uptime. I've never used an old mainframe system, can you get greater uptime than that? Including hardware failures, power outages, network outages?

<comment><USER27> There was one point in my life when I was working for a large mainframe company ;) A bank wanted to move a system to a new site. The uptime on that system was 11 years. Uptime on a mainframe system is pretty much considered 100%

4 hours downtime a year is just way to much for some systems.

Just have a google for "mainframe uptime".

Yes the software is abstracted from the HW redundancy. You can pull CPUs with running code in systems and things keep working. Really - walk up and pull the CPU out. No impact to running code.

Heck you can run your private cloud on one:

[https://www.fool.com/investing/general/2015/01/24/heres- why-...](https://www.fool.com/investing/general/2015/01/24/heres-why-ibm-is- still-building-mainframes.aspx)

</comment></comment></comment></comment></comment></comment><comment><USER28> This old argument again? It seems like every 25 years somebody brings this up....

<comment><USER29> Every 25 years? COBOL's only been around for about 60. You make it sound as if it were something we've had happen far more frequently.

</comment></comment><comment><USER30> I quite like the fact that programs written decades ago are still in use. In the web development world there is so much churn. Anything you write now will have been rewritten a year later. It is quite disheartening.

I like this quote from [https://teuxdeux.com/purpose](https://teuxdeux.com/purpose)

> On that note, why the heck does every app need to change all the time? Can't > something on the Web be more or less finished?

However I have no idea what COBOL is like to work with so I am probably being unrealistic.

</comment><comment><USER31> One of the design goals for COBOL was that non programmers should be able to understand it with a little training. That would allow non technical managers to have a bit more control over their projects than they would have with Fortran, Algol or PL/1.

I don't know how well that worked out, but other than Hypercard all other languages I am familiar with (and they are many) only make sense to those who can program in them. So though Java is often considered to be the modern COBOL, at least in this regard it isn't.

</comment><comment><USER32> There's a misconception that COBOL is dead, its not, there are developers and new compilers being built for it. [1]

IBM isn't sitting around waiting for COBOL to die out, its working out hooks between COBOL and Java and introducing new languages like NodeJS [2]

The problem isn't money, its risk. No CIO is willing to risk moving to a new system, and that's the problem that needs to be attacked.

[1] [https://www.ibm.com/developerworks/community/groups/communit...](https://www.ibm.com/developerworks/community/groups/community/BinaryOptimizer)

[2] [https://developer.ibm.com/zsystems/documentation/java/worksh...](https://developer.ibm.com/zsystems/documentation/java/workshop/java- and-cobol-interoperability-introduction/)

</comment><comment><USER33> I know very little of COBOL but I have often wondered if bank COBOL software could be transpiled (a quick googling shows there are transpilers). That is COBOL -> Some_Other_language and perhaps Some_Other_language -> COBOL.

Then in theory you could write unit tests in some language to test the real COBOL and the transpiled COBOL.

<comment><USER10> This company has been doing it for quite a while with an amazing toolkit for language work:

[http://www.semanticdesigns.com](http://www.semanticdesigns.com)

[http://semanticdesigns.com/Products/Services/LegacyMigration...](http://semanticdesigns.com/Products/Services/LegacyMigration.html?Home=COBOLTools)

They also have a proprietary, parallel language I'd like to see go FOSS:

[http://semanticdesigns.com/Products/Parlanse/index.html?Home...](http://semanticdesigns.com/Products/Parlanse/index.html?Home=ParlanseForDMS)

</comment></comment><comment><USER34> I work for a large brokerage company that has a deeply integrated system written entirely in COBOL on the IBM mainframe. That sucker is going no where, and for good reason: it's incredibly efficient for what it does. As a batch processing system, the mainframe simply can't be beat. We deal with millions of dollars worth of transactions every day that have to be correctly accounted for and reconciled. In order to get the performance required to do all of that, we stick to the mainframe.

However, I do see the appeal for building off of the COBOL foundation using more modern languages. Writing a UI in COBOL on CICS is an absolute nightmare to deal with and maintain (not to mention my firm's egregious install and deployment process that is nothing but red tape and TPS reports). I'm working on a project right now where we're migrating some of our reconciliation screens to the web, where the UI communicates with a Java/Spring Boot server that itself interacts directly to the database using DB2 Stored Procedures.

In this space, I see a need for moving away from COBOL. But for the batch processing? Not a chance.

</comment><comment><USER35> Say I wanted to learn COBOL, has anyone got any resources they'd recommend?

<comment><USER21> Programming in COBOL is best learned by signing up as a trainee employee in a company that has been using it for a long long time and that employs a bunch of old programmers who will be _more_ than happy to teach you.

It's a quirky language, (omit a single '.' somewhere and you're in a for a world of hurt) has its neat parts and in general will come across as limiting once you have been exposed to other, more expressive languages. But that's probably also the reason it is still around, think of it as JAVA but then conceived in the gray past. The original intent was to make a programming language that would allow managers to program. That didn't quite work out.

<comment><USER36> Hey, apologies for randomly hijacking a comment for this question, but over the past years you've been popping up all over HN's comment section with (it seems) a rather eclectic and broad mix of experience, knowledge, and (possibly) talent. I'm almost starting to suspect you're multiple persons (but not really).

Have you ever written about how this came to be? I find myself to be similarly broad in interest/experience, but I'd judge myself much more superficial/limited in this regard because of the breadth of it all. I'm curious how you manage it all.

<comment><USER37> You've never heard of Jacques Mattheij, inventor of the live webcam?

<comment><USER36> Nope, perhaps too young for that?

That said, the guy doesn't even have a Wikipedia page! So how should I know?

<comment><USER37> By being old, obviously.

</comment></comment></comment></comment></comment></comment><comment><USER38> I wonder what banks would do if it wasn't for those genius suggestions in the article... /s

</comment><comment><USER39> The decisions to keep these systems around are not about technology -- they are about risk. Every IT lead in every bank knows the options for updating the systems. But they also have risk management concepts attached to their decisions, and because we are talking about banks, there is no such thing as small consequences. Banks are extremely risk-averse, so if the system is working and changes bring risk, you don't do the change. Figure that by the time there really is nobody left to maintain it, somebody else will have taken on the risk, and new products will be available. So there is less risk in waiting for those products than in taking on new development efforts yourself.

</comment><comment><USER40> I am probably the odd man out here, but I took two semesters of COBOL and really enjoyed it. I have been trying to figure out how to get into COBOL programming, but the job postings are few and far between and seem to want more experience than I have. I honestly think I would be really happy programming in COBOL day in and day out.

As an aside, I think part of the reason I like COBOL is because I am an above average to very good academic writer. I enjoy writing papers and find it hard to meet page minimums because brevity and clarity is important to me. These characteristics (good, clean, to the point writing) seem to translate to COBOL more than any other language that I have used.

</comment><comment><USER41> Has anyone ever been part of any kind of migration from Cobol to anything else ? What happens to underlying hardware - is it even possible to migrate from mainframe to the cloud without a complete reengineering ?

<comment><USER42> Nobody uses mainframes anymore (except banks). They have emulators however, that emulate a mainframe on windows.

<comment><USER43> Not true. I recently worked at a major auto parts retailer and all part pricing and availability data was stored in mainframes.

Currently I work for a major insurance company which has multiple data centers with many, many mainframes... Think ~60K square feet worth of mainframes per data center.

Mainframes are pervasive and aren't going anywhere anytime soon.

</comment></comment></comment><comment><USER44> Banks have no issues hiring ex-offshore contractors who have been doing the work for years. These guys can maneuver themselves through mainframe technologies and show their proficiency with quite ease.

<comment><USER45> Banks also have no issues retraining their IT staff to learn COBOL and ascend from the Mostly For Fun Open Systems department to the Really Important Mainframe Systems department.

</comment></comment><comment><USER46> Compared to COBOL, that IBM PC is a whippersnapper. An IBM 370 would have been a better match.

[https://en.wikipedia.org/wiki/File:IBM_System_370-145_und_Ba...](https://en.wikipedia.org/wiki/File:IBM_System_370-145_und_Bandlaufwerke_2401.png)

My dad programmed in COBOL for the Army, and he retired in 1975. That's how old COBOL is. Knowing my dad, he probably still has his manuals, though finding them might prove an archaelogical exercise

</comment><comment> norea-armozel It's kind of heartening to see programming languages like COBOL, Fortran, and Ada still are chugging along helping folks solve their problems. I think instead of trying to replace the language how about we design modern hardware and software to work around it? Isn't that where virtualization can help (I'm assuming too much probably with this question considering how many programs of that era are hardware specific)?

</comment><comment><USER47> There is another important problem: the hardware and software these production COBOL applications runs on (mainframes) is a burden for vendors like IBM. Unless these mainframe systems are replaced by commodity hardware and software, banks will always have to fear EOLs or high prices to keep development viable for vendors.

</comment><comment><USER48> It's not just banks, a good number of industries still run legacy COBOL systems. Timeshare for one.

</comment><comment><USER49> I think they actually do. But very slowly. Last time I checked the amount of known COBOL solutions was already surprisingly small. It's mostly people who don't know anything about COBOL and COBOL fans who still believe that COBOL is that important.

</comment><comment><USER50> Maybe so, but that would be an immensely huge undertaking costing a lot of $$$$. Good luck getting them to do that.

</comment><comment><USER51> I don't know about anyone else, but one reason I wouldn't get into COBOL is I wouldn't want to be that guy who thought he could learn an archaic language but lost the banks millions because of programmer error. I suspect a lot of people simply don't want the kind of responsibility that working with bank mainframes entails, even if they know COBOL.

</comment><comment><USER52> Rewrite it in Rust/Javascript

<comment><USER21> You're going to have a hard time selling that combination.

<comment><USER13> Is there a proper decimal library for either language?

<comment><USER21> Meh, who cares about a few cents ;)

<comment><USER13> I still remember tracing down an odd bug involving taxes and contract calculations that resulted from a programmer I thankfully couldn't identify using a single precision float to do calculations that involved unit of measure conversions that then had calculations involving contract terms and weights. The original unit stored was a decimal with 30 total digits and 10 decimal digits. When I finally found the part of the code where decimals suddenly because floats, I was inclined to do violence given it was 3AM and I was chasing a couple of hundred thousand pennies in various places. It was deep in the middle of a stored procedure so the standard excuses don't apply.

I swear there are not enough classes about numbers.

<comment><USER21> > I swear there are not enough classes about numbers.

Yes. This is one thing that irks me about these fads in programming, they all solve problems that have long ago been solved and then re-introduce all the bugs that were already discovered, fixed and forgotten about ages ago. Old software is a very nice repository of information about edge cases and real world complexity.

A $0.75 accounting error turned out to be named "Markus Hess". Precision matters. If it works good. If it works but you don't know why it works: bad. If it works, but has a small problem and you don't know why: bad. If you run a $1M budget and you're off by $0.75: bad. And so on. You really don't want to store anything to do with money in floats.

<comment><USER13> I remember a 'Survey of Programming Languages' class in college. Perhaps a archeology of code class and things already done. You are right, I wonder how much of Computer Science knowledge is locked away never to be seen. Perhaps a tax credit for companies that donate their old source code to the Library of Congress.

</comment></comment></comment></comment></comment></comment></comment><comment><USER53> wouldn't it be great to have something like COBOL-grpc and rewrite everything in rust/scala/java/c# but not all at once, more like the simple things first?

I think that would probably be a good business.

</comment><comment><USER54> If I were a bank I'd start a new bank, in Not COBOL, and put all my new customers on that. Then after 10 years offer to move people still at the old to the new bank, to get new offers.

<comment><USER55> How do you message to your existing customers that you're holding their life savings on fragile 1970s tech?

Also, you'll still have to write wrappers for the old tech (iPhone apps which access the COBOL core) in order to maintain feature parity with the other banks.

<comment><USER38> > _How do you message to your existing customers that you 're holding their > life savings on fragile 1970s tech?_

You mean "battle tested for 40+ years, totally solid 1970s tech"?

If anything, it's any crap they'd write now that would be MORE fragile.

<comment><USER55> You're thinking like an engineer.

You're right, of course, but the public is trained to trust the latest and greatest.

If 'battle tested' was the most salient selling point we'd be on Series 60 or QNX phones.

'We're putting new customers on the latest technology and keeping existing ones on our old systems' is not going to be an easy thing to message to the general public.

<comment><USER56> _If 'battle tested' was the most salient selling point we'd be on Series 60 or QNX phones._

Actually, there are more Series 40 and Symbian phones sold today than iPhones - 350 million to 200 million (India / rest of Asia, Africa and Latin America are the main buyers). Many people here still miss the old Nokias. Of course, Android is the new Series 60.

[http://gadgets.ndtv.com/mobiles/news/nokia- sold-35-million-f...](http://gadgets.ndtv.com/mobiles/news/nokia- sold-35-million-feature-phones-in-2016-strategy-analytics-1663745)

[http://tech.firstpost.com/news-analysis/india-smartphone- shi...](http://tech.firstpost.com/news-analysis/india-smartphone-shipments-to- overtake-feature-phones-in-2016-cmr-295949.html)

</comment></comment></comment></comment></comment><comment><USER57> if you think COBOL is bad you haven't seen RPG yet.

</comment><comment><USER58> If you read the article carefully you'll notice that most banks DO NOT maintain their own software! They licence the software, and usually the job of running the system, from a software house. The article is based on an intervjue of the CEO of Auka. Auka is a software house for a peripheral piece of banking software. (read, he's selling software licenses). Try to look at this from the banks point of view.

My first job was in one of these software houses for banking and finance(B&F) who made both core system and peripheral software.

A bunch of us programmers tried to make the same sell to one of the bankers we had on staff. (You need bankers to do the job of products manager in this business). He looked at us like we're morons, and asked a rather pointed question: "OK, say we rewrite the whole software stack in C++ (this was 1998). What NEW banking products can we make in C++ we CAN'T make in cobol?" Answers is of course; None, zip, nada. Last time you changed bank, did you ask who's banking system is being used and in what language it was written in ? I'm guessing not.

So banks go to the software houses to license a core banking system, and they care pretty much about only two things: 1) Is it solid (i.e bug free. Few things evaporate trust in a bank faster than there being questions about the banks ability to do basic math right). 2) price

There have been a few cases when a new core banking system have been written from scratch, and most have been failures due to being too buggy when launched. Word get out among the banks and the system is dead. All will wait until it's proven, no one will be the first one out of the gate. The bug free requirement is a show stopper from the getgo.

On to price. The development cost of such a system is in the neighborhood of 250 - 500 million USD. The only way to get that down is to strip down the features to a much simple system. The other software houses are just going to sell an existing cobol system, with disabled features to match yours, and underbid you.

Bankers, unlike most CS majors, actually understand how to calculate cost of investments! Say 500M USD development cost, a future value calculation will yield that you'll need a return-on-investment (ROI) of 20-50M US EVERY YEAR FROM HERE TO INFINITY to make the investment pay off. (That's PROFITS, not revenue)

Core banking systems are so feature stable, and have been so thoroughly debugged over DECADES, that there is very little maintenance to be done. I'd expect that each of these systems have a staff of 10-20 programmers maintaining them (and they spend a lot of time doing other things). How big a staff of maintainer will you new banking system need after launch? Even if it was zero and you assume you pay each maintenance programmer 250k USD, a staff of 20 still only cost 5M USD.

The article have a section "what can the banks do" left out a fourth option. Instead of using CS majors to code cobol, you use B&F majors, and give them a 1-2 year education on doing cobol programming. The CS majors need 1-2 years of on the job experience to reach a B&F Bachelor level understanding of what a core banking system need to do anyway. Cost is the same.

One last point, say you do write a new system today your choice of language will be either Java or C#. As database there is no viable alternative to SQL. In 30 years no fresh CS major will touch Java or C# with a ten foot pole, and you'll have to do another rewrite to the tune of 100-200M USD (assuming that programming will require less hands).

Much cheaper to keep on educating non CS majors to do cobol.

</comment><comment><USER59> And we should all switch to Metric, give up fast foods, and call our mothers once a week... but look, it's never that simple because all of these things take effort.</comment>


Why Y Combinator News is so popular? - <AUTHOR>

Sometimes newbie questions are the most interesting , it isn't this case, but let's see what happen.
The point is that I can't understand why Hacker News has so success..
Design is very poor and seems like 90's websites, the submit form is saddest of all the web. Social interaction is almost zero, is an involution of forums (which we know that they went out of fashion).
I know that I has some innovative business logic with its submissions, positive votes and karma. But I am sure that if anyone try to do something like this, (now or at 2007 when Hacker News was born), it would have less than ten visits per day.
I have to say that it generate me a great confusion, because as you know, all technologies and web sites move toward social media, innovated designs, javascript... We spend hours and hours trying to javascript works and making the best look & feel. And then you see how simple is Hacker News and I don't know if I have mistaken of profession and I had to be lawyer.
So, WHY we love it?
I hope you understand my humor, because my English is not the best. <comment><USER2> Because HN actually has the best content, it doesn't have to do any of the other things you mention to get users. So it can focus on the thing that really matters, which is the value that users get from the site, which in the case of HN has nothing to do with graphic design or trend-following social features.

If something is low quality, but many people use it anyway, that means that there is a part of it that is truly world class.

</comment><comment><USER3> When the evidence strongly contradicts your assumptions, you may want to revisit them.

I'n here because the featured articles and comments are well aligned with the interests of technology entrepreneurs like me. HN development effort is wisely directed towards improving voting and ranking.

Making the "innovations" you describe would be like using cake frosting to put a fancy design on a grilled salmon.

I love the existing low latency/low bandwidth design of HN. It works great on my iphone in limited connectivity conditions, much better than normal websites. It's a real plus, but minor compared to the quality of articles and comments.

</comment><comment><USER4> I can't answer for others but here are my personal reasons (in no particular order):

1\. The community. Its better than anything I can find elsewhere at the moment for its size and diversity.

2\. The content. This, like the answer above, is the same.

3\. Engagement levels are decent.

Please note that better does not mean best, it just means its better that anything else I can find.

</comment><comment><USER5> For me: \- Really good articles and content posted and upvoted.

\- Good quality comments and lots of expertise from individuals from every sector of tech.

\- No trolls / bs comments like most anonymous forums (ok, a few, but they get downvoted quickly).

</comment><comment><USER6> Every other social news site tends to pull away from techish news. Hacker News does it too from time to time, but on the average, it does a good job at it. I also love people like Peter Norvig jumping in and talking about a subject or some random startup "Show HN"ing their new product.

</comment><comment><USER7> 1) The subject matter.

2) High-quality comments.

3) I actually like sites with a simple UI. I still haven't figured out the Reddit user interface. I gave up on Facebook years ago, after their third or fourth site redesign.

</comment><comment> saiko-chriskun As with all things, community (i.e. network-effect) is what's most important.

e.g. craigslist

</comment><comment><USER8> The slightly obnoxious answer would be volumes of people trying to suck up to the YCombinator decision makers. Despite this sucking up, the discussion, especially if you are good at scanning through comments, is still the best I have seen. So that is why I like it.

</comment><comment><USER9> People using it.</comment>


Younger than 28? You've never lived a month of below average global temperature - <AUTHOR> http://www.treehugger.com/climate-change/are-you-younger-28-youve-never-lived-month-below-average-temperature.html

<comment><USER2> Lacks precision. How is the average calculated, precisely? It seems that winter months would always be below average. If the average is per month, I can't believe that each month is warmer than the one last year, and that year after year.

This is a crappy piece of "journalism".

</comment><comment><USER3> Nobody experiences average global temperature. It's just a statistic. There's been plenty of colder than 'average' (which can mean several different things) months in various places on Earth.</comment>


Apple's bands go way too far - <AUTHOR> http://www.pcworld.com/article/188760/Apples_Bans_Go_Way_Too_Far.html?tk=rss_news

<comment><USER2> The thread title and the article title are one letter different from each other, but it's a pretty important letter.

<comment><USER3> "Apple's bands" would be the Beatles, Wings, Hot Chocolate, Grapefruit, Plastic Ono Band, etc...

</comment></comment><comment><USER4> Apple Records is totally out of control. At this rate one of their bands is going to end up "bigger than Jesus"!</comment>


GIF: The jood, the bad, and ujly   - <AUTHOR> http://idibon.com/gif-and-ways-to-say-g/ <comment><AUTHOR> Mater</comment>


Apple, The Hyperion Ion Cannon And Why Future iPhones Could Have Sapphire Screen - <AUTHOR> http://techcrunch.com/2013/11/11/apple-fires-its-ion-cannons/ <comment><USER2> That was hard to read...

"The manufacturing process for most solar panels involves manufacturing a block of sapphire or other crystalline silicon and then slicing a .2mm-thick sheet off of it with a wafering saw."

Painful</comment>


Roundoff Error and the Patriot Missile (1992) - <AUTHOR> https://web.archive.org/web/20100702180720/http://mate.uprh.edu/~pnm/notas4061/patriot.htm <comment><USER2> The computer science behind TBM interception is a fascinating problem with very high stakes consequences, as occurred on February 25, 1991.

I was an active duty Patriot Technician and Systems Mechanic (24T) during that time; and even though we were rebooting our systems regularly to diminish the impact of this roundoff error, there were other critical timing issues during the intercept stage.

TBM interception involves the science and math behind a "bullet hitting a bullet". These are extremely high velocities converging on each other.

To Raytheon's credit, they were iterating rapidly and released patches almost daily as new data was collected.

Even when we managed to launch a Patriot to engage an oncoming Scud, success was dependent on the proximity fuzed warhead detonating at just the perfect predictive moment ahead of the projectile. This timing was perfected over a decade in White Sands NM using lower velocity drones. But Patriot's software was not optimized for TBM-scale velocity (it is now).

A "perfect" hit typically resulted in a shower of hot metal and undetonated debris raining down on civilian populations.

From a game theory perspective, this is basically a no-win situation. You're just trying to minimize collateral damage once a theater of operations escalates to using TBMs.

<comment><USER3> Is TBM "theatre ballistic missile", "tactical ballistic missile" or something else?

<comment><USER2> Good question. The terms seem to be used interchangeably.

But Wikipedia classifies Scuds as "Tactical" in this case, because of their short range.

</comment></comment></comment><comment><USER4> I'll never forget my Computational Methods professor discussing exactly this project, and how a lack of knowledge or care about things like the conditioning of your routines, or compounding rounding errors in floating point, could literally get people killed.

Most of the students laughed at this idea.

</comment><comment><AUTHOR> Also: "As a stopgap measure, the Israelis had recommended rebooting the system's computers regularly."

[https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dha...](https://en.wikipedia.org/wiki/MIM-104_Patriot#Failure_at_Dhahran)

<comment><AUTHOR> I read further down, and it got more interesting. Success rate is claimed from 95% by ones to below 10% by others. "standard firing doctrine on average four Patriots were launched at each incoming Scud .. suggests low confidence in individual missiles".

<comment><USER5> _suggests low confidence in individual missiles_

Or the high consequence of an individual miss. Not that I disagree that Patriot took a long time to evolve to effectiveness, but it's probably more complicated. Take for example the Phalanx CIWS, which fires hundreds of rounds at each target, even though theoretically a single round should be enough, because missing a single incoming target would be very, very bad.

<comment><AUTHOR> Yeah, but bullets a dumb and cheap. The multi $M rocket with radar, guidance should have at least 90% hit rate against SCUD like big target. Agree, not an easy task for Mach 5 SCUD.

<comment><USER5> _should have at least 90% hit rate_

Why? Just because it's expensive?</comment></comment></comment></comment></comment>


Meet 'Project Zero,' Google's Secret Team of Bug-Hunting Hackers - <AUTHOR> http://www.wired.com/2014/07/google-project-zero/ <comment><USER2> People here seem to miss an important point.

"Unsafe" internet is not an inconvenience for Google. It's a mortal enemy.

With botnets all around clogging networks they will not be able to serve videos, search results or ads. With malware stealing your credit card details you will not buy stuff online and firms will stop buying ads.

Basically, it's not a matter of choice for Google to make internet safer. It's an absolute necessity long term. The big questions is exactly _how_ to make internet safer - and this announcement shows they at least have an idea where to start.

<comment><USER3> the same way why governments have armies.

</comment></comment><comment><USER4> It's incredibly exciting to consider just how much talent Google has managed to amass on this team. Say what you will about whether it's an entirely altruistic endeavour or not, but I don't think anybody can dispute that devoting a team of this calibre to vulnerability research can turn out as anything but great for the internet as a whole.

I've seen Ian and George work in passing, and if the rest of the team is half as capable as they are, I'm expecting some really great findings to surface from the project.

</comment><comment><USER5> Are there any good online resources that someone experienced in this field would recommend that go through the basics of how to perform this type of bug hunting?

I have a background in computer science but was never given the opportunity to take any classes in reverse engineering and exploitation of software. Thanks!

<comment><USER6> Aside from the courses/exercises mentioned above you could also give Google Gruyere a go: [http://google-gruyere.appspot.com/](http://google- gruyere.appspot.com/)

If you want to go in-depth I learned a lot by just reading interviews (and following the links) from the 'How to Break Into Security' series of KrebsOnSecurity, here's the ones I had in my bookmarks (there are more if you use the search)

Thomas Ptacek (tptacek) Edition: [http://krebsonsecurity.com/2012/06/how-to- break-into-securit...](http://krebsonsecurity.com/2012/06/how-to-break-into- security-ptacek-edition/)

Charlie Miller Edition: [http://krebsonsecurity.com/2012/08/how-to-break-into- securit...](http://krebsonsecurity.com/2012/08/how-to-break-into-security- miller-edition/)

Richard Bejtlich: [http://krebsonsecurity.com/2012/07/how-to-break-into- securit...](http://krebsonsecurity.com/2012/07/how-to-break-into-security- bejtlich-edition/)

</comment></comment><comment><USER7> Reminds me of the IBM black team.

[http://www.irrationaldiversions.com/guest/black](http://www.irrationaldiversions.com/guest/black)

<comment><USER8> The insight there is that one should always try to wrap criticism with praises: people don't like being told that they suck at their job, even if it's true. If instead of showing themselves as destructors, they'd adopted an image of mentors or teachers, things would've gone way better. Hopefully Google's Project Zero will be wiser than the IBM team on this point.

Note that this is even truer when criticism comes from an outsider, and Google's team will be doing exactly that. If they also deal with companies whose culture is very much reputation based (like in Asia), they'll have to be even more cautious.

<comment><USER9> I think providing unsolicited advice is always going to be fraught. Showing up as "mentors" and "teachers" is not going to go over well if the person you show up to teach thinks that you don't know what you're talking about. It's certainly possible that a lot of people will welcome the help, but it seems just as likely that people will say, "You come in here and think that you know our applications, but you don't know the history and the specific compromises we decided to make, etc, etc."

One problem I think is that no one ever writes the story of the major bug that got fixed in time. If you could just check the counter-factual of what would happen without security upgrades, a team like this could build a reputation for saving a company millions of dollars and reams of bad PR, and they'd be more likely to be welcomed. As it is, it can be easy for entrenched interests to make the case that security-minded people are just obsessive because, "Hey, we haven't had a breach yet!"

<comment><USER8> I meant that mentor thing in the context of IBM. I agree that it would not be much better in the case of Project Zero.

That said, I still think that a positive approach (positive criticism) cannot be worse than plain critics.

> "You come in here and think that you know our applications, but you don't > know the history and the specific compromises we decided to make, etc, etc."

That's exactly the sort of answers that team should prep for: it is obvious to me that whatever compromise I made for my software stack, if there's a security issue, I will have to reconsider them. The whole point is to _not_ rub it up my face for me to accept the issue more easily (not everyone is an adept of egoless programming). I was also saying that with the perspective of the Sony situation: in Japan, losing face is an extremely serious matter. I don't know how this situation was handled by this guy though: perhaps he did all he could to manage their feelings. It's clear to me though that doing it the IBM black team way did is a recipe for failure.

</comment></comment></comment></comment><comment><USER10> "And what does Google get out of paying top-notch salaries to fix flaws in other companies' code? Evans insists Project Zero is "primarily altruistic.""

I think it's great that Google is trying to make software more secure, but I don't believe there's an altruistic spirit behind it. I think these researchers do search for bugs in software other than Google's, sure, but it's software that Google uses to run its services, so in the end the aim is still to make _their_ products secure.

<comment><USER11> No. Google already does that, better than any other company on the Internet. From the announcement, this project is different:

 _We 're not placing any particular bounds on this project and will work to improve the security of any software depended upon by large numbers of people, paying careful attention to the techniques, targets and motivations of attackers. We'll use standard approaches such as locating and reporting large numbers of vulnerabilities. In addition, we'll be conducting new research into mitigations, exploitation, program analysis—and anything else that our researchers decide is a worthwhile investment._

Unless the word "any" means something different to Chris.

</comment></comment><comment><USER12> I wonder if there's a possibility, using langsec(language based security) soomething similar to build a generic tool to solve this stuff once and for all ?

</comment><comment><USER13> Seems like George Hotz deserves more than an "intern" position.

<comment><USER14> _Google 's (GOOG) interns held coveted positions even before being featured in the film "The Internship," which hit theaters this weekend. On average, interns there are paid $5,800 monthly, while specialized software engineer interns make as much as $6,700 per month, according to the job-rating website Glassdoor. _

Remember that Google pays interns fairly well. It's not like he's running copies and picking up coffee for people at some random office.

<comment><USER15> That's a very low wage for a skilled software engineer though.

<comment><USER16> not to shabby that would equate to a senior developer in London BTW

<comment><USER17> In GBP its only ~40k a year...

<comment><USER18> Considering that tech jobs I've seen advertised in England pay between 1/3 and 1/10 of what I would expect a similar job in the US to pay, that seems about right.

</comment></comment></comment></comment></comment></comment><comment><USER19> Cool. What year can we expect "photos-server.bounces.google.com" to stop sending spam?

</comment><comment><USER20> This is patchwork, at best. It may slightly improve posture...they'll hunt for bugs in already published software, instead of demanding strong security principles for software engineering.

"The software security industry today is at about the same stage as the auto industry was in 1930" ... "it looks fast, goes nice but in an accident you die." ... "The major shortfall is absence of assurance (or safety) mechanisms in software. If my car crashed as often as my computer does, I would be dead by now." -- Brian Snow, Former Technical Director of the NSA, We Need Assurance [http://www.research.att.com/talks_and_events/2008_distinguis...](http://www.research.att.com/talks_and_events/2008_distinguished_speaker_series/b_snow/2008-10-15-snow?fbid=VGG7O3cANdm)

"Most programmers think that getting run-time errors, and then using a debugger to find and fix those errors, is the normal way to program. They aren't aware that many of those errors can be detected by the compiler. And those that are aware, don't necessarily like that, because repairing bugs is challenging, and, well, sorta fun.

You are not giving a programmer good news when you tell him that he'll get fewer bugs, and that he'll have to do less debugging. Basically, we still live in the dark ages of programming, not unlike the time engineers were learning about boiler technology by figuring out why a boiler exploded, scalding people to death (remember the Therac-25?). People will probably have to die in order for "software engineering" to be a true engineering profession, instead of the buzzword that it is today. Sad but true." -- Mathew Heaney

As someone said here on HN, it took two major disasters for people in the Netherlands to build coastal defence structures. We only seem to learn from disasters.

<comment><USER21> So how does it work for Google to demand strong security principles of Adobe for their Flash product? Finding 400 game over bugs on their own then telling Adobe about them seemed to get more traction.

<comment><USER20> Exactly. This doesn't seem to be popular around here, but unless secure coding practices are mandated, commercial aspects (first-to-market etc.) will take precedence. This is an industry-wide policy issue. Regulation _works_ \-- we should really take a hint from Federal Aviation Regulations.</comment></comment></comment>


Bee portraits - <AUTHOR> http://blog.flickr.net/en/2013/12/13/bee-portraits-like-youve-never-seen-before/

<comment><USER2> These are really beautiful photos.

Insects get their iridescence and colour by adjusting the micro-structure of their surface[1] so that it reflects light in different interference patterns - this is much energetically cheaper than synthesising the big dissociated organic ring structures that we use in pigments and dyes, and more stable (but, obviously, must be "grown" into shape rather than painted or stained).

This is also how most flowers get their colours[2].

[1] [http://animal.discovery.com/insects/butterfly- colors.htm](http://animal.discovery.com/insects/butterfly-colors.htm)

[2] [http://aob.oxfordjournals.org/content/105/4/505.full](http://aob.oxfordjournals.org/content/105/4/505.full)</comment>


Peter Thiel Is Exploring the Creation of a Conservative Cable News Network - <AUTHOR> https://www.buzzfeed.com/ryanmac/peter-thiel-conservative-news-network-roger-ailes-fox <comment><USER2> I realize this idea is a bit old fashioned... but how about a news network where they simply try as hard as they can to report objective reality, and we don't worry about whom that favors?

<comment><USER3> Choosing what to show (and what not) is just as important in shaping opinion and worldview while still allowing for objectivity. We have limited time, limited attention spans, and limited concern (or outrage).

For example, one can cover, say, the illegal immigration situation in the US. While a more liberal outlet might focus on humanitarian concerns of the immigrants, the "good ones" leading virtuous lives in the country a conservative one might focus on the humanitarian concerns of Americans, major crime, etc.

What would be nice is an objective outlet that provides reasonable consideration of both sides in a concise manner, analyzes potential benefit and harm, etc. I'm sure this is the "Good, cheap, or fast" of news.

<comment><USER4> Politically "active material" is, for some reason, the only branch of knowledge that we all seem to agree can't be expressed in words. I can tell you everything known about the effects of... caffeine on general health: all I have to do is start talking, and then not stop until I've said every well- supported, relevant fact. There's absolutely no fundamental reason why I can't put the profile of an undocumented hard-working fruit picker in the same broadcast as a report on a brutal drug-related homicide believed to have involved people here illegally. There are many _political_ reasons why I wouldn't do that, most of them related to the motivations that drove me to do character profiles (a dangerous combination of emotional credibility and statistical weakness) in the first place, instead of having calm talks about the large averages that we use to illuminate _every field of truth that 's devoid of strong ulterior motives._

<comment><USER5> You still require an audience which understands you, believes you... otherwise you do what you just said for vaccines, and you still get anti-vaxxers. Besides. 90%+ of your audience just flipped to the channels which tell them what they want to hear.

<comment><USER4> The tools that we could use to get the "uninterested" to believe the truth work equally well for falsities, and are usually _used_ to spread beliefs of convienience. If those tools were just sent down entirely, you'd be left with "right" and "random," and the random would always average out at the polls. Sadly, in our present world stupid is dangerous because machiavellians and martyrs alike are magnetizing it with arguments that are as wrong as they are emotionally convincing.

<comment><USER5> _Sadly, in our present world stupid is dangerous because machiavellians and martyrs alike are magnetizing it with arguments that are as wrong as they are emotionally convincing._

I don't usually do this here, as it's not strictly substantive, but damn that's a concise and lovely way of putting it.

</comment></comment></comment></comment></comment></comment><comment><USER6> If Thiel is going to use his own ideology, it would likely be more of a Libertarian news network. It isn't clear tho if that's the case. Maybe he just thinks there's more market for "conservative" and thus would go that direction. Or a third possibility (what I think is most likely actually) is that nobody knows what words mean other that "Conservative" and "Liberal" so they picked "the closest one."

<comment><USER7> There's not really a conservative news network, a libertarian one, or a classically liberal one. Fox News has positioned itself in a tabloid/populist space. It's hardly ideological (is cutting corporate tax rates pro little guy?), so something with a more definite point of view as opposed to virtue signalling would be interesting.

</comment></comment><comment><USER8> I worry about being on the cusp of not being able to discern real from non- real. Pictures, stories, audio, video can be convincingly fabricated. Our society and the rule of law may not be able to function. Maybe (hopefully?) we can develop technology that will help solve some of these problems. We're only in the first inning when it comes to political divisiveness.

</comment><comment><USER9> Is he confused about what Fox is or is he trying to copy it?

<comment><USER10> I do wonder what "there is room to flank Fox News from the right" is supposed to mean. What does that network look like?

<comment><USER11> At least in the US, libertarians typically consider themselves "right" of the Republican party. It's confusing, because right/left in politics exists on multiple dimensions. One of those is religion/social morality, and on that dimension libertarians are far to the _left_ of mainstream Republicans. On the economics/gov't size dimension, however, they are solidly to the right.

<comment><USER7> The Republican party is more diverse than most commentators appreciate. Trump didn't even have a majority of the vote in the Republican primary. Consider that the median Republican voter did not consider Trump to be their first choice. And that basically all the candidates except for Kasich ran to the right of Trump.

Also, libertarians are generally to the right of the Democratic party on religious liberty issues. Hardcore libertarians have no problems with people having kooky or unhealthy religious practices, for that matter.

</comment></comment></comment></comment><comment><USER12> Well that would be just another billionaire owned blabber box then wouldn't it?

Wanna know what I don't see much at all of on the FB feed right now?

Links to FOX News, MSNBC, CBS, ABC, NBC, produced "News". Almost none.

People are getting tired of tilted "News" and I promise right now do my best to help bleed Peter Thiel's cash as fast as I can by exposing bullshit they produce every chance they offer, and I'm sure that will be constantly.

Bring it on...

</comment><comment><USER13> MSNBC and CNN both tried to go hardcore conservative and out-Fox Fox briefly around the same time many years back, both lost ratings and failed to dent Fox when they did.

I'm not sure there's a market here; the demand for a conservative cable news network has a strong tribal identity with Fox News.

</comment><comment><USER14> We need to be careful that our news outlets do not become basically state media when their party/ideal of choice is in power, and opposition media when their party/ideal is not. It appears that is what we are leaning towards right now, and all it does is foster more polarization.

</comment><comment><USER15> If your news only aligns to a political ideology it is not news.

</comment><comment><USER16> Great!

</comment><comment><USER17> No thanks.

</comment><comment><USER18> Numerically, there are a great many more left-leaning sources than there are right.

Another conservative network would be good. If we can't have fair news, at least we can get biased news in equal and opposing doses.

<comment><USER19> I will take your word for it that there are more left-leaning sources. I will also assume for the sake of argument that it is possible to quantify the political alignment of a news outlet.

What is your definition of "left-leaning"?

What is your definition of "fair" in the context of news?

Why do you believe news cannot be "fair" or that we cannot have it?

Is the numeric quantity of sources at any point on the political spectrum relevant? How do you find the middle? Is it an average of all sources? Is it just a scale from MIN to MAX? If it is min/max then can't an extremely conservative (or liberal!) organization move the middle simply by making outlandish claims on their side of the spectrum? Does that make sources that would otherwise be considered "fair" appear biased?

<comment><USER18> These are good questions.

I'd say left-leaning sources are those that tend to report negatively on conservative politicians and positively on liberals. The Harvard study purports to measure what constitutes negative coverage, so this seems like it could be measured.

About numbers, it seems today often Fox reports favorably for the GOP, while CNN, NBC, MSNBC, NPR, and the BBC seem to favor the political left. (I think the Harvard study seems to suggest this.)

I suppose a microcosm of the 'balanced list' I'm describing might be 'Real Clear Politics'. This site posts leftist articles, then immediately follows them with right-leaning articles in equal numbers one after the other. It's an interesting way to get news, and it allows the reader to study different biases, often on the same topic.

<comment><USER19> Thanks for that explanation. I'm still unclear on why the total number of sources or articles with a given alignment is relevant.

In your "Real Clear Politics" example two perspectives are given equal weighting in their representation. This seems to make an assumption that there are exactly two valid perspectives and that they can be easily balanced.

Can't that system be exploited by extremists? If an extremely left-wing organization publishes a story that is nearly fabricated in its bias does a right-wing organization need to publish an equally flawed piece on the other side? Should people even read the stories?

I think it's accepted that there is bias in reporting. I also think it is a trap to believe "middle" == "balanced" == "fair" because extremists can exploit that perspective by making increasingly extreme statements. This is the basis of much of cable news as I understand it and I believe it oversimplifies the issues and creates echo chambers by rewarding the biggest delta in opinion.

In my opinion it is more important to get _diverse_ news sources than it is to try and balance ideologies, especially when those ideologies are defined by someone else.

<comment><USER18> Thanks for that. I agree, diversity in news sources is a good way to get differing perspectives. (Also, perspectives not being pushed from the same opposing ideologies, as you suggest.)</comment></comment></comment></comment></comment>


Some doctors moving away from ventilators for virus patients - <AUTHOR> https://www.sfgate.com/news/medical/article/Some-doctors-moving-away-from-ventilators-for-15187546.php <comment><USER2> I've heard it speculated that the thing to do may be to not put people on ventilators, but give them blood transfusions.

Where I heard this: [https://science.slashdot.org/comments.pl?sid=16122794&cid=59...](https://science.slashdot.org/comments.pl?sid=16122794&cid=59921250) . Also [https://www.statnews.com/2020/04/08/doctors-say- ventilators-...](https://www.statnews.com/2020/04/08/doctors-say-ventilators- overused-for-covid-19/)

</comment><comment><USER3> Somehow the link is not working for me. I found the article browsing SFGate, good read.

<comment><AUTHOR> I emailed the mods. It's been fixed.

<comment><USER4> Off topic, but: What's Covid doing (or going to do) to the homeless population? If you're in a shelter, how do you do social distancing? And if you're on the street, how do you social distance there?

I'm asking you because you have more understanding of the realities of homelessness than anyone I know...

<comment><AUTHOR> It's pretty bad, from what I gather.

Some shelters and soup kitchens have closed. Normal people can't find hand sanitizer. Homeless people can't either and also frequently lack consistent access to sinks and showers.

[https://streetlifesolutions.blogspot.com/2020/03/covid-19-an...](https://streetlifesolutions.blogspot.com/2020/03/covid-19-and- impact-on-homeless.html)

[https://www.reddit.com/r/homeless/comments/fwn68c/i_dont_thi...](https://www.reddit.com/r/homeless/comments/fwn68c/i_dont_think_most_people_realize_how_screwed_we/?utm_medium=android_app&utm_source=share)

<comment><USER5> And a nightmare for prisons and nursing homes.

<comment><AUTHOR> Yes. The headlines I've seen suggest nursing homes are seeing a lot of deaths.</comment></comment></comment></comment></comment></comment>


I'm pissed. – Glenn Pendlay - <AUTHOR> https://glennpendlay.wordpress.com/2012/05/20/im-pissed/ <comment><USER2> This headline reads badly to a UK English speaker. If he's drunk can he at least keep quiet about it?</comment>


Ask HN: Where to host ASP.NET MVC app - <AUTHOR>

If i have an ASp.NET MVC app, any recommendations on where to host it ? I am aware of PAAS services like Azure, AppHarbor but they seem too expensive. Anything else out there that can handle this ? My research so far shows that most good hosting providers support only Linux based OS. So unless I play around with mod_mono etc to get the .NET app on linux, is there a simpler alternative ? I am also not looking for really cheap shared host and need a dedicated server. <comment><USER2> Depending on the nature of the application, you may be able to sign up for Microsoft's BizSpark program. That includes $160 of credit for Azure per month for three years. That would be more than enough to host your application on either an Azure website or Azure Cloud Service.

I've been running applications on Azure Web Sites and Cloud Services for several years now and have found it to be much more reliable and better performng than the cheap shared hosting option I'd been using previously.

<comment><USER3> Actually it's $210/month (40% discount off list prices) per employee.

</comment></comment><comment><USER4> Azure is not a bad option. They have a free level of service with Azure WebPages that I've used for my hand-rolled ASP.NET MVC4 blog (richardssoftware.net). Once you're setup, its dead simple to update your app, either through Visual Studio or by setting up GitHub integration to automatically publish on commit.

Using a custom domain name requires that you bump up to the next level, but that is only about $10 a month.

</comment><comment><USER5> I personally use arvixe.com ([http://www.arvixe.com/windows_vps_hosting](http://www.arvixe.com/windows_vps_hosting)) and have been pretty happy with them.

</comment><comment><USER6> As the other comments said, Azure is an option, but if you're not eligible for BizSpark, it can be expensive.

I've read good things about AppHarbor, haven't tried it myself though.

[https://appharbor.com/](https://appharbor.com/)

They have a free tier but you have to use their domain.

I'd also look at Amazon AWS, but it can also get pricy :( .

I found this blog post, it has a few more options:

[http://seroter.wordpress.com/2013/08/16/where-the-heck- do-i-...](http://seroter.wordpress.com/2013/08/16/where-the-heck-do-i-host-my- net-app/)</comment>


Minecraft Christmas Jumpers - <AUTHOR> https://gametops.co.uk/

<comment><USER2> In-game Christmas jumpers. All pixels, no wool. All joy, no itch.</comment>


Tumblr censors it's dashboard to educate about the proposed SOPA bill. - <AUTHOR> http://www.tumblr.com/protect-the-net Tumblr censors it's dashboard to educate about the proposed SOPA bill. <comment><USER2> I'm incredibly impressed at the willingness of these companies to stand up and be counted, to show an awareness of current events and to empower their users to do something about it. If only this was the way politics worked across the board.

</comment><comment><AUTHOR> EG: [https://twitter.com/?photo_id=1#!/buzz/status/13684610262749...](https://twitter.com/?photo_id=1#!/buzz/status/136846102627495936/photo/1)</comment>


Protean Echo – Fuse All Your Cards into One - <AUTHOR> http://getprotean.com/ <comment><USER2> Is this really a problem? Too many credit cards make your wallet uncomfortably large? Let's get back to solving problems that matter. I can't believe we have three companies on the front page today reducing the number of credit cards in your wallet.

<comment><USER3> Actually, I might have this problem. I don't use a lot of credit, but I carry around a primary CC, a backup CC (that is never used unless the primary CC is stolen), a corporate CC, four debit cards for various accounts, and a myriad of other things.

My kingdom for a solution that gets me down to one card.

<comment><USER4> Why do you need to carry around four debit cards and a backup credit card? I'm not saying this works for everyone but my wallet contains $20, a driver's license, and a credit card.

If I'm going to be somewhere where I might need a business CC or debit card then they're temporarily added. Otherwise I store all my CC info in 1password anyway which I can access on my phone.

<comment><USER5> I carry three: two Amex cards and a debit card. The Amexes are for different cashback situations and one of them is a Costco membership card too so I have to carry both. I would actually like to add a backup Visa or MasterCard as well since lots of places do not accept Amex.

<comment><USER4> I have the Costco Amex too, but how often are you going to Costco that you're carrying it around everyday?

</comment></comment></comment></comment></comment><comment><USER6> Combine this with something like BoA's ShopSafe "disposable" credit card numbers and POS credit card fraud could be practically eliminated. Consumer privacy would also be increased because it will become much more difficult to cross-reference purchases across different merchants. (You'll still have to worry about Visa selling your purchase records, but one step at a time.)

[https://www.bankofamerica.com/privacy/accounts- cards/shopsaf...](https://www.bankofamerica.com/privacy/accounts- cards/shopsafe.go)

[http://www.ecommercebytes.com/cab/abu/y205/m02/abu0137/s02](http://www.ecommercebytes.com/cab/abu/y205/m02/abu0137/s02)

<comment><USER7> Disposable credit card numbers in the USA? Inconceivable! An actually secure feature that is widespread in Europe found its way into the US? What has the world come to.

Any Canadian implementations?

<comment><USER8> PayPal started offering virtual one-time-use MasterCard cards linked to your PayPal balance in 2004.

<comment><USER9> but they stopped offering them years ago.

[https://www.paypal-community.com/t5/PayPal-Extras- MasterCard...](https://www.paypal-community.com/t5/PayPal-Extras-MasterCard- Archive/Single-use-PayPal-credit-card-numbers/td-p/84161)

</comment></comment></comment></comment><comment><USER10> These guys have been around much longer than Coin. I think this goes to show how much hype being part of YC can generate.

Kudos to both products.

<comment><USER11> Also, [https://walla.by/the-wallaby-card](https://walla.by/the-wallaby-card) \- they have been around even longer.

<comment> jack-r-abbit I think Wallaby works differently by being a new plastic card you use and they dynamically route your charges to which ever registered card will give you the best return (cash back, airline points, etc).

</comment></comment></comment><comment><USER12> 13% of Americans have 10 or more credit cards? Wow, that sounds serious.

They should probably pass on the Protean Echo purchase, and figure out how to manage their money better.

<comment><USER13> More credit lines give you a higher credit score. Yes it has relatively low impact, but the more lines you have, the better it is for your credit score. That's just the system.

<comment><USER12> I only have one. My credit is excellent. I've never had a problem with anything.

I'm not saying you're wrong, but clearly it isn't the only way.

<comment><USER13> Like I said, it's a low impact factor, but it still is. And I'm not saying this is "my experience" it's just one of the factors.

Also credit lines could be anything from retail credit, mortgage, car loan etc. All apply.

Compared to paying every month, utilization, past default etc. it's a low factor, but it still is.

</comment></comment></comment></comment><comment><USER14> When two dynamic magstripe products appear on the front page of HN, I just had to find out how it works.

Protean provided a link on the front page FAQ but unfortunately that link doesn't work, so here's the working how-it-works entry[1] and a history of reprogrammable card technologies[2] from their blog. The "magstripe" is essentially an electromagnet that is able to sense the reader's swipe head and start the "playback" along the entire track. If you'd like to build a simple one, you just need to playback a waveform into a coil placed at the swipe head [3].

And regarding their answer on the card skimming bit, it's most likely just a form of software protection. If they can so easily duplicate a card's magstripe, what's stopping anyone from being able to do it (with their product)?

I would definitely buy one though.

[1] [http://blog.getprotean.com/?p=124](http://blog.getprotean.com/?p=124)

[2] [http://blog.getprotean.com/?p=396](http://blog.getprotean.com/?p=396)

[3] [http://hackaday.com/2008/08/04/magnetic-stripe-card- spoofer/](http://hackaday.com/2008/08/04/magnetic-stripe-card-spoofer/)

</comment><comment><USER15> "Q: Will Echo facilitate card skimming?

A: No. Echo users can only mimic payment cards (debit and credit) registered under their name. Sorry skimmers!"

I'd like to hear more about how this card is designed not to allow skimmers to use it. My suspicion is that the app will, in fact, be easy enough for skimmers to hack so that they can put anyone's card they want on it, turning it into a pocket skimmer for waiters or anyone who can get their hands on a customer's card for a few seconds.

"Q: What happens if I lose Echo? Is it secure?

A: Yes, Echo is secure. You can set Echo Card to lock down when out of range of your mobile app. "

Again, more information would be nice. Is card data stored in encrypted form and decrypted only at the moment of use via a key provided by the app? If so, are keys securely broadcast to the card? Is card info uploaded to the echo card securely for that matter? This is important to ask, since you might wind up transmitting card data on a public channel repeatedly.

There are some pretty big cryptographic concerns here that are completely glossed over. I absolutely would not use this card without knowing more.

<comment><USER16> To answer your first question, I gather they would be grabbing the name hard- coded in your mag stripe. Can't use multiple cards with different names.

<comment><USER17> Unless the software that enforces this is compromised. If the iPhone can be jailbroken by hobbyists, you can bet there will be resources greater than the Protean dev team devoted to hacking this device to bypass their checks.

Credit card skimming is big money. A cheap, innocuous device like this could be very interesting.

</comment></comment></comment><comment><USER18> Wait, isn't this exactly the same as "Coin" which got a lot of buzz today?

<comment><USER19> It's interesting to see two similar projects come out around the same time. Is there some new technology that only makes this possible now?

<comment><USER8> This one was announced in August 2012. Several others have tried the same thing over the past few years.

</comment></comment></comment><comment><USER20> It already seems obsolete as it won't work with chip cards. Most POS debit and credit transactions in Canada are now done via chip-cards, so emulating a magstripe isn't helpful.

Debit cards: [http://www.interac.ca/images/PDFs/interac%20infograph_ENG_FI...](http://www.interac.ca/images/PDFs/interac%20infograph_ENG_FINAL_V3.pdf)

<comment> X-Istence Europe has been doing that for years!

</comment></comment><comment><USER21> I'm sure there are going to be plenty of places which refuse to accept anything but an actual credit or debit card.

I mean, there's no signature to check. What do you do when 10% or more of the places you go refuse to take this?

Heck, a lot of places used to require the cashier to type in the last 4 digits of the card visually, to make sure the physical card matched the stripe. I haven't seen that in a while, but that would also be impossible with this.

Are the credit-card companies on board with this, instructing retailers to accept these?

<comment> X-Istence Best Buy still requires the physical card to type in the first four numbers ...

<comment><USER22> First four? That's two-thirds of the Bank Identification Number ( BIN ), offers no security at all. After all the bank's logo is plastered over the card and reverse BIN lookup is easy.

What an odd thing to capture.

<comment> X-Istence I might be mistaken, but they are required to type in 4 numbers, last time I asked the clerk he said it was the first 4 numbers...

</comment></comment></comment></comment><comment><USER23> "Q: When will Echo be available?

A: A year ago, we estimated a 2013 availability. We're still working on perfecting the technology. We haven't released a revised availability date."

I'm all for several kinds of these things, just as we have different kinds of watches and phones. It's a matter of taste more than anything once the basics are established, as they clearly are. And, of course, of getting it to market. Hopefully the Coin I preordered today isn't still in preproduction a year from now.

</comment><comment><USER24> I like that this works with loyalty cards too. Unfortunately my early beta card got destroyed after the fifth or sixth time I took it to the Pizza Hut buffet and had them punch it.

</comment><comment><USER25> Interesting to see them in the same space. I wonder if someone makes the 'dark' version of this card, connected via your phone to carding networks dynamically becomes a stolen ATM card for you to get cash quickly and then deletes the data after use. Leaving you with only cash and the disguise you used to hide from the ATM camera.

Well at least that is what I _think_ the bad guys are thinking right now.

</comment><comment><USER26> Well isn't this awkward with coin and all…

<comment><USER27> Is it? Not sure, but the Coin team went gangbusters on the promotion and it seems to have worked great for them. I couldn't visit any social site today without someone talking about Coin. But I've a feeling that payment cards are far from a winner-take-all business.

The Protean Echo, OTOH, has been in development for some time. Thiago first gave me the demo at the Tech Brewery in Ann Arbor, MI and it blew the doors off anything we'd ever seen that was remotely similar. The form factor of the card itself — clear "Gorilla glass", like the iPhone screen, with embedded circuits — and the whole user experience are beautiful. I just wish they'd hurry up and release it!

</comment></comment><comment><USER28> Guess they should have made a video, like Coin

</comment><comment><USER29> For fun you can even scan friends cards.

</comment><comment><USER30> I actually don't want a card. Or a wallet. I'd like my keys and phone and wallet to merge into one blob. This would cause my "oh s$%t I lost X" anxiety to go from 3 points, to 1 point.

<comment><USER5> Would you then hand your cards/keys/phone blob to a waiter at at a restaurant when you pay for your meal?

</comment></comment><comment> vezzy-fnord The problem I have with this, is that its greatest strength is also its single point of failure. One card to rule them all, and one card to lose them all.

</comment><comment><USER31> well, not quite "all", looks like this one has a limit of 3 cards at a time on the Echo card, where the Coin has a limit of 8 at a time.

<comment><USER32> More or less:

"Q: Echo mimics just 3 cards?

A: No. Echo mimics an unlimited number of cards with the help of our free mobile app - simply drag and drop any card you'd like Echo to mimic within the app."

<comment><USER31> It sounds like you'll have to launch the app to change which three cards are stored on the Echo. This is actually too low of a number for me, so it would end up being more of a hassle to launch the app all the time than it would be to just carry 5 cards everywhere.

</comment></comment></comment><comment><USER33> I declare today to be "Merge All Your Cards Into One" day.

</comment><comment><USER34> the CEO is pretty legit. [http://en.wikipedia.org/wiki/Thiago_David_Olson](http://en.wikipedia.org/wiki/Thiago_David_Olson)

</comment><comment><USER35> Man that's so trendy now ;-)

</comment><comment><USER36> this is a parody site right?

</comment><comment><USER37> Your card looks sexier than the coin one (to me!). And suddenly we have two competing hot-shots in a day that would bring out the best in each other. Wish you guys and the coin guys ALL THE BEST! Screw all the naysayers, go prove the world really needs lesser cards to carry!</comment>


Signed or unsigned int in C - <AUTHOR> http://blog.robertelder.org/signed-or-unsigned/ <comment><AUTHOR> [http://blog.robertelder.org/signed-or-unsigned- part-2/](http://blog.robertelder.org/signed-or-unsigned-part-2/)

in this following article the author presented a page to choose unsigned or signed in practice</comment>


Your Daily GitHub Contributions Chrome Extension - <AUTHOR> https://chrome.google.com/webstore/detail/github-contributions/peiknoincjbnfdckomgepfhifpjpaoam <comment><AUTHOR> Here is the GitHub repository for it as well.

[https://github.com/daspecster/github-contributions-chrome- ex...](https://github.com/daspecster/github-contributions-chrome-extension)</comment>