Shellshock DHCP Remote Code Execution – Proof of Concept - <AUTHOR> https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/ <comment><USER3> Yeah, I don't think anyone has grasped the extent of how dangerous this vuln is -- was it released a little prematurely? is it still in "embargo"?

This is hundreds of times worse than heartbleed in terms of scope/attack surface for modern servers... (I say hundreds of times worse because heartbleed was scrape-some-data-till-you-get-private-keys-and-watch- communication, where this is just get-yourself-a-shell-and-pwn-the-machine)

<comment><USER4> On the other hand Windows sysadmins are probably enjoying some schadenfreude right about now.

<comment><USER5> It's mostly Linux issue because bash is there installed by default and even /bin/sh is really bash...

For example on BSD you could technically install bash, but chances that it is used as a shell for a services is very small.

<comment><USER6> Debian's default /bin/sh is not "really bash," it is dash. The same is true for many embedded distros based on busybox.

<comment><USER7> While this is generally true of newer Debian installations, older machines that have been been regularly updated over the years to stable may still have /bin/sh pointing to bash. I fixed a few of my machines yesterday to use dash.

<comment><USER6> dash changelog.Debian.gz entry from July 22nd, 2009:

      * Change the default for the system shell to dash.
      * Ship /bin/sh in the package and fix the diversion handling
        for it to make sure /bin/sh is always present.
      * Set debconf priority to high when upgrading from an existing
        system.

Unless the admin has--for some bizarre reason--set debconf to critical; during one of those "regular updates" the admin would have been presented with the following question:

      The system  shell is the default  command interpreter for
      shell scripts.

      Using  dash   as  the  system  shell   will  improve  the
      system's overall performance. It does not alter the shell
      presented to interactive users.

      Use dash as the default system shell (/bin/sh)?

          <Yes>      <No>

<comment> vertex-four This assumes that the admin is administering their systems by running apt-get update && apt-get upgrade manually, rather than some automated process.

<comment><USER6> What automated process for Debian administration is unaware of debconf?

This is a honest question. How could an automated Debian administration process not be aware of and interact on some level with debconf?

<comment> vertex-four Does this change default to "yes" on unattended installs? I'd assume it doesn't, because that would be dangerous.

EDIT: Indeed, from the same changelog: debian/dash.NEWS.Debian: when upgrading existing installations, the system shell will not be changed automatically (closes:#539363).

<comment><USER6> Just so we are clear you would be talking about an _unattended dist-upgrade from lenny to squeeze_? Have you done this?

Please explain how your automated Debian administration system that has been in place since Lenny[^1] handles _unattended dist-upgrades_ without the use of preseeding the debconf database for questions with a priority of high or critical?

[^1]: Squeeze was February 2011, any new stable installation since squeeze defaulted to dash as /bin/sh

EDIT: Nevermind, I answered my own question, unattended dist-upgrades from Lenny to squeeze is not something you have any experience with: "I'm now using Debian Wheezy, after primarily using Windows environments my entire life." [https://news.ycombinator.com/item?id=6564610#up_6565766](https://news.ycombinator.com/item?id=6564610#up_6565766)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Is it just me or would it be a good time to learn a bigger lesson from Heartbleed and Shellshock:

Minimalism is seriously a good idea. "Features" are not harmless and cost way more than you think. Providing more flexibility or functionality than absolutely necessary should really be considered and called out as defective, smelly and a bad practice.

<comment><USER9> Which brings to mind the latest push for systemd as an init replacement. :/

<comment><USER10> You will be shocked to learn that the Linux kernel is actually much bigger :/

<comment><USER11> Which, in itself, is another disaster.

<comment> vhost- Erm what? Can you elaborate a bit on this?

<comment><USER11> Massive kernel, loads of code.

Impossible to read and understand.

</comment></comment></comment></comment></comment></comment><comment><USER12> I believe there will be plenty of linux NASs that will be vulnerable for the forseeable future. NASs are usually bigger and more functional than routers, they tend to run a more full system. Many of these for exampe run bash as far as I remember: [http://www.amazon.com/s/field- keywords=QNAP](http://www.amazon.com/s/field-keywords=QNAP)

<comment><USER13> Just FYI to other owners:

Synology DSM 5.0-4493 Update 5 here: it uses busybox, so not vulnerable.

        synology> which bash
        synology> which sh
        /bin/sh
        synology> which ash
        /bin/ash
        synology> ls -l /bin/sh
        lrwxrwxrwx    1 root     root             7 Jun  5 11:27 /bin/sh -> busybox
        synology> ls -l /bin/ash
        lrwxrwxrwx    1 root     root             7 Jun  5 11:27 /bin/ash -> busybox

<comment><USER14> Thank you for checking out DSM! This comment saved me a bunch of time.

</comment></comment></comment><comment><USER15> So now we can have

dhcp-option-force=114,() { :; }; if hash apt-get 2>/dev/null; then apt-get update -y && apt-get upgrade -y;fi; if hash yum 2>/dev/null; then yum update;fi;

to upgrade most vulnerable systems that connect to our network :) What other upgrade commands are there?

<comment><USER15> It would be even better if we could create a community driven script hosted at some trusted location that would basically download info how to upgrade specific distribution, and execute that script on the vulnerable system.. so something like wget fix && chmod +x fix && ./fix :)

<comment><USER16> Then what would happen if someone compromised the fix?

</comment></comment></comment><comment><USER13> Thanks for the info.

Has anyone tried this with an OS X client to see if it behaves like the Linux system in the article? I know OS X bash is vulnerable to the exploit, but I don't know if their DHCP system handles environment variables in an exploitable way.

<comment><USER17> OS X doesn't use Bash for configuring DHCP, so it's not vulnerable. All of that is done in the kernel on Macs.

</comment></comment><comment><USER18> I think one of the things Heartbleed PoCs did really well was show the result for the end user. Most people aren't going to know what any of this stuff means. Can we come up with a really straight forward explanation in laymans terms as to what this means for the average Internet user?

<comment><USER19> [http://shellshock.co.za/](http://shellshock.co.za/)

i thought this was pretty straightforward

<comment><USER20> offtopic

why do people use custom scrolling behaviour? it's always horrible

</comment></comment></comment><comment><USER21> Holy shit that is scary. Package this on an android phone and you can wreak havoc on any random network

<comment><USER22> Assuming it's a network full of machines who haven't bothered updating yet. EDIT: right?

<comment><USER23> Um, "haven't bothered"? Think about all the _Linux /Unix_-based devices that could be affected here, it's in the millions. Do you run a local server on your box? How about your Linux-based router? Has it been patched yet? Why not, it's been more than _24 hours_ now.

<comment><USER24> > How about your Linux-based router?

In the embedded world, people rarely run full GNU userland utils. They're extremely big and bloated, and embedded devicse needs maximum bang for buck. Therefore most of them comes with busybox, which besides being incredibly compact also is 100% unaffected.

Same goes for Android/Linux-based phones. Most don't come with a proper shell at all, and those who do, usually have busybox.

<comment><USER22> > Same goes for Android/Linux-based phones. Most don't come with a proper > shell at all, and those who do, usually have busybox.

If this is true, there's been a fair amount of paranoia on HN that has gone sadly unanswered with corrections.

</comment></comment></comment></comment></comment><comment><USER25> Another reason to implement DHCP snooping on your network gear.

<comment><USER26> That's what I was thinking. If you let random machines on your network hand out DHCP addresses you've got bigger problems.

</comment></comment><comment><AUTHOR> Note that this will affect devices without listening services. Embedded devices are very likely to be affected for a long time.

A note for those trying to reproduce the PoC (as I was yesterday) - ISC's DHCP server only sends client-requested options by default, though this can be overridden [1]. tftpd [2], the software used in the PoC, is likely the easiest way to demo the vulnerability.

[1] [http://linux.die.net/man/5/dhcpd- options](http://linux.die.net/man/5/dhcpd-options) (search for "dhcp- parameter-request-list")

[2] [http://tftpd32.jounin.net/](http://tftpd32.jounin.net/)

<comment><USER27> Thankfully embedded devices are less likely to have bash installed than desktop or server systems, or this would be quite nasty.

<comment><USER28> Are smaller shells like busybox affected though? I bet a lot of routers run it (I know mine with OpenWRT does).

<comment><USER29> The problem is very specific to bash and bash only (a hacky feature via environment variables so shells can inherit their parent's functions)

</comment></comment></comment></comment><comment><USER30> So, an exploit using off-the-shelf software. Just awesome.

<comment><USER31> Well, yes. If you were going to exploit CGI scripts you'd likely use wget or curl instead of coding an HTTP client from scratch so why is this suprising?

<comment><USER30> It's a little surprising because I'm tempted to classify this one as 'requires 0 lines of code'.

<comment><USER32> its pretty much the same for CGIs, its a one liner. theres other exploits like that. it happens :)

</comment></comment></comment></comment><comment><USER33> So is the default dhclient conf vulnerable in any of the Linux distributions using bash for /bin/sh (eg CentOS/Fedora)?

edit: According to one poster on Stackexchange, Debian/Ubuntu may be vulerable despite not having bash for /bin/sh: "What's more, on Debian (and possibly many of its myriads of offsprings like Ubuntu), which uses dash as /bin/sh, dhclient-script is explicitely shebanged to /bin/bash, and it does seem to contain a bashism, too" ([https://security.stackexchange.com/questions/68156/is- connec...](https://security.stackexchange.com/questions/68156/is-connecting- to-an-open-wifi-router-with-dhcp-in-linux-susceptible-to-shellshoc))

</comment><comment><USER34> I've tried to replay this attack in VM environment using Debian, but no luck.

option dhcp_114_FW_URL code 114 = text; option dhcp_114_FW_URL "() { ignored;}; cat /etc/shadow > /tmp/shadow"

or

option domain-name "() { :;}; cat /etc/shadow > /tmp/shadow";

not working.

dhcpdump says that option sends correctly: OPTION: 53 ( 1) DHCP message type 5 (DHCPACK) OPTION: 54 ( 4) Server identifier 192.168.1.1 OPTION: 51 ( 4) IP address leasetime 600 (10m) OPTION: 1 ( 4) Subnet mask 255.255.255.0 OPTION: 3 ( 4) Routers 192.168.1.1 OPTION: 15 ( 39) Domainname () { :;}; cat /etc/shadow > /tmp/shadow

What could be the problem?

<comment><USER35> What were you using to configure networking on the target machine? NetworkManager, ifupdown, something else?

I found that with ifupdown, you see the issue, as it uses dhclient which in turn calls out to dhclient-script, which is written in bash. If you use NetworkManager, it doesn't call dhclient-script; it does however call the scripts in /etc/network/if- _.d, and if any of those are written in bash, then you see the issue. None of the scripts in /etc/network/if-_.d on my system used bash, they all used /bin/sh, so on a Debian system where that points to dash instead of bash you're OK.

<comment><USER34> Of course I've used dhclient for this (also with -r option) with ifconfig up/down. Not working. I've also tried to re-simlink sh to bash. Not working. I'd like to check py script by mschwager ([https://github.com/mschwager/shellshock_poc](https://github.com/mschwager/shellshock_poc)), may be it will be OK.

</comment></comment></comment><comment><USER36> I created a python + scapy poc:

[https://github.com/mschwager/shellshock_poc](https://github.com/mschwager/shellshock_poc)

I tested it with my laptop and android phone on my wifi network.

<comment><USER34> So could you get a root shell (on linux laptop)?

<comment><USER36> Unfortunately my poc isn't working as expected. I'll continue investigating, and keep the repo up to date.

Feel free to fork it and use it as a place to start for your own poc.

</comment></comment></comment><comment><USER37> dhcpcd-6.4.7 is hot off the press, the main improvement being mitigating the bash "ShellShock" exploit by escaping all characters as noted in IEEE Std 1003.1, 2004 Edition, 2. Shell Command Language, 2.2 Quoting except for the space character.

Needless to say, the entire BSD family is not affected by this bug as bash is not the default shell and to be fair a lot of Linux distributions are not affected either. If bash is your Linux distributions /bin/sh, OR you have applications directly calling bash, you should be telling them to get with the times as most people have since moved on to ash, dash or busybox for more efficient processing.

Regardless, shell is such an important in part of the system - it allows non programmers to "do things". Thanks to the dhcpcd hook system, a user was able to start tcpdump on hotplugged interface before dhcpcd actually started using it during the boot process. Why he wanted to do this, I don't know, probably for some debugging. But the point is, how would he have done this without shell hooks?

The important thing to take away from this is don't lock yourself into one technology - strive to be portable. dhcpcd works on many OS's, libcs, shells and userland tools. If any of them prove faulty, swap them out - <USER2> dhcpcd itself! But please at least tell me why you're swapping dhcpcd out so I can improve it :)

</comment><comment><USER38>
        curl -s https://s3.amazonaws.com/download.draios.com/stable/install-sysdig | sudo bash

Let's hope that script does what it claims to do :)

<comment><USER39> Even if that was meant as a joke, I do hope you realise the irony.

To protect against running untrusted code in a shell, you ... run code from an untrusted source in the shell. As root.

<comment><USER38> Yes :-)

</comment></comment></comment><comment><USER40> Wow, that is scary how a simple DHCP option can propagate like that.

Speaking of Linux-based NAS systems, Amahi systems have been updated via a repo update that pulls the latest bash fix.

</comment><comment><USER41> Why did the quotes show up?

<comment><USER42> My first reaction too. However, it's not hard to imagine some escaping being thrown in there at some point.

</comment></comment><comment><USER43> Does this mean I shouldn't run dhcp servers? Or is even my laptop running a dhcp client going to have a bad time?

<comment><AUTHOR> This means that DHCP clients that use bash and have DHCP server-controlled environment variables can have commands injected (as root) by a malicious DHCP server.

Notably, attackers in an unhardened network can reply to DHCP clients themselves, even if there's already a DHCP server on the network. So it's not just the sysadmin who can exploit this, but anyone on the same network (broadcast domain) as the vulnerable DHCP client.

<comment><USER43> Alright, I'm shutting down my cable modem. See y'all later.

</comment></comment></comment><comment><USER44> I was going to do this this evening and now he's saved me the time. Thanks! :)

</comment><comment><USER45> FreeNAS (based on FreeBSD 9.2) has a vulnerable bash. I have 18.104.22.168.

<comment><USER35> The question is, does it call bash in its dhclient-script? I took a look through the FreeBSD source tree, and their version of dhclient-script uses /bin/sh. As long as /bin/sh is not bash (and that script doesn't in turn call any other bash scripts) it should be OK.

The best way to find out if you're vulnerable is by testing. It takes just a few minutes to set up dnsmasq to serve up an exploit. Here were my settings:

      interface=eth2
      dhcp-range=10.0.1.100,10.0.10.200,12h
      dhcp-option-force=114,() { :; }; echo "hi"

Of course, replace that 'echo "hi"' with the exploit of your choice. In my case, the output from dhclient would be printed on screen when restarting networking, so 'echo "hi"' was sufficient to verify that it was being executed.

If any bash scripts are called, with the environment variables that are set by dhclient, then that snippet should be run. If bash is not invoked, then that snippet won't ever run.

<comment><USER46> You can pretty much guarantee that nothing in the core system for FreeBSD calls Bash, because Bash isn't in the core system :)

</comment></comment></comment><comment><USER47> I don't know if I'm clear after the update. Is my bash version patched or is it patched only for the first vulnerability?

GNU bash, version 4.2.37(1)-release (x86_64-pc-linux-gnu)

</comment><comment><USER48> Why does the output say 'foo' and not just foo? That looks suspicious.

</comment><comment><USER49> Anybody try this with an iPhone? Not sure if bash is even installed on it.

</comment><comment><USER50> What DHCP service is this and how do I tell if I'm using it?

</comment><comment><USER51> one more reason for networking done by network-manager or networkd (systemd) instead of bash scripts

<comment><USER52> NetworkManager's had vulnerabilities over the years ( [http://www.cvedetails.com/product/5634/Gnome- Networkmanager....](http://www.cvedetails.com/product/5634/Gnome- Networkmanager.html?vendor_id=283) ), as has systemd. Stating this as a reason to switch is ridiculous. One can easily switch to a much more audited, secure scripting environment, such as ksh, and still have all the power scripting brings.

<comment><USER53> Not saying I agree with GP, but "the power scripting brings" can be part of the problem. Scripting is used as a means to execute arbitrary commands on a single level privilege (that of the user hooking the scripts, very often root or some high-privilege user) as opposed to a limited set of application- specific functionality. This adds a whole level of complexity to the system, which in security terms is typically the kind of thing that will give you trouble.

<comment><USER54> Agreed. When in security classes we were taught to use e.g. execve() instead of system(), it wasn't because shells were thought of as particularly vulnerable. You just want to use a tool that has the minimum possible feature set, so you can be sure that no one malicious will be able to trick you into using even correctly-functioning features (e.g. through shell injection).

Sort of a special case of the principle of minimum privilege, when applied to the feature set of your tools.</comment></comment></comment></comment>


AMP stories: Bringing visual storytelling to the open web - <AUTHOR> https://developers.googleblog.com/2018/02/amp-stories-bringing-visual.html <comment><USER2> Example of a cool one

[https://mic.com/stories/327/what-happens-in-your-brain- when-...](https://mic.com/stories/327/what-happens-in-your-brain-when-you- listen-to-music)

</comment><comment><USER3> Anything and everything AMP is the opposite of "the open web".</comment>


Costs of a PostgreSQL connection - <AUTHOR> http://hans.io/blog/2014/02/19/postgresql_connection/index.html <comment><USER2> > We were running out of file handles which caused the database to crash

Most distributions ship with conservative defaults for the maximum number of concurrent file descriptors and socket connections. Especially for a database server, it's wise to tune these values before optimizing anything else.

> 1000 files per connection * 370 = 370,000 files

This is a very pessimistic estimate, in reality you'll need much less than 1000 file descriptors per connection. As long as you tune your file descriptor limit, you should be able to handle one or two orders of magnitude more connections than this.

A few resources that might help:

[http://serverfault.com/questions/92723/file-descriptors- sett...](http://serverfault.com/questions/92723/file-descriptors-setting-on- etc-sysctl-conf)

[http://www.cyberciti.biz/faq/linux-increase-the-maximum- numb...](http://www.cyberciti.biz/faq/linux-increase-the-maximum-number-of- open-files/)

[http://stackoverflow.com/questions/2569620/socket-accept- err...](http://stackoverflow.com/questions/2569620/socket-accept-error-24-to- many-open-files)

<comment><USER3> Thank you. We configured the system to accept more file descriptors. I think our issue was caused by something else.

</comment></comment><comment><USER4> * work_mem is not used per connection. It _may_ be used for some queries. Same for temp_buffers.

What I miss here is information about the Postgres version used.

Also, if 3.5GB of memory hurt you on a database server with 370 connections, you need to think about buying a DB server with more RAM (our main DB server has 512G and typically ~220 connections, we don't sweat over it and don't use PGBouncer to add latency).

<comment><USER3> Thanks for your comment!

Re work_mem: I think this is per query and thus might affect every connection?! At least thats what I gather from 'PostgreSQL 9.0 High Performance' Re temp_buffers: 'Sets the maximum number of temporary buffers used by each database session.' For us it practically means per connection. Not for you?

Shit, I'm missing the version! 9.3. I edited the blog post.

Re memory: I think that really depends on the application I think. We have many idle connections.

<comment><USER4> > _Re temp_buffers: 'Sets the maximum number of temporary buffers used by each > database session.' For us it practically means per connection. Not for you?_

It means that potentially every connection may at some point use this amount of memory, but idle connections will not. If you have 20 busy connections and 350 idle ones, at most 20 x temp_buffers will be used and there is no benefit from PGbouncer in this regard. If you have 370 busy connections, all of them might use temp_buffers and your tradeoff can be 370 concurrently executing queries at higher memory cost vs. e.g. 20 concurrently executing queries via PGbouncer at lower memory cost and 350 stalled queries with potentially high latency.

> _We have many idle connections._

In this case, you will not have any issues with memory use from temp_buffers, work_mem ...

<comment><USER3> Yes you're right, idle connection do not use temp_buffers or work_mem.

I was trying to gather everything relevant to resources per connection. I'm not saying work_mem caused our problem.

</comment></comment></comment></comment><comment><USER5> I have always found it odd how some databases conflate network connections with threads (or processes) of execution. If Postgres has an ideal number of concurrent workers it should instantiate that many and multiplex requests from various connections across them which has several benefits including allowing you to preemptively shed requests you know you won't get to in time and do other scheduling and QoS stuff.

I get it from a historical perspective where it would have been needless complexity to implement something else.

On an unrelated note it's pretty amazing what threads get conflated with in general.

<comment><USER6> One of the important reasons Postgres connections are serviced by a separate process is that if that process segfaults, you only disconnect other connections (because if might have tainted shared memory when it died), but the main database process keeps running and you can reconnect immediately.

<comment><USER7> Not quite. If a backend segfaults, postgres will detect it and immediately terminate all connections and exit. When it restarts, it will enter recovery mode. It does this because a segfaulted backend may have corrupted shared memory. The only way to fix that to restart in recovery mode and replay the WAL.

</comment></comment></comment><comment><USER8> For some reason, Rails doesn't behave well with pgbouncer or any other pg connection pool. So I really have no choice but to set my max connections to 1900, and pray that it's enough. Surprisingly, my 48 GB RAM, quad core CPU, non SSD server can handle that load, although the hardware will probably degrade after a certain time (oh well _shrugs_ )

<comment><USER3> We enabled PGBouncer transaction mode and had to set 'prepared_statements: false' in our database.yml b/c the transaction mode doesn't support that. Works fine for us.

<comment><USER9> What are the implications of 'prepared_statements: false'? It sounds really bad.

<comment><USER10> Prepared statements are not a massive performance gain in postgres so I wouldn't worry.

<comment><USER11> If done right they can be huge. The fact that they do nothing when you just do "prepare" followed immediately by "execute" in place of just running the query directly is not a problem with postgresql or prepared statements, it is a problem of doing something dumb. For simple selects the parsing and planning stage can be 90% of the time spent. The problem is that postgresql doesn't have stored procedures, so you have to make sure every connection is initialized by running all of your "prepare"s before it is made available to the pool.

<comment><USER12> You can get detailed timing data about parse, plan, execute timings from postgresql logging. Parsing is almost always trivial. Planning can get expensive for complex queries with many joins (large space of solutions to explore). For simple queries there's almost no benefit for prepared statements in postgres. Prepared statements are a maintenance headache and don't play well with session multiplexed connection pooling (like PgBouncer); generally best to avoid them unless you have measured a concrete and significant benefit.

<comment><USER11> >You can get detailed timing data about parse, plan, execute timings from postgresql logging. Parsing is almost always trivial.

And yet you can get >50% speedups for super common queries like "select * from foo where id = ?" if you prepare it once and then use execute instead of just running the select every time. Seems like maybe you're making assumptions you shouldn't.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> If pgbouncer makes this big a difference to performance, is it included in managed PostgreSQL services, such as Amazon RDS and Heroku Postgres?

Or would you have to roll your own pgbouncer setup for these systems?

<comment><USER3> Neither AWS RDS PostgreSQL nor Heroku has a PGBouncer.

<comment><USER14> Heroku actually does seem to support/encourage it:

[https://postgres.heroku.com/blog/past/2013/11/22/connection_...](https://postgres.heroku.com/blog/past/2013/11/22/connection_limit_guidance/) [https://github.com/gregburek/heroku-buildpack- pgbouncer](https://github.com/gregburek/heroku-buildpack-pgbouncer)

<comment><USER13> Saw that reference in the linked post from Heroku in the original article.

Has anyone used this? Is it configurable, or do they just choose some reasonable defaults?

<comment><USER15> Works great for me. There's some minimal configuration explained in the pgbouncer docs. What the pgbouncer buildpack does is just route your DATABASE_URL through the local pgbouncer.

In my python app, I switched from an sqlalchemy connection pool per process (eg per gunicorn worker) to using a Null pool everwhere. No increase in latency; far fewer connections needed.

</comment></comment></comment></comment></comment><comment><USER16> Would be nice to see a little more detail on the clients that need hundreds of connections. I have no experience with PostgreSQL, but do get around this in other RDBs through a mix of async calls, caching and optimising data structures and application logic (meta-data driven schema; indexing content in the app before a db write to eliminate having to retrieve that content to search it, or indexing it using the db).

</comment><comment><USER17> If you only have `2 * n cores` connections, doesn't that mean that you can at most have `2 * n cores` transactions running at once? I suppose on larger servers that is fairly reasonable (as you want these transactions to be very short lived anyway), but it does seem like you don't give yourself much wiggle room.

</comment><comment><USER18> hard to believe there are still people non using pgbouncer in production :)

<comment><USER11> Not everyone runs some PHP damaged setup where connection pooling has to be pushed out to a proxy. Some people use sane applications in the first place. There is no reason for those people to add an extra layer of latency and potential failure to achieve what they already have.

<comment><USER19> True - it's only application insanity preventing a distributed collection of database clients from properly coordinating the proper allocation of postgres connections amongst themselves.

Now true, in the event of a network partition, you lose the ability to open a database connection. But that's a small price to pay, right?

<comment><USER20> I guess this is sarcasm, but it's not clear what you're trying to actually say. How is a connection-pooling proxy supposed to make an application more resilient to network partitions? If anything, it's worse, since you have twice as many points of failure -- if either the application can't talk to the proxy, or the proxy can't talk to the database, you're hosed.

<comment><USER19> Practically speaking, you typically run pgbouncer on the same box as postgres.

Even if you ran pgbouncer on a different box, the situation is still better. Suppose you have a probability P of having a partition between any two boxes. Then the probability of a partition taking down the system with pgbouncer is P.

If you instead had N clients coordinating among themselves how many connections to use, your odds go way up. The probability of a partition existing between two clients is 1-(1-P)^(N(N-1)/2) ~= N(N-1)P/2 (for very small P). Once two clients can't communicate, neither one can connect to the DB (because they don't know if the other two have pushed the db over the limit). All clients will need to stop connecting to the DB if any client is ever disconnected from the other N-1 of them.

In a distributed system, ensuring that SUM(x[i]) remains bounded for all time is a tricky problem to solve.

<comment><USER21> > Practically speaking, you typically run pgbouncer on the same box as > postgres.

I've done this, long-term, in production. This is not how PGbouncer is designed to be used, and it causes serious problems under load. (I am still doing this, but I have it on my todo list to remove this glitch from my architecture, as it caused my entire site infrastructure to fail once during a launch.) Put simply: PGbouncer is single-threaded; it is not difficult to end up in situations where the one core PGbouncer is running on to be at 100% while the remaining cores (in my case, seven) running PostgreSQL are having no issue with the traffic.

<comment><USER19> Just curious, how does that happen? I've never found myself in a situation where PGBouncer can't handle the load but Postgres can.

I'm guessing it's a situation where you are running a large volume of very easy queries, for example primary key lookups with no joins?

<comment><USER3> We do have this problem! It is only a matter of how small the PGBouncer machine is compared to the PostgreSQL. In our case the PGBouncer had to deal with 16000 req/s, coming from 700 clients going through 100 connections to the PostgreSQL. We now have 4 PGBouncers for this DB, and we're 'load balancing' them with DNS.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> tl;dr;tl;dr; - use a connection pool.

</comment><comment><USER23> Now you fixed your Postgres could you fix the reminders in Wunderlist pretty please ?

It doesn't work (for me) on Android so I started to use the app less and less.</comment>


South Africa: R140 Mil Website Company On the Premier's Payroll for Years - <AUTHOR> http://allafrica.com/stories/201303111649.html?viewall=1

<comment><USER2> Public corruption in Africa? Shocking.

Sarcasm aside, this is a press release put out by a political party (The Democratic Alliance) that opposes the current premier (edit: of Free State). I'm not saying it's untrue, but the source definitely has an agenda.

<comment><USER3> Most of the details of the original accusation have been independently confirmed by the local media and by some analysts. It's a massive scandal here.

Disclaimer: I am a South African journo and know some of the people doing the confirming personally - one even stays on my property in the back cottage. The source may have an agenda but so does the truth.

</comment></comment><comment><USER4> Seems like no industry in SA can hide from this stuff. Thanks to the DA for putting this info out there.</comment>


Beautiful web type – typefaces from the Google web fonts directory - <AUTHOR> http://hellohappy.org/beautiful-web-type/?1 <comment><USER2> The last time this came up people pointed out this kind of thing:

        Beautiful W
        <span class="kern">
            eb
        </span>
         Type

It would be nice to just see what they look like without all that hackery, since no one is going to do that ever in real life.

<comment><USER3> So the problem happens because google web fonts actually subset the actual fonts to remove things so that the file sizes are reasonable. For example it's only latin characters unless you specify. And opentype data is also stripped. This means ligatures, for example are tossed. I had a hell of a time figuring this out. I think font-specific kerning also goes away when this happens.

This is why I now serve my own font.

Here's the code I found that does this: [https://code.google.com/p/googlefontdirectory/source/browse/...](https://code.google.com/p/googlefontdirectory/source/browse/tools/subset/subset.py)

<comment><USER4> You can get some of the best fonts from Google Web Fonts here [http://brick.im/](http://brick.im/) with ligatures etc.

<comment><USER5> I use some Google Web Fonts and I was interested, but when I went here:

[http://brick.im/fonts/](http://brick.im/fonts/)

And I clicked on a few fonts, I kept getting 404s. Any idea?

<comment><USER6> It looks like it's supposed to link to the downloadable original source, but it's missing. To use the font just click the little + button and then the 'Bucket' button in the menu.

<comment><USER7> They're supposed to link to a font-specific specimen page where you can see exactly how the font renders and take advantage of some content-editable headings and paragraphs.

</comment></comment></comment></comment></comment></comment><comment><USER8> These examples showcase the importance of typesetting as much as they do typeface choice. Proper hierarchy, contrast and layout can extend the ability of the typeface individually to do a lot more than seems plausible when seen in isolation.

<comment><USER9> Agreed, that was a stunningly beautiful way of showing fonts. They're not just showcasing the typesetting, they're also relating the emotion of it by using specific passages of text from different places that match the spirit of the font. I can't believe no-one ever thought to do this before, but I'm still very surprised to see it though.

<comment><USER10> > I can't believe no-one ever thought to do this before

Lots of sites for typefaces include "posters", "specimens" or other examples of using the font in a context that highlights its best usage, often including quotations.

<comment><USER11> Except standard specimen samples are gibberish where these bits are more opinionated

</comment></comment></comment></comment><comment><USER12> As a developer who plays the role of designer in my start-up (www.gopaperbox.com), I must say that typography is insanely hard.

Getting the right heights, weights and style to look visually appealing is probably the hardest part of the whole thing. Making graphics is pretty easy in today's world with icon fonts. I have been rolling with Proxima-nova lately - but I'm not tied to it.

Can you guys check out the fonts on my page and give some feedback? I would love to switch to a free Google font.

Thanks!

<comment><USER13> Fiddled with it in with the web inspector, here's a mock up of what I think might look better (was going to send you the edited css but the tab crashed while I was taking the screenshot..)

[https://dl.dropboxusercontent.com/u/324756/PaperBox%20%20%20...](https://dl.dropboxusercontent.com/u/324756/PaperBox%20%20%20Take%20back%20your%20desk.png)

I think it might be a good idea if you could cut down the copy you have for the featurettes by about 1/3

\---

edit: also, if you can swing it, a quick video demo might be a nice alternative to swap out the image e.g. [http://www.domo.com/company/what-is- domo](http://www.domo.com/company/what-is-domo) and [http://monanetwork.com/](http://monanetwork.com/)

<comment><USER12> Wow, way cool! I agree, your design looks much cleaner and more sophisticated! Thanks!

<comment><USER13> Glad you liked it :)

I don't typically do design either but got hit with a string of marketing- microsite gigs of late and have a sort of formula down. (basically things my designers yelled at me to fix - spacing, font weight, font size)

Best of luck with your startup! And if at all possible consider Google Drive integration? This is actually something I would use (would love to be able to easily scan receipts and chuck'em ), except dropbox is $10.99/month for 100G, while GDrive is $1.99/month for 100G, kind of a no brainer as a cheapskate :P

</comment></comment></comment></comment><comment><USER14> As usual the fonts look beautiful on Mac but horrible on Windows (both using Chrome).

<comment><USER15> Open chrome://flags/ and activate "Enable DirectWrite". That will give you proper rendering of webfonts. (Like FF and IE on Windows.)

<comment><USER16> I'll just put a little note on my site instructing users of Chrome on Windows to do that :)

It has been YEARS of putting up with the horrible Google font rendering in Google's browser on Windows, all the while IE and Firefox render them perfectly.

</comment></comment></comment><comment><USER17> Not enough sans serif fonts for my taste. I think that serif fonts have a very specific, somewhat limited place on the web.

<comment> mark-r Serif fonts are finally coming into their own, now that enough devices have high enough resolution to do them justice.

That said I think I still prefer sans serif for myself.

</comment></comment><comment><USER18> I've found brick.im[0] to be pretty good for free fonts as well. They have better support for ligatures, too.

I'm working on something similar, Pretty Open Type[1]..

[0]: [http://brick.im/](http://brick.im/) [1]: [http://namanyayg.github.io/pretty-open- type/](http://namanyayg.github.io/pretty-open-type/)

</comment><comment><USER19> Web fonts is nice, but one part of a font family is even better. Here's a really nice list of all the Google Web Fonts Family [http://somadesign.ca/demos/better-google- fonts/](http://somadesign.ca/demos/better-google-fonts/)

<comment><USER18> Google already sorts that way, now. See 'Sorting: Number of Styles'.

</comment></comment><comment><USER20> Some nice typefaces (Gentium is a favorite) and quotations there.

I like the following from Stowe Boyd's _Postnormal era_:

        Authoritarian/Centralized > Egalitarian/Decentralized
        Objective/Impartial > Subjective/Partial
        Hierarchy > Network
        Nuclear > neo-Tribal
        Globalism/Growth > Localism/Steady-State
        Nation/Province/City > Locale/Watershed/Region/World
        Broadcast > Participative
        Exploitative/Unsustainable > Restorative/Sustainable
        Dogmatic/Orthodox > Enigmatic/Heterodox

Edit: A right arrow (→) would be better than the greater-than symbol in the above.

</comment><comment><USER21> love this.

I use Raleway, its is a beautiful typeface IMHO

[http://anexiledderryman.com/cv](http://anexiledderryman.com/cv)

<comment><USER22> That font has terrible numbers, 3 to 9 are totally weird [1]. The @ symbol is also mentally taxing on smaller sizes.

[1] [http://imgur.com/87sEqIW](http://imgur.com/87sEqIW)

<comment><USER23> I love old-style numbers.

Why should letters get all the ascender & descender fun! :P

<comment><USER21> Agree completely!

</comment></comment></comment></comment><comment><USER24> Is the reason you (assuming this is the author) use only +BTC for donation because you only want BTC or bc you think you'll only get BTC or because you think only BTC is appropriate to donate to online work?

</comment><comment><USER25> The Gentium Book / Open Sans combination is sexy. Thanks for taking the time to do this.

I would love to see more, and if possible be able to sort by style type and read labeled font names.

</comment><comment><USER26> [https://news.ycombinator.com/item?id=3522965](https://news.ycombinator.com/item?id=3522965)

</comment><comment><USER27> My company's proxy flagged your site as a Malicious URL. Most likely for the wrong reasons but wanted to let you know.

</comment><comment><USER28> Nice collection, although one in my opinion awesome font is missing - Lato.

<comment><USER29> Lato is the sixth one in the showcase.

<comment><USER28> Oh, I just noticed it. But it's only the title, the rest is Merriweather.

<comment><USER7> For me the sixth is all Lato -- the blue block that starts with "Unity"</comment></comment></comment></comment>


Roam – a graph-based personal knowledgebase - <AUTHOR> Roam (https://roamresearch.com) is a webapp for doing research (note-taking, "Zettelkasten", codex, personal knowledge-base, whatever you want to call it). Its UX has a lot of rough edges (esp. rel to import/export), but for now it's free, and IMHO this paradigm -- a graph instead of a hierarchy -- is extremely powerful and interesting. It takes some effort to get past the ugly UI, and I'm still adjusting to the awkwardness of bullet list items as the primary unit, and learning to resist the habit or instinct to categorize as I type... but even so, it's already useful and noteworthy. Interested to see if others here will agree. <comment><USER2> The "privacy policy" is outrageous: [https://roamresearch.com/#/v8/help/page/y7wOdeUpZ](https://roamresearch.com/#/v8/help/page/y7wOdeUpZ)

Won't even try it, sorry.

<comment><USER3> Can you elaborate?

<comment><USER4> Not sure about severine, but I was curious so I read the policy. These 2 clauses stood out as deal breakers:

"As a condition of your use of the Service, you grant Roam a nonexclusive, perpetual, irrevocable, royalty-free, worldwide, transferable, sub-licenseable license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute, modify and adapt and create derivative works (either alone or as part of a collective work) from your public Content."

"We may terminate or suspend your account and bar access to the Service immediately, without prior notice or liability, under our sole discretion, for any reason whatsoever and without limitation, including but not limited to a breach of the Terms."

Seems risky to put content here.

</comment></comment></comment><comment><USER5> There's a similar open-source tool with an Emacs front end called Semantic Synchrony.

[https://github.com/synchrony/smsn/wiki/What-you-need-to- know...](https://github.com/synchrony/smsn/wiki/What-you-need-to-know-to-use- Semantic-Synchrony)

</comment><comment><USER6> Exactly what I've been looking for - but, a few caveats, what is the business plan? Is this going to be open sourced? Who is behind the project?

<comment><USER7> I've asked them about this. Their current thinking is something like $10/month service.</comment></comment>


Show HN: Sesame, the wireless Mac lock - <AUTHOR> http://atama.io/sesame.html <comment><USER3> At first I thought this was similar to a bike lock so that your Mac can't get stolen. But that doesn't appear to be what this is. I don't see why simply "locking" your screen with something as simple as configuring a Hot Corner (all I do when I leave my Mac is swipe my trackpad to the bottom left) and it locks the screen. Logging in again isn't a problem no matter where it is. The fear is that if I'm in a coffee shop, my entire device will be stolen.

<comment><USER4> Yep.

A friend brought up another scenario, where you have to get up fast. If the Hot Corner is not fast enough, you can always just close the lid.

On the other hand, a fob like that seems unreliable in comparison. Aside from "steal the fob" (which, arguably, is similar to "steal the Mac, get info from Mac"), what is the operating envelope? At what range will it shut it down? At what range will it reactivate? How reliable is it?

<comment><USER5> You can lock the screen with control-shift-eject (if you have an eject button).

<comment><USER6> cmd-opt-eject is also an option

Edit: this is actually to sleep the whole machine I think

</comment></comment></comment></comment><comment><USER7> I hate to be that guy, but hasn't this idea been around for a while, but using the bluetooth on your phone? Aside from using Bluetooth 4 (LE), what would the advantages be to this?

I'd also caution against marketing this as a "Mac lock"... I at first thought it was going to be an alarm for the physical device, not the OS.

<comment><USER8> Yep, I used it before on Windows - the problem was that the Bluetooth range was too long :-). But it works great without the need of yet another piece of hardware on you (that you need to charge I think?).

<comment><USER9> I ran into the opposite problem with Bluetooth, although on not-so-recent hardware. A little while ago I wrote a bunch of shell scripts for Linux to active Motion [1] on my home computer and laptop whenever I (or rather, my Bluetooth-equipped phone) was away. It would then record any detected motion as video and pictures (uploaded offsite in real time in case the computers got stolen -- that, I thought, was a neat feature) and alert me. In practice the system ended up producing too many false alarms when it failed to detect my phone for up to several minutes when I was around and generally had a very unstable range.

[1] [http://www.lavrsen.dk/foswiki/bin/view/Motion](http://www.lavrsen.dk/foswiki/bin/view/Motion)

</comment></comment></comment><comment><USER10> Good idea, but presentation is a bit iffish.

First, that the opening title about the coffee thing - I had to re-read that section twice to realize it wasn't referring to someone getting a refill in a coffee shop and wondering why the heck would they leave their precious Mac behind.

Second, I would strongly consider redoing photos that have woman's hand in them. As odd as it may sound, the nail polish color is annoying and distracting. It has this old lady feel to it. Also there's something altogether wrong with the second from the bottom photo, it is just ... gross.

Also, the fob seems to be just a tad too big. I can't help but to compare it to the Fitbit. That's the baseline for size _and_ it's got the wireless proximity sync _and_ an incredible battery life. It may not have crypto support, but there are few simple ways around it (e.g. preloading one-time pad during paring over a wire).

All in all though - very cool. I'd rather see one project like yours than a hundred of Jekyll JavaScript icons for MongoDB on Bootstrap or what have you :)

<comment><USER11> Good comments.

Here's a photograph of fitbit next to Sesame. They're about the same size.

[http://www.flickr.com/photos/55147661@N03/10578659116/](http://www.flickr.com/photos/55147661@N03/10578659116/)

<comment><USER10> Oh. Well then, yet another reason to redo the photos, to provide a better sense of scale for the fob as it looks _big_.

</comment></comment></comment><comment><AUTHOR> Software dev here -

First time writing mac software instead of iOS, throws up some interesting new challenges! Any questions i will do my best to answer!

<comment><USER12> Looks great! I don't really suffer from the possibility of people snooping whilst I'm away, but it'd be a great convenience device.

I'm an iOS developer as well, but I haven't delved into OS X development. What makes the device compatible with newer MBP's but not older ones (i.e. my 2009 model)?

<comment><USER13> I would imagine it's not compatible because of Bluetooth 4. I had a similar issue with my MacBook vs iMac using that Authy two-factor authentication app that was talked about a couple of months ago.

</comment></comment></comment><comment><USER14> I hate to be that guy, but this already exists as a stand-alone iOS app [http://www.imore.com/iphone-proximity-sensor-locks-mac- keyca...](http://www.imore.com/iphone-proximity-sensor-locks-mac-keycard-mac)

</comment><comment><USER15> I did this with my phone using a wireless hotspot and some bash scripting. Basically you're paying 40 euros for closed source hardware that works only with Mac, when you could do it with some scripts and your smartphone ;)

<comment><USER10> To quote form an earlier thread -

 _you can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem. From Windows or Mac, this FTP account could be accessed through built-in software_

[0] [https://news.ycombinator.com/item?id=9224](https://news.ycombinator.com/item?id=9224)

<comment><USER16> You forgot the original:

      > Apple Releases iPod

      No wireless. Less space than a nomad. Lame.

        - <USER2>

[http://slashdot.org/story/01/10/23/1816257/apple-releases- ip...](http://slashdot.org/story/01/10/23/1816257/apple-releases-ipod)

</comment></comment></comment><comment><USER17> Why isn't it possible to just use your iPhone or any other Bluetooth (4.0 low energy) device, they should have a unique mac address and could be used for something like this.

<comment><USER18> I am curious too. It has me looking at apps like: [https://itunes.apple.com/us/app/tokenlock/id402433482?mt=12](https://itunes.apple.com/us/app/tokenlock/id402433482?mt=12)

How/why is this better?

<comment><USER11> iPhones have this habit of running out of battery. That could be inconvenient. The battery in the key fob probably lasts on the order of months because that's its only purpose in life.

<comment><USER19> That's one way of seeing it... Usually when I am at work or work with my Mac most likely my phone is either with some decent battery % or being charged. So if I leave for a few min, my phone usually always goes with me thus will work fine without another device.

I just scan around and there is another app in the Mac AppStore: [https://itunes.apple.com/us/app/keycard/id578513438?mt=12](https://itunes.apple.com/us/app/keycard/id578513438?mt=12)

And some tutorial: [http://mac.tutsplus.com/tutorials/security/use-your-phone- to...](http://mac.tutsplus.com/tutorials/security/use-your-phone-to- automatically-lock-your-mac-when-you-walk-away/)

which reference another open source project -which seems left in the water for the past few years.

Anyway the concept overall is good but I think I am not the target market: not really interested to add one more BT devices that I need to carry.

Good luck to the team

</comment></comment></comment></comment><comment><USER20> control + shift + eject/power.

But really, I'd prefer this to be an app on my phone instead of a keychain. I usually walk away from my computer with my phone but I'll leave my keys on my desk because they're more uncomfortable in my pocket.

</comment><comment><USER21> Flashback to 2005 and the Security DR 90105 00 PC DEFENDER Wireless Screen Lock Data Protection. Hope Sesame put more effort into wireless security and the client software!

[http://www.hanselman.com/blog/Coding4FunSomeAssemblyRequired...](http://www.hanselman.com/blog/Coding4FunSomeAssemblyRequiredUSBWirelessPCLock.aspx)

[http://www.overstock.com/Electronics/PC-Defender-Wireless- PC...](http://www.overstock.com/Electronics/PC-Defender-Wireless-PC-Screen- Lock/2066122/product.html)

</comment><comment><USER22> I thought this was going to an alternative to a physical lock, which seemed impossible, but on my way to click on the link it occurred to me you could setup the Mac so it sounded an alarm if moved, unless you unlocked it with your password. Which would be also be a cool idea. (Since I am at a cafe I guess my mind went more towards physical security.)

</comment><comment><USER23> Aside from the other comments that the functionality could already be replicated with a mobile phone, it would be cool if the device could have some kind of screen effect as though the machine is powered off. (ie. the power pendants in the TV series Revolution)

</comment><comment><USER24> This looks cool, but I would really hate to have to always have the device on me for this to work. I can just as easily hit Control+Shift+Eject to lock the screen when I get up.

<comment><USER11> I don't have an eject key on my Mac. No DVD drive, no eject.

It goes on the same keyring as my house key.

<comment><USER25> replace the eject key with the power button and the same key combo locks your screen

</comment></comment></comment><comment><USER26> On Mavericks: Just tap the 'shutdown' button. That will turn of the screen and lock your laptop. Problem solved.

</comment><comment><USER27> This looks like one of the ideas that could be patented all over. Have you guys done any due diligence on that front?

</comment><comment><USER28> Why isn't this just an iPhone app?

</comment><comment><USER29> Not sure that anyone wants to be updating the battery in something so simple every few months?

</comment><comment><USER30> I fail to see what value this really adds:

If you have a laptop, just close the lid. By default (on a Mac) you have to log in again when you return.

If you have a desktop, what kind of environment are you going to be in where you need to guarantee the screen locks when you are away even momentarily?

<comment><USER31> Closing the lid will put it to sleep, which is not always what you want to do.

<comment><USER32> Hotcorner screensaver?

<comment><USER31> Yes, that is what I use.

</comment></comment></comment></comment><comment><USER33> Got one</comment>


How do you document what you are learning at work? - <AUTHOR> We run a whole bunch of micro-services at work and I keep discovering things about them when I am reading through the code, fixing bugs, runbooks or whatever else. Right now, I have a note for every service and I keep appending to that. Evernote has some serious issues - no versioning, easy to totally delete the note (no warning). How do you all keep track of all the incremental learning? <comment><USER2> Mindmaps, with notes. Allows you to organize the information in a visual hierarchy, so that you can quickly refer back to the notes. I use Freemind[1], an open source tool.

[1] - [http://freemind.sourceforge.net/wiki/index.php/Main_Page](http://freemind.sourceforge.net/wiki/index.php/Main_Page)

</comment><comment><USER3> If you're using emacs you can use org-mode for note taking. Plus, there are lots of benefits wherein you can organize everything just in plain text.

Some of the previous discussions about org-mode:

[https://news.ycombinator.com/item?id=2423276](https://news.ycombinator.com/item?id=2423276)

[https://news.ycombinator.com/item?id=8668271](https://news.ycombinator.com/item?id=8668271)

[https://news.ycombinator.com/item?id=2091850](https://news.ycombinator.com/item?id=2091850)

From org-mode website: Org mode is for keeping notes, maintaining TODO lists, planning projects, and authoring documents with a fast and effective plain- text system.

[http://orgmode.org/](http://orgmode.org/)

</comment><comment><USER4> I use OneNote. I have a Notebook for each project I'm on, with tabs to keep my notes organized. My small team, 3 people, has a shared OneNote Notebook to allow collaboration. At my previous employer, we used Atlassian's Confluence.

</comment><comment><USER5> I have a few text files at work that I keep track of things. I treat it more as a reference file/personal FAQ file, some notes are verbose and some are terse. When I am learning on a side project I keep my notes in Google docs. I take the time to format those notes better so I can study them easily. Google Docs has history and warns you when you delete a file. What do you use versioning for? I correct my notes when I discover they are wrong, and if we release a new version of the product, I just record the new behaviour in addition to the old behaviour (along with dates, build numbers etc)

</comment><comment><USER6> I'm using tiddlywiki and I must say it's doing an amazing job. It doesn't stand on the way, works via mobile, everything is fine so far. I am slowly transitioning from Evernote. However if someone doesn't pick-it-up it will probably cease[1] by the end of 2016.

[1] [http://osmo-service.tiddlyspace.com/ServiceUpdate20160112](http://osmo- service.tiddlyspace.com/ServiceUpdate20160112)

</comment><comment><USER7> Wiki, that way other people can contribute as _they_ learn incrementally.

Wiki gardening is a thing, though, and without it, doom will follow.

At my last job we did the same thing, but I heavily customized the wiki to include endpoint testing, DB access, context-sensitive autocomplete, etc. It was pretty cool.

<comment><AUTHOR> I use wiki for stuff the team would care about. But asking this for personal use. For eg, there might be some git commands that I learned that I want to write down, everyone else may not really care about it/ may already know it.

<comment><USER7> Same answer; wiki, with customization for search.

Lately I use nvAlt, and now I may switch to Quiver (OS X), for a lot of that. I might even switch to Dash (of which there are Linux variants) after I explore its snippets and note-taking capabilities.

</comment></comment></comment><comment><USER8> I found Evernote was the easiest way to always have it around.

</comment><comment><USER9> A directory of markdown files. I use git for version control.

</comment><comment><USER10> I just write them to text files and usually lose them.

</comment><comment><USER11> I use gist.github.com</comment>


Disrupting Uber - <AUTHOR> https://www.jacobinmag.com/2016/07/uber-drivers-app-ridesharing-taxis-sharing-economy/ <comment><USER2> Good luck with the co-op idea.

The problem is that drivers feel like their services are worth a lot, and passengers simply don't believe it. The reason why Uber is a success is that they created new demand by dropping prices. Everyone I know, including myself, would never have taken an Uber as frequently as we do if the prices were as high as taxis.

You can't replicate this unless you keep pushing prices down, and this is what Uber is doing.

So, as long as drivers want to keep their prices high, the riders won't come, which will prevent more drivers from entering the co-op, which will mean riders will wait a long time before their drivers arrive, which means they will just go to Uber, etc. The co-op will never reach critical mass that way and will fail.

The article doesn't even mention the massive amounts of driver incentives that they pour back into the drivers. One driver told me that if they worked 2 hrs during rush hour, Uber would guarantee $50/hr. That's $100 for 2 hrs worth of work, which is pretty damn good and makes the rest of the day less stressful about trying to hit your numbers to become profitable.

<comment><USER3> Read the article more carefully, "they might be willing to switch to a co-op model that offers a cheaper price and solid service". A co-op can have lower prices and pay it's members more because they don't have to funnel profits to support the bloat of a central corporation like Uber.

<comment><USER4> Can they, though?

The corporation isn't some money-sucking black box. It's dispute resolution, software development to match rides efficiently (Uber Pool is tricky), and advertising.

Yes, it also skims money off the top to pay for things like driverless car R&D, but is a small, likely disorganized co-op going to be efficient enough at all the above to take advantage of that margin?

<comment><USER5> It's highly unlikely that a small, disorganized co-op is going to be efficient enough to take advantage of the situation and be able to out-compete Uber.

That said, the reality is irrelevant here. Jacobin is the kind of magazine where economic reality is treated as a suggestion, to be discarded as is convenient.

<comment><USER3> That's how economic reality should be treated. Our own reality is primary. We will take back our lives. What Jacobin is working towards is admirable. We believe in progress, that a better way is possible, and that the current state of affairs is suboptimal. We should encourage alternative economic thinking.

<comment><USER5> I am in favor of encouraging plausible, workable economic thinking. Jacobin is better described as leftist fever-dreams with roughly that level of connection to any reality.

Could things work differently? Absolutely. Are they going to work differently because some hack gets off fantasizing about how in abstract theory, the services Uber performs could be better performed by a co-op that pays workers more? No.

All the co-ops I've encountered or dealt with fall into one of three categories:

* Non-functional, incapable of making decisions or delivering value.

* Functional but completely unscalable. May depend on bizarro local economic conditions or be in one of the few cities where people are willing to pay 30% extra for pizza because it's a co-op.

* Function, scalable, and does not operate much like a co-op at the level of service delivery. REI falls into this category.

Uber works because it's functional, scalable, and reliable. You can go to almost any major city in the US, boot up your Uber app, and reasonably expect to get decent service. It is, abstractly, possible for a co-op to do that. You and Jacobin are completely, totally, 100% correct on this point. Things could be different and better for the people who Jacobin has decided matter.

In fact, we all live in a framework where such a thing is possible! If only someone was brave enough to put their labor where their mouth is. Maybe the propagandists at Jacobin could... nah. They wouldn't go for that. They much prefer theory.

<comment><USER6> > * Function, scalable, and does not operate much like a co-op at the level of > service delivery. REI falls into this category.

No true scot? The definition of a co-op is a group organized to meet economic or social desires through jointly owned business. What does this have to do with any particular approach to service delivery? You appear to be defining cooperatives as some unworkable theoretical concept and then any actual successful example of implementation is an exception. Convenient!

Vanguard also falls into this category but is absolutely a cooperative.

<comment><USER5> Workers at REI get sub-$12/hr. REI is structurally and technically a co-op. They are just a co-op that does not exhibit the benefits of a co-op that Jacobin would suggest will flow from being a co-op.

If it's structured like a co-op and exhibits none of the benefits of a co-op, what's been gained? I'm saying that co-ops generally have to sacrifice at least one of: structure, functionality, scalability.

<comment><USER7> REI is a consumer-owned co-op, not a worker-owned one. The entire co-op is designed around saving consumers money, not making the workers more.

So yes, REI does deliver the benefits of a co-op to its owners - high-quality goods at a lower price than they would be unable otherwise be able to get. This is the entire point of a consumer co-op. Workers can also be member- owners of the co-op, and frequently are, but the benefits are geared towards getting better discounts on the goods REI sells. This is in addition to the implicit benefits of being an owner of the company and having a say in its direction.

<comment><USER8> But the prices aren't actually lower than what can be had elsewhere even with the dividend you get back each year. The primary benefits of REI is how easy it is to return products you don't like or don't have a need for and the fact that you can get a product the same day if you live near one.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> What they're missing is that higher wages depend on some barrier to entry (there are many kinds) that protects the people who have jobs at the expense of anyone who is looking for a job.

As someone who works for a company with high hiring standards and correspondingly high pay, I have mixed feelings about this. It seems like there should be some jobs that are easy to get without much training, and taxi driver is a good candidate for this. If we build fences around every kind of job, life gets even harder for the unemployed.

So I'm not automatically on the side of workers with more "skin in the game." I'd need a stronger argument about why we should support them rather than part-time drivers.

<comment><USER10> I think the most valid complain about Uber as an employer is that it is advertised as well a paying job but that there are hidden costs that most drivers won't consider.

It's similar to how programmers often look at consulting rates, but don't factor in non-billable hours.

<comment><USER11> Does Uber have substantially more hidden costs than, say, a pizza delivery driver.

<comment><USER12> Nobody looks twice at the car the pizza is delivered in. Pick up a few riders in a car that smells like pizza, and you'll no longer be an Uber driver.

<comment><USER11> So keeping a clean car is one of the hidden expenses?

<comment><USER13> I'd say keeping a care _desirable to warrant a 5-star rating_ is, or any upkeep cost you would have to pay that Uber does not subsidize. I'm not a driver so I can't comment on specifics, but I doubt Uber pays for fuel, unless you're a full-time driver.

</comment></comment></comment></comment></comment></comment><comment><USER14> These "disruptors" need to work on wealth creation and not installing "economic rents." Economic rents, a term in Microeconomics, is trying to achieve profits beyond those in an efficient market (for example, creating artificial scarcity). The appear to be complaining because Uber is lowering the cost of overly expensive taxi fares when they should be working on a system that provides rides for less money while still helping drivers get more pay (if that is important to them).

In NYC, because of the legacy taxi medallion system which artificially limited the number of medallions to 13,000 (resulting in a medallion market value of $1.2 million now down to $700,000 after Uber/Lyft), taxi fares are still about twice that of many US cities. The artificial limit of medallions created artificial scarcity which resulted in "economic rents" thus ultimately requiring passengers to pay much higher fares that then went to the medallion owners.

One example would be to lower gas usage by using electric vehicles or hybrid cars (NYC Yellow Taxis are converting to hybrids) which not only lowers fuel costs but lower air pollution. They could make a financial deal with the city or state showing the lower health care costs from lower air pollution and have the cars financed.

<comment><USER6> > _The[y] appear to be complaining because Uber is lowering the cost of overly > expensive taxi fares when they should be working on a system that provides > rides for less money while still helping drivers get more pay (if that is > important to them)._

This is a magazine for American Leftists, so they're really quite clear what they want: they want valuable services rendered to people with profits shared among the workers, not the gatekeepers to an arbitrary app. More than creating wealth, they want that wealth to be owned by the workers. To quote from the piece:

> _This doesn't mean drivers are better off working for a traditional taxi > company. While Uber's burdensome cost-shifting has come to define > Uberization, the company merely digitized the taxicab industry's already > exploitative practices. The taxi medallion system, which requires drivers to > pay their cab's medallion owner at the start of each shift, deserved to be > "disrupted." But Uber's employees face serious costs and risks nonetheless._

> _The possibilities don't have to be so restricted however. Ride-share > drivers usually already own their vehicles, so in theory they could enter > the ride-share marketplace themselves. By ditching Uber's predatory > practices for a cooperative model that uses the same technology, driver- > owned apps could democratize the ride-sharing marketplace, fulfilling the > initial promise of the so-called sharing economy._

Uber is really a place where the leftist case makes the most sense, because the means of production is _already owned_ by the workers and are in effect paying a portion of their profits for the right to take part in an economy.

<comment><USER15> 1) There is an assumption that Uber is not only profitable, but wildly profitable. There is no data to support this claim outside of Uber's press releases (obviously biased) stating "oh, yeah we just raised another billion but I promise we're profitable in a few markets". To argue that Uber is withholding profit from drivers, one would first have to prove that Uber is making profit, not just a positive contribution margin.

2) The high liquidity of drivers would imply a functioning market (not to say that it's perfect). The most obvious solution for drivers who are unhappy with the pay would be to get a different driving job, right?

3) The core issue is that the barrier of entry to driving for Uber is very low, increasing labor competition. This also keeps the price of a ride low. The wage of the driver is the agreement between the rider and the driver for the service, Uber is acting as a mediator. There is nothing in this article that comes close to proving that Uber is not fulfilling it's role as a mediator.

4) It will be interesting to see if the app works, but the strategy seems flawed. The constrained variable are the riders; there are already plenty of options. Paying drivers more doesn't seem to be a very compelling reason for riders to choose a different service.

<comment><USER7> 1) Regardless of whether or not Uber is making an actual profit, which is not the point of the article, it is quite easy to show that Uber is withholding more revenue from drivers than theoretically necessary - on all rides, Uber takes a percentage cut of the overall fare, along with ~$1 or so in fees. You could argue that Uber's cut goes to running Uber itself, but the whole point of the article is that there is no need for a monolithic company running the platform in the first place - the software running it is fairly easy to create (given that there are hundreds of ridesharing apps worldwide) and the server costs are minimal - if the average Uber fare is $10 and it takes a 20% cut, it is ludicrous to suggest each ride costs $2 in server time. $0.02c might be more accurate (or even $0.20, if you add in other operational expenses), but that's a delta of $1.98 or $1.80 not going to the drivers for every fare.

2) Yes, to a company that is owned by the drivers and gives them back the maximal share of the revenue, taking into account the (minimal) operating costs.

3) To call Uber a "mediator" when both the customer and the driver have no say in the cost of the fare is laughable. Uber unilaterally sets the price, and if you don't like it, you're shit out of luck.

4) Like the point I made in 1), Uber takes a much larger cut than what is truly necessary. Even if the hypothetical ridesharing co-op had the exact same fares as Uber, a much larger proportion of the fare goes to the driver. And I would disagree that riders are the only constrained variable - there is almost zero switching cost between different ridesharing services for not only the rider but the driver as well. If only Uber and the ridesharing co-op are the only options for ridesharing in a given city, and they have the exact same fares for customers, but the co-op pays the drivers better than Uber, any driver would logically switch to the co-op since they would be paid more, and the customers would quickly switch to using the co-op's app as well, since the waiting times would be shorter compared to Uber.

</comment></comment></comment></comment><comment><USER16> > Yet again, an investigative report has found that Uber underpays its > drivers.

Aren't the fares proportional to how many drivers are available? If the fares are too low, don't drive. If enough people stop driving, the fare will go up.

<comment><USER17> If you're driving for beer money you won't care that the fares are low. If you're driving as a career you can't just not work and hope the fares go up.

<comment><USER18> It's an important point, that these concerns are always about careerists, not the beer money group. But there are two groups here.

The beer money group could be significant: retirees, students, people who want extreme flexibility because they have another primary job or responsibility. Half of all drivers is a significant block.

On the other hand, careerists legitimately face an impossible situation, since so much of their life is in the hands of one company that's constantly tinkering with its economics.

The common policy response across similar situations seems to demand every single job must work as a 40 per week career with benefits, killing any pure beer money jobs.

I don't know whether that's a wise policy solution or not. Maybe the benefits do outweigh the costs. But it's certainly not pareto optimal. Restrictive policy responses hurt one group of people in an attempt to protect others.

I'd feel better about such policies if proponents showed awareness of who they were hurting. Like if proponents said, "ok, honestly, we're going to hurt retirees with this jobs protection measure, but we think that's ok, because we value single moms over retirees."

Though if you get that far, you could just reduce it to a wealth transfer. Let Uber do what it wants, then tax retirees and give the money to single moms. Similar effect. One group loses, one group benefits.

Though of course then you'd stop and ask why you're taxing people supplementing a fixed income. Maybe you'd rather tax some other group first.

And that line of analysis is how you end up supporting deregulation combined with aggressively progressive taxation where the benefits are targeted to vulnerable groups.

<comment><USER19> > Restrictive policy responses hurt one group of people in an attempt to > protect others.

That's the definition of Pareto optimality

<comment><USER18> Ok, pareto optimal describes a state, and I was abusing the term to apply it to a change of states. Definitely could be ambiguous: Are you moving towards pareto optimality, or starting at PO?

When I've heard others commit similar abuses, they use "pareto optimal [change]" or "pareto efficient [change]" as synonyms for "pareto improvement." ie, moving towards pareto optimality. ie, a change that makes someone better and doesn't hurt anyone.

But you're right, "pareto improvement" is really the proper term there.

<comment><USER20> I think the parent was referring to how "you're at a Pareto optimum when any change has to make someone worse off", and was applying that (incorrectly IMHO) to the situation you described where a regulation makes someone worse off.

I say "incorrectly" because "some regulation R makes some group worse off" (as you were saying) does not imply "all reg changes would make someone worse off" (Pareto optimality).

</comment></comment></comment></comment></comment></comment><comment><USER21> "The drivers who don't completely depend on their work with Uber to pay their bills — a group that makes up about half of the company's workforce — depress full-time workers' wages."

I bet this creates a larger defensive moat than most competitors assume.

Uber is a supply/demand driven model (eg success w surge pricing) and even modest additional supply generates lower rates.

Lacking that same supply efficiency in full time driver platforms will keep their prices higher and without a significant price advantage consumers will stay with the known brands.

Not to mention the end game which is going to drop human drivers from the equation all together.

<comment><USER22> Uber is a investment fueled churn machine right now. Supply and demand(even as overly simplistic that model is) has yet to come into the equation. We will not have any idea the validity of the business model until the never before seen massive expenditures in driver acquisition subsides. Which probably won't be for several years or more.

<comment><USER2> The CEO already said that the top 30 cities produced over $1B in profits. I don't think your information is correct anymore.

<comment><USER23> Oh wow, so Kalanick opened his mouth and a huge number came out. Does he have anything on paper to back this up? An audited financial statement? Even a napkin with numbers on it?

</comment></comment></comment></comment><comment><USER24> > _" competing with Uber might seem intimidating, but in many respects the > company is a paper tiger. Its massive valuation, which stood at $62.5 > billion in January, comes from intellectual property — its brand and data — > rather than from tangible assets."_

Right... except that the brand is what creates the demand side of the market, the data is what makes the platform efficient and the IP provides strong defense against 3rd parties like this one.

Just to point out this is a thought-piece in a very socialist political magazine - and while I love Bernie as much as the next guy, this piece is a political folly and not really grounded in any business or technical fact.

<comment><USER25> Uber's brand did not and does not create the demand for catching a ride. The 400-year continuous existence of some form of ride service, starting with horse-drawn hackneys, tends to indicate a pre-existing demand, as does the fact that "taxi" is the same word in different languages all over the world.

<comment><USER26> You were able to pay a stranger to drive you around long before Uber came out. Even today if you loiter around any major airport you'll have plenty of people approaching you to offer a ride.

The difference is that I have 0 trust in a random person offering me a ride. I trust the Uber brand though.

</comment></comment></comment><comment><USER27> I still believe that Uber artificially creates a market by subsidizing a price point that is attractive to the drivers.

<comment><USER28> If their unit economics are positive than this is not true. If their unit economics are negative then it will be a spectacular show when the music stops. This is aside from promotional costs for the first few months when they enter a new market, as long as those costs actually decrease within the first year in a new market.

<comment><USER29> That view doesn't look at the big picture - it's very possible that they are allowing for, and happy with, losing money to grow market share for many more years, maybe even until they can offer driverless rides to turn market share into profit.

<comment><USER30> Waiting for driverless cars to make them profitable seems like one of the worst bets you could make. Even if they were content to wait, say, 20 years, when driverless cars hit the market, what's to stop _anyone_ from buying a small fleet of them and tossing their own uber-like app up on the store?

Heck, I can even see it in the distant future, turnkey Uber-like businesses, you get your choice of franchise to buy into. You supply the cash for the cars, they supply you an app and a little branding.

Saying "Uber's playing a long game by waiting for driverless cars and THEN..." just seems totally implausible.

<comment><USER31> Its not playing the long game. Its playing the short game. Self driving cars are going to be here for consumers by 2020.

What protects Uber is the network effect. Even if I had a million self driving cars right now, nobody has my app installed, and I don't have an optimized pricing and logistics set up yet.

And if you have your own fleet of self driving cars, why would you build the whole setup yourself? Why not just rent them to Uber?

<comment><USER32> > Self driving cars are going to be here for consumers by 2020.

I doubt this is true, at least if you're talking about all-weather driving. Not even the optimistic researchers I've chatted with are _that_ optimistic; this timeframe would require all-weather driving to be basically solid at the research level by 2018 or so, which is not totally impossible but unlikely. Maybe if it's limited to Uber Phoenix, though.

<comment><USER33> To be fair, a lot of the self-driving car testing and research thus far has been done on rather linear freeways in immaculate California weather. It's pretty easy to become overoptimistic.

At least, Uber ATC is in Pittsburgh, where it can become more grounded in reality by potholes, haphazard construction, thin windy two-way roads without markings or lanes, and unexpected acute precipitation.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> I know it's Jacobin, but where do they come up with the leading thesis that Uber "underpays its drivers." Relative to what? Even after expenses, Uber drivers make well above minimum wage.

Ultimately, it's impossible to satisfy all parties, particularly drivers. They want to be paid more, but most reports say Uber is not profitable. A co-op cannot rely on VC money to finance its expenses, so to pay drivers more they'd either have to charge more than Uber or avoid most of the expenses Uber incurs. I don't see either scenario leading to a competitive option: either you're the expensive option, or you offer a subpar experience.

</comment><comment><USER34> The greatest problem of coops is that they don't have any incentive of getting rid of riders. With the feedback in Uber, an abusive driver would be kicked off soon. I'm tired of taxi drivers that don't take me where I want. I never had this problem with Uber.

<comment><USER35> Have you tried being white?

<comment><USER34> I'm an adult, white guy with lots of gray hair... but I live in Brazil.

BTW, other day I was talking to a black guy friend of mine. He was complaining that the taxis didn't even stopped for him. More than one he had to ask as policeman to stop a taxi for him. As a funny guy, he says that he asks the policeman: "Would you please stop a taxi for me. I'm not able to do it, maybe they are thinking I'm black!".

</comment></comment></comment><comment><USER36> Uber is trying to keep prices low by removing the driver in the medium term. Any driver-owned service is going to have a hard time competing with that. There are less than 10 years of human driven transportation in urban settings. Still time to make a living, but not a career.

</comment><comment><USER37> Here's a crazy idea for solving the problem with uber and taxis: public transport.

<comment><USER38> As someone who has lived in the Bay Area 17 years - it just never seemed to materialize.

Disclaimer: I work for Uber.

</comment></comment><comment><USER39> This prompted me to try to understand what a co-op really is. I read the wikipedia page, and still don't really get what keeps it separate from a regular business, except for ideals. At a co-op like this, they would still need programmers to fix inevitable bugs in the app, marketing/logistics people to figure out how to get traction (because that doesn't just happen by itself) and expand to new cities, and managers to coordinate, and everything else a regular company needs (financial, HR, etc). It ends up sounding like what I think of as a regular company. What's the difference?

<comment><USER40> The employees would own the company, including any programmers, etc. There would be no shareholders to pay out to, so the money that would have been paid out as dividends could be saved by consumers and/or given to employees.

</comment></comment><comment><USER41> Uber has all the cards here. They came with a system that enables the drivers to use their time more efficiently, which dropped the price for the end user. Also lowered the entry barrier. Almost anyone with a car, smartphone and a driving licence can do it, which is why they afford the high turn over.

Is it worth it trying to compete with them? Definitely .

Will this lead to increased drivers profit ? Not really. Because the value that they provide is massively accesible,and with the advent of autonomous cars, fully replaceable.

Bad times for taxi drivers are coming quickly, and there's not much anyone can do about it...

<comment><USER42> They truly don't. They own the best technology but no driver OR customer loyalty.

If a cooperative treats their employees better and with higher wages then why should the best, most active drivers stick with Uber?

<comment><USER43> because that is where the customers are

<comment><USER40> If a coop doesn't have to pay investors, they can split that between the drivers and the consumers. Customers will switch apps for cheaper fares, all else being equal.

</comment></comment></comment></comment><comment><USER44> Hi, we have found our "peer-to-peer ride share app" to be surprising popular[0]... in a different era, this was called carpooling. Which theoretically could disrupt Uber with "free" rides, but the article's premise seems to be on disruption through disintermediated profit sharing. Our app seems to indicate, at least in suburban areas, profit motive isn't the only driver in this market.

[0] [http://www.snapridesapp.com/](http://www.snapridesapp.com/)

</comment><comment><USER45> It looks like post-Austin exit of Uber and Lyft, smart guys jumped on the opportunity to fill the gap. I really hope Arcade City will be able to provide sustainable & scalable solution!

P. S. I have no affiliation with either Arcade City or Christopher David. Read about this effort here: [http://www.vocativ.com/327333/a-world-without-uber- dispatche...](http://www.vocativ.com/327333/a-world-without-uber-dispatches- from-austin)

<comment><USER46> you're betting that a facebook group is a scalable solution?

arcade city is a great example of unintended consequences -- instead of safer rides, austin's regulations led to consumers choosing a __much __riskier ridesharing option (no GPS tracking, no recourse when something goes wrong, no background checks _at all_ , etc)

[http://www.bizjournals.com/austin/news/2016/06/21/austin- cra...](http://www.bizjournals.com/austin/news/2016/06/21/austin-cracks-down- on-unsanctioned-ridesharing.html)

[http://countercurrentnews.com/2016/06/dwi-arrests- skyrocket-...](http://countercurrentnews.com/2016/06/dwi-arrests-skyrocket- uber-lyft-kicked-austin/)

<comment><USER47> > you're betting that a facebook group is a scalable solution?

As I understand, they had an experimental phone application. They took down support for it, and are building a next version.

<comment><USER46> Ah, interesting, hadn't heard that -- is it the same as [https://austinstartups.com/rideaustin-turns-tnc-lemons- into-...](https://austinstartups.com/rideaustin-turns-tnc-lemons-into- lemonade-df841accfd32#.idfh3zxsv) ?

<comment><USER47> I think the company is actually based in New Hampshire.

[http://arcade.city/](http://arcade.city/)

</comment></comment></comment></comment></comment><comment><USER48> Even in the unlikely case that the co-op could temporally get more customers than Uber, Uber could just artificially lower the prices for customers/increase rates for drivers and win customers/drivers back. A co-op could not do that since they have no money in the bank.

Except when all this happens on an own blockchain where people can invest in the co-op via tokens on that blockchain? Maybe this could even be combined with a prediction market which decides how to counteract attacks (on prices) from Uber?!

</comment><comment><USER49> Vic Vaiana is naive. Co-op apps aren't 10X better than Uber so it's unlikely people will download them, let alone get people to switch from Uber and retain them long term.

<comment><USER50> I don't think the barrier is nearly that high. I could see people downloading co-op apps if they hear that they have more drivers or better drivers. Getting to that part is difficult, sure, but not out-of-hand impossible.

</comment></comment><comment><USER51> There is one big problem I have with uber: Uber takes PERCENT (20%) of ride value, while it has fixed cost associated with ride.

In fact it's a uber clever way to tax (sic!) workers.

I believe uber will be disrupted, either by nations (goverment must be ultra blind to allow burden its citizens by foreign corporation paying no corp taxes (EU case) plus having most of the cost in different country (all but US case) or by people themselves.

</comment><comment><USER52> A driver's co-op is an interesting idea, but how long until the drivers are all replaced by self-driving cars?

</comment><comment><USER53> It's a bit silly to leave out any mention of self driving cars in an article called "Disrupting Uber".

Driving around cars around all day is a silly job, ideally a job that should not exist in 5 years from now. We'd better discuss basic income instead of co- op taxi companies.

<comment><USER54> I'm trying to think of a job that isn't "silly", in the sense that it couldn't eventually be done by robots, and I'm drawing a blank... Do you intend to say that working is "silly"?

<comment><USER55> The silly spectrum, as defined culturally.

</comment></comment></comment><comment><USER56> The app in the article looks like vaporware (hope to be proven wrong). Anyone else trying to build P2P apps where the worker sees the full value of their work? I get the theory, it seems possible, but it been a few years since we started talking about building stuff like this on the blockchain and I've seen 0 activity. Every developer (including myself) who I've discussed this type of thing with has basically said the same thing: if I had a bunch of money in the bank and wasn't already working on a project that seemed interesting/important, I'd be down to try building it for some labor vertical (delivery, taxis, farming). From my vantage, it's public service in the same sense that doing a sabbatical with 18F is public service. Maybe 18F should try?

</comment><comment><USER14> Does anyone know why I would be downvoted for taking the time to explain what is going on. Does someone have a problem with lowering overly high taxi fares. Uber has been doing that which is a good thing.

<comment><USER57> There are barriers to entry to most jobs than don't fit your saying they are all harmful "economic rents".

<comment><USER15> Correct, but the article is advocating that full time drivers capture rents from the market. This is justified by implying (without evidence) that Uber is engaged in rent seeking against the drivers.

</comment></comment></comment><comment><USER58> (deleted)

<comment><USER59> I think this belongs in the "Hitler Uses Docker, Annotated" thread.

</comment></comment><comment><USER60> This is standard Uber practice. Use billions in its warchest to incentivize drivers into joining it, and offering huge benefits that gradually become less generous as it comes closer to market saturation.

<comment><USER11> What's a warchest?

<comment><USER60> I am referring to the billions it has got to spend, which it is using to fuel growth. War chest literally means " a reserve of funds used for fighting a war.". Seemed appropriate, since Uber is waging a war for market share</comment></comment></comment>


Performance Anxiety: Don't Choke - <AUTHOR> http://scienceblogs.com/cortex/2010/04/dont_choke.php

<comment><USER2> The bit about math problems causing more anxiety when presented horizontally: wow.

Perhaps those math ed "word problems" that try to make calculations more grounded in real situations are blocking student math success more than they're helping.</comment>