How the car industry hid the truth about diesel emissions - <AUTHOR> https://www.theguardian.com/environment/2019/mar/22/dirty-lies-how-the-car-industry-hid-the-truth-about-diesel-emissions <comment><USER3> I remember Mazda having trouble making their diesel engines performant while conforming to California emissions regulations, and wondering why they were having so much trouble compared to European car manufacturers. Then this scandal broke and it was obvious why.

<comment><USER4> I wonder why _mazda_ or some other competitor didn't find this by doing their own research? I make software for structural engineering and when some competitor launches a program that makes "better designs" it has usually turned out to be because they simply don't follow the design codes/regulations. We wouldn't be pushed from the market by that - we'd fund the analysis, reverse engineering and legal processes necessary to show the competitor is cheating.

<comment><USER5> My conclusion, from the first time I thought about it, is that they were all cheating.

Engineers move job; they talk to each other. Every car company had to have people who knew the truth and, if they were being unfairly competed against, could publish this truth.

<comment><USER6> Correct. Every single manufacturer in the industry knows what the others are doing. They all buy each other's vehicles and tear them down to the last bolt and bit to see how they work and how they can "borrow" some ideas without infringing on any patent (or breaking the law maybe).

They were all aware of what VW was doing and it wasn't a surprise, lots of companies did it [0] a lot of times [1]. Usually though the penalties were light. Many times they involved US companies and the strong local lobby pushed for the lighter fines. Like the heavy duty diesel engines case where 7 truck manufacturers were ordered to pay $1bn _together_ for doing the exact same thing. Which in the grand scheme of things was peanuts compared to VW's $4.5bn (plus the tens of $bn of extra costs). So the expectation was always "it's just the cost of doing business, pay it and let bygones be bygones".

[0] [https://www.nytimes.com/1998/10/22/us/record-penalty- likely-...](https://www.nytimes.com/1998/10/22/us/record-penalty-likely- against-diesel-makers.html)

[1] [https://en.wikipedia.org/wiki/Diesel_emissions_scandal#Previ...](https://en.wikipedia.org/wiki/Diesel_emissions_scandal#Previous_defeat_device_cases)

</comment></comment></comment></comment><comment><USER7> European here. My next car will be electric, likely a Tesla. The dieselgate is the reason why I'm not even considering Volkswagen's upcoming 'ID' family of electric cars. I've similar feeling about the whole traditional auto industry.

<comment><USER8> My next car will be "no car at all". Even electric cars have huge externalities that you do not pay for, but your children, namely, the disposal of the batteries, pollution created by the manufacturing, costly extraction of rare earths etc. Instead we should heavily invest in high-speed trains.

<comment><USER9> Except lithium ion batteries are very recyclable, and rare earth elements aren't in limited supply, they're just usually very sparsely distributed.

<comment><USER8> Wear from car tires cause the majority of microplastics that get into the seas (around 50%, if I'm reading understanding this study correctly):

[http://epanet.pbe.eea.europa.eu/ad-hoc-meetings/workshop- pla...](http://epanet.pbe.eea.europa.eu/ad-hoc-meetings/workshop-plastics- environment-11-12-may-2015/presentations/microplastic-pollution- norway-m.-kjeldby-miljodirektoratet/download/en/1/S2%205_Kjeldby.pdf)

<comment><USER8> At least in 1st world countries. The contribution of those are rather small compared to China and India.

WorldBank Pollution data: [https://data.worldbank.org/indicator/en.atm.pm25.mc.m3?end=2...](https://data.worldbank.org/indicator/en.atm.pm25.mc.m3?end=2016&start=1990&type=shaded&view=map&year_high_desc=true)

Maplecroft Deforestation Risk 2018 (as opposed to his 2012): [https://www.maplecroft.com/insights/analysis/esg- deforestati...](https://www.maplecroft.com/insights/analysis/esg- deforestation-risk-shoots-up-over-2018/)

Statista Countries Polluting Oceans (updated version of his): [https://www.statista.com/chart/12211/the-countries- polluting...](https://www.statista.com/chart/12211/the-countries-polluting- the-oceans-the-most/)

[https://www.pnas.org/content/early/2019/03/05/1818859116](https://www.pnas.org/content/early/2019/03/05/1818859116)

</comment></comment></comment></comment></comment><comment><USER10> I work in this industry, so I've been following it from the start. I've run test cells and written software to analyze the results from the emissions cycles that the government uses to validate the emissions compliance. I have worked around and for a very large diesel engine manufacturer who I am convinced does not cheat on this test. You'll understand why, below.

I recently leveled-up my career, and I now work with the person who originally setup such testing at this manufacturer, and one of the two people who literally wrote the spec, which is one of the most thorough technical documents I've ever laid eyes on. These are 2 of the highest-caliber engineers I have ever met in my 25-year professional career, both in terms of intelligence and capability, and in terms of integrity and trustworthiness.

This quote from the article pisses me off: "What I understand now is that the people we entrusted with the power to protect us essentially decided not to bother. Instead, they have allowed carmakers to spew whatever they want into our air." Really?! The government commissioned the spec. The government mandated that engine makers make their engines comply, and validate this compliance with internal testing. The government then paid independent testers to validate the manufacturer's results.

Excuse me, but what more did the author expect the government to do? The regulators entrusted this process to expert engineers, and expert testers. Did the author expect people who could invent the spec and create a test cell to do the validation to go to work for the EPA directly, and do the paperwork, instead of the engineering? Did they expect them to escrow the code, and validate that there was no cheating? Possible, but, again, you're asking a very specific skillset to give up DOING, and instead REGULATING, and that doesn't usually work.

The fault of this scandal lies -- of course -- with the manufacturers, but the fault also lies with the legislators. To control diesel engine emissions within the spec requires an array of very expensive after-treatment components. That can work in the class-8 heavy trucking industry, but you can't even fit it into a passenger car, let alone make it affordable at gasoline car prices. To think that cars could use diesel engines, be cost- competitive with gasoline-fueled alternatives, AND pass the ridiculously-low emissions standards that lawmakers have arbitrarily decreed was simply wishful thinking.

<comment><USER11> "Excuse me, but what more did the author expect the government to do?"

It is not some outrageous expectation that the $8,000,000,000+/year, 14,000+ employee EPA and/or DOT independently verify the real world emissions performance of passenger cars and other vehicles. The cars were so grossly out of compliance that anyone with a ordinary field emissions testing machine could have caught it.

If, as is very likely the case, the regulators had no technical resources among their hordes of lawyers they could have asked any number of publicly funded universities to perform the actual investigation and go beyond the agreed upon and easily fooled test regime. The discovery was actually made by US academics with very limited financing.

This institutional pencil whipping is SOP at EPA. GOA had a gasoline powered alarm clock (among other improbable devices) Energy Star certified as part of an investigation in 2010. Energy Star certifications are literally pencil whipped through an automated system with no human review.

When the EPA found itself answering for their part in the emissions scandal in public hearings there was no defense. They didn't even try to cite limited budgets[1] -- the go-to excuse every time some regulator comes up short -- as a cause. They just failed.

That's difficult to accept for some, and so all manner of rationalizations are employed to dilute that simple truth. But I'm not among them.

[1] [https://www.c-span.org/video/?c4787386/blaming- budget](https://www.c-span.org/video/?c4787386/blaming-budget)

<comment><USER10> I still shake my head at this. If you wrote laws that said manufacturers of a particular thing had to do X, and expected them to adhere to it internally, and then paid expert testing facilities to validate those results, why would you EXPECT that you would have to do additional testing to validate the validation?

And further more, why would you think that merely testing the test would lead to a different result? You can say that the Euro V is "not representative" (as someone else did in this thread) of normal driving, but the FTP test's torque and RPM curves were lifted from real-world driving through hilly areas. It most definitely is representative. I don't know about the Euro V.

So I don't get it. In this scenario, what people are asking the EPA to have done was load up vehicles with mobile emissions equipment (which is a very difficult thing to do, by the way), and validate that the TEST ITSELF correlated with real-world driving. Granted, this is an interesting exercise, but one that I would expect the EPA to - again - pay someone else to do.

Given the engineering that went into the spec on the US side, I wouldn't expect that this was something they should have needed to do. You can say that they were the regulatory body in charge of this, and therefore should be responsible for catching cheaters, but I don't see how a reasonable person can find that the EPA was intentionally negligent in this matter.

<comment><USER12> Nobody charged the EPA with ensuring adherence to some made up test cycle, but to the emission limits. If the test cycle is your approximation of real world behavior, it is highly negligent to never confirm that _real world results_ actually match the approximation! This is science 101.

<comment><USER10> I'm specifically arguing that the FTP cycle result IS, in fact, a real world result. So to me, claiming that the EPA needed to do their own verification would be silly. The only reason to do this would be to catch cheaters.

I know I'm naive, and very trusting. I would never have thought a company to have the utter stones to completely fake the results as VW did. If you've looked at the depths of their algorithms to do it, you see the effort that went into it. I just would never expect such behavior from one of the largest auto makers. It's so far beyond the pale to my expectations that I can't blame the EPA for not catching it.

YMMV.

</comment></comment></comment></comment></comment><comment><USER13> I live in france, and I often spot cars that have a grey/blue smokes. Many other cars also have this awful smell.

Here, every 2 years, cars must legally be examined in a "controle technique", like an exam which controls several aspects of a vehicle.

I wonder if those fumes are legal, and I really wonder if people can manage to cheat at that exam, because I think I'm noticing an epidemic of those fumes.

How can I really be expected to ride a bike next to cars like this? I'd rather spend time in a tram or bus than expose my lungs to this.

<comment><USER14> I have an older diesel VW. It is extremely common for people to run tunes that disable the check engine light that is produced when you delete the exhaust gas recirculation valve (EGR), urea pump and diesel particulate filter (DPF).

For things like the EGR, blocking it off is simply installing a bracket or two and closing off some vacuum lines. I can imagine people would simply reinstall this and swap the tune to pass and then immediately remove it after.

In the US, for emissions, all you have to do is not run any check engine lights when at the test center which is easy to do in the software tune.

<comment><USER15> > In the US, for emissions, all you have to do is not run any check engine > lights when at the test center which is easy to do in the software tune.

Which is very disappointing...

When I first moved to Arizona I had a '67 Galaxy and that thing got to run on the dyno in the emissions office but when I got my truck to replace it (not having AC in Arizona isn't fun) all they did was plug in into the computer and charge me _more_ for the test.

My (carburated) motorcycle was in between, they couldn't run it on the dyno and couldn't plug a computer into it so just tested it at idle -- which seemed pretty pointless to me, even being all hopped-up it still got better gas mileage than most cars on the road, though it did get pretty horrible gas mileage for a motorcycle considering I had to run premium in it.

</comment></comment></comment><comment><USER16> " Schmied responded that as long as emissions went down when limits were tightened, his department didn't mind they were many times higher than allowed."

Some context for this: the official European test cycle was known not to be representative of real driving conditions. Because it was less aggressive than real-world driving, it pretty much always overstated fuel efficiency and understated emissions. So real-world emissions not going down at the same rate as tested emissions is a sign of foul play, but them being higher isn't necessarily. (The US test cycle is better.)

<comment><USER17> Sure, but don't the laws limit emissions? Irrespective of how well standard government tests were measuring those emissions?

So "We publish this data" just sounds like "I'm doing my job. Anything more is not my problem."

<comment><USER16> The laws limited emissions in the standard government test cycle, and the thresholds on emissions were chosen based on how well cars could be made to perform in those test cycles. While actual defeat devices were illegal, the legal emissions limit wasn't actually the real-world emissions limit and everyone knew it.

(The EU is now gradually moving to real-world emissions testing and a more realistic test cycle, though judging from the other reply they might have some cheating problems with that - especially as real-world testing inherently has wider errors than lab testing.)

</comment></comment></comment><comment><USER18> Netflix'a Dirty Money documentary Ep 1 covers this topic: [https://www.netflix.com/title/80118100](https://www.netflix.com/title/80118100)

</comment><comment><USER19> Excellent review by Adrian Colyer for those interested - [https://blog.acolyer.org/2017/06/20/how-they-did-it-an- analy...](https://blog.acolyer.org/2017/06/20/how-they-did-it-an-analysis-of- emissions-defeat-devices-in-modern-automobiles/)

Also, the book _How they did it_ gives insightful glimpses.

</comment><comment><USER20> This happens in almost all industries. Big oils' repetitive attempts to kill EVs, Big Pharmas, insurance and hospitals lobbying against healthcare reforms, Big Banks working against finance regulations etc.

<comment><USER21> Big Parma is lobbying FOR healthcare reforms.

<comment><USER22> Not for anything that may reduce profits though.

</comment></comment></comment><comment><USER23> So did the recall all those failing 97% of 250 car models in the EU?

<comment><USER24> Yes, but in many countries like the UK the recall is voluntary, it's just a recommendation.

<comment><USER25> Thank God it is as it worsens mileage.

<comment><USER26> Thank God it is as it allows you to place externalities on us?

</comment></comment></comment></comment><comment><USER27> I've seen claims that VW's whole diesel emissions and engine control subsystem was actually contracted out to Bosch. But VW execs knew about the software defeat device.

<comment><USER28> The controlling unit indeed comes from Bosch, but it is a generic unit that can control any kind of engine. The car manufacturer using this unit programs it to perform the actual world, mostly by specifying parameter sets for its operation. The car manufacturer has for example to determine, how exactly the ignition needs to be set up for a given temperature and load etc. There are plenty sensor inputs these profiles can depend on like engine temperature, revs, load, outside temperature, speed of the car. The Bosch software can offer the "test dectection" as one of the inputs. There can be quite reasonable use cases for that information, but that VW used it in the way they did, was VWs choices. The same or a similar control from Bosch unit is probably used by many other car manufacturers, but without abusing this specific "feature".

As the article writes, there are other "strange" engine configurations with other car manufacturers, like using the outside temperature. Reducing or switching off the exhaust cleaning system at outside temperatures below 17C (the tests are guaranteed to be done at 20C) achieves a similar effect to what VW was doing without literally breaking the law by using a defeat device.

<comment><USER29> _> There can be quite reasonable use cases for that information_

What reasonable use case is there for a detection of the test cycle just from ECU information? If you're just testing stuff surely you have access to the ECU to just set a flag manually for anything you need?

<comment><USER28> Could be reasonabe safety features like not performing emergency breaking, or functions aiding the testing process (without interfering with it of course).

<comment><USER29> I can see plenty of reasons to change behavior for the test. But that's not the question. The question is why infer you are being tested through the ECU inputs? Setting a flag manually seems like a much better solution for all those objectives versus a possibly unreliable inference from speed and other data.

</comment></comment></comment></comment></comment><comment><USER30> I could never understand how something that was less refined, diesel, meaning that it had more unnecessary "stuff" could produce less emissions. Diesel always did, and always will, as far as I'm concerned he snake oil when it comes to emissions.

<comment><USER31> Its less refined in the sense of less cracking.

It contains more energy for a given volume, so you get better fuel economy than with petrol. It might not be better for the particulates and NOx that we are now optimising for, but its better for CO2, that we were optimising for. So I don't think the snake oil label is warranted.

<comment><USER32> Diesel engines are also significantly more efficient at converting that energy into usable torque. That's why an idling diesel consumes almost no fuel - <USER2> isn't doing any work.

</comment></comment></comment><comment><USER33> I always cringe when one of these "we could have been driving electric cars" articles shows up. Cars are not bread and the vast vast majority of the planet's population (who even own a car) don't just go around shopping for new cars. It's going to take DECADES before electric cars have a significant impact on the climate change. That is an economic reality. (Not to mention that electric cars are only now starting to barely match gasoline cars in terms of usability and range.)

</comment><comment><USER34> A coworker and I had a discussion with another coworker when this scandal broke. We couldn't convince him that he was wrong when he said there is no way car software could "cheat" like that. Even after we came up with several things that could be done in the space of about a minute, he remained unconvinced. If you follow through the article to the reference US DoJ press release, VW's software used several of the ideas we came up with as part of their "cheat". This coworker also thought that the California drought was a big hoax, so...

<comment><USER35> What's the point of this anecdote other than to make you look smart and your coworker look dumb? Maybe both things are true but it's hardly a very interesting observation that there are both smarter and dumber people in the population.

<comment><USER36> It is how scandals work. Lots of people believe the lies and can't be persuaded to think from an evidence first viewpoint. They need the story to be headline news on the BBC or some other reputable source before they will 'believe it'.

Every scandal relies on groupthink to keep it quiet.</comment></comment></comment>


Having a Library or Cafe Down the Block Could Change Your Life - <AUTHOR> https://www.theatlantic.com/ideas/archive/2019/05/america-needs-more-community-spaces/589729/ <comment><USER2> Basically going out but having anxiety and depression are the cause and not visiting those the symptoms

Also M'lord pseudolus (another great article)</comment>


Physicists find a new way to push electrons around - <AUTHOR> http://newsoffice.mit.edu/2014/moving-electrons-on-graphene-0911

<comment><USER2> > Currents in these materials, being neutral, might not waste much of their > energy as heat, as occurs in conventional semiconductors — potentially > making the new materials a more efficient basis for computer chips.

This part is probably only hype, but the sideway movement looks very interesting, at least from a theoretical point of view.

<comment><USER3> TFA talks about a neutral zone. I assume there is a flow of equal number of (+) and (-) particles there.

If that is utilized, heat savings might prove to be true.

</comment></comment><comment><USER3> There is something about there being 4 electrons in the outermost shell of an element.

What is it?</comment>


Ask HN: Why you keep coming back to HN? - <AUTHOR> <comment><USER2> Because I find interesting stuff and I get to interact with other like-minded people. I feel like I have always something new to learn.

</comment><comment><USER3> I found several of my clients and my most recent internship on HN, it may be small but for me it's the best job board on the internet, and the articles and projects here have a high signal to noise for my interests.

</comment><comment><USER4> Because it was first written in Lisp!</comment>


Tell HN: "Who's Hiring?" Threads Are a Mess - <AUTHOR>

I've never been a fan of how hard it is to sift through "Who's Hiring?" threads, but the recent "Who's hiring in <region>?" threads are not the solution. They clutter up the homepage more, and they still don't fix the fact that there's 63 comments on the "Who's Hiring in Europe Thread?" and there probably aren't more than 5 for any one city (so if you don't want to relocate, you're still getting a low signal:noise ratio).
What we need (unless pg were to want to actually add some kind of structured hiring functionality, which seems unlikely) is a standardized format that makes it easy to Ctrl+F through them to find things you want.
Here's a proposed format:
<general description of the job, mentioning the company name, what you're doing, the level of experience it is, etc. whatever you want>
Location: <List any way someone would refer to your location or locations nearby-enough that it still applies. Include the word "remote" if you'll accept remote workers>
Technologies: <List all of the technologies that someone in this job will be using>
Position: <Include the word the word "developer", "designer", or "infrastructure" if it's one of those, but you can go into more detail>
So first you describe the job like normal (but possibly leaving out some of the info that will come later), then you add what amounts to metadata to make it easy to search through.
Here's an example of how a job (http://posterous.theresumator.com/apply/JbAS4A/) would look when translated to this format (Note that I'm not associated with Posterous and that I may be misrepresenting the job in this post. I just chose it because it was on the jobs page.):
Posterous is looking for battle-tested, seasoned, war-hardened backend infrastructure engineers who love building and maintaining software used by millions of people. You'll work with a driven team of like-minded software engineers to build the next great Internet treasure. You are a skilled craftsman when it comes to capacity, uptime and scaling, and love it when your site is humming along like a well-oiled machine.
We want someone who has built for massive scale and will be able to build our tech stack to support hundreds of millions of uniques per month.
Compensation includes full time salary, generous equity compensation plan, and benefits.
Location: San Francisco, SF, Bay Area, Silicon Valley
Technologies: Linux, NoSQL, MongoDB, Casandra
Position: Senior Infrastructure Engineer
Note that I listed "Silicon Valley" as a location even though it's not. Someone looking for jobs in the Valley would probably be willing to consider jobs in SF, so they should list it. When it doubt, list it.
It's a little rough and certainly needs some tweaking, so I'd love comments on how to improve it. But I think that some standardized format like this could make it a lot easier to look through these. If you're looking for a Rails job anywhere, Ctrl+F for "rails". If you're looking for a job in NYC, Ctrl+F for "NYC" or "New York". Much easier than having to look through them all. <comment><USER3> Speaking as someone who has hired multiple times from HN:

I agree that the nascent trend of "Who's Hiring in XXX" has got to stop.

I strongly disagree that what we need is to formalize the job listings and make them searchable.

I strongly disagree that we need to loosen the "YC only" restriction on job ads.

I strongly disagree that what we need is a YC-style job board.

I'm with the other commenter on this thread that said that one of the strengths of the "Who's Hiring" thread is that it's a way to learn about what people are doing and what companies are engaged with HN. It's not a job database. It's a conversation. When I've posted positions here (note: we're still hiring!), I've been thrilled to get comments and questions and to be able to answer them publicly.

My suggestion:

There's already a leader list, and there's already a user profile. news.arc should just look at people's profiles as they're saved, and if the profile says "we're hiring", add that user to a list of users who are hiring. Keep another list. If you want to scan through everyone who's hiring, there's your database. The rest of us can just keep talking about what we're doing and having conversations and not worry about optimizing things or geeking out on how to run a job board.

<comment><USER4> One thing that comes to mind after reading this comment - maybe what we really need is a HN startup directory? A list of startup names as titles, comments and voting (so you would easily know which one is interesting).

<comment><USER5> <http://startuply.com>.

Guess who funded them?

<comment><USER6> Nice. However, there's only 2 jobs in Berlin from Music Pictures whereas it said clearly on the other post that SoundCloud is also hiring in Berlin. <http://ventureloop.com> lists more here but then again those are all VC backed. So, somehow another job board didn't solve the problem.

</comment></comment></comment></comment><comment><USER7> I've never minded the disorganization: I think of these threads as a good way to see who's busy and learn about a few new companies and products.

Besides, considering the high quality of opportunities that are usually offered here, time spent combing through these threads is more efficient than sifting through the piles of trash on regular job sites.

<comment><USER8> +1.

It's interesting to see it in this form; otherwise, you could miss interesting opportunities that aren't in your local area. I referred one non-local (WRT to me) person to an interesting post because of that.

</comment></comment><comment><USER9> Really, this would be neat, but would it help at all?

If you actually wanted a job, why not just read through them all and contact the ones that are near and interesting? - it's really not that hard, I read them all and I'm not even looking for a job.

HN could instead do with a proper job board. I'd suggest that a job board should not be restricted to advertising just specific jobs like every other board does. In a small startup roles will not be that well defined yet. You should be able to post just a company and say they are looking for good people, by stating:

      - What the Company does / the problem it solves
      - Capital raised and current situation
      - Technologies currently used
      - <USER2>

<comment><USER10> Instead of the first point (what the company does) I suggest link to a Company website. 3 other points are very good - maybe one more point with the salary/equity info?

And all of those posts should be aggregated under <http://news.ycombinator.com/jobs> link.

<comment><USER9> There should be link for further information, yes. Though I think you should be a quick pitch inline - actually thinking about this a bit more, there should be char limit on it too, say 500 chars.

Not sure about Salary/equity details, it brings up all sorts of issues, whether they are in it for the money and lack of knowledge of the market rate. Also it's specific to a job, rather than just a call out to people who want to be involved which could be anyone from people straight out of college to people with 20+ years experience doing technical or non-technical jobs.

</comment></comment></comment><comment><USER11> Or... people could just use one of the 278 existing job sites that have proper search and are generally better suited to the task than a generic forum.

If you want to bring YC people together it might be easier to agree on a "secret handshake", like the string "YCYC" somewhere in the description?

<comment><USER12> "[...]use one of the 278 existing job sites[...]"

I like to know what people in this community are working on.

I'm not, however, interested in job openings in general.

My points are: 1 ) a job site is not the same, unless it is tied to this community. 2 ) even if a secret handshake existed, I wouldn't be likely to start my day searching a job site for "YCYC"

</comment></comment><comment><USER13> I understand where you're coming from, but don't agree. The unstructured nature of "who's hiring" and the fact that it's so entangled with the general conversations going on in this community are a key part of what makes it alive and different. Occasionally people who don't have any roots here (strange to put it that way, but it does seem to be how things work) try to make more traditional job posts, and those (even before they get killed) stand out like sore thumbs. There's something valuable about this ambience.

There are two classic rules to be respected. One, don't rush to systematize things, especially human things. Two, when communities spontaneously create new patterns, that's very valuable -- sometimes even beautiful -- and should be attended to delicately, as if one were discovering a new and exotic species.

Two companies that have done an amazing job of following spontaneous user trends are Twitter (e.g. hashtags) and Reddit (e.g. IAMA). The trick seems to be to wait a long time until the pattern is clear, then provide nonintrusive support to enhance what is already happening. The obvious temptation is to impose familiar structures (do it "right") that are foreign to the spotaneous life and end up killing what was most interesting about it.

<comment><USER14> Really, the most important things are:

\- Where is the company located?

\- Is remote work a possibility?

\- Is remote work only available in-country (or a select list of countries -- e.g. USA and Canada only)?

\- A reminder to people to make sure they have contact info somewhere (there are always a couple of posts that say 'email me' with no email address in the post or profile).

These only seem to be loosely followed. If we could cement these as constant reminders / rules to the people posting jobs in the threads it would go a long way.

[ It could also help to have a standard format for location. It's annoying when someone only says their company is in 'Canada' but you have to hunt down the information (i.e. company site) to realize they are not in the part of 'Canada' that you are looking for. ]

</comment></comment><comment><USER10> Maybe it is time to get <http://news.ycombinator.com/jobs> a little bit more useful and turn it into a job posting board? Then it's just one step to create a specialized submission form to make things more organized.

<comment><USER15> As far as I know, currently only YC backed companies can post on HN jobs.

To make it more broader (and perhaps more useful), anyone with more than a certain karma threshold (e.g. 500) can also be allowed to post a job opening on it. A certain number of karma points (e.g. 50) can be deducted for making every job post. This strategy would keep it clean and free from recruiters, and since the post is coming from a 'accredited' HN user, it would possibly have a good chance being interesting and useful enough for most of us.

The additional problem this would solve is that it would allow job postings to be visible for longer durations than what's possible with regular news threads.

Just a thought.

<comment><USER16> Or simply allow HN members to flag blatant recruiter postings, and after 3-4 flags (or whatever) the post gets removed and the person's account gets blacklisted/deleted/warning sent depending on the number of offenses. It would be easy to tell a recruiter's account as the account would be fairly new, with few posts and low karma.

</comment></comment></comment><comment><USER17> It's a status quo.

The reason people are posting jobs here is because of the community and the select group of people participating.

But if you create a YC Job Board then you loose the community and you increase the audience of the postings to be much much larger and outside of the original target audience (eg: just think of all the job board aggregators, the jobs would end up on, etc).

</comment><comment><USER18> Hmm, personally I'm ok with the free form posting + reply format the community has evolved. No need to change anything. Keep bureaucracy at bay!

</comment><comment><USER12> Idea: since the comments are hierarchical there could be a thread for each continent.

<comment><USER19> Add one for telecommuting.

</comment></comment><comment><USER20> My personal suggestion would be for PG to loosen the restrictions on the "Jobs" section to not be restricted to those that have gone through YC.

</comment><comment><USER21> Listing any relevant names for the position is a huge plus. I'm tired of first cycling through all the matches for "NYC", then everything for "New York City".

Another thing I'd like to see is differentiating full-time and part- time/internship positions. Maybe a "type" field could be useful as well?

</comment><comment><USER22> Speaking as a startup CTO who would love to recruit HN hackers, I'd welcome any additional structure that helps people find my jobs - a "microformat" as suggested by the OP, or a proper job board, or anything in between.

</comment><comment><USER23> This would actually be a good use for an HN wiki, as suggested here: <http://news.ycombinator.com/item?id=1330602>

</comment><comment><USER24> Time for Hacker Jobs?

<http://jobs.ycombinator.com>

</comment><comment><USER25> If only this website had a section for potential employment opportunities...

<comment><USER26> That is for ycombinator funded startups only.

</comment></comment><comment><USER27> someone should create a job posting board platform and get every high profile blogger to start their own job board for their audience.</comment>


Ask HN: What do the green usernames signify? - <AUTHOR> Sorry, but I don't know if there's a more official channel to ask this.<p>Does it have something to do with passing a threshold in karma points? <comment><USER2> Newly created accounts.

</comment><comment><USER3> [http://www.google.com/search?hl=en&q=site:news.ycombinat...](http://www.google.com/search?hl=en&q=site:news.ycombinator.com+green+usernames&aq=f&aqi=&aql=&oq=)

<comment><USER4> That's not as helpful as you think.

<comment><USER5> If the answer to a question is in the first page of google results, it should not be asked.

<comment><USER6> I just happened to google this question and now this post is the first result, so I'd say there was no harm in him asking.

</comment></comment></comment></comment><comment><USER7> My previous answer (here: <http://news.ycombinator.com/item?id=2454874>) was: They're greenhorns.</comment>


Show HN: Idea to startup - <AUTHOR> https://ideatostartup.org <comment><USER2> In your own words, "the ideatostartup is kind of a crash course". What exactly does that mean? A start-Up should be a well thought out process although it is a learning curve but not one where the founder decides to take a crash course just because an idea pop up. Do you stick around after the 40 days or just move unto the next one?

<comment><AUTHOR> Dear Pavornyoh, Thanks for your question.

By "the ideatostartup is kind of a crash course" , we mean that ideatostartup will take you from idea to startup within those 40 days. Within those 40 days, you will have a MVP and clear cut process and strategy of achieving the product market fit.

The company itself will definitely grow over years but the launch will happen within the 40 days. We have met a number of entrepreneurs who just can't launch even after spending years on an idea. The reason is simple. Sometimes they are afraid to go out and talk to customers, to validate the idea while other times its because they just can't get the product built and keep adding features after features.

We ensure that entrepreneurs get over this fear of launch and focus on achieving the product market fit.

For 40 days, we work 24*7 with the founder/s. After that we provide all the resources and connections we can as advisers.

<comment><USER2> If the founders are afraid to launch based on the reason you stated above, don't you think your suggestion to help is just temporary? There are different kind of markets and without domain expertise in a particular market, how do you map out strategy, sales etc.? How do you act as advisors?

<comment><AUTHOR> Thanks again pavornyoh!

Since we develop the products ourselves and ensure that entrepreneur goes out and talks to customers, we fix both the problems. As we have seen from experience, many entrepreneurs fear for the first time. And, mostly its about the fear of failure and validation. We help them overcome it and do what is necessary.

We have created a process for converting the idea to startup. If you have noticed, the entrepreneurs that succeed in one venture, are more likely to succeed in their future ventures irrespective of the domain. Once the entrepreneurs know the process, they can execute the details as per the context. We also connect entrepreneur with the expert in that particular domain.

<comment><USER2> So... 1)But you stated the founders are scared to talk to customers so how do you ensure that this particular problem is fixed? Is there a clear process the founder how to follow? Do you have a sales coach training them?

2)So are you saying you only take founders who have been successful in a venture before based on this response -"If you have noticed, the entrepreneurs that succeed in one venture, are more likely to succeed in their future ventures irrespective of the domain."

3) I am just trying to understand the thought process behind your marketing pitch about what you want to do. If your background is development, why not stick to that alone instead of throwing all the others in?

<comment><AUTHOR> Thank you again, Pavornyoh, for taking out your precious time.

1\. We help founders overcome the fear. There is a clear process.

2\. By that , we mean following certain processes improves the success rate for startups. Successful entrepreneurs know these processes. And we teach first time entrepreneurs this process.

3\. Entrepreneurs who are passionate about an idea face many problems. The first problem is :

i. They need a product but may not have the necessary tech skills. We fix this problem for them.

ii. Almost all failed startups have the product, but what they do not have are enough customers. We guide entrepreneurs how to get customers.

We fix these 2 problems in the 40 days.

After these whenever startup achieves product/market fit and enters in the scale phase, we connect them with the relevant domain experts who will help them scale.

<comment><USER2> This - "We guide entrepreneurs how to get customers. We fix these 2 problems in the 40 days". Those 2 problems cannot be fix in 40 days in my opinion. So you consider all ideas no matter how crazy it is and work with it by developing and mapping out a strategy?

<comment><AUTHOR> Definitely not all ideas. We work only on 1 idea for 40 days. And of the 10s of ideas we receive, we only select the one where we can help the most.

<comment><USER2> Interesting- I think you will have a hard time convincing people here in the U.S to go with you. For $9,000 a promise to fix 2 of their main problems in 40 days isn't enough for the very savvy ones.. But all the best to you..:)

<comment><AUTHOR> Thank you :-)

Convincing people has not been a problem so far. Because its usually the entrepreneurs whom we have worked with that refer us to their friends.

Also, you don't have to pay 9k at once, its usually milestone based or weekly. There is no lock-in. The entrepreneur can leave whenever they want if they don't like the program.

Btw, I really appreciate your questions and suggestions. Is it ok, if I put these questions on ideatostartup?

Thanks.

<comment><USER2> Yes- You can do that.

<comment><AUTHOR> Thanks. I think I must mention in the site that, there are no holidays in those 40 days and average working hours are 10-12 hours everyday. So for 9k you get 400-450 hours of working hours. That's less than 25 dollars per hour.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER3> The presentation is making it sound like a "test area" , throw some money and see if it works or not . I feel , what you are writing right now is pitch for yourself and sadly its not working .

<comment><AUTHOR> Nothing to be sad about nautical. We have already received enough applications and don't need any more for atleast 6 months now. :)

<comment><USER2> Hmmm.. Based on this response to @Nautical, your pitch on the site said you can only take 1 application in November. So if you are booked for 6 months, why take an application in November?

<comment><AUTHOR> We received the applications yesterday after submitting on Hn and other places like Google groups. The ideas to work on till October are finalized. The ones received yesterday aren't. So while we would like to receive as many applications as we can, they are not necessary.

</comment></comment></comment></comment><comment><AUTHOR> Hi there! Happy to listen to your questions and valuable feedback. Thanks.</comment>


Slack's New Arbitration Policy - <AUTHOR> https://konklone.com/post/slack-is-now-forcing-users-into-arbitration-and-that-is-terrible <comment><USER2> There are two separate issues here. Requiring arbitration is one. Disallowing class action is another. You cannot conflate these two things.

Disallowing class action is absolutely in-favor of Slack and companies in general. Class action suits are a powerful pro-consumer force. They allow consumers to seek redress without cost - as the legal costs are paid for by the plaintiffs attorneys. Sometime consumers don't get much out of these suits while the attorneys make a lot. But their threat is a strong check on powerful companies.

Forcing arbitration is a murkier matter. The first google result on arbitration vs trial ([http://www.nolo.com/legal-encyclopedia/arbitration- pros-cons...](http://www.nolo.com/legal-encyclopedia/arbitration-pros- cons-29807.html)) provides a decent analysis. Frequently arbitration is less expensive for both sides because the process is simplified. You also avoid shenanigans like fighting for 6 months about jurisdiction and venue (which either side can do to seek a more favorable court).

The article states that arbitration is bad because consumers don't have legal representation. This is flat out wrong. Consumers can and _should_ have legal representation in an arbitration. Just like in a trial, consumers need to pay for this legal representation themselves, and it would be foolish not to have it.

The article also says that arbitration is bad because companies have more legal resources than consumers. This is a fallacious argument. Companies will _also_ have more legal resources in a trial. If anything, the simplified process of arbitration makes this less of an advantage. So arbitration may be slightly better for consumers in that respect.

<comment><USER3> > Class action suits are a powerful pro-consumer force. They allow consumers > to seek redress without cost - as the legal costs are paid for by the > plaintiffs attorneys.

Keep in mind that Slack is a B2B service, though; its clients are companies, not individuals. Would a class-action suit really make sense here, given that most of the "consumers" involved should already have access to legal representation?

<comment><USER4> > Would a class-action suit really make sense here

Definitely. Their low-end plans are relatively cheap. That means that even if you have legal representation, it often wouldn't be worth suing them. But a class action spreads the legal cost across many plaintiffs.

Simple example. Suppose BadCo has 10,000 customers who each pay $1000 per year, for annual revenues of $10m. If they can cheat each customer out of an additional $100 (say by overbilling), then they'll make $1m, which is enough money to be tempting. But very few people will go to the time and trouble of a lawsuit just to get $100 back. But a class action lawyer might happily take the suit thinking they could make 25% of that million.

</comment></comment></comment><comment><USER5> What's the problem? Send these guys a private offer to arbitrate, according to your terms. Put your concerns on an affidavit concluded with your offer, and give them an opportunity to respond within 10-15 days. If they go silent (they will), send a notice of default next, and then file your lawsuit in civil court. You will have satisfied the private arbitration clause (arbitration went nowhere), and with your options exhausted, you now must file in court.

Source: I'm an _ex aequo et bono_ arbitrator.

<comment><USER6> I may be a bit dense, but your comment doesn't seem to relate to the article I just read. Is this the wrong thread or am I missing something?

EDIT: I have to be missing something. Half the comments here talk about arbitration, but that word doesn't appear once in the blog post. Was it edited?

<comment><USER7> You're not missing anything. Two posts were merged. This is the Privacy policy blog post by Slack. There was another blog post (third-party) that talked about changes in their TOS to include arbitration.

[https://konklone.com/post/slack-is-now-forcing-users-into- ar...](https://konklone.com/post/slack-is-now-forcing-users-into-arbitration- and-that-is-terrible)

</comment></comment></comment><comment><USER8> Lawsuits are incredibly painful. The emotional and time tax to be in one, regardless of what side you are on, is immense.

I hear what this guy is saying. However, having been in three lawsuits, one of which I initiated, I would do the same thing as Slack. I would generally try to do anything reasonable I could to avoid a lawsuit.

Arbitration or mediation (very different things) is almost always required anyways, by the courts, if you file a lawsuit. They make you try. At least they try to force a mediator.

If you force arbitration, it's the same thing as forcing a lawsuit and would result in my immediate desire to resolve your issue without continued legal maneuvers.

Anecdotally, and as I think most litigation attorneys would tell you -- People settle lawsuits because they are either out of time, or money. They almost never settle because they think they've lost the case. The merits of the case rarely matter once you are knee-deep in the litigation, but the toll a lawsuit takes does factor into a settlement decision quite often.

</comment><comment><USER9> Compared to Hipchat, Slack has handled this compliance issue much better. I am personally uncomfortable with the idea of managers seeing employees communications, and Hipchat didn't put any consideration into this when they released that feature. Slack on the other hand seems quite aware of this issue and done things which make me much more comfortable, at least short-term. It goes to show what careful and empathetic product thinking can do to enhance your customer's experience.

<comment><USER10> It is absolutely ridiculous to be uncomfortable with managers seeing employee communications. First off, any time you log in to a machine at most corporations you're told that ALL network activities are monitored. It's not a joke. They are monitored. Every packet you send out and every packet you receive CAN BE RETRIEVED. This isn't new. I'm 30 and have seen this since I was in high school. I'm sure older folk have seen it for even longer.

Next off, you are owed NO privacy on services that your company is paying for for interoffice communication. You never have been. The fact that people bitched and moaned over Hipchat allowing history to be viewed is just ignorant and stupid.

You know why managers have the ability to view these things? Harassment. Sexual, physical, altercations, etc. If your company has more than 5 people these things WILL come up and the INABILITY to retrieve this data is BAD.

We have ALWAYS been able to retrieve this data via XMPP (Openfire), MSOffice Communicator/Lync, etc.

This is NOT some mind blowing new development.

<comment><USER11> This kind of monitoring may be normal in BigCorps but it's definitely not part of startup culture.

I'm also irritated by the mindset that considers this kind of institutionalized snooping a good thing ("INABILITY to retrieve this data is BAD").

<comment><USER10> I've been a network administrator and had control of everything.

That did NOT mean that I was actively viewing everything and sitting in a tower somewhere cackling at all of the deep dirty news I had. I had to pull data a handful of times during lawsuits or sexual harassment complaints.

You should not be delving into deep personal/sexual conversations on any work tool without having in the back of your mind that it may come up at some point, whether you're at a startup or not. I'm on my 3rd startup and while I know nobody has been monitoring (because I pay for the tools) I still keep the tools somewhat professional. To the point that I couldn't care less if someone looked into my conversations. If we're going to bitch about that, then the fact that my data is on some unknown server at Hipchat is FAR more worrisome to me than my COO looking at my conversations.

You SHOULD trust your employees and if you don't trust one replace them. You should also TRUST your management to not spy on you. But you should also assume that they have the ability, if not, you're daft.

</comment></comment></comment></comment><comment><USER12> Yet another company that is opting out of complying with any legal system by forcing an arbitration clause on its customers. I switched from Hipchat when it changed its TOS to include mandatory arbitration and now it looks like I'll have to ditch Slack, too.

Pity. It's a good service.

(kind of hilariously, the arbitration provisions are not well drafted and are almost certainly unenforceable.)

<comment><USER13> Companies often choose arbitration when doing agreements between themselves, even large companies. The reason for this is, if, say, Nike and Apple did a deal and it went sour enough to have a lawsuit, they can resolve it much more quickly and cheaply than if they had to go to court.

The US court system is very slow, and requires significant resources in terms of lawyers that are not required with arbitration.

This should also be to the benefit of individuals as well, as the bar for suing a company as a consumer is much higher than picking a mutually agreed arbiter and getting the case heard.

IF the clause is fair (e.g.: mutually agreed arbiter certified by a national arbiter certification organization) then I tend to see these clauses as consumer friendly.

<comment><USER14> Without the clause, arbitration is still available if it is agreed by both parties.

In practice the arbiters that do not side with the companies are not chosen again in the future.

<comment><USER15> Bias, what about bias? I've always wondered if my software license should contain a thrid-party arbitration, and I've always chosen not to, because I have no control on the arbitration's neutrality.

They could charge customers a fee for settling "in favor of", or settle based on their membership time or random dice, and it would still be enforceable in court.

Note that my business is located in France so a US arbitrator could have a national preference for arbitraging in favor of a US citizen, and there would be nothing illegal in that.

</comment></comment></comment></comment><comment><USER16> They're holding our chats hostage, we can't even look at our chat history without accepting the terms. And to think that we chose Slack over HipChat solely for their better ToS. This makes no sense at all, why would you force something like this onto your customers so aggressively? They're killing all of their good will with us in one fell swoop.

<comment><USER17> I don't see binding arbitration as a bad thing as long as both parties are allowed to agree on an arbiter (I may have missed something, but I imagine that's always the case, and also the case here(?). ...Hell, maybe you could end up on Judge Judy).

I hate to say it, but HipChat is really flawed (IRC, please). Slack is far superior technically. I'd still pick Slack. People may be blowing this out of proportion.

<comment><USER18> If both sides can agree on an arbitrator, you don't need to have anything be binding, they can just agree to arbitration.

Binding arbitration clauses that just say both sides have to agree on an arbitrator aren't really a thing. That would be an 'agreement to agree' which in some jurisdictions is even void, because it's impossible to sue anyone over a breach of it. (Whose breach is it when two parties couldn't agree an arbitrator? Well, both, and neither).

So binding arbitration clauses either specify an arbitrator in the contract or allow one of the parties (guess which) to choose at runtime. The slack one is the former, it specifies one called 'JAMS ADR'.

</comment></comment></comment><comment><USER19> It's a business tool, paid for by the employer. You shouldn't expect anything you do on there to remain private, just like you should expect your company mailbox to be private.

<comment><AUTHOR> To be fair, the features in question are called "private groups" and "direct messages." There's bound to be some expectation that they are private and/or one-to-one.

<comment><USER20> Would you expect emails via company mail servers from yourself to a coworker to be private? How about chats using some intranet based tool like MS Lync?

Private and direct messages within a company should be thought of as not involving your coworkers, but IT and legal a might be monitoring.

<comment><AUTHOR> You, apetresc, and I are all unusual users - we're thinking about this in terms of network connections. Our first instinct is to figure out which parties in the chain could have stored a copy of the message. The typical user will probably just rely on clues like "private" or "direct" and make assumptions from there.

The privacy level of these features can and will be misinterpreted. Read a few legal cases where employee communications are exhibited; you'd be surprised what people say on internal platforms.

<comment><USER21> Any employee is a fool for thinking making permanent records of things using company resources will remain private.

You're on holiday or otherwise unavailable and someone needs some details for some obscure project you're working on? Crack open their email!

Those accounts and everything else belong to your employer and if it suits their purposes to go poking around your email or IMs, then they will.

</comment></comment></comment></comment></comment><comment><USER22> I personally would feel very uncomfortable reading any employee messages... BUT here's why I think it's OK in principle to have the ability to snoop enterprise IM: we require everyone to use this chat system. It's part of your job to be on it and work is conducted over it, so we have some plausible responsibility in making sure it's being used properly and that people are doing what they're supposed to be doing.

I'm solidly against reading employee's personal email or gchat or IRC messages even though I think legally we probably could.

<comment><USER23> In the US, document discovery for litigation typically falls on the defendant. So a company that's being sued is required under the law to produce relevant business records and communications. If it's hard to access such "documents" en masse and export them for legal review, then businesses which must deal with nontrivial litigation requirements (the threshold is often right around the $1B/annual revenue mark) will not use the system.

In the EU, things are a bit different and employees have a limited right to privacy when using corporate systems. Not so much in the US, though.

</comment></comment><comment><USER24> Fun fact: according to law in the Netherlands, companies can not restrict their terms to law of another country of the customer is Dutch[1], and binding arbitration clauses involving 'normal' customers are void[2].

No clue how easy it is to sue a company on the other side of the world, though.

All sources are in Dutch, unfortunately.

        [1] http://wetten.overheid.nl/BWBR0005289/Boek6/Titel5/Afdeling3/Artikel247/geldigheidsdatum_22-09-2014 (part 4)
        [2] http://wetten.overheid.nl/BWBR0005289/Boek6/Titel5/Afdeling3/Artikel236/geldigheidsdatum_22-09-2014 (part n)
        [*] IANAL-but-this-guy-is: http://www.iusmentis.com/contracten/algemenevoorwaarden/#zwartelijst

</comment><comment><USER25> It's hard to justify _not_ putting a mandatory arbitration clause into a contract, even if it is unethical. It's an incredible boon for companies and most users don't appreciate what they're losing.

<comment><USER26> I'm always worried when I see sentences with the structure "It's hard to justify [doing/not doing] X even if it's [unethical/illegal]". What type of justification do you need?

<comment><USER25> Why are you worried? From the suits' perspective:

1\. Arbitration is going to potentially save hundreds of thousands of dollars down the line if there's a legal issue.

2\. Arbitration incredibly favors the company over the customer.

3\. Most customers don't understand the value of their right to civil action.

So while an arbitration clause is, in my mind, equivalent to telling your customers you don't actually care about being reliable, many companies are putting them into place just because they can.

<comment><USER12> #1 is false. Ask Google or Apple or JPMorgan Chase -- who get sued frequently, yet don't bother with arb clauses

#2 is true in most instances, but in order to find out you have to actually go through the entire arbitration and pay your lawyers' bills

#3 is very true, but that only adds to the idea that it's unethical.

Companies put them in because the corporate defense bar thinks this is the new hotness -- and few of those folks have ever actually litigated any of these clauses.

</comment></comment></comment></comment><comment><USER27> Why not just make two policies: one for bigcorps where there is a big (but friendly) "your boss can read your messages and we'll tell you when it happens" at first sign up, and one for normal, sane, organizations where the old TOS simply remains?

<comment><USER26> Thats basically what they described isn't it? This compliance export feature is the only thing that allows reading private messages, and it is disabled by default and requires significant hoop-jumping to enable. So for most companies the original privacy policy will apply effectively.

</comment></comment><comment><USER28> Nothing's indispensible, particularly on the Internet. So why complain? Just go and find another environment. If you can't, build one.

I used to complain about Delicious and after a while I stopped complaining and decided to use another service. As simple as that.

<comment><USER29> _> why complain_

Because it offers a non-zero chance of the best outcome: a low cost, high benefit outcome where the world changes to fall in line with your expectations. If you do not say anything then the world has little chance of changing. It is a rational result of cost benefit analysis. (Consider that moving to another service is costly, and building a new one more costly still.)

Additionally, I would point out that complaining about things that we don't like is a universal human trait, which you yourself demonstrate. :)

<comment><USER28> Hey dude I'm on your side on this issue, I wholeheartedly see everything you say. By saying "why complain" my target was those dictatorship-practising web instances and the thing is to remind them that nothing's irreplecable, particularly on the Internet.

</comment></comment></comment><comment><USER30> I think those that think this is a terrible move on Slack's part should find another chat solution. There are others.

On the other hand, I support Slack's option to do this. I don't think people here appreciate the financial load that class action suits place on consumer service companies.

Yes, class action lawsuits are a useful tool to extract concessions from companies, but they are also abused by litigators who are out to make a buck. Because often the cost of defending a lawsuit is such that early settlement is the best option even when the legal claims of the plaintiff are weak.

</comment><comment><USER31> Meh. American government/supreme court are the ones who removed your rights.

Slack is a corporation and should try to (within the law) remove as many of your rights as possible to protect investors and shareholders. If you don't like it, you know what to do.

Re: Slack. It looks very nice but it's not very difficult to copy it's product as yet, it's USP as with most of these things is timing. I would suggest there must be a few competitors that you can replace it with already?

<comment><USER32> And their customers should do anything in their power to protect the interests of their own shareholders. That includes publicly complaining in hopes that the negative publicity will force Slack to change their terms.

Even if you accept that corporations must disregard ethics and legality and act solely to maximize the interests of their shareholders, that doesn't that you can't complain about their actions.

</comment></comment><comment><USER33> I think that is a reasonable approach. The question my days working on NASD (FINRA) compliance have trained me to ask is how Slack controls employee and vendor write access to the audit log. I now work in a nearly regulation-free environment and we are happy users of Slack, so I'm just asking out of curiosity.

</comment><comment><USER34> Sounds fine to me, but this has me curious:

 _" In addition, Compliance Exports may include the edit history for messages that team members have edited as well as messages that team members have marked for deletion."_

That makes me curious whether "deleting" a message actually deletes the data, in any circumstances.

<comment><USER35> If they're complying with e.g. FINRA, then they can't delete messages; they're required to provide a high-fidelity export.

<comment><USER34> Oh, sorry.. I understand that. My real question was for those of us on standard plans is hard-deletion a thing, and has it ever been in the past.

In fact, even for folks on plans this covers it's not clear how much of this is "backwards compatible" with regard to data and conversations in Slack prior to these terms.

[Edit: actually I see now "Compliance Exports are not retroactive and do not apply to past private conversations before the feature is enabled" so strike the second paragraph.]

</comment></comment></comment><comment><USER36> Is there a way for a user to know if their conversations are being logged for compliance?

<comment><USER37> The feature is opt-in, requires a somewhat formal process to turn on, and all users will be notified "via Slack that the feature is active and that their private messages are subject to export". They don't make it clear if it'll be made sufficiently obvious to a _new_ user who joins _after_ it's turned on, but I'd guess so.

Also quite nice that "Compliance Exports are not retroactive and do not apply to past private conversations before the feature is enabled"

</comment></comment><comment><USER38> Looks like this is the standard reaction to something that is akin to parasite infection in biology - abusive scammers that exploit US legal system to rob companies and individuals with money. There's a theory that a lot of features of modern organisms (including sexual reproduction) has evolved as a defense mechanism to parasites. Looks like we're witnessing such evolution right now. I wonder maybe the solution should be sought elsewhere - not trying to shame Slack (or others) into doing something that makes no sense in current environment and suffer from parasites, but try to fix the parasite problem instead or at least make it less severe.

</comment><comment><USER39> What I don't understand is why not have this be "opt-in". Meaning if your company does not need this feature for real legal reasons they don't enable it and everyone is happy. I've heard a few people saying they did _not_ want this feature in Hipchat and would have to switch to make sure there team was not suspicious. If my company never needs to access private chats for legal reasons, there is no reason it should be enabled today and they can have access to it in 3 years.

I understand specific companies have specific needs and Slack has to meet some of these but there is no reason that this should impact everyone else.

<comment><USER40> Did you read the article? It explains a very thorough opt-in process which involves mailing a signed letter on company letterhead and manual reviewal.

<comment><USER39> Sorry if I wasn't clear enough. What I mean is that if in 3 years my company needs to have access to some logs, they will have to go through the multi- steps process but then have access to whatever they need (starting from today's logs)

What I meant was that the possibility to access private chats should stay not retroactive and only happen once the company has explicitly stated it will need this feature enabled.

EDIT: so that if my company has no legal needs _today_ it won't have access to private chats made today once they decide in the future that they _now_ need the feature

<comment><USER41> That is how it works. "It's worth repeating – Compliance Exports are not retroactive and do not apply to past private conversations before the feature is enabled."

<comment><USER39> I did not understand the sentence that way even after reading multiple times but that seems to make sense now. I must have been too biased when reading it before. Thank you for pointing this out.

</comment></comment></comment></comment></comment><comment><USER42> If you're on the free version should you still worry? Is there any way chats older than the cap on backlog can be restored?

</comment><comment><USER43> If you don't want cheap startup hosting TOS, don't use cheap startup hosting.

</comment><comment><USER44> How can you force anyone to sign away their rights like this? I'm confused. If you want to file a class-action lawsuit, go ahead. No contract can prevent you from doing that.

<comment><USER32> In a sane legal system, that would be true. Unfortunately, the US Supreme Court has upheld mandatory arbitration clauses, so companies are now allowed to effectively exempt themselves from the law.

<comment><USER45> Is there oversight on arbitration? What stops the private arbitration system from just saying "Slack's always right"? Or must you come to an acceptable agreement in arbitration else go to court?

</comment></comment></comment><comment><USER46> That's capitalism for you.

</comment><comment><USER47> Eric Mill's excellent post about Slack's new arbitration clause was just merged into this thread by the moderators. Here is the URL:

[https://konklone.com/post/slack-is-now-forcing-users-into- ar...](https://konklone.com/post/slack-is-now-forcing-users-into-arbitration- and-that-is-terrible)

The post is titled "Slack is now forcing users into arbitration and that is terrible." I highly recommend reading it, as there's no mention of the arbitration ToS change in Slack's own blog post.

Edit: Also worth reading the ongoing conversation between Stewart Butterfield (Slack CEO) and Konklone on Twitter: [https://twitter.com/stewart/status/536975596920635393](https://twitter.com/stewart/status/536975596920635393)

<comment><USER48> Wow, I can't believe these were merged... one is talking about flaws in an arbitration clause and the other is a press release from the company... and they choose the fluff press release.

It makes these comments not make sense, and buries the real issue.

<comment><USER47> I agree, but the appropriate route is to email email@example.com with this sort of feedback.

<comment><USER49> Contacting the team is great & should happen, but declining to post feedback _on_ an affected thread would be unfortunate for everyone involved.

Context is key in any discussion. Let the voting system sort it out :)</comment></comment></comment></comment>


Ask HN: Are password managers secure? - <AUTHOR>

OK so I've come to like a certain password manager.
I'm sure the data itself is secure in its raw encrypted form.
But, if I were an evil hacker, I'd be aiming to target the User Interface somehow. Since once I enter my password, the app is unlocked and my passwords are all there to find through the GUI. I'd aim to siphon out data through the OS and windowing system somehow, after the user has unlocked.
How much of a threat is this, do you think?
Also having a Chrome plugin just feels like an extra hackable interface? <comment><USER2> If your system is hacked, _using_ any password manager is insecure. Some password managers also have poor encryption, so even read-only access to your password database can be bad.

KeePass (KeePassX in Linux) is one of the best, but a simple keylogger can get your "master password" when you enter it, and thus access to your password database.

Nothing is absolutely secure, there are just degrees of relative safety.

<comment><AUTHOR> So I guess in that case, given even large software companies release products with dangerous exploits in them, password managers are a bad idea... why give a hacker a single point to access every one of your passwords?

</comment></comment><comment><USER3> The idea of phising out your data through the UI would be extremely difficult. There would be three methods you could attempt to gain access through a UI. The first and simplest to try is to check in memory, it's possible the application stores some data in memory after loading it from your database. This is a minimal risk with certain types of applications, Java based or Web applications are protected through security layers which make any information that is in memory useless. The second method is to use an injection, this primarily only works on Windows, and it would be a virus that would try to get a hook into your password manager to try and gain access programmatically to variables and memory. This is a threat to desktop applications, but again, a minimal risk to Java or Web based applications protected by the JVM or the browser's locking of the JavaScript. The third is the most useless for a hacker to attempt, since it is fickle and unlikely to work, it'd be for them to automate mouse clicks and keyboard actions to either the OS or the application in an effort to copy your data. This would be fickle since the UI can change, it has to be very precise actions, probably hard coded X,Y cords and therefore very likely to break - and if you are using the computer at the time it tries this, you will notice things going on.

Chrome plugins are not easy to gain access to. Chrome is a very secure browser, and they lock their V8 JavaScript engine so no two plugins can talk to each other unless they setup special hooks. They also run the entire application in a locked state, which both prevents plugins from accessing the operating system and from other applications from easily accessing Chrome without a special plugin.

Web-based password managers offer many benefits over desktop-based password managers. The risks for desktop based are there are many things they have to fight against and also maintain your database in a state that is secure against extreme bruteforce hacking attempts.

Web based are protected by their application and the browser, at the same time 3rd party plugins can pose risk, but developers of these can easily protect against interference of plugins and users can do so easily as well by disabling plugins on that site.

To both keyloggers are minimal risk, most password managers you use not to record your password but to create new account entries, and you are likely to generate a unique password for each site, therefore keylogger would be useless. Clipboard monitor may pose a risk, but applications like KeePass avoid this by using their Auto Login feature, and web/Chrome extensions avoid this by auto-filling or auto-logging in your login details.

The risk of a key logger getting your master password is also minimal risk for most applications. Most tend to offer "access codes" or "pin numbers" in addition to your password, allowing you to enter a small additional password or your original password via an on screen keyboard, which negates risk of keyloggers.

The idea that a password manager is a "single point of failure" is also wrong. The primary point of failure will be the end user releasing their login to their password manager, not the password manager being hacked. Because all passwords managers worth using encrypt your data, bruteforcing would take years per user. If any online manager were hacked, your data would be one of thousands and would likely never be decrypted to begin with. If it's a desktop application, those tend to encrypt with even stronger types of encryptions because they can waste the CPU on it; which means even more years to bruteforce if your database is given out.

The risk is in the end user, if he/she leaks her password or gets a virus/keylogger to get his/her master password. In which case this is just the same as using the same password across all sites.

I have heard of people using a single password and adding the website's domain they are registering under with an SHA1. Therefore if my password is "password" and I registering a facebook account, I'd go to an SHA1 site, enter "facebook.compassword" and get "ca2e97dbded3dc7af83446a225471fc6a721a1f9" as my password.

Modernly bruteforcing works quite quickly, so longers passwords are higher security than having a short-special character. Most sites require a min length of a password, usually 5 or 6 characters, therefore a password of "f1v3r" would be easy to brute force if I know the min length, I could get to that in a matter of minutes, whereas a long password like "thisisalamepasswordbutitslongsohahahaha" would take forever to try and bruteforce, and no dictionary hack method would work against that.

People who use password managers still make the mistake in using an insecure password with it, allowing people to simply bruteforce into their account, which is just as bad as using a weak password on websites directly, making the use of a password manager pointless.

Personally, and I have bias to this, I recommend Cyphrd.com - it's an online password manager that is well above any other online password manager for security, they are well protected and the weakest point is the end user, which they do all they can to help you protect yourself. Additionally they do more than just passwords, it's also a secure note taking service, stores credit cards, files/documents, contact and profile information for people, anything - since they encrypt all the data client-side and are open source with their encryption and are also constantly checked for security holes and patched before any are made into production, it's a great service.</comment>


The top 1% of the US makes $480k or more in adjusted gross income - <AUTHOR> https://www.bloomberg.com/news/articles/2018-02-22/to-get-into-the-1-you-need-adjusted-gross-income-of-480-930 <comment><USER2> Consider four different people:

1\. a lawyer who works 100 hours/week flirting with a heart attack and earns $480,930

2\. a small business owner who sells their plumbing co after 4 decades and earns $480,930 from the sale, but never broke six figures before

3\. a retiree who sits on the couch 24/7 and earns $480,930 in passive dividends

4\. a professional of some kind who works 20 hours/week in a low stress job and earns $480,930

The press likes to talk about these data points, and it's valuable information, but ultimately income tells a very small piece of the story. Source of income, job security, cost of living, and quality of life all matter a lot too.

<comment><USER3> Pray tell, what kind of low stress job lets you earn $500k/year with 20 hours/week? (Actual job, please, not "4-hour workweek" style passive investment income.)

<comment><USER4> Investing $5m of your own capital.

<comment><USER3> A) That's passive income, and B) I'd like to know where you're getting those steady 10% rates of return.

<comment><USER5> > I'd like to know where you're getting those steady 10% rates of return.

Index funds?

</comment></comment></comment></comment></comment><comment><USER6> Some of it is just screwy. Like...

The average tax rate for the top 2% is higher than for the top 3%. That is as it should be, if you believe in progressive taxation.

It's higher again for the top 1%, and higher again for the top 0.1%.

But then it's _lower_ for the top 0.01%, and _lower again_ for the top 0.001%.

In fact, the average tax rate is lower for the top 0.001% than it is for the top 3%.

In 2015.

<comment><USER7> I'm assuming it's dependent on source of income. Salary is taxed differently than long term capital gains which I assume those huge incomes are.

<comment><USER6> Yeah, I'm sure that explains it, but it doesn't justify it.

<comment><USER7> Do you see no value in tax incentives for investment?

Also, keep in mind those very top people are likely not at the top that long. As someone else pointed out, those could be people that sold their company.

<comment><USER8> Unless you are a buying stock at a public offering, most "stock investing" is not investing into a company. The company doesn't benefit from the money you are "investing". If you bought $1 million shares of Google. Google doesn't get that money or use it for its operations.

<comment><USER9> that is simply not true. the more you buy stocks in a company, the more its market cap goes up. with higher market cap, it is easier to invest in new businesses, acquire other companies, hire better people through stock incentives, etc...

<comment><USER8> Market cap doesn't go up based on people buying shares. You are just trading ownership.

In theory, the market cap of the company is the current value of all future returns.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> This title, while informative, is unfortunately not super related to the article itself, which is about municipal bonds, who buys them and asking the question, why are people buying fewer muni bonds than before?

<comment><USER11> Given the number of muni debt isn't going down - someone must be owning it. I personally sold my munis after realizing I'm paying AMT on most of the bonds anyway so wasn't tax free for me.

<comment><USER12> What did you buy instead, if I may ask?

<comment><USER11> At the time stocks, now I'm selling those too and paying down the mortgage. There arent many bargains out there.

</comment></comment></comment></comment><comment><USER7> Is this household or individual? I only see "tax return" mentioned, so it could be a mix of both.

A common Silicon Valley working couple, 10+ years into their careers are likely to be in the 1% if you roll in things like bonuses and stock/option grants.

And at the same time you have people claiming to be middle class with incomes over $250K.

<comment><USER13> You don't feel a 250K annual salary is middle class? That is a king's ransom in most of the country.

<comment><USER14> I suspect they meant 250K is too high to be middle class.

</comment></comment></comment><comment><USER15> A good chart from 2012 to look at might be this

[https://archive.nytimes.com/www.nytimes.com/packages/html/ne...](https://archive.nytimes.com/www.nytimes.com/packages/html/newsgraphics/2012/0115-one- percent-occupations/index.html)

</comment><comment><USER16> On a side note, you are in top 5% if you make about 200k/year. I guess most of SE in CA are top 5% earners then.

</comment><comment><USER17> >The average AGI of the 1% in 2015 was $1,483,596 What is the point of this article? Seems like it just spews random descriptive statistics. I guess it gives you an idea of the shape of the wealth graph at the top extreme, but it's too narrow to really say anything.</comment>


Isolation Therapy - <AUTHOR> http://en.wikipedia.org/wiki/Isolation_tank

<comment><USER3> That does sound relaxing...

<comment><AUTHOR> It's pretty much the layman's (or scientist's) meditation chamber - <USER2> one should be pretty cheap nowadays, too...</comment></comment>