Lock Picking – A Basic Guide - <AUTHOR> https://www.hackthis.co.uk/articles/picking-locks-a-basic-guide <comment><USER3> I taught myself how to pick locks my final year of high school - in France, high school students have to take the "baccalauréat", a set of exams that cover everything you've studied in high school, in all subjects. It spans the course of 2 weeks or so, and you get 1 week to prepare before it.

I hadn't been doing so hot in high school (writing assembly for my TI-83's z80 was more fun than reading Shakespeare and doing derivatives), so my parents locked my laptop in the attic for me to focus on revising during that week.

Of course, I spent a few hours reading at the local library on lock picking, and managed to get my laptop from the attic on the first day (the lock was a fairly old model too, which helps). I spent the rest of the revision week writing C and hanging out in IRC :')

For the record, I did pretty well on the baccalauréat :)

<comment><USER4> Similar thing happened with my when I was ~14, except it was the family desktop -- laptops were way too expensive for us back then -- and they had a lock on a power switch that led up to the computer. Learned to pick locks and got extensively lectured about why I shouldn't do things just because I can. My parents eventually gave up on trying to lock my out of the PC(after trying BIOS passwords, OS-level passwords and combination locks).

Funnily enough, I learned C when I was supposed to be studying for the baccalauréat. I'd learned programming in BASIC for a casio calculator(mainly for making games and a few solvers for things that we were supposed to solve manually in exams but that were too tedious). A friend of mine linked me to [http://siteduzero.com/](http://siteduzero.com/) (apparently it's changed to [http://fr.openclassrooms.com/](http://fr.openclassrooms.com/) recently) and I ended up not studying. That really hurt me in History, Geography and Biology(which require a lot of memorization) but otherwise I breezed through everything else.

PS: I'm not in France but in a country where the french baccalauréat is considered equivalent to the state-mandated exams(Lebanon, used to be under French mandate).

<comment><USER5> I am going to make a new word, "learnacrastinator", "learnicrastor" (feel free to fix/expound). One who learns a subject or skill while procrastinating studying for another.

<comment><USER6> Maybe "procrastilearner"?

<comment><USER7> I like that better.

The word, not the fact you've just described my life.

</comment></comment></comment></comment></comment><comment><USER8> Pardon the self-promotion, but this hits a bit close to my area. If you'd like a much more comprehensive guide:

[http://www.youtube.com/playlist?list=PL66CD42F86F3A1F85&feat...](http://www.youtube.com/playlist?list=PL66CD42F86F3A1F85&feature=plcp)

I also cover disc detainers, and a bunch of other stuff. I'm shooting a new series on lock forensics presently, just got a great microscope that can take my DSLR for high def microscopy.

<comment><USER9> Self promotion is no issue when you have high quality content! I started picking locks recently for fun and your guide on YouTube is one of my favourite resources. It's also my go-to whenever trying to show someone in a minute or two the gist of lockpicking.

To find you on Hacker News is a pleasant surprise =] Keep up the good work!

<comment><USER8> Thanks for the kind words! Really appreciate it and always happy to bump into folks who know my work. My name on here comes from one of my 5 favorite locks, the Emhart interlocking pin system: [http://www.lockwiki.com/index.php/Corbin_Emhart](http://www.lockwiki.com/index.php/Corbin_Emhart)

It was invented by Leo Raskevicius, who sadly passed away years ago. In his original patent he actually made provisions for a magnetic version as well. Brilliant guy. Sadly the lock isn't made anymore.

</comment></comment></comment><comment><USER10> A much cheaper and easier approach that works for most locks is to get a coke bottle and tear a strip out of it, then use it to do the 'hollywood credit card trick'.

unlike a credit card it doesn't snap or break very easily - the type of plastic will become softer when placed under pressure and is very flexible but strong - if you continue to force it in the right area it will work its way around hard corners and into tiny gaps until there is enough pressure to pop the bolt. when the bolt has an edge that is sloped towards you it will pop on the first push (the way i see most 'yale style' locks fitted on doors that open inwards - i.e. most front doors)

it takes an exceptionally tightly fitted door frame to prohibit this (e.g. one with brushes or hermetic seals)

the one time i couldn't break into my own home doing this was because there was a brush fitted down the side of the door - fortunately there was not one fitted in the letter box, so i found a long spanner at a nearby construction site and then spent the next four hours of my life whacking the mechanism from through the letterbox blindly until i caught the handle the right way and the door popped open...

<comment><USER11> I did this a few times when I was a student. A variant on this is to wedge a kitchen knife between the door frame and the door jamb. Sure some paint gets damaged but it gets you in...

Another use for the coke-bottle strip is with padlocks - simply push inside and it opens using the method you describe on most of them.

In fact there are so many ways to get round a lock that going to all of the trouble of picking it is rather quaint. Here are some common things that happen:

Emergency services - they go straight for the 'Big Key' which is that battering ram we have all seen on TV.

Bicycle thieves - no interest in the lock. Bolt croppers cost less than a good lock and they are far quicker at getting the job done reliably.

Car thieves - break into the house and steal the keys.

Regular folk locked out of homes/cars - call the locksmith or simply break some glass.

If you need to gain entry surreptitiously (and not damage a lock) it can be far easier to use social engineering to temporarily obtain keys, e.g. from an employer, then get them cut in a matter of minutes at some place around the corner.

Alternatively an impression can be made in 'plasticine' or a photo taken. A friendly locksmith can sell you the blank, and, with some time with a needle file, a key made.

Although fun can be had picking locks, 'in the wild' it rarely happens because brute force or a bit of Coke can is usually far more effective.

<comment><USER12> In fact, key blanks and stampers can be purchased online.

</comment></comment></comment><comment><USER13> The MIT Guide to Lockpicking[1] is the classic resource for getting started. It's an exceptionally good tutorial because it teaches you how locks work so you have a solid mental model you can refer to.

[1] [http://www.capricorn.org/~akira/home/lockpick/](http://www.capricorn.org/~akira/home/lockpick/)

<comment><USER14> I came here to say this. My father provided me with a printed copy of this book and a few locks from the garage and I learnt a lot. A very rewarding experience for a young mind.

</comment></comment><comment><USER15> This is why my deadbolt uses an Abloy Protec2 cylinder (custom ordered from Bay Area Locks: [http://www.bayarealocks.com](http://www.bayarealocks.com)). It's drill resistant, and it's disk-based so it's bump and rake proof.

Abloy also claims it's pick proof. Whether that will remain true in the future I'm not sure, but I do know that at the very least it has yet to be successfully picked. If someone did figure out a way it would likely be extremely difficult to do in practice.

After watching some videos that showed just how easy it is to simply kick a door in, another thing I did was replace my strike plate with a heavier duty one, and replace the worthless 3/4" screws that "hold" most strike plates in with 4" screws that actually go into the 2x4's of the house frame.

<comment><USER10> > After watching some videos that showed just how easy it is to simply kick a > door in, another thing I did was replace my strike plate with a heavier duty > one, and replace the worthless 3/4" screws that "hold" most strike plates in > with 4" screws that actually go into the 2x4's of the house frame.

This is good advice. I did this on my own door frame after being broken into on the first day where the door had simply been kicked in. I can not kick the door in now - I tried. Although the quality of the door is important too - mine bends really quite far before breaking. :)

If you are really security conscious and you don't have them already - <USER2> suggest brushes at the door frame edge and the letterbox to prevent approaches other than picking.

<comment><USER15> If you have a door that's not very strong and you can't afford to replace it with one that is, they do make metal plates that wrap around the deadbolt and optionally the door handle, which apparently makes it much more difficult to break the door itself.

They look something like this: [http://hostedmedia.reimanpub.com/TFH/Step-By- Step/FH11JAU_DO...](http://hostedmedia.reimanpub.com/TFH/Step-By- Step/FH11JAU_DOOSEC_02.JPG)

</comment></comment></comment><comment><USER16> A good place to start is office furniture locks. They usually aren't very well made, and therefore easy to pick. The nearby office supplies can be used as your tools. You can use the large wire from one side of a binder clip as-is as your torque wrench, and a bent paper clip as your rake pick. First, straighten the clip, then bend the middle into a triangle shape. Bend the ends outward for better control over depth and angle.

Insert the binder clip wire, apply some torque, and scrub the pointy end of the triangle on your former paper clip against the pins. The lock will turn in seconds. You may need to adjust the shape of the triangle somewhat to achieve best results.

Popping open your first lock with entirely improvised materials is a powerful reminder that cheap locks are little deterrent to anyone but the most casual and unmotivated intruders, just like privacy locks in bathrooms.

<comment><USER10> actually i find that 'mechanically' opening these kinds of things is usually easier - I remember getting into one of those lockable little cashboxes (that every office seems to have) when I lost a key for it by prying the lid open and bending the case just enough to get one of my fingers far enough in to unhook the catch from the inside with it - pointless little boxes really.

<comment><USER17> They're not designed to be thief-proof. For that you need a bank vault or safe.

Those little boxes are designed to prevent me from swiping your $50 bill in your drawer when your back is turned or you step out of the room for 30 seconds.

</comment></comment></comment><comment><USER18> I have been locksporting by myself for some time, and I make my own picks from street sweeper blades.

If you're at all interested in picking, do yourself a favor and get this practice lock for ~$40 it is amazing:

[http://learnlockpicking.com/](http://learnlockpicking.com/)

Also, I highly recommend getting on the TOOOL email list for your area.

in the SF bay it is firstname.lastname@example.com - great group and good list, although I mostly lurk.

Here are some of my picks.... ignore the lame embellishments; I am not very artistic :)

[http://imgur.com/a/ug2wI#0](http://imgur.com/a/ug2wI#0)

<comment><USER8> I love your pinning tray! Absolutely gorgeous. Nice work rolling your own, few things in this world are as satisfying as opening a lock with tools you made yourself.

</comment></comment><comment><USER19> I was really into this back in high school but never got proficient in it. The concept is simple to understand but actually executing it takes a LOT of practice. Raking can open a lot of older locks pretty quickly, but that doesn't mean you're skilled.

Also, just owning the tools is illegal in some states.

<comment><USER20> _> Raking can open a lot of older locks pretty quickly, but that doesn't mean you're skilled._

I disagree. Raking has opened a lot (most I've tried) of locks in my experience. So, I'd say I'm pretty skilled at picking locks.

<comment><USER21> I've managed to open a lot of unlocked doors (most I've tried) but wouldn't consider myself "skilled" at it, since it's a pretty easy task. I think the definition of "skill" implies something that isn't easy, thus being able to do something isn't automatically proof of skill.

<comment><USER22> >>I've managed to open a lot of unlocked doors

Me too! My success rate is over 90% for unlocked doors. Locked ones are harder.

;)

<comment><USER21> Do you refer to yourself as skilled at opening unlocked doors? :)

<comment><USER18> [http://i.imgur.com/Kcerv5S.jpg](http://i.imgur.com/Kcerv5S.jpg)

</comment></comment></comment></comment></comment></comment><comment><USER23> One thing that I did when I was learning it, was to prepare a set of training locks.

I bought two locks, diassembled then and reassembled leaving aside a number of pins out.

So I had a lock with only one pin, one with two, one with 4 and one with all the 5 pins.

It helped a lot because you learn to feel when the pin stucks on the open position and also to learn about how much pressure you need to put on the tensor. Too much and it will prevent the pins to go down. Too little and the pins will not stuck on the outer frame.

Ahh, and ofcourse, see the lock diassembled over my desk, and reassemble it gave a lot more insight on how it works than to just watch some animations.

</comment><comment><USER24> Helpful animations on how locks work: [http://toool.us/deviant/](http://toool.us/deviant/)

Good presentation on types of locks and approaches to picking: [http://www.blackhat.com/presentations/bh- europe-08/Deviant_O...](http://www.blackhat.com/presentations/bh- europe-08/Deviant_Ollam/Presentation/bh-eu-08-deviant_ollam.pdf)

And a guy who knows a ton about picking: [http://deviating.net/lockpicking/slides.html](http://deviating.net/lockpicking/slides.html)

</comment><comment><USER25> Can anyone explain how the pins getting "set" works? I understand there is torque applied to the entire cylinder, but once you push a pin up, why does it stay there, is it just the torque? How can you push many pins up when the torque required for each pin to become set is presumably variable?

<comment><USER8> It catches on the shelf of the pin chamber. Every time you set a pin, the plug actually rotates ever so slightly, misaligning the upper and lower pin chambers of whatever pin you were working on. The driver pin can't return to the lower chamber, and now you are putting pressure on another pin. Find that one, lift up, plug rotates, it sits on the shelf, next pin binds, and so on and so forth.

<comment><USER25> So does this mean that you have to set pins sequentially? It seems like if the plug rotates slightly, it does it for the entire length of the lock, so doesn't this affect whether or not other pins are able to be set?

<comment><USER8> The reason we can pick locks is that there are many minute differences between the various internal objects. Pins may not be perfectly round, pin chambers may not be in alignment, etc. Small small differences, but when you apply a very light pressure to the pins, you'll actually bind the "weirdest" one first. You aren't binding every pin, just one at a time, when that one is set, you move on to the next weirdest.

The order the pins set in will be unique to the lock, not a universal sequence. In fact, the order will change depending on the direction you pick, and even two locks pinned exactly the same will likely set pins in a different order.

This is called the "tentative method" and it was pioneered in the late 1700s. This idea of tension & manipulation can be applied to nearly every mechanical locking system (there are a very small number of exceptions).

<comment><USER25> I see, I guess what I am thinking is that if you are applying pressure to one pin, you must be applying (at least some) pressure to all the other pins since you apply the pressure via torque from turning the cylinder which turns (presumably?) uniformly from front to back. I guess the entire cylinder can jostle slightly within its chamber, so that could affect where and how pressure from torque is applied.

<comment><USER8> Sorry to say, but what you are thinking is actually just wrong. Drop your mental model and adopt mine.

You apply very light pressure to the wrench, which turns the plug, which collides with the weirdest pin out. There are circumstances in which you may bind multiple pins. If the lock is made to absurdly high standards (and I mean lock manufacturer playing a prank on lockpickers level of high standards) or if you apply your tension too heavily.

Watch this video to see what I mean: [http://www.youtube.com/watch?v=gNKvPS1ac6E&list=SP66CD42F86F...](http://www.youtube.com/watch?v=gNKvPS1ac6E&list=SP66CD42F86F3A1F85&index=14)

The first several pins in the lock, as I am searching for the binding pin, are under no pressure whatsoever and can move freely between the upper and lower pin chambers.

Also - noticed you are at Quora, I actually write about lockpicking in film and television over there from time to time: [http://tvpicking.quora.com](http://tvpicking.quora.com)

<comment><USER25> Thanks, to be clear, I wasn't assuming I was right, but was making assumptions, thanks a lot for replying to my comments, you've been very helpful :)

<comment><USER8> No problem :) They are really beautiful, complex systems, and as amazing as it is to understand and then manipulate them, I passionately believe that the real genius is holding them all together in your head before they've ever existed in the first place.

Lock engineers have incredibly sharp minds.

<comment><USER25> The video you shared gave me a much better idea of what's happening I'm sure it's still not close to what really is going on, but thanks for that.

Unrelated, are there any locks which use full length pins that are hollow and encapsulate the spring? It seems like a big source of the misalignment that allows setting is from the pin itself being able to move off its axis where it attaches to the spring.

<comment><USER8> Great question! Yes, there are a few locks that have hollow pins that the springs rest in. Typically they do that for space constraints, though, rather than to improve alignment.

There's a great example whos name is escaping me at the moment...its a South American company. Anyway, they have a lock with two rows of pins, one normally aligned and the other coming in from the side. However, there isn't as much room horizontally (you'll notice most plugs are located toward the bottom of the housing, yet centered horizontally) so they use the encapsulating pins to make up for the lost space.

That's one of the most interesting challenges in lock engineering, actually. There are a handful of standard formats for locks around the world, and whatever you build needs to fit within those agreed-upon (and very compact) formats, or you won't enjoy wide adoption of your concept.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER26> Finland is nearly completely fitted with Abloy rotating disk locks for anything worth locking down, and this was a nerdly disappointment when I was a teenager and got interested in how to pick locks. There weren't meaningful, pickable locks to play with.

The older Abloy locks from 60's/70's can apparently be picked if you're really skillful but it takes a lot of time and effort, and this was never common knowledge.

I read about hackers who were picking locks in the USA, or just outside of Scandinavia, and how pin tumbler locks work, and realized that those would indeed be plausibly pickable but I never had access to them in practice. I think probably could've found some if I really, really wanted to but nobody was using them for anything serious so learning to pick something considered as toy locks wasn't very motivating.

</comment><comment><USER27> I'm trying to prototype something called The Hacker Pen and wanted to get some community feedback. It's basically a nice heavy pen, with lock picks on the inside. It will also include a USB key with a digital penetration testing suite on it.

What are your thoughts?

<comment><USER28> Nice idea. Depending on where you sell this from you may want to check the laws about providing such a tool and if you need to verify anything about the customer before allowing a sale. For example in some parts of the USA one has to show proof of either being a licensed locksmith or a member of some law enforcemnt group.

<comment><USER29> Here's a good starting reference on the legality of owning lockpicks from state to state:

[http://toool.us/laws.html](http://toool.us/laws.html)

It doesn't cover sale / purchase, just ownership by state.

<comment><USER5> Wow, two different colors of green. That person must hate the color blind with a passion.

</comment></comment></comment></comment><comment><USER30> It's fun and relaxing but most locks are too easy to pick. For me it's kind of similar to knitting as a relaxing exercise :D

I still remember a fun talk I heard about the safety of gun safes (or lack thereof). They cracked it and told the manufacturers how easy it was and got a reply along the lines of "well maybe it's easy for a specialist like you with good equipment but it's safe enough for normal folks". Next slide contained a video of a 6 year old kid (highly trained security specialist) cracking the thing with a straw (specialized security equipment).

</comment><comment><USER31> Growing up as the middle of 7 children - 5 of them girls - I taught myself how to open padlocks with their bobby pins. It started for the usual mischief, opening their secret young girl things, and then moved onto more rewarding achievements. My technique was to break the pin into two, using the wavy pin as the tension pick, and the straight pin to rotate the barrel. This hasn't failed me on any padlock I've come across, and with practice will take only a few seconds.

</comment><comment><USER32> As a field engineer, I often use the universal key (screwdriver) to open doors - sometimes you don't even need to pick the lock - just move the hasp out of the way.

<comment><USER33> I met a guy who used to check fire extinguishers for a living. Frequently in places that weren't staffed. Rather than wait, he said he'd sometimes just pick the lock (with prior permission), check the extinguisher and go on his way.

</comment></comment><comment><USER34> How I and the ocasional lock smith uses lock pick "practicaly":

1\. get any torque wrench (L-shapped metal that goes in the keyhole)

2\. get any triangular pick (any thin metal that goes in the hole, saw a triangular tip)

3\. insert the pick as far as it goes, apply some tension to the torque wrench, pull the pick out it pressing against the lock pins.

4\. repeat #3 until lock is open. you will usually ram the lock like there is no tomorrow, so some graphite or other kind of lubricant may help.

</comment><comment><USER35> Trained as a locksmith out of college, dad and sibling still trade mainly on "warrant runs" for the large energy providers when they need to get access to house to cut people off.

It's really cool seeing people take an interest in picking, but just wanted to point out that professional & hobbyist picking is completely different. A professional's first priority normally is to get into the property, damage generally not being a huge issue so the approach changes dramatically.

First you try all the doors, as you would be surprised by how many people just simply don't lock their doors whilst making a judgment what will be the easiest entrance. Then you target the door with the worst lock, normally a UPVC door with a euro cylinder and use an electric pick gun to give it a quick blast. This gets you in within 5 minutes 90% of the time. [1] If the pick gun doesn't work you snap the cylinder in the door and replace the lock for a total cost of about £5 [2]

The hardest part of the whole job is when you have to identify a mortice lock in order to bypass it and knowing if it's worth an attempt at a pick. (Simple 3 lever locks are worth a pick first before a drill) Once the lock has been identified though it's easy to drill, you get your template out [3], mark up the holes and drill out the stump

There are also other methods and the general gist of the story is you use the method which takes the least amount of time with doesn't leave an unreasonable amount of cost!

Some other methods/products to look at which are interesting and commonly used:

\- Mica, a specifically made plastic for slipping rim latches, most commonly referred to as "yale locks": [http://uklockpickers.co.uk/mica- shim.html](http://uklockpickers.co.uk/mica-shim.html)

\- Letterbox tool, very basic (its just posh string on a stick) but also very effective at knocking off deadbolts or opening a latch that won't slip: [http://www.walkerlocksmiths.co.uk/bypass-tools/letterbox- too...](http://www.walkerlocksmiths.co.uk/bypass-tools/letterbox- tools?product_id=161)

\- Try out keys for mortice locks with a low number of levers: [http://www.walkerlocksmiths.co.uk/mortice-picks-tools/try- ou...](http://www.walkerlocksmiths.co.uk/mortice-picks-tools/try-out- keys?product_id=121)

\- Plug spinner for when you pick the lock the wrong way: [http://www.youtube.com/watch?v=fUmCUj44BPg](http://www.youtube.com/watch?v=fUmCUj44BPg)

[1] [http://www.youtube.com/watch?feature=player_detailpage&v=mTt...](http://www.youtube.com/watch?feature=player_detailpage&v=mTtk9QtcoPc#t=190)

[2] [http://www.youtube.com/watch?v=FqhhXyROxQM](http://www.youtube.com/watch?v=FqhhXyROxQM)

[3] [http://www.eltonlockservices.co.uk/drill%20template%20new%20...](http://www.eltonlockservices.co.uk/drill%20template%20new%20front.jpg)

</comment><comment><USER36> I feel like Lock Picking is an obligatory subject for hackers. Defcon hosts these events, hackernews features these posts. I don't find it interesting to break into something mechanical

</comment><comment><USER37> I may or may not have learned at a boring job with filing cabinets and other locks...I promise if you hire me, I won't do that, though.

Anyway, this is a crazy hard skill to master, simply because of the feel required to actually push each pin in place, and the fact that you're doing it blindly and often without so much as audible feedback from the lock.

You definitely need to practice to get good, and there are all types of funky locks outside of your home country

</comment><comment><USER38> It looks like most lock picking videos focus on the easy locks. How hard would it be to pick a lock with side pins or however they are called? For example the Kaba locks use them and most houses e.g. in Switzerland do have one of them.

[http://www.kaba.sg/media/470570/v4/resized650x-1/mechanical-...](http://www.kaba.sg/media/470570/v4/resized650x-1/mechanical- locks-kaba-star-schluessel.jpg)

</comment><comment><USER39> The fatal flaw with physical keys is that the image IS the key. As 3d fabrication and photography become ubiquitous, it becomes more and more absurd to use these locks to protect anything. In essence, anyone who has seen a key gains the permanent irrevocable ability to bypass that lock, until the lock is replaced.

<comment><USER8> So - don't let anyone see your key.

</comment></comment><comment><USER40> A couple years ago I bought this book, read it in a few days, and was on my way. Highly recommended. Super fun.

[http://www.amazon.com/Practical-Lock-Picking-Physical- Penetr...](http://www.amazon.com/Practical-Lock-Picking-Physical-Penetration- ebook/dp/B008S8I77E)

</comment><comment><USER41> I don't know if this affects everyone as it does me, but light text on black background is really, really tiring for me to read. It leaves white and black horizontal stripes in my vision for many minutes. On sites like this I have to open my developer view and fix the CSS.

</comment><comment><USER42> cached page => [http://webcache.googleusercontent.com/search?q=cache:https:/...](http://webcache.googleusercontent.com/search?q=cache:https://www.hackthis.co.uk/articles/picking- locks-a-basic-guide)

</comment><comment><USER43> Wont always work thoughwith every lock. What does work is a drill. All cylinders must be made of soft non-corrosive metal like brass.Just send a big enuf drill down the cylinder and twist it with a screwdriver, quiker;)

</comment><comment><USER44> With the inexpensiveness of electronics today, why haven't we moved from a mechanical "password" (the height of the pins) to a simple electronic code programmed into the key?

<comment><USER38> My key to the office building has a chip inside. So i guess they are slowy coming.

</comment></comment><comment><USER45> The MIT guide to lock picking is rather good as well: www.lysator.liu.se/mit- guide/MITLockGuide.pdf

</comment><comment><USER46> Does anyone have a lock recommendation for making an apartment/house more secure?</comment>


Shutting Down Forum (GDPR) - <AUTHOR> https://discourse.drone.io/t/shutting-down-forum-gdpr/2297/13 <comment><USER2> I"m not really a fan of the GDPR. I don't think it really protects privacy. I think it just uses the power of the EU, a fairly big and strong organization, to intimidate the rest of the world to comply with laws that it really shouldn't have legal jurisdiction to enforce globally. I think this is a scary precedent to set that the biggest bully on the block can de facto enforce such standards because the rest of the world is terrified of the consequences of standing up to them.

Isn't this the sort of thing people accuse the US of? The rest of the world makes ugly jokes about "Be careful what you say about the US or they might come _liberate_ you too." The EU is now in the _protection_ racket. When the mob says you should give us a few bucks because it would be a shame if something happened to your business, people recognize that is not nice behavior. But the EU can do the same on the web and some people laud it is a good thing for individuals in the name of personal privacy.

If you want none of your personal info on the web, I have a suggestion: Don't participate in forums, social media, etc.

(Yes, I am guilty of having this opinion without having actually read it. I blogged previously about my opinion this would do bad things to forums. I am shocked to see negative fallout happening so very soon.)

<comment><USER3> The GDPR exists because everyone has been a dick because they know they can get away with it. By default the mentality is take take take. Now the business models built on that are being trashed. If someone keeps burgling your house they need to go to prison. Simple as. Time is up for this way of thinking.

It is not difficult to be compliant. Most people don't bother because they are drama queens or hiding what their business is really based on and the latter is usually not ethical by any manor and deserve to be shoved off a cliff.

People will have to do some real innovation instead of selling off data and working out how to attract people into a product that exists only to do that really.

<comment><USER4> Saying that people need to be shoved off a cliff is not elevating your position. In fact, these kind of statements are exactly what make me concerned about regulations and laws. One has already made your mind up about a group of people and now it's time to execute.

<comment><USER5> Such is the result of tech industry overreach. Had they adopted a more moderate stance, people would not be calling for them to be pushed off the proverbial cliff.

<comment><USER3> Yes the data gathering side of the tech industry is sounding like they're selling menthol cigarettes to sick people at this point.

</comment></comment></comment></comment></comment><comment><USER6> The owner says that he doesn't have time to review GDPR-related requests; that's fine. But I wonder if he would receive a US court order would he treat it the same way? What if he received a letter from NSA? A DMCA request? What if someone posted something illegal on the forum, would he ignore that as well?

It seems like he has no time only for legislation from EU.

<comment><USER7> Yes, this is really little different from shutting down a whole forum because you received a single DMCA request. If anything it's even more of an overreaction, because a DMCA request could be followed up by legal action, whereas a data subject can't sue. All they can do is report you to the regulator. The regulator is unlikely to do anything if it's a frivolous request. Even if it's legitimate, their first action them would be to send a warning.

<comment><USER8> DMCA is capped at what, $30k per violation? There are obvious ways to avoid it, and the law has settled down.

GDPR is capped at $20+ million, no one knows what a typical fine looks like, the law is much harder to read, and everyone is afraid to be made an example of.

<comment><USER7> Its predecessor regulation capped fines at around $750k. Guess how many were levied at or near the maximum? Zero. The only large fines were for serious, deliberate abuses, such as a group maintaining a secret blacklist of construction employees. This isn't like the massive fines from US regulators on foreign companies. The rules say that fines should be proportionate to the scale of the breach and the harm caused. The large fines are for serious, deliberate, repeat offenders. It's also to stop a company like Google deciding that they'd rather not comply, and treat a fine as a cost of business.

<comment><USER9> When a new law is enacted, it's not prudent analysis to assume anything about how it will be enforced based on the previous law, especially not when fines were increased 25x - GDPR is _not_ a minor clarification of a few bits and pieces, it's a whole new thing. The previous law was _specifically_ criticised for having no teeth, and the new law has _specifically_ been highlighted for it's new teeth. Of course it's possible that regulators will just sit on their hands, it's just not very likely.

The only reasonable assumption is that those new teeth will be tried out, and whoever they will be tried out on first will have a bad time. Do not assume that the first cases will be Google and Facebook, the regulators aren't stupid enough to try their luck first on the two organisations that has spend the most on being technically compliant, and has bottomless warchests to fight it.

<comment><USER7> That doesn't mean lawyer up or shut down at the first request. Of course you should be prepared, by doing sensible things like having an up to date privacy policy, and only keep the data that you need and that you have permission for. However when it comes to compliance, if you get a request, be sensible. The time to lawyer up is if you get a notice from the ICO, if you think it's unreasonable and/or you don't think you can comply with it. I've dealt with the ICO quite a bit, as I've appealed a few FOI requests, and they've always been very reasonable, if a little overworked and slow to respond.

</comment></comment></comment></comment></comment></comment><comment><USER10> Could/should probably ignore GPDR requests if your business operations are entirely US based, whether or not anyone from the EU uses your site. US national sovereignty doesn't disappear because the EU says jump. We are not bound by the laws of governments other than our own.

You can probably ignore them anyway if you aren't a big company. With millions of these troll letters going around (and probably getting ignored), odds of any corrective action against you seem very low.

In any case, the corrective demands of the EU give you time to comply after they declare that you've violated something? Could probably wait for that point even if you're in the EU.

<comment><USER11> If you make money from EU users and are US based you need to be GDPR compliant or they will target you through payment processors and ad networks.

If you don't make money from EU users and don't want to be GDPR compliant you should probably just shut them off if you ever want to operate in the EU in the future

<comment><USER12> So you admit that GDPR is really just a trade barrier.

<comment><USER13> GDPR - the core of it - is about privacy, it's an increment on prior laws in EU countries. It's also in part a response to the data hungry US tech companies, without question.

The 4% of worldwide revenue fine potential is exclusively targeted at the US tech giants. By my last count, the US has roughly 100 tech companies worth over $10 billion each (with trillions of dollars in worldwide revenue). Nobody taxes revenue, that's about the most moronic thing you can possibly do - unless you're doing it to try to harm / punish companies. Very few EU tech companies have meaningful worldwide revenue to tax.

<comment><USER14> Of course they're trying to harm companies when they fine them. That's implicit in the term "fine".

They target revenue because otherwise companies will just use Hollywood accounting to declare they make 0% profit, they just pay huge licensing fees to some cayman island company.

</comment></comment></comment></comment></comment><comment><USER15> I just sent a GDPR letter to a company in the UK, which is still part of the EU. I have one of their Android phones, and it came with a non-removable app. It appeared to just be a bookmark. One day that app woke up and sent me a notification asking me to visit a web site, which led to a SurveyMonkey form.

So I sent the company a letter asking what data they have on me. It's going to be interesting to see what happens.

<comment><USER16>
        It's going to be interesting to see what happens.

My bet: Nothing.

<comment><USER17> From the several requests I've made already, that seems unlikely.

<comment><USER16> Can you give an example, whom you sent a request and what you got in return?

</comment></comment></comment></comment><comment><USER18> From the prototype letter:

"I am a customer of yours."

Not until you pay me, you're not. Yes, Mr. Well Actually, I know that the law says otherwise, and that's exactly why the law is FUBAR.

<comment><USER19> Are you implying that free services like Facebook should be exempt from privacy laws like GDPR?

<comment><USER20> Well if you know that Facebook is bad, why did people even register in the first place? Or put their whole life onto it?

It's ok if the privacy law only gone against stuff like analytics or horrible facebook buttons that even collected stuffs from people who clearly weren't users. i.e. tracking especially tracking outside their "domain"

however GDPR goes against all and anything. I mean if I go to a supermarkt I can't just tell the supermarkt owner to shut down all his cameras until I leave the store, he would basically just kick me off his market (which actually is his right in the EU). However the EU somehow made a solution that actually even goes against their own market principles just to have extreme amount of Privacy in the internet (only in the internet, their own institutions can still collect data, i.e. in germany the ard has tons of data about everybody) and this is my problem with the GDPR, it's a law from people who actually just want to hurt the big us internet companies. The law also was made by a lot of people without any clear technical background (there were some, but they were a minority)

<comment><USER21> GDPR isn't limited to the Internet. It includes most automated processing.

[https://gdpr-info.eu/art-2-gdpr/](https://gdpr-info.eu/art-2-gdpr/)

> This Regulation applies to the processing of personal data wholly or partly > by automated means and to the processing other than by automated means of > personal data which form part of a filing system or are intended to form > part of a filing system.

</comment></comment></comment></comment><comment><USER22> Considering GDPR is actually a thing from 2016, and 25th May only marked the day from which on it would actively be enforced... that kind of comes late.

What I wonder: this is an Open Source project, so why not ask the community for help instead?

Being a long-time (very happy) Drone user, I would have happily helped to produce the necessary documents for the project if that had been asked before the final deadline.

Well, probably would even do that now.

</comment><comment><USER23> I don't know why all these websites are shutting down due to GDPR when all you have to do is hire a competent law firm with GDPR compliance expertise to review your software and help you determine if any parts need to change to become compliant and also help you address any GDPR requests.

</sarcasm>

<comment><USER2> _In its majestic equality, the law forbids rich and poor alike to sleep under bridges, beg in the streets and steal loaves of bread or violate the GDPR._

\-- Anatole France (I might have edited that quote slightly)

<comment><USER24> OMG this is perfect! I'm so stealing this quote. It applies to so much it's scary.

<comment><USER25> But in this context it really doesn't work well as an analogy.

Few rich people have any inclination to sleep rough, whereas many wealthy tech companies have been happily selling their users' data as the law allowed it.

<comment><USER23> The idea is large companies can afford the compliance costs.

<comment><USER2> The idea is large companies can steal many loaves of bread and get away with it on a technicality because they have the resources to comply with the letter of the law while pissing on its spirit.

Only little people would steal a crust of bread for their supper. The rich generally commit bigger crimes.

</comment></comment></comment></comment></comment></comment><comment><USER26> Well, if the owner of the forum is receiving request e.g. to delete accounts or to disclose what data is recorded about someone, why not just comply with the request? What's the big deal?

<comment><USER27> If I ran a forum for a number of years, and a person decided to close their account, that'd be fine. But if they then said that I need to remove _all of their posts_, that's really shitty.

It would destroy the usefulness of a forum.

<comment><USER28> How does GDPR affect people in other countries with no interest in doing business in Europe? If I host a forum in the US and you ask me to remove your posts and I tell you where to stick it, what legal consequences might I face?

Erm, asking for a friend.

<comment><USER29> As much as I dislike Donald Trump, I am willing to hold my nose here and suggest encouraging the Trump Administration to go full MAGA and direct Congress to pass laws explicitly stating that no foreign judgements or fines may be enforced on US citizens.

<comment><USER30> boom.

1000% increase in foreigners moving/ starting technology companies in the US.

seriously tho. great idea.

</comment></comment></comment></comment></comment><comment><USER31> How can it be hard for a forum to comply to GDPR? What kind of private information does it really need to save?

<comment><USER32> I'm a European that supports the GDPR but here's my take on the issue in the post.

I don't think it would be hard for the person in the post to comply, it would just be time consuming. Say for example that a user requests a data transcript. Well he will have to collect all the post etc from that user and send it somehow. Now this is probably just a simple SQL query but it takes a bit of time, time that many people don't have.

Another issue seems to be that he is afraid of repercussions and is conditioned in the US system where everyone seems to be suing everyone all the time.

<comment><USER33> On HN I can go to my user profile and see all comments/posts I've made. And I can delete them all.

I strongly suspect this sufficient. Maybe it would be ideal to offer a "delete account" and "download account" button.

But there is no reason you should be processing letters from people.

I'm not even sure you need to offer removal of public information. But allowing deletions of accounts is hardly controversial.

<comment><USER34> > _And I can delete them all._

How? I can only delete for a small amount of time after posting. I cannot delete any of my past comments. If there is an option to remove old(er) comments I would sure like to know about it, seems to be hidden pretty well.

</comment></comment></comment></comment><comment><USER35> I'm a little confused. _Who_ is sending compliance requests? If it's not the ico, there's rely no problem. If it is the ico, ask what needs to change. No lawyers required.

<comment><USER36> > No lawyers required.

Phrases like this just sound weird to me. If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer.

I wonder if this is a cultural difference between the US and EU? Might explain some of the different reactions people have had to the legislation.

<comment><USER37> >If there's a risk that someone could sue you over something, from a business perspective I have always been taught that you avoid it, period, until you get a lawyer.

Bad news: If you have a business, people can attempt to sue your business for whatever they want, and you might have to defend against it. There is nothing on the books that says lawsuits have to be reasonable before they can be filed, only that people who abuse the legal system get punished AFTER a court decides they're a moron.

<comment><USER38> Judges in the US routinely dismiss frivolous cases[1] with prejudice.

And in fact even filing a frivolous case can result in fines or jail time for contempt.

So no, you can't in practice sue someone for anything.

[1]: [https://en.m.wikipedia.org/wiki/Frivolous_litigation](https://en.m.wikipedia.org/wiki/Frivolous_litigation)

</comment></comment></comment></comment><comment><USER39> The GDPR seems to me to be just another example of nontechnical authorities trying to regulate what they don't understand.

Why don't more technical people become politicians, or at least form lobbying groups or think tanks?

<comment><USER21> The response to the GDPR seems to me to be a bunch of people who fundamentally misunderstand how law works, especially in Europe, and who have a pathological relationship to regulators because their own legal system is fucked beyond all recognition.

GDPR requires you to only gather the data you need; only keep it for as long as you need it; tell people what you're doing with it; and allow them to correct it if it's wrong. How is that too hard?

<comment><USER40> ... and document every instance of processing, as well as the legal basis for processing for each use of each piece of data, and how you decided that legal basis (and if you used "legitimate interest," you need to do a LIA -- the template I use is several pages _before_ you enter the information). Then you have to negotiate different DPA terms with a dozen clients whose privacy lawyers told them they each need a different term because we privacy professionals still have no idea what parts of this law mean. Oh, and then you have to handhold customers who think they know more about privacy law than you do because they read a 500-word rundown of the GDPR, because if you don't nicely convince them they're wrong, they'll make a complaint.

There's plenty more, but you get the idea. Anyone who says implementing this law is simple isn't implementing this law in a business of normal size and complication.

<comment><USER21> > and document every instance of processing, as well as the legal basis for > processing for each use of each piece of data, and how you decided that > legal basis

But only if that's proportionate.

[https://gdpr-info.eu/art-24-gdpr/](https://gdpr-info.eu/art-24-gdpr/)

> Taking into account the nature, scope, context and purposes of processing as > well as the risks of varying likelihood and severity for the rights and > freedoms of natural persons, the controller shall implement appropriate > technical and organisational measures to ensure and to be able to > demonstrate that processing is performed in accordance with this Regulation. > 2Those measures shall be reviewed and updated where necessary.

> Where proportionate in relation to processing activities, the measures > referred to in paragraph 1 shall include the implementation of appropriate > data protection policies by the controller.

<comment><USER40> The bar for that is very, very low given the guidance we've received from the supervisory authorities, so that doesn't really minimize my point. An incredibly small number of businesses would be able to argue that this doesn't apply to them.

</comment></comment></comment></comment></comment><comment><USER41> I have a contrarian opinion to much I am reading here. Until a few weeks ago, I hosted my own web site and used blogger to host my blog on a subdomain. With huge reluctance I disabled comments, and then when Google's patches for GDPR compliance didn't work for me, I converted my 2000+ blog posts from the last 20 years to Jekyll and now host as part of my web site.

While it is nice to have total control, now I need to be using my laptop to post new blog posts, and I miss having readers comment. I also feel badly that the interesting things that readers have posted are lost to the Internet.

Even with all that, as a US citizen, I approve of GDPR and I wish it were universal. As much as I miss user comments, I am fortunate to have many readers engage with me directly via email discussions.

<comment><USER21> Was your blog personal? Or was it commercial?

If it was personal the GDPR doesn't apply.

<comment><USER41> Well, what is a personal blog? My blog was mostly fun tech stuff, but it attracts dev business. So, I would say it is a commercially blog.

</comment></comment></comment><comment><USER42> Guy shuts down forum, goes through the nightmare letter dissecting each part as "good question" or "you should have this already" or "easy one". So what was his issue anyway?

<comment><USER19> He points out that he's dealing with several of these requests. Even if you're doing everything correctly in terms of privacy etc., responding to these requests can still be time consuming.

<comment><USER21> How is "read the privacy policy, then click this link to get all your data" time consuming?

</comment></comment></comment><comment><USER43> I've been sending all kinds of companies a request of my data. Everyone that keeps sending me mails without me knowing why, I just sent them a nice request to give me a copy of my data.

After that, I request them to delete it all :)

</comment><comment><USER44> He's still obliged to respond to that letter. Can't hide like this.

(guys, I'm being sarcastic)

<comment><USER45> Do you think if the complaint went to a government official in the EU they would throw down the hammer on a site that was up for all of a couple days in GDPR time?

I have my doubts.

I've got a handful of sites (ultimately for portfolio / coding practice type stuff) out there. Honestly it wouldn't take me too much to respond to someone's letter considering the simplicity of the site(s), not that anyone uses them.

I also really wouldn't expect any EU official to throw down the hammer on me. Personally I wouldn't panic, and I'd at least wait for the EU official to weigh in before panicking.

<comment><USER44> No, but it is more than enough to scare people. Doing a project that makes you zero or very small amounts of money does not justify any risk-taking, and certainly nobody wants to go into the trouble of sending emails to various DPA people in Europe if the need arises. This kind of treatment should be reserved for large companies or specific uses of private data. In addition, the approach of the law "guilty until proven innocent" is hugely off-putting.

</comment></comment></comment><comment><USER46> Goes to show that when an industry does not self-regulate, it gets over- regulated, which often disproportionately benefits incumbents, which incentivizes future lack of self regulation.

<comment><USER13> Not exactly. GDPR only applies to the EU. China isn't going to rewrite its laws to make the EU happy and mirror GDPR, neither is the US.

It's more accurate to say that when an industry doesn't self-regulate, the EU over-regulates and shoots themselves in the face. The US and China will race even further out ahead accordingly.

In the US I can easily unleash a large user data hungry AI at will, experimenting all day long with anything and everything I can come up with. I can screw with people's data in countless ways, without their permission. While this haven exists, I can rapidly learn and come up with technology and services that tech companies in the EU can't risk attempting and won't bother to contemplate.

To the point: you can still push every edge of the AI revolution in the US and China, to see what's there. That revolution is heavily built on user data. In the EU, you're in a straight-jacket at the very beginning of the revolution (one that is guaranteed to only get tighter), many years before we've even seriously begun experimenting with the fertile soil. They're fucked, the world will be dominated by AI that comes out of either the US or China, or both.

<comment><USER25> GDPR does not restrict EU companies' activities in less regulated markets. They are still just as free to abuse the privacy of users in USA as are their competitors overseas.

Your anxiety appears to be about American AI companies' competiveness in the face of even worse abuse of users' privacy in China than in USA.

In a race to the bottom do you really want to be the winner, no matter what?

<comment><USER47> [https://gdpr-info.eu/art-3-gdpr/](https://gdpr-info.eu/art-3-gdpr/)

> _This Regulation applies to the processing of personal data in the context > of the activities of an establishment of a controller or a processor in the > Union, regardless of whether the processing takes place in the Union or > not._

</comment></comment></comment></comment><comment><USER48> The GDPR does not apply if it is for personal use or for a hobby only. I don't know how the structure of this forum is set up, but this can be a good reason to run such forums on your personal name.

<comment><USER49> Where is the exception for hobby projects specified?

<comment><USER48> Article 2, section 2(c) exempts processing of personal data "by a natural person in the course of a purely personal or household activity".

[http://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELE...](http://eur- lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&from=EN)

</comment></comment></comment><comment><USER31> By the way, what I really love about GDPR is that now I finally can disallow a website to log and analyze my behaviour to provide any kind of "personalisation" they want and still use it. It's just so great they can't say "agree or go away" any more.

I thought it was going to be another stupid thing like a "cookie law" (which, I hope, is going to be canceled now as we''ve got the GDPR), the recent US FOSTA or a "store all my data in my country on a government-certified server with a police backdoor" law but fortunately it absolutely is not.

I really hope non-EU countries are going to clone this law, it seems to be the second (the first being the US net neutrality policy) law I love.

</comment><comment><USER50> The EU is already targetting Open Source in the new legislation. We should start making a stronger case for the internet while we still have it. The Pirate Party tends to be the best resource for the support, they organise petitions and have elected officials in the Parliament.

</comment><comment><USER51> The thing I have to wonder is who did this and more importantly, why?

If you're a startup competing against an open-source project, then this is potentially a great (not good) way to get a leg up. You get the benefit of access to the code until you don't need it anymore, then get the project shut down and reap the benefit of being the last man standing.

Sure, you might eventually run up against the license on the software you just lifted, but open-source projects can't afford the same protections that a well-funded startup has.

And if you somehow get sued for license violations, the penalties are usually more a slap on the wrist than an effective notice to knock that shit off.

I really hate the way my mind works some days.

<comment><USER44> > If you're a startup competing against an open-source project

Doesn't have to be a startup. I expect many small businesses will use it to damage competitors. It's not like it's unheard of .

</comment></comment><comment><USER52> I wonder is the drone.io guy has read the link he provides to the end of it:

>> So, there you go, that should take the sting out of answering the 'nightmare letter', even if not all the questions are appropriate (or appropriately worded) you can answer the bulk of them in relatively short order and with automation you can take the sting out. If this is the worst you can expect under the GDPR then that's not so bad, and the effect might actually be positive:

\- we get to know about a lot of undisclosed breaches

\- it will be clear who has their house in order and who hasn't

\- if you don't have your house in order just answering the letter will help you to get there <<

</comment><comment><USER45> It's really hard to know what exactly was asked of him by the letter and by whom. I get the nightmare letter scenario but is that the exact request he got?

Can he not extract all that user's data and delete if that is what is being requested?

<comment><USER53> This was linked to in the post: [https://jacquesmattheij.com/so-your-start-up- receive-the-nig...](https://jacquesmattheij.com/so-your-start-up-receive-the- nightmare-gdpr-letter)

It is a request for a lot of information.

<comment><USER45> Yeah i'm familiar with that. I was wondering if that was the exact request. It's not clear to me that the dude got that exact request.

It's also not clear to me that anyone getting that letter must do what that letter says to the letter else face consequences. We haven't seen that situation tested yet (although I can get why someone might not want to test it them self) all we've seen are letters being sent from individuals to individuals. Now how any enforcement would actual play out IRL.

<comment><USER44> Who wants to be a guinea pig for lawyers? what fun!

<comment><USER7> It wouldn't be lawyers unless it got a lot further down the line and went to tribunal. It would be the ICO (or equivalent), which is the regulator.

</comment></comment></comment></comment></comment><comment><USER54> Well that sucks, I wonder if this means other discourse instances might be hit with the same GDPR letters? There'll probably be someone who has (or will have) forked discourse to make these changes.

<comment><USER55> How does Discourse factor into this? From my read of this, it doesn't seem to be specific to the fact that he's using Discourse.

<comment><USER54> I thought he was using Discourse for his forum? Its not like I'm taking a shot at Discourse, I was just saying that it might be worthwhile to tack on an export function that is user facing to mitigate the onslaught of requests.

[edit]: @jcastro, I totally didn't realize that was already there, my bad.

<comment><USER56> Not sure what version this was added to but Discourse has an export button that individual users can use from their profile page.

</comment></comment></comment></comment><comment><USER57> Does he have any proof that the person is a troll ? From what I read he just assumes it.

<comment><AUTHOR> When you receive a request that is titled the "Nightmare letter" [1] it is hard to assume otherwise.

1: [https://www.linkedin.com/pulse/nightmare-letter-subject- acce...](https://www.linkedin.com/pulse/nightmare-letter-subject-access- request-under-gdpr-karbaliotis/)

<comment><USER58> I don't think the TITLE of the letter is literally "Nightmare letter". It's the name of the letter that people copy and send.

</comment></comment></comment><comment><USER59> Can't wait for future nightmare letters coming from Saudi Arabia when they find moral indecency on my web site or China finding imperialist propaganda that needs addressing. This will be used as a precedent for every other control freak pushing their values onto us. What happened to free and open internet?

<comment><USER60> This already happens. Russia sent notices to GitHub about certain documents that were hosted there. China and Saudi Arabia just straight up block things they don't like.

<comment><USER59> Yea, but this emboldens them because they can now point to EU and say that this is what normal countries do, long arm[0] people around.

[0] [https://en.wikipedia.org/wiki/Long- arm_jurisdiction](https://en.wikipedia.org/wiki/Long-arm_jurisdiction)

<comment><USER61> Or US with DMCA requests.

</comment></comment></comment></comment><comment><USER62> Unless I'm missing something, shutting down the forum does precisely nothing to limit GDPR liability as the main drone.io site itself has an account/login area. Whilst it's private beta currently, unless EU access is blocked, GDPR liability will continue to apply to any personal data collected via that.

The only benefit here is that there's one fewer system to keep track of when it comes to tracking/deleting personal data - the need to respond to subject access requests, right to be forgotten, form letters etc remains.

</comment><comment><USER63> Can you send a GDPR letter to a public body, for example, the Office for National Statistics? Can you ask them to delete your data? Should they comply or are they waived from GDPR compliance?

<comment><USER64> > Can you send a GDPR letter to a public body

I'm pretty sure you can.

> Can you send a GDPR letter to a public body

You can, for PII. One would hope they store their data anonymized.

> Should they comply or are they waived from GDPR compliance?

I think they'd need to make a pretty strong case for why they cannot anonymize your data for their work to get an exception.

</comment></comment><comment><USER65> I operate a 150 person forum and I, too, am scared shitless of weaponized GPDR harassment.

</comment><comment><USER66> Overreaction as usual!

</comment><comment><USER46> Is it legal to publish the name of the requestor? Name and shame?

<comment><USER67> > The sad thing is that one email came from the co-founder of a Startup out of > Germany.

They should definitely name and shame them.

<comment><USER68> Having lived in Germany, "Co-founder of a Startup out of Germany" conjures up the image of one of the many economics-degree-holding bros who strut around and "network", bullshitting everyone (themselves included) that they're going to be the next Zuckerberg.

Then again, my remote impression is that Silicon Valley isn't that much different nowadays.

</comment></comment></comment><comment><USER69> Overbearing legislation applied by unelected representatives is being abused. If only there were technical solutions provided with an assumption of goodwill instead of 88 pages of mandates without such an assumption.

<comment><USER70> Legislation is usually applied by unellected people. Judicial independence is usually seen as a good thing. Perhaps you mean that the law was enacted by unellected people, which is also incorrect of course? So now I don't see your point at all?

<comment><USER71> The law has been proposed by the European Commission who is just nominated not elected.

<comment><USER72> The European Commission's members are sent there by the national governments. Elect another parliament/government if you don't like who yours did sent.

<comment><USER12> That's like saying if you don't like a police officer then elect a different city council. Parliament members don't campaign on who they'll nominate to the EU commission. Brexit can't come fast enough.

<comment><USER73> Thank God for the Queen and the Lords eh?

</comment></comment></comment></comment></comment></comment><comment><USER74> People asking to exercise their rights on their own private information are not trolls.

<comment><USER27> In this case, you are making work for a person that doesn't monetize the platform you're using. It was service that was offered in good faith, and is now, because of this useless request, not going to be available.

Instead they are being forwarded to a service that _does_ monetize their service.

<comment><USER70> >now, because of this useless request

No, it is because of an overreaction to a request. If they are acting in good faith then just reply

<comment><USER75> How many hours should this person put in to respond to the request?

<comment><USER21> About 3 minutes.

"Here's the privacy policy. Here's the data export page."

<comment><USER11> Haha data export page, what even is that? Let me just go to my SQL DB, redis, glacier backups, and Kafka logs and just click the data export button. It will only take 3 minutes.

<comment><USER7> There's a button to download the user's data on their profile page. You can direct them to that. There's also a function to anonimise a user, which scrubs records of IP addresses and usernames.

</comment></comment></comment></comment></comment></comment></comment><comment><USER76> The EU could have sent a man to Mars with the money used on GDPR ...

</comment><comment><USER77> Wow, look how easy it is to put the small Internet business out of business now. Well played 9.9%.

</comment><comment><USER52> So basically drone.io is saying that discourse is not RGPD compliant and reddit is better equipped to deal with RGPD requests so he's moving his community discussion from a self hosted discourse to reddit.

Looks like a knee jerk reaction and missing the point that you can evade RGPD by outsourcing to a third party, one can still send RGPD requests to drone.io and owner is still responsible for answering those but now has to deal with getting the relevant data from reddit.

<comment><USER44> no he wont be. reddit will

</comment></comment><comment><USER37> I don't really see this as a GDPR troll. This guy is saying he can't manage formal GDPR requests. He's running an internet forum for christs sake. We had forums before we ever had tracking, and anonymous internet handles were practically invented on forums. What's he doing exactly that he can't answer GDPR requests with a simple "we don't collect personal information"?

Of course, he probably is collecting PII, because he's using discourse. But since he says he doesn't have time to answer GDPR requests you can be pretty sure he doesn't take the time to ensure his infrastructure hasn't been owned. I'd wager he doesn't even know what PII the system he runs is collecting, so how can he be securing it on his users behalf?

It's totally reasonable for his users to ask how he's protecting their personal data. If he wants to flip tables and storm out when they ask, that's up to him. From my perspective, the system works. He wasn't making the effort his users deserve to securely store their PII, and so now he isn't storing it at all. No one had to sue anyone, no one had to go to court, and he made the sensible decision to get out of the PII game he had no business being in. Success if ever I heard it.

<comment><USER78> Oh no, your email address (PII) might be compromised. How would you survive if a competent hacker could find that?

<comment><USER37> [https://medium.com/@N/how-i-lost-my-50-000-twitter- username-...](https://medium.com/@N/how-i-lost-my-50-000-twitter- username-24eb09e026dd)</comment></comment></comment>


Watch SpaceX hop StarHopper, untethered 20 meters [video] - <AUTHOR> https://www.youtube.com/watch?v=aChE86D0c_A <comment> _-_T_-_ Second test, after first test was aborted - [https://www.nasaspaceflight.com/2019/07/spacex-resume- starho...](https://www.nasaspaceflight.com/2019/07/spacex-resume-starhopper- tests/)

</comment><comment><AUTHOR> It looks like the window may be open until 12am CT. [https://www.brownsvilleherald.com/news/local/starhopper- may-...](https://www.brownsvilleherald.com/news/local/starhopper-may-hop- today/article_050cd4f0-aef3-11e9-a0e7-bfaba8a0c9ad.html?mode=jqm)

<comment><AUTHOR> [https://twitter.com/NASASpaceflight/status/11545871711369748...](https://twitter.com/NASASpaceflight/status/1154587171136974849)

</comment></comment><comment><USER2> when?

We don't know the TO we don't even know the date, may it be more useful to show it after it has happened?

<comment><AUTHOR> The people left at 7pm CT which the host said means a 1 hour minimum wait.

It's an unofficial stream, so no details from SpaceX.

<comment><USER2> ok, I'll pop back in an hour and see what happens.

</comment></comment></comment><comment><USER3> been watching it for the last hour and a bit.. nothing happening</comment>


ZFS for Linux - <AUTHOR> http://www.linuxjournal.com/content/zfs-linux <comment><USER2> I keep hearing that the GPL and CDDL are incompatible. But repeating something doesn't make it true. And I have read both licenses, and have come to the conclusion that they're unlikely to be incompatible in the first place. Unfortunately, every time this line of argument come up, it tends to get buried in discussion.

The basis of the incompatibility claim seems to be from 3 arguments:

1) Statements from the FSF website, but those have no legal bearing against the actual text of the licenses

2) Claims that the CDDL was engineered to be incompatible with the GPL, again, it's an interesting hypothesis but has little bearing against the actual text of the licenses

3) Derivative Work argument from the GPL. This seems to be the only one that could hold water; however, I doubt that a court would find ZFS to be derivative work of the Linux kernel.

Furthermore, even if you argue that the "derviative work" clause makes them incompatible, there's no way actually to prosecute such a violation. Copyright law is something called a tort in law, which means you have to show that someone violated the rules AND also caused quantifiable harm. What would our theory of harm be? ([https://blog.hansenpartnership.com/are-gplv2-and-cddl- incomp...](https://blog.hansenpartnership.com/are-gplv2-and-cddl- incompatible/))

<comment><USER3> Actual lawyers have also read both licenses and came to the conclusion that they are incompatible: [https://sfconservancy.org/blog/2016/feb/25/zfs-and- linux/](https://sfconservancy.org/blog/2016/feb/25/zfs-and-linux/)

The main debate over the incompatibility isn't about GPL vs CDDL; even Canonical isn't arguing that the licenses aren't incompatible. It's specifically about the Linux kernel vs ZFS; ie. does linking the ZFS module with the Linux kernel make the ZFS module a derivative work of the Linux kernel.

If yes, it has to be able to have the GPLv2 applied to it, which it can't. If no, then the incompatibility is irrelevant, and the kernel and ZFS can be distributed together and under their own separate licences. This is where opinions (by legal experts, not people on the internet) differ, the FSF and SFC's lawyers say this makes ZFS a derivative work and you can't distribute them together, Canonical's lawyers say it doesn't and therefore you can.

<comment><USER4> I'm surprised there isn't a one-click way for the user to build their own kernel with ZFS inside it.

As long as I don't distribute the resulting binary there should be no legal implications.

<comment><USER5> DigitalOcean[1] has a one–click option to compile FreeBSD kernel with ZFS configured (for what its worth).

edit: including my referral link here will probably result in negative karma, but i'm desperate for points!

[1]: [https://m.do.co/c/8c882a721944](https://m.do.co/c/8c882a721944)

<comment><USER6> FreeBSD isnt GPL licensed but BSD and therfor has no licensing issues.

</comment></comment></comment></comment></comment><comment><USER7> The author seems very confused about the provenance of ZFS. The ZFS that is in ZFS-for-Linux is OpenZFS, the open-source version, not Oracle's. OpenZFS is what's in FreeBSD and illumos and ZFS-on-Linux and so on and so on, and it is most definitely not under any form of Oracle control.

<comment><USER8> So, just to be clear, the hand-wavy idea I got at some point that there were multiple major implementations is actually wrong?

As an aside, _are_ there any independent implementations?

<comment><USER9> There's Oracle Solaris ZFS. Since Solaris has been killed off, this original variant of ZFS is finished unless relicensed.

OpenZFS is a fork, and is the upstream for Illumos, FreeBSD, Linux and macOS and all share the same on-disk format. The exact heirarchy, I think it's Illumos and FreeBSD as essentially co-equal upstreams, then ZoL (ZFS on Linux), and macOS is downstream of ZoL. I wouldn't call them different implementations.

zfs-fuse I _think_ is based on the original. [https://github.com/gordan- bobic/zfs-fuse](https://github.com/gordan-bobic/zfs-fuse)

</comment></comment></comment><comment><USER10> The lack of RAIDz expansion is a real deal killer now that its possible to expand normal linux RAID/LVM/filesystems.

RAID/filesystem expansion is probably the #1 thing that in the past was a huge PITA. These days its possible to reshape a linux array with a single add/grow option to mdadm after installing a new disk.

<comment><USER11> Some are working on it: [https://www.freebsdfoundation.org/blog/openzfs-raid- z-online...](https://www.freebsdfoundation.org/blog/openzfs-raid-z-online- expansion-project-announcement/)

</comment></comment><comment><USER9> Couple of small gripes: a. Using fdisk to undo partition is not the correct way to unpartition a drive. You should tear down the layers of a drive's storage in the reverse order they were created, by using wipefs to remove the signature for that layer, so wipefs each partition and then wipefs the drive to remove the partition map itself (there are two signatures on GPT partitioned drives). The suggested method leaves all of the signatures intact, fs and partition map, and can cause later confusion.

b. Near as I can tell, upstream GRUB supports ZFS. The article cites a 2011 freebsd thread. [http://git.savannah.gnu.org/cgit/grub.git/tree/grub- core/fs/...](http://git.savannah.gnu.org/cgit/grub.git/tree/grub-core/fs/zfs)

</comment><comment><USER12> Has there ever been a serious community effort to relicense ZFS? Intuitively, that feels like it would have been a much more worthwhile effort from the start than trying to recreate it from scratch in the form of btrfs.

Is that a reasonable idea? What would it take for someone to go about it today? I would expect that it would be possible if every copyright holder (I'd guess mainly developers and their current/past employers, next of kin, estates, etc.) were asked to sign a document collectively consenting to having ZFS's license changed.

Or is there a reason that some current copyright holders might not want that? I get why Sun would've refused since it was a competitive advantage for Solaris, but what's stopping it from happening now?

This whole situation just seems really silly as I'm not sure what anyone has to gain from it.

<comment><USER13> Oracle holds the copyright on much of OpenZFS. They'll have to agree to relicensing it first.

With Solaris dead I'd generally agree that it's a little pointless to keep it incompatible. They might as well just place it under something like BSD or Apache 2, that should keep the FreeBSD and Mac OS X ports happy as well as opening up the possibility of inclusion in the Linux kernel. With Oracle Solaris dead, I think there's even a case for Oracle's bottom-line: they could start including ZFS with Oracle Enterprise Linux and boast about all the advantages of using it there.

<comment><USER14> > _"... they could start including ZFS with Oracle Enterprise Linux and boast > about all the advantages of using it there."_

As the copyright holder, can't they do that anyway?

By not relicensing it, they keep others -- Canonical, Red Hat, etc. -- from being able to do the same thing.

</comment></comment></comment><comment><USER15> The legal issues are annoying, but ZFS on Linux has been running quite well for years now. Not sure what the 'news' part is here.

<comment><USER16> The problem is that it isn't upstream, so having it as a rootfs is somewhat dangerous - you need a custom initramfs).

<comment><USER17> Works automatically on Ubuntu. I'm writing this on a Linux system with ZFS on root which has worked perfectly for nearly two years now.

</comment></comment></comment><comment><USER18> See also: TFS: A file system built for performance, space efficiency, and scalability

[https://github.com/redox-os/tfs](https://github.com/redox-os/tfs)

[https://news.ycombinator.com/item?id=14386331](https://news.ycombinator.com/item?id=14386331)

</comment><comment><USER19> I'm hoping BcacheFS will be the next COW FS to take over this space in Linux.

</comment><comment><USER20> Has anybody managed to run native encryption root and boot system with Linux yet? That would be really cool.

<comment><USER21> I tested that out for an embedded product. It works, and while some things could be better, the biggest hurdle is that since it's not stable yet it can't be shipped. A stable release could be supported for years, but native encryption being unstable means issues like this[0] would be showstoppers.

0: [https://github.com/zfsonlinux/zfs/issues/6845](https://github.com/zfsonlinux/zfs/issues/6845)

</comment></comment><comment><USER22> I had a lot of 'fun' trying to get a ZFS root on ubuntu a couple months ago.

Not my brightest idea.

Ended up having a small XFS root partition and putting everything else on ZFS. Works great, but I don't look forward to the day when my root filesystem fails.

<comment><USER23> Yep. I have a number of ZFS machines, and I always put root on ext4 (or ext4 on md), and just use ZFS for user data partitions.

<comment><USER24> ZFS root works fine on NixOS.

[https://nixos.wiki/wiki/NixOS_on_ZFS](https://nixos.wiki/wiki/NixOS_on_ZFS)

</comment></comment></comment><comment><USER25> "Definite legal ambiguity remains with ZFS"

This seems to be the biggest problem with ZFS. Even Apple ditched ZFS on macOS.

ZFS is slowing down and impacting the real alternative: btrfs. IMHO Red Hat should be ashamed for abandoning btrfs.

<comment><USER26> I'm not sure I blame Red Hat all too much in this.

Both ZFS and btrfs are owned/driven by Oracle. When Oracle bought Sun (and ZFS), it seemed like the pace of btrfs slowed significantly. I'm not sure what Oracle really wants to do in this situation, but they are clearly in the driver's seat.

(This is also alluded to in the article)

<comment><USER27> > Both ZFS and btrfs are owned/driven by Oracle.

While ZFS is owned by Oracle they certainly don't drive development. Oracle has their closed source version of ZFS used in the now dead Solaris. Then their is OpenZFS which is where the majority of research and development takes place and where Illumos, FreeBSD, MacOS and Linux developers upstream their work.

<comment><USER28> And, from one of the linked articles, SuSE is the biggest contributor to btrfs.

We've been running btrfs in production for our small shop for a couple years. We've had one incident, but not too many problems, really.

Though, next time, I might not be using btrfs RAID-1, and instead use the regular MD. I'd still want the on-disk checksums for data, and the snapshots, which are awesome.

<comment><USER26> But when Oracle bought Sun, I'm fairly certain Oracle was _the_ driver. (Didn't they employ the initial developer?)

SuSE just doesn't have the same level of resources that Oracle can bring to bear. At the time, btrfs was a crucial feature for the next version of Linux _because_ of ZFS. When Oracle bought Sun, that competitive pressure was gone.

</comment></comment></comment></comment></comment><comment><USER29> Optimizing on the filesystem is interesting, but the underlying hardware should not be neglected -- and benchmarks should be done before anything else!

I recently needed a large and fast SQL database. I decided to start by doing some simple tests with dd and some more advanced ones with fio.

On a very decent AMD EPYC 7401P 24-Core with 128G of ram and 6 NVMe drives, I found that performance started declining once I added the 6th drive.

Based on my benchmarks, the most I can get out of this machine is about 4GB/s in read/write performance. This makes me suspect it is the speed limit from the CPU to the PCH.

So instead of this 1 server, I will deploy a cluster of smaller servers each equipped with 2 NVME and hope the network drivers do a decent job (just checked the dmesg: eth2: (PCIe:5.0Gb/s:Width x4)

<comment><USER30> The AMD Epyc 7401P you're using has 128 PCIe 3.0 lanes, which can provide way more bandwidth than the 4Gbps figure you're getting (8 Gbps per lane, so 1024 Gbps on paper). The AMD Epyc platform has been benchmarked at 57 GBps (bytes, not bits) of random storage bandwidth: [http://www.legitreviews.com/one-amd- epyc-processor-reaches-5...](http://www.legitreviews.com/one-amd-epyc- processor-reaches-57-gbs-of-random-storage-bandwidth_195653)

There's simply no way a PCIe x4 NIC is going to be able to compete with the bandwidth available within that server.

<comment><USER29> I just can't get such results at the moment, so I am trying some creative solutions to get over the limit I'm hitting.

Would you have some suggestions to diagnose the issue better?

</comment></comment></comment><comment><USER16> .

<comment><USER13> There's some ZFS whitepapers that explain the data structures in a code-free way ;)

Not to mention the GRUB driver. It's GPLv3 but I wouldn't be surprised if the GRUB project is willing to relicense it for a Linux kernel port.</comment></comment>


Show HN: A Readme-driven blog - <AUTHOR> https://github.com/uacaps/Blog

<comment><USER2> I think it would be also a good idea to build a gist based blog. Gist also renders markdown.

<comment><USER3> [http://gist.io/](http://gist.io/) is kinda like that.</comment></comment>


Summer reading suggestions from scientist Harold Varmus - <AUTHOR> https://directorsblog.nih.gov/2016/08/09/summer-reading-suggestions-from-scientists-harold-varmus/ <comment><USER2> I really enjoyed Age of Wonder. Good to see a Nobel Prize-winning scientist enjoyed it, too.

</comment><comment><AUTHOR> Wow! Who knew it would take a scientist to make me consider reading Middlemarch!!</comment>


Ask HN: Are there ML systems that can reason across multiple input modalities? - <AUTHOR> I'm working on Modular Neural Networks, and I think it may be an interesting architecture. For example, you could train smaller subnets on individual problem spaces across modalities and have them feed to a larger intermediary. Is anyone working on this? <comment><USER2> Sounds close to what Berkeley AI and Robotics lab is developing with model agnostic meta-learning. pytorch implementation here:

[https://github.com/tristandeleu/pytorch-maml- rl](https://github.com/tristandeleu/pytorch-maml-rl)

And demo where robotic arm learns to navigate a simple task after watching a single video of human doing same ;)

[https://bair.berkeley.edu/blog/2018/06/28/daml/](https://bair.berkeley.edu/blog/2018/06/28/daml/)

<comment><AUTHOR> Very cool, thank you!

</comment></comment><comment><USER3> Yes. Multimodal emotion recognition is one such area.

There are indepdenent pipelines for each mode, and derived features are then fused and used for final prediction.

You may also want to check out casacded models.

<comment><AUTHOR> Awesome thank you!</comment></comment>


Megaupload Assisted U.S. Prosecution of Smaller File-Sharing Service (2012) - <AUTHOR> http://www.wired.com/threatlevel/2012/11/megaupload-investigation-roots/ <comment><USER2> This whole thing is making the FBI look like a bunch of clowns...

<comment><USER3> I know a few people who have worked with them (not naming names), and they all agree that the FBI are nowhere near as slick as the media makes them out to be.

</comment></comment><comment><USER4> Yes, this is the source of their current troubles: being told to hold on to the evidence from that case.

EDIT: in -> from

<comment><USER5> Well, the files that they were told to hold on to _were_ a majority of the claimed files (something like 35/37, IIRC) when the DoJ went after him.

</comment></comment><comment><USER6> But if you get a subpoena, you have no choice in the matter. I don't know the facts in this Megaupload/Ninja Video case, but this is hardly the revelation that Wired wants (?) to make it.

</comment><comment><USER7> It is always "history repeating" with Kim Kimble.

</comment><comment><USER8> Testdownload:

[https://mega.co.nz/#!h1IjjJRR!dv9lRUyCCmbkZ9drqnrw_y3GWYUPXS...](https://mega.co.nz/#!h1IjjJRR!dv9lRUyCCmbkZ9drqnrw_y3GWYUPXSSdm8N4Fbyhrxw)

Screen:

<http://i.imgur.com/4YrRPpO.jpg></comment>


Clinton's private e-mail was blocked by spam filters–so State IT turned them off - <AUTHOR> http://arstechnica.com/information-technology/2016/06/clintons-private-e-mail-was-blocked-by-spam-filters-so-state-it-turned-them-off/ <comment><USER2> I wonder >why< it got on the spam list. Perhaps it was simply unrecognized.</comment>


Show HN: A free invoice generator - <AUTHOR> I built this[1] because I couldn't find any other such tools that met all of the following criteria:<p>* Use SSL * Save settings through localStorage * Allow PDF export w/o any watermarks * The exported invoice must look identical to the preview<p>1: https://www.free-invoice-generator.com <comment><USER2> Pet peeve: for ambiguous currency signs, the currency code must always be clearly mentioned on the invoice.

I hate it when I buy from companies in the US and they just write their prices as $.

Then my accountant doesn't know if that invoice was in USD or HKD. There are dozens of countries that use the $ as their currency symbol.

At least mention the currency code somewhere, please.

<comment><AUTHOR> Good point! I'll add a way to toggle the code on or off.

</comment></comment><comment><USER3> This is pretty nice and very easy to use, good job!

One point: I would normally expect to see a breakdown of how much tax (VAT in my case) has been added, rather than just a percentage - I know you just subtract the subtotal from the total, but having the amount of tax shown as a separate line is actually a requirement for a VAT invoice in the UK [0] and may well be in other countries.

When I'm working with new subcontractors who may not necessarily have an invoice system set up already, I normally point them at [http://invoiceomatic.io/](http://invoiceomatic.io/), which was built by the geniuses at FreeAgent (which I use myself). [1]

[0]: [http://www.hmrc.gov.uk/vat/managing/charging/vat- invoices.ht...](http://www.hmrc.gov.uk/vat/managing/charging/vat-invoices.htm) [1]: [http://freeagent.com/](http://freeagent.com/)

<comment><AUTHOR> Thanks! That's a great point about VAT, I'll be sure to add that in an update.

Invoice-o-matic looks freaking sweet, I wish I'd known about it sooner. :D

</comment></comment><comment><USER4> This is really good. With the boring, generic, exact-match domain you've given it I was expecting something spammy. Is your aim to go after the SEO benefits or would you consider renaming it to something a bit more characteristic?

<comment><USER5> Personally, I appreciate the descriptive domain name. It's far more characteristic of what the product is for than some random word with an arbitrary dropped/added letter/number.

edit: Further reading of this thread show how many other solutions there were, but the author couldn't find. So maybe the problem is one of marketing, and picking a descriptive domain name might be what's needed.

</comment></comment><comment><USER6> Can you make the code available on GitHub? What would be really cool is to add API so that it can be accessible programmatically by other accounting systems.

</comment><comment><USER7> This is great! Thank you so much.

I basically use Freshbooks.com as an invoice generator. This is way cleaner.

Some polish-level things that would make it cleaner to use for a SaaS product:

* There aren't really "quantities" or "rates". You are a customer of my product, which costs $X amount, so there is just a line with cost $X.

* Needs to comma-delimit amounts greater than $1,000

* Want to be able to put my logo where "INVOICE" is.

* Want to be able to include an "Amount Paid" below the "Total", and then have "Amount Due" under that, which is Total - Amount Paid.

Also, I want to be able to save invoices (local storage or server is fine), generate a new one this month from last month's per customer, etc. etc.

Feel free to email me (email@example.com) if you want more feedback or some examples.

Also: Charge your customers money!

<comment><USER8> While I appreciate everything in this list, in addition the the last item, I also want to voice support for your open sourcing this project.

The community would be grateful for your efforts, if that's an available option.

Thanks & all the best!

</comment></comment><comment><USER9> I made one as well [0] for my own invoices as a contractor in the UK which I made to try out Typescript.

I just went the way of using the print to pdf feature of the browser rather than generating the PDF myself (and no need for any server side things this way!), works well enough for my case.

Code is on github: [https://github.com/Keats/invoicer](https://github.com/Keats/invoicer)

[0]: [http://vincent.is/working-on/invoicing/](http://vincent.is/working- on/invoicing/)

</comment><comment><USER10> Odoo Invoicing has the features you need and his fully open source. [https://www.odoo.com/page/billing](https://www.odoo.com/page/billing)

It implements: SSL, PDF, Export, same preview than print but no local storage. In the other hand, it has: online payments, auto generation (subscriptions), send by email or regular mail, etc.

One-click demo: [https://demo.odoo.com/?module=account](https://demo.odoo.com/?module=account)

(disclaimer: I am the author of Odoo)

<comment><USER11> I need to look into this. I feel like I've hear of odoo months back and maybe it wasn't as mature. All the apps called out that connect with it, if it delivers what it says should rival anything commercial closed source right now. Whats the best resource to get up to speed on the details of odoo, is there a long video demo perhaps?

</comment></comment><comment><USER12> If I set currency to RUB, I has "руб." at left of price, but it must be right of it.

Ex. now it "руб.150", but must be "150 руб."

</comment><comment><USER13> This is great, I really like how clean the interface is! I might start using this from now on.

Minor pet peeve: It would be nice to have rich text formatting for the additional notes. Formatting bank information on how to pay me would be added there, so making certain details clear would be ideal.

</comment><comment><USER14> Shameless Plug: We built a similar tool using AngularJS [http://metaware.github.io/angular- invoicing/](http://metaware.github.io/angular-invoicing/) which is free and Open Source and folks here at HN enjoyed it we guess. :)

</comment><comment><USER15> It looks great, I just tested it out and enjoyed the simple layout. Its refreshing to see a service focus on UI over flashy tricks and gimmicks filled with marketing jargon.

Also congrats on the URL choice, really easy to remember and should score you some SEO points.

</comment><comment> pkmx- Google sheets. Use the templates.

</comment><comment><USER16> Nice work! Maybe add a way to export/import all invoices (say I want to switch machines). A data table to see all invoices and a reporting tool will be useful. Also, this is front-end only, why do we need ssl?

<comment><USER17> _Also, this is front-end only, why do we need ssl?_

Not the author, but you still need secure transmission of the JS code, otherwise a MITM could send a modified version that sent your stored data to their servers.

<comment><AUTHOR> This and the fact that there is a backend service that handles the work of generating the PDFs are the reasons why I wanted SSL (though I am looking into moving the PDF generation to be completely client-side).

</comment></comment></comment><comment><USER18> Nice work! This is very similar to the invoice tool I made: [http://invoice- generator.com](http://invoice-generator.com)

<comment><USER19> Nice ! But there are no Ads on your website. Did you intend to make money with it ? or was it a fun side project you did ?

<comment><USER20> They want you to upgrade to the full invoiced.com service.

I've used this free site once in a while. It generates good looking invoices.

<comment><USER19> Ah ! Thanks for pointing it out. I see the "upgrade" tab on the top now.

</comment></comment></comment></comment><comment><USER21> Application: looks good! Domain name: sucks. I would go with a much shorter name on a different TLD. e.g. 1invoice.co

<comment><USER22> or just stick with the exact match domain for better rankings in search engines...

</comment></comment><comment><USER23> This is beautiful and exciting. Do you plan to share the source code in github ? I would love to contribute.

</comment><comment><USER24> Nice ! Option for png header to include ? Then company logo can be included. :)

</comment><comment><USER25> This is OK only if you have to make one invoice and you are alone. I personally use Direct Invoice ([https://direct-invoice.com](https://direct- invoice.com)) it has a customizable dashboard, it's multi-user and the web app is beautiful.

</comment><comment><USER26> INR shows up wrong - টকা

<comment><AUTHOR> Thanks for pointing that out! I've updated it to use ₹ instead.

</comment></comment><comment><USER27> Wow, good work. Seems to work well for tablets too.

</comment><comment><USER19> Do you intend to make money with this ?

</comment><comment><USER28> how are you generating the pdf? client side as well?

<comment><AUTHOR> There's a Scala-based backend service that generates the PDFs based on the data it receives from the client (I am planning on transitioning to something like[1] for this purpose in the future, however). The PDFs are garbage- collected within 10 minutes of when they are created.

1: [http://parall.ax/products/jspdf](http://parall.ax/products/jspdf)

<comment><USER29> On you site it says "Free Invoice Generator does not store any of your data online. Instead, all of your settings are saved to your browser through the LocalStorage mechanism. Clicking the above button will delete the data that Free Invoice Generator has saved to your computer so far."

Maybe I have a poor understanding of the logistics but on reading that I have the impression that my data never leaves my browser. If so, how are you generating the PDFs server-side which are populated with my data?

This looks great and my question isn't a complaint. If you store user's browser data for 10 minutes or so, then you should probably change the wording in your claim to reflect this. And if you can generate a PDF server-side which somehow adds user data without leaving my browser's local storage I'd be most interested in learning how that works as it sounds almost magical.

<comment><AUTHOR> You're right, I've updated the message to reflect that fact. Thanks for pointing that out!

<comment><USER29> Cool, though I'm almost disappointed now. I was hoping you had figured out some hack to use the browser's 'print to file' functionality, omitting the sidebar and printing only the invoice part of the web page.

<comment><USER14> that can be done with a print-only stylesheet. display: none for the sidebar

</comment></comment></comment></comment></comment></comment><comment><USER30> Bitcoin invoices?

</comment><comment><USER31> From the HN guidelines:

"Don't abuse the text field in the submission form to add commentary to links. The text field is for starting discussions. If you're submitting a link, put it in the url field. If you want to add initial commentary on the link, write a blog post about it and submit that instead. "</comment>


Ask HN: Hackers Who Design? - <AUTHOR>

I'm writing a book, Design for Hackers: Reverse-Engineering Beauty, with which I hope to help software developers better understand design decisions.
I do have a certain framework for the book, but I'm also interested in hearing your specific needs and experiences. Some questions:
- Why are you interested in learning more about design? (if N/A, then why not?)
- What have you found confusing about design?
- What is one blog post/book/movie, etc. that has helped you better understand something about design?
- What software tools do you find useful when designing?
Thanks so much for your help! <comment><USER2> I've never understood the programmers that write off design as fluffy stuff for the "creative" people who wear black turtle necks and berets. As if design was somehow beneath them, or as if it's wallpaper that you can plaster over a project once the code is written to "pretty it up".

To answer your questions:

 _Why are you interested in learning more about design?_

Because I want to spend my career making people feel the way I felt when I first used an iPod. I picked the iPod here because it seems to be the stock example that gets trotted out whenever someone needs to reference good design, but you can replace it with whatever well designed product you like. We've all had those experiences in our lives where we use something new, and it makes something that was previously difficult easy. That's the kind of stuff I want to spend my time creating, and a sound knowledge of design is a means to that end.

 _What have you found confusing about design?_

When and how to break the rules. I'm a fan of Robin Williams' _Non-designers Design Book_ ([http://www.amazon.com/Non-Designers-Design-Book-Robin- Willia...](http://www.amazon.com/Non-Designers-Design-Book-Robin- Williams/dp/0321193857)), but as a consequence my projects can look a little sterile because I follow the rules exactly as she lays them out.

In contrast, if you go and look at something made by Jason Santa Maria (an outstanding web designer at the top of his game) (<http://jasonsantamaria.com/portfolio/>) you'll see he breaks a lot of the rules, and it doesn't matter. In fact, it often times makes the work better.

Perhaps you can't codify or reverse engineer that. Jason has design talent. Me, not so much.

 _What is one blog post/book/movie, etc. that has helped you better understand something about design?_

I'm fond of _The Contemporist_ (<http://www.contemporist.com/>) for its great photography of great architecture. It's a great place to draw inspiration. My favourite post so far: [http://www.contemporist.com/2010/05/20/chicken-point- cabin-b...](http://www.contemporist.com/2010/05/20/chicken-point-cabin-by- olson-kundig-architects/)

 _What software tools do you find useful when designing?_

For HTML/CSS/PHP I tend to use Espresso (<http://macrabbit.com/espresso/>). I never mock up web pages in Photoshop. I go straight to code.

For desktop software, I'm a big fan of Microsoft Visual Studio's IDE.</comment>