Working from home may do unrecoverable damage to young careers - <AUTHOR> https://www.theatlantic.com/magazine/archive/2020/10/career-costs-working-from-home/615472/ <comment><USER2> Like anthropology, you have to come up with a story and run with it but it's just a story in the end. If anything, the current situation will see people being graded even more for their work and productivity. You have to recall that we are all in this together. Everyone became a remote worker in a new remote worker culture. No one is an unknown quantity when we are all measured in the same way.

</comment><comment><USER3> it's definitely something i'm concerned with</comment>


The ARM plan for CentOS - <AUTHOR> http://www.karan.org/blog/2014/03/26/the-arm-plan-for-centos/ <comment><USER2> This is great news! CentOS needs to get its feet wet with ARM even if it's 32-bit to start with. This will kick off another growth wave in the lower end dedicated hosting segment with the target being individuals and _very_ small businesses.

We're already offering _managed_ ARM-based dedicated servers that are cheaper than our cheapest VPS plan. But we've picked Ubuntu 64-bit as the base. I'm looking forward to integrating CentOS 64-bit sometime/hopefully next year!

<comment><USER3> Ubuntu 64-bit? Are ARMv8 servers already commercially available? Where are you getting them from?

</comment></comment><comment><USER4> Me and lsc at prgmr.com have bantered about offering arm servers but the cost/wattage per core compared to xen guests still isn't competitive, plus we haven't found anything yet which supports ECC. If there was sufficient interest though we could try offering it. I already have a lot of experience with TI so we'd probably use the beaglebone black [http://beagleboard.org/Products/BeagleBone%20Black](http://beagleboard.org/Products/BeagleBone%20Black) Probably storage would be a combination of network (maybe usb) + the local flash for ephemeral data.

</comment><comment><USER5> Maybe I don't know enough about the details of the RedHat/CentOS distinction, but if RHEL supports ARM, then doesn't CentOS automatically get that support for free?

Or is the CentOS project going to be adding extra functionality above and beyond RedHat?

<comment><USER6> Nothing is for free, but the article clearly states that the released RHEL doesn't have good enough ARM support, which means CentOS/RHEL 6 can't do ARM well.

If the CentOS project decides to take on ARM when RHEL is released, it's a matter of resources.

</comment></comment><comment><USER7> just the fact that he's confident centos7 can be turned around quickly when rhel7 goes GA is awesome news

the arm stuff is a neat bonus

</comment><comment><USER8> Ubuntu has great ARM support</comment>


Python 3 is now available on App Engine standard environment - <AUTHOR> https://cloud.google.com/blog/products/gcp/introducing-app-engine-second-generation-runtimes-and-python-3-7 <comment><USER2> We're a SaaS platform running on App Engine and were part of the early-access program. Porting over our Python 3 based platform from App Engine Flex to AE Standard took just a few hours - only tweaks needed were to the YAML config files and rewrite our deployment scripts after creating a new environment and project.

We still maintain a docker-based environment on AWS EBS which we were able to port over as well. Overall a fantastic experience. The App Engine Standard team provided stellar support too.

We did notice pure CPU performance on AE standard to be less than dedicated AE Flex instances, but on a price/performance ratio AE standard is 10X better for infrequently accessed micro-services which will allow us to migrate some of these to standard for great cost savings - as well as ramp up auto-scale to handle spikes automagically.

With Python 2 becoming officially deprecated in 2020 this means App Engine Standard just got a huge boost in long term relevance. Great for developers who want to deploy without having to deal with infrastructure.

Good to hear that AE standard - i.e. this vision of a 0-effort Python deployment support - is still relevant after all the Kubernetes-related announcements at Google Next.

<comment><USER3> Just curious, why did you migrate from Flex to Standard? Only for the 10X price/performance boost for infrequently accessed services?

PS: Regarding automagically handling spikes I have a warning that might be useful for you. The way AE load balancer works is that it:

0\. A request comes.

1\. AE checks for available instance. If none available:

2\. Spins up new instance.

3\. !!! Assigns the request to that instance.

4\. Waits for /_ah/warmup to finish.

5\. Adds that instance to its serving pool so other requests may be routed there as well.

Note that step 4 is after step 3, so at least one request will wait for /_ah/warmup. So occasionally you will see requests with high latency (if your warmup is slow, of course). Our latency requirements were quite high, so we ended up switching to manual scaling and heavily over-provision to handle spikes. That costed us good money, though.

<comment><USER4> This should be a little better now: [https://cloudplatform.googleblog.com/2018/05/Increase- perfor...](https://cloudplatform.googleblog.com/2018/05/Increase-performance- while-reducing-costs-with-the-new-App-Engine-scheduler.html)

But yeah, you should definitely do your own load testing. GKE or Flex are probably better choices if you need more control.

(I work for GCP)

</comment></comment></comment><comment><USER5> > At this time, the original App Engine-only APIs are not available in Second > Generation runtimes, including Python 3.7.

This means that if you already have a significant app running on Appengine Standard, none of the built-in APIs are supported (memcache, images, search, task queues, email, etc). That's a significant blocker to anyone wanting to upgrade their existing Standard 2.7 app to 3.7.

<comment><USER2> Correct, but for us (migrating from AE Flex to Standard) it meant that it was working out of the box.

<comment><USER5> It seems to me this product is mainly targeted at 1) new customers, and 2) AE Flex customers wanting to switch to Standard.

The third category (Existing 2.7 Standard customers wanting to just upgrade to 3.7 -- which is me unfortunately) are going to be disappointed and stuck in a hard place, I think.

<comment><USER6> What would be the incentive to migrate from AE Flexible to Standard if these apis are not there? The only thing I can think of is scale to 0.

<comment><USER4> Scale to 0, faster scaling up/down (no need for full VM spin up), faster deployments, less surface area for attack (maybe?).

</comment></comment></comment></comment></comment><comment><USER7> Thanks for supporting this cutting edge technology. I really hope it catches on.

<comment><USER8> I can't tell if you're sarcastic or not. Python 3 is pretty old now, definitely not cutting edge technology.

<comment><USER9> Pretty sure they're being sarcastic. But I'm guessing the commenter hasn't used Google Cloud anyway - Python 3 was supported on Flex enviroments for a long time. The news here is that they're supporting it on Standard environments, and there seems to be good technical reasons for taking so long.

</comment></comment></comment><comment><USER10> Exciting release of the 2nd generation of App Engine runtimes. I'm really excited to see how the community receives this product.

It uses the gVisor sandbox, allowing sandboxing at the process level. This in turns allow for fast turning up and scaling of apps.

Disclosure: I work for Google, on the App Engine Runtimes team.

</comment><comment><AUTHOR> Hi all,

Product Manager for App Engine here. Happy to answer any questions about Python 3 on the App Engine standard environment.

<comment><USER11> Can I run pandas in it?

<comment><AUTHOR> Yes, this runtime supports arbitrary dependencies specified via a `requirements.txt` file. If you find a library that doesn't work, please let us know. In general, anything that works using an open source Python 3.7 distribution should be supported.

<comment><USER12> Incidentally, the best way to "let us know" about bugs in GCP (App Engine or whatever else) is via the Issue Trackers, as per [https://cloud.google.com/support/docs/issue- trackers](https://cloud.google.com/support/docs/issue-trackers) (disclaimer: making this and similar processes work is my current job at Google).

</comment></comment></comment></comment><comment><USER13> I believe the title should be updated to say 3.7 as the article title does. The .7 is pretty significant to those who would be interested in this.

<comment><USER14> Any highlights of why 3.7 is significant vs 3.6,3.5,3.4?

<comment><USER12> If I had to guess, I'd say the most relevant changes for App Engine use may be the optimizations documented at [https://docs.python.org/3/whatsnew/3.7.html#whatsnew37-perf](https://docs.python.org/3/whatsnew/3.7.html#whatsnew37-perf) : the `sort` method of lists about 50% faster in common cases, the `copy` method of dicts up to 5 times faster, etc.

</comment></comment></comment><comment><USER15> Out of curiosity, why did this take 10 years?

<comment><AUTHOR> Long story short: security is hard.

Launching these new unmodified Second Generation runtimes required us to develop new security and isolation technology (based on gVisor [1]). This allows us to securely run arbitrary code on shared data centers with isolation guarantees. This took us significantly longer than expected. The good news is, now that we have this new stack in place, we should be able to deliver runtime updates significantly faster.

[1] [https://github.com/google/gvisor](https://github.com/google/gvisor)

<comment><USER16> In case anyone else is wondering why you'd not just use LXC:

[https://cloud.google.com/blog/products/gcp/open-sourcing- gvi...](https://cloud.google.com/blog/products/gcp/open-sourcing-gvisor-a- sandboxed-container-runtime)

That said, they don't quite go into the details of what type of isolation is missing from standard containers - I'm curious. It does seem like it would have been ideal for everyone if LXC would have had better isolation, rather than having to run a userspace kernel emulator thingy for each container, but c'est la vie!

<comment><USER17> I work on gVisor. The answer is that having a separate kernel is required to achieve a high degree of isolation and by definition Linux containers share a kernel with the host. A separate Linux kernel could work as well, but gVisor tries to achieve a different set of trade-offs.

</comment></comment></comment></comment><comment><USER18> .NET Core?

</comment><comment><USER19> Where can I find more information on Cloud Scheduler & Tasks? Having a hard time googling it :) and the links go to a sign up form.

<comment><USER12> For Cloud Tasks, [https://developers.google.com/api-client- library/python/apis...](https://developers.google.com/api-client- library/python/apis/cloudtasks/v2beta2) should help.

<comment><USER19> Thanks! Unfortunately, there's a link to Cloud Tasks API on that page that 404s and there's not much else info on it. As far as I can tell, it's alpha. Maybe I can find the Google Next presentation on it.

<comment><USER12> The links to APIs I see on that page are [https://developers.google.com/resources/api- libraries/docume...](https://developers.google.com/resources/api- libraries/documentation/cloudtasks/v2beta2/python/latest/) and [https://developers.google.com/api-client- library/python/](https://developers.google.com/api-client-library/python/) , both work for me. The latter in turn points to [https://cloud.google.com/tasks/](https://cloud.google.com/tasks/) (Tasks Alpha) which also works for me. Maybe it only works for customers enrolled in the limited-access Alpha and as a Googler I'm automatically enrolled without knowing that...? But, I can also see the latter in an incognito window in Chrome...

<comment><USER19> Last link doesn't work for me. Tried multiple devices and browsers. Just 404s. I didn't find the first two links very helpful.

</comment></comment></comment></comment></comment><comment><USER20> Would be nice if Python was available in the cloud function environment.

<comment><AUTHOR> This is supported today! [https://cloud.google.com/functions/docs/writing/](https://cloud.google.com/functions/docs/writing/)

<comment><USER21> Do you have suggestions on whether to deploy simple (functional - no state or external resources used, except perhaps usage tracking) APIs as cloud functions or on the App Engine? What would be the "turning point" when it's best to start considering App Engine?

</comment></comment></comment><comment><USER22> Awesome! Have really been looking forward to this release.

</comment><comment><USER8> It wasn't already?

</comment><comment><USER22> Awesome!</comment>


Why we tolerate Facebook, but despise Google - <AUTHOR> http://notes.kateva.org/2012/04/why-we-tolerate-facebook-but-despise.html <comment><USER2> Didn't you get the memo? Hating on Google is the new "Micro$oft"...

<comment><USER3> Same with Apple. I'm starting to get the impression that animosity towards companies actually have nothing to do with the company at all.

<comment><USER2> Not just companies, politics too. For example, many people were swooning over Obama as The One and soon found out that he's in fact a mere mortal with virtues and flaws like the rest of us. Then they turn against him because "he let them down", as if he could've ever lived up to their unreasonable , super- human expectations. The reality, of course, is that the world is a messy place and we all do some really good things, and some really bad things, and a whole bunch of mediocre things. Microsoft makes a seamless office suite & email+calendar solution, Apple makes some really good hardware that leverages airtight software integration, and Google makes Web that much more tolerable to use. Thinking that any of them is Perfection Incarnate - or Beelzebub himself, on the other end of the spectrum - is infantile and counterproductive.

</comment></comment></comment><comment><USER3> Does he actually list any reasons for his "hatred" of Google?</comment>


Software Design Philosophy - <AUTHOR> https://ramcloud.stanford.edu/wiki/display/ramcloud/Software+Design+Philosophy <comment><USER2> I cannot believe how subjective it can get to discuss about such issues. You can discuss about the DO's and DONT's of programming with a fellow programmer for hours, and then he goes on his life and keeps writing infinite number of abstractions with little to no real benefit. Especially a common disease in Java world.

Writing clean and minimal code is hard, really hard... Great article</comment>


Why Marissa Mayer Told Remote Employees To Work In An Office ... Or Quit - <AUTHOR> http://www.businessinsider.com/why-marissa-mayer-told-remote-employees-to-work-in-an-office--or-quit-2013-2

<comment><USER2> So, Yahoo had a human resources/administrative problem, not a remote work problem. They failed to stay on top of their employees because they were working remotely. They were "hiding" and many didn't even know they were on payroll. That's a management failure. It can just as easily happen in-office.

<comment><USER3> True, but I can sympathize with her decision. It's fast and effective enough, and Yahoo needs to move quick.</comment></comment>


What's new in dbt 0.9.0 - <AUTHOR> https://blog.fishtownanalytics.com/whats-new-in-dbt-0-9-0-dd36f3572ac6 <comment><USER2> Hey - I'm one of the maintainers of dbt. Happy to chat about the software or generally how we think about analytics in here!</comment>


Dan Abramov Deactivates His Twitter - <AUTHOR> https://www.reddit.com/r/reactjs/comments/cv3jcp/dan_abramov_deactivates_twitter_account/ <comment><USER2> What is the significance of this?

I understand he is a core team member, but... so?

<comment><USER3> a lot more context is missing from this particular link as we didn't want /r/reactjs to host this discussion.

theres been unusually charged debates over the past few days in twitter js land. you're welcome to look it up if you wish but if you aren't already aware then i'd not recommend it.

<comment><USER2> I avoid twitter like the cesspool it is. Thanks for the warning.

<comment><USER3> personally i learn a lot thru twitter. u just have to mute and block liberally.</comment></comment></comment></comment>


SYN cookies ate my dog – breaking TCP on Linux (2018) - <AUTHOR> https://kognitio.com/blog/syn-cookies-ate-my-dog-breaking-tcp-on-linux/ <comment><USER2> This is excellent. I never thought about it that way. Indeed, with syn cookies the receiving party has no idea what was the original sequence number, so it will treat _any_ delivered packet as first.

Couple of caveats:

\- you can jam syn cookies enabled with tcp_syncookies=2 sysctl

\- syn cookies are generally bad because they prevent to negotiate window scaling. Window scaling is important unless you are doing low bandwidth like telnet :)

\- you can somewhat negotiate window scaling when tcp timestamps are enabled. But enabling tcp timestamps in general case brings little benefit and wastes 12 bytes of each packet for basically no gain.

\- for a bonus point, consider what happens when both syn cookies and TCP_DEFER_ACCEPT are enabled.

More about syn packet handling in linux [https://blog.cloudflare.com/syn- packet-handling-in-the-wild/](https://blog.cloudflare.com/syn-packet-handling- in-the-wild/)

<comment><USER3> > But enabling tcp timestamps in general case brings little benefit and wastes > 12 bytes of each packet for basically no gain.

I disagree; TCP timestamps are awesome. Linux enables these by defaults.

Quick search gives me some measurements from 2012 [1] that indicate that TCP timestamps are enabled on 83% of the top 100k web hosts.

You can afford to waste 12 bytes; the bottleneck isn't these 12 bytes but how well you get congestion control to work. And congestion control relies on getting an accurate estimate of the round-trip time

[1] [https://link.springer.com/chapter/10.1007/978-3-642-36516-4_...](https://link.springer.com/chapter/10.1007/978-3-642-36516-4_14) (paywall)

Edit: typo

Edit: Also, just because 83% of web hosts having it enabled does not imply that it is a good idea to do so in general. They could just all be running the linux defaults and these could be just wrong

<comment><USER4> You can measure RTT continuously, accurately, and even in the presence of packet loss just with selective acks and a little bit of extra bookkeeping in the sender.

It's hard to overstate how expensive TCP timestamps are. The thing is that they bloat every single packet including control packets. 2% of the world's bandwidth is being wasted on this.

The only reason for anyone to implement TCP timestamps today is that iOS clients have horrible receive window scaling if timestamps are disabled. (Well, that was the only reason a few years ago when I was still in the game of keeping up with the quirks of different TCP stacks.)

I wrote more on the subject at the time: [https://www.snellman.net/blog/archive/2017-07-20-s3-mystery/](https://www.snellman.net/blog/archive/2017-07-20-s3-mystery/)

<comment><USER5> I would guess that Apple could be convinced to fix this, if someone has the right contact. The iOS TCP stack shows a lot of care, generally: they do path MTU probing well, and they've deployed MP-TCP (requires apps to enable it though), among other things I can't remember. Fixing performance if timestamps are disabled seems like something they'd do.

</comment></comment></comment></comment><comment><USER5> FreeBSD had a more fun SYN cookie bug in 2015 (fixed here [1], and I think this is the diff where it was introduced [2]; determining which releases it touched is an exercise for the reader); the initial sequence of the sender had been left out.

I guess you would have a similar lack of dogs, but also, if a connection was opened and closed quickly, a re-transmitted packet from the client would satisfy the SYN cookie calculation, and the server would re-open the connection, but at it's original sequence number.

The details are a bit hazy, but the client would get an ACK with SEQ behind where it had ACKed, and would send an ACK probe with it's latest values. The server would see an ACK ahead of where it had sent, and send an ACK probe. If the hosts had low enough round trip times, the number of ACK probes sent could be tremendous. For those unfamiliar with FreeBSD, the localhost interface on FreeBSD runs full TCP, and under high load can drop packets and retransmit. We ran into this on localhost first, but then later across the internet with external clients.

[1] [https://github.com/freebsd/freebsd/commit/56ba0a68edde7b3832...](https://github.com/freebsd/freebsd/commit/56ba0a68edde7b38323f81f9d56998b10668dd9e)

[2] [https://github.com/freebsd/freebsd/commit/fc2be30b217171175b...](https://github.com/freebsd/freebsd/commit/fc2be30b217171175bae209edb4f697cc0cb542d)

</comment><comment><USER6> This write-up is from over two years ago (Feb 2018). I was curious if the issue has since been fixed. Turns out the functions for generating and checking the SYN cookie values have not changed since, so I guess it's safe to assume the bug has not been fixed.

</comment><comment><USER7> This particular problem is solvable by having (client_sequence_number+1) to be part of the HMAC (thus checking it as well), and by storing the MSS in the MSB part of the generated server sequence number rather than in the LSB.

Then every packet other than the first data packet will be discarded as invalid, and eventually the client-side retransmits will take care that everything works properly.

The problem that is impossible to solve, however, is the lost third ACK (acknowledging SYN-ACK) from the client , if the client doesn't send any data to server upon the connect. It's sufficiently rare in today's protocols, though.

Another problem that the above approach will create afresh is that it assumes that the retransmitted client SYNs will have the same ISN, which isn't the same in practice with e.g. some load balancers (who also try hard not to keep the state). And that behavior is kinda a slightly gray zone in the TCP spec, IIRC...

Edit: (I wonder if the last paragraph above is the real reason or I missed something else)

Edit2: oh, thanks to Majromax's mention of the DJB's write-up, the above has the problem of not complying with "sequence numbers increasing slowly", and indeed brings up a real-world scenario where that approach was an issue - using rcp/rlogin protocols, which reused a very narrow range of source ports, so the 5-tuple reuse was common.

<comment><USER5> > Another problem that the above approach will create afresh is that it > assumes that the retransmitted client SYNs will have the same ISN, which > isn't the same in practice with e.g. some load balancers (who also try hard > not to keep the state). And that behavior is kinda a slightly gray zone in > the TCP spec, IIRC...

I don't think this is a big problem with SYN cookies. If you get a SYN with initial sequence X, you send an appropriate SYN+ACK, and if you get a retransmitted SYN (because the other end didn't get your SYN+ACK), you send a new SYN+ACK appropriate for that one. If you then get an ACK for either, you would form a full connection; which should work fine.

I would have to review the RFCS, they might say that if you had room in your syncache to hold the data, you should send a RST to the second SYN or the first SYN, because the states are conflicting; but since you don't have the information you don't have the information.

Anyway, unless the client end is _really_ messed up, it shouldn't send both the ACK on the first SYN, because it received your SYN+ACK and a new SYN, because it didn't receive your SYN+ACK. I acknowledge that there are plenty of really messed up TCP stacks on the internet though :)

<comment><USER8> > Anyway, unless the client end is _really_ messed up, it shouldn't send both > the ACK on the first SYN

This is a race condition; hypothetic sequence of events:

      send SYN-0, wait for reply or timeout
      timer interrupt fires
      timeout to resend SYN(-1) is ready, start running that
      packet interrupt fires (interrupts resend)
      got SYN+ACK-0, construct and send ACK-0
      iret
      finish constructing SYN-1 and send it
      iret again

This is clearly a bug, but it could easily work >99.99% of the time (especially if the timeout is high enough that normal RTTs never hit it, which is probably how the person setting the timeout would try to set it).

<comment><USER5> Yeah, I guess someone could write that, and if it worked mostly it would get shipped. Like you said in another post, ugh.

Overall, I'd rank that like a 3 out of 10 on the scale of tcp bugs in the wild.

</comment></comment></comment></comment><comment><USER9> I've noticed some issues a while ago with TCP syn cookies breaking DLM cluster setup of 64 hosts. (63 hosts all trying to join the same cluster generate enough TCP traffic that the kernel thinks it is a flood and starts sending syn cookies, but then the DLM join of some hosts doesn't actually complete). This can be worked around by increasing the backlog (one of the mitigations listed in this article):

      --- a/fs/dlm/lowcomms.c
      +++ b/fs/dlm/lowcomms.c
      @@ -1209,7 +1209,7 @@ static struct socket   *tcp_create_listen_sock(struct connection *con,
       log_print("Set keepalive failed: %d", result);
      }

      - result = sock->ops->listen(sock, 5);
      + result = sock->ops->listen(sock, 128);

This is mostly a theoretical issue, because upstream RHEL used to support only up to 16 hosts in a cluster.

</comment><comment><USER10> Awesome write-up, thanks for sharing.

Network is fascinating. I initially introduced myself to the subject by reading Michal Zalewski's _Silence on the wire_ [1]. I really recommend it to anyone who wants to do the same.

[1] [https://nostarch.com/silence.htm](https://nostarch.com/silence.htm)

</comment><comment><USER11> It's interesting to look at this from the perspective of HMAC codes: the host uses (several bits of) the sequence number as an authentication code over other aspects of the connection. The client IP and ports are elsewhere in the packet, so the sequence number also needs to carry data for the timestamp and maximum segment size.

From that security-based perspective, this bug seems to belong in a common category of data escaping the hash -- here where the (sequence number + MSS category) sum has hash collisions.

</comment><comment><USER12> In my uneducated mind, it seems like the connection should only be accepted if the initial handshake ACK packet is completely empty.

</comment><comment><USER13> Well what's the mitigation for Linux? Did they end up disabling the MSS negotiation?

</comment><comment><USER14> Do yourself a favor and disable all javascript and XHR on this website if you visit.

</comment><comment><USER15> (2018)

</comment><comment><USER16> This bug really just falls in with "You didn't encrypt and authenticate your data, so anything could have happened".

Sure, this time it's a software design bug in the endpoints, but next time it might be a cosmic ray, or an evil middleman, or a buggy proxy. If data isn't encrypted and authenticated, then you shouldn't care what form it arrives in.

<comment><USER17> Nothing in this post says that the data wasn't authenticated; in fact, the symptom they saw (the client is kicked off because the server doesn't understand the message) is exactly what would happen if the data _was_ authenticated.

<comment><USER11> The data's authenticated, but the authentication is accidentally broken. SYN(seq_num) and SYN(seq_num+3) can both generate the same cookie using a different (but still valid) maximum segment size.

To lump this into an existing category of bugs, syn cookies are a kind of HMAC, only the implementation is custom and nonstandard. It isn't a surprise that a bespoke HMAC leaks, but to the credit of kernel developers syn cookies the initial 1996 specification pre-dates the common understanding. (But to its demerit, it looks like the DJB spec ([http://cr.yp.to/syncookies.html](http://cr.yp.to/syncookies.html)) would have not had this issue, since the MSS was encoded in the _top_ bits of the cookie and not the _bottom_ bits.)</comment></comment></comment>


Square Appointments - <AUTHOR> https://squareup.com/appointments <comment><USER2> Why would I pay $90/mo [1] with Square when I can pay for the same services and features directly from BookFresh for just $20/mo [2]?

In case you are not aware, Square purchased BookFresh back in February [3].

I think it's a safe assumption that Square Appointments is just rebranded BookFresh

[1] [https://squareup.com/appointments#pricing](https://squareup.com/appointments#pricing)

[2] [https://www.bookfresh.com/pricing](https://www.bookfresh.com/pricing)

[3] [http://techcrunch.com/2014/02/26/square-acquires- bookfresh-t...](http://techcrunch.com/2014/02/26/square-acquires-bookfresh-to- add-booking-services-for-merchants/)

EDIT: links

<comment><USER3> If they stop marketing BookFresh...people don't buy what they don't know about, eh?

</comment></comment><comment><USER4> Square bought BookFresh in February. [http://techcrunch.com/2014/02/26/square- acquires-bookfresh-t...](http://techcrunch.com/2014/02/26/square-acquires- bookfresh-to-add-booking-services-for-merchants/)

</comment><comment><USER5> Thanks HN for these comments.

I was looking for an appointment SaaS for a dental office and was only aware of ZocDoc[0] which charges a steep $300 per month.

[0][http://www.zocdoc.com](http://www.zocdoc.com)

<comment><USER6> ZocDoc's offerings are a little different - they are essentially doing patient scheduling and marketing/outreach for you, and getting doctors / dentists new patients (from what I understand about patient economics, about 1 a month justifies the spend).

<comment><USER5> ZocDoc is certainly different, but for a small office $240 a year is easier to digest than $3600 a year. If it's for a group practice, then it's a different story. I don't think ZocDoc is particularly great with marketing and outreach, it's basically Yelp + appointment scheduling.

<comment><USER7> I can comment on both ZocDoc as I have second hand experience with a DDS that uses it. ZocDoc handles marketing and DRIVES patients to book appointments by showcasing them on their website and mobile apps. It doesn't guarantee new patients, but younger demographic of people DO prefer to use it over the phone call method. Dentists also get reviews from verified patients, which builds credibility (vs Yelp reviews from anyone).

I see value in Square Appointments because they're enabling scheduling management and communications on web and mobile. So an underutilized small business website can now add that capability. Pricing is competitive. It's the cost of doing business.

Another note. An API would be useful.

Great post. Looking forward to integrating this for a DDS.

</comment></comment></comment></comment><comment><USER8> Most of the comments here seems to be about the pricing. IMO if you're a small business, the pricing is fair. Yes, competition may be better/cheaper but keep in mind that Square is trying to create an entire platform here. They've got payments, point of sale, invoicing, and analytics.

</comment><comment><USER9> So I wonder what ran through patio11's mind when he read that...

Though it is an all or nothing proposition - you can't take just the appointment reminding features and leave everything else.

<comment><USER10> Prior to reading this my top of mind worry was wondering if I'll make it up Mt. Fuji today. After reading this, it still is.

<comment><USER11> [https://siteanalytics.compete.com/appointmentreminder.org](https://siteanalytics.compete.com/appointmentreminder.org) "This site has relatively low traffic."

[https://siteanalytics.compete.com/squareup.com](https://siteanalytics.compete.com/squareup.com) Jun 2014 Unique Visitors: 1,403,543

Don't you worry about squareup consuming all the oxygen in your room?

<comment><USER12> This is an object lesson about customer segmentation and about purchasing intent.

</comment></comment></comment></comment><comment><USER13> Is there any automation of the common yet difficult problem of "your dentist / hair stylist / doctor has called in sick today and we're trying to reschedule all of todays appointments". This is not all that unusual. My wife's hair stylist was sick two appointments ago and my kids pediatrician office (windowless) had a summer time air conditioning failure.

Its not in the PR page so I assume its not handled although this would be a very handy feature. "One click reschedule everyone for today"

</comment><comment><USER14> Why is it not free? These additional features are to lure you in to using the payment platform and lock businesses in. More so I need end-users to also install the square app to use this feature. So there is that additional friction as well. This is really not something they should be charging for.

<comment><USER15> If you have enough business that you need a scheduling solution, I don't think $90/mo for all-you-can-eat SaaS is anything businesses would think twice about. Actually, I think it's odd how Square Cash is totally free and always makes me question what the catch is (probably that you'll end up with your data in some next-gen consumer credit scoring system).

<comment><USER16> > I think it's odd how Square Cash is totally free

My assumption has always been that this cannot last. That said, if it's only free when you're using another paid Square product, that could be a really interesting approach.

</comment></comment></comment><comment><USER17> I'm interested in this new wrinkle, and always looking for something that will help out my day. But is $30 a month, for a single person, a competitive pricing plan?

<comment><USER18> For some businesses, that's going to be paid for in the first day or two if it's able to reduce no-shows.

</comment></comment><comment><USER19> I shopped around for a service like this a week ago.

We went with Setmore: [http://www.setmore.com](http://www.setmore.com). Clean design, their branding is subtle on the free tier, multiple staff/services, ical, and most of all it's extremely easy for customers to create/re- schedule/cancel appointments.

Over Square Appointments I'd say their pricing is much more keen (substantial free tier, $25/month premium).

</comment><comment><USER20> Another example of Google squandering a good thing. They had appointments built into calendar, pushed Google apps to businesses, then promptly shut down appointments.

I just recently noticed They slipped appointments back in to Google Apps Calendar, but it's still just wonky and not integrated well in typical Google fashion.

<comment><USER21> I don't think Google is interested in getting into this business...

<comment><USER20> They are inherently in this business through Google Apps, they even offer the appointment making feature and functionality. It's just poorly executed, just like so much at Google.

<comment><USER21> I.e. they don't care about this as a product, do they don't invest in it.

</comment></comment></comment></comment><comment><USER22> I wonder why there don't seem to be many open-source options in this space?

I did a Google before, but I could only find a single option - [https://code.google.com/p/easy-appointments/](https://code.google.com/p/easy- appointments/), a PHP app.

Is anybody aware of any others?

<comment><USER4> Disclaimer: I develop [http://makeplans.net](http://makeplans.net) which is also an online appointment booking solution (SaaS).

I don't think any of our clients would be interested in hosting their own software. Most of our clients don't even have an IT-department. But sure there is a market for open-source solutions as well. Particularly if you need customisation or to be integrated with offline applications. But with a good API and API-connecting services like Zapier integration is becoming less and less a valid point to host your own software.

I never heard about Easy Appointments before, thanks for the link it actually does look quite good unlike most other open source business applications. There a few other open source solutions out there but it is more like Wordpress plugins.

</comment></comment><comment><USER23> Congrats to Square on their new product. Execution looks a bit "cheap" but I'm sure they will be working hard on it.

I recommend [https://www.appointlet.com](https://www.appointlet.com) for online appointment scheduling.

</comment><comment><USER24> Seems like they are competing with MyTime - [http://www.mytime.com](http://www.mytime.com). The only thing they lack is good search to find businesses

<comment><USER25> This opens the door for them to compete with a lot of these platforms. Since they already have the hardware on site (iPad) they start to become a competitor for StyleSeat, MyTime, Noshlist, NoWait, etc.

<comment><USER24> Yes the greatest advantage SquareUp has is that they already have a list of clients that they can advertise this to. Clients that might be using their SquareUp credit card processing system.

</comment></comment></comment><comment><USER26> Isn't this what patio11's Appointment Reminder essentially does?

</comment><comment><USER27> Competing with appointment reminder now ;)

</comment><comment><USER28> My barber uses Appointy.

[http://appointy.com/](http://appointy.com/)

</comment><comment><USER25> It's really cool to the additional value being added tot he platform outside of payments.</comment>


Code search for the open source - <AUTHOR> http://codevisually.com/cocycles-open-source-search-engine/ <comment><USER2> please submit the original site and not a page linking to it.</comment>


Behind-the-Scenes Glimpses of Google - <AUTHOR> http://mashable.com/2010/07/23/google-office-tour/

<comment><USER2> Fairly accurate stuff, but nothing Earth shattering. Just a collection of YouTube videos from a while back.

</comment><comment><USER3> Makes me think of Rome before the fall. I can't help but wonder if this brings success, or just what success brings.</comment>


The Quest to the Perfect Makefile - <AUTHOR> https://r4nd0m6uy.ch/the-quest-to-the-perfect-makefile.html <comment><USER2> This is a good rundown of GNU Make capabilities. Be careful about relying on things like pkg-config to auto-discover dependencies, since distros changing things will permanently break the entire history of your project. Then you can't git bisect and have to use things like Docker to go back and examine old versions.

Here's a Makefile I put together recently that builds over 9000 objects, 72 libraries, and a few hundred executables. [https://github.com/jart/cosmopolitan/blob/master/Makefile](https://github.com/jart/cosmopolitan/blob/master/Makefile) The interesting part I've noticed is tuning the makefile so it correctly orders linker arguments, making sure the relationships between granular libraries is a DAG, and being able to build individual targets without building the world. GNU Make probably makes this easier than any other tool, since it's secretly a functional programming language. Which is something that might frighten the uninitiated.</comment>


Built-in Graph Database in SQL Server 2017 - <AUTHOR> https://docs.microsoft.com/en-us/sql/relational-databases/graphs/sql-graph-overview <comment><AUTHOR> Interesting developments with the latest SQL server version announced: [https://blogs.technet.microsoft.com/dataplatforminsider/2017...](https://blogs.technet.microsoft.com/dataplatforminsider/2017/04/19/sql- server-2017-community-technology-preview-2-0-now-available/)

Was thinking about migrating to Postgres but SQL server on linux with graph processing is a great combination.</comment>


Google owned TLDs don't have a records any more - <AUTHOR> <comment><AUTHOR> Think I hit a bug with the HN submission (might have submitted a localhost URL). This is the correct URL: [https://captnemo.in/blog/2018/06/02/google- tld-no-more-a-rec...](https://captnemo.in/blog/2018/06/02/google-tld-no-more- a-records/)</comment>


Why is it so annoying when people are ambiguous? - <AUTHOR> <comment><USER2> This is only annoying to some people. I don't know if it's part of a person's brain structure or just a preference, but some people are fine with ambiguity and others are not at all.

My personal theory is that some people learn generalized coping mechanisms for various situations in life and other people prefer to memorize scripts for dealing with some situations. We all probably do a little bit of each, but some people prefer one or the other. My theory is that people who like to memorize specific steps to take to solve problems don't deal with ambiguity well.

<comment><AUTHOR> Thanks! This is helpful

</comment></comment><comment><USER3> It reminds us of how little we feel like we have accomplished, which triggers jealousy.

<comment><AUTHOR> So not knowing something makes us feel jealous of people who possess certainty on something?</comment></comment>


Show HN: Top 10,000 Hacker News Posts of All Time – Interactive Visualization - <AUTHOR> https://www.sizzleanalytics.com/Boards/sizzle/Hacker-News-Top-Posts-All-Time/dfb2af8e-67fa-47a7-892c-435de6321378 <comment><AUTHOR> Hello HN,

I am one of the developers that built sizzleanalytics.com. We built this tool using d3, dc, and crossfilter.

We'd love for it to become the "github for data visualizations". You can upload your own data, clone or fork public visualizations, or keep your data private, all for free.

We're actively building out new features, so we'd love to hear your thoughts.

If you're interested in how we gathered the data for this visualization, here is a blog post about it: [http://aaron-hoffman.blogspot.com/2016/10/hacker- news-datase...](http://aaron-hoffman.blogspot.com/2016/10/hacker-news-dataset- october-2016.html)

Archives of all 10MM json files are available there as well.

</comment><comment><USER2> Les we forget [http://www.drop-dropbox.com](http://www.drop-dropbox.com)

<comment><AUTHOR> this website does not use or require dropbox</comment></comment>


Who Pays on the First Date? No One Knows Anymore, and It's Really Awkward - <AUTHOR> https://www.wsj.com/articles/who-pays-on-the-first-date-no-one-knows-anymore-and-its-really-awkward-1498488525?mod=e2tw <comment><USER2> On the first date with my current girlfriend, she offered to pay for her dinner. Pleasantly surprised, I told her she'd, "...pay for the next one (date)." She took it really well!</comment>


Ask HN: ethics questions in HCI design? - <AUTHOR> http://www.quora.com/What-could-be-the-ethical-or-moral-issues-involved-with-Human-Computer-Interaction (I didn't ask the question, but I saw it and thought it was interesting enough to write an answer and solicit more.<p>Does that still go with the "Ask HN" monicker?) <comment><USER2> I posted the same link over there: <http://wiki.darkpatterns.org/Home> this is a great resource for learning how the UX can be used to manipulate users.</comment>


An Open Letter to PHP-FIG by Anthony Ferrara - <AUTHOR> http://blog.ircmaxell.com/2014/10/an-open-letter-to-php-fig.html

<comment><AUTHOR> And the follow up: [http://blog.ircmaxell.com/2014/10/a-followup-to-open- letter-...](http://blog.ircmaxell.com/2014/10/a-followup-to-open-letter-to- php-fig.html)</comment>


Charlie Munger: 'The Phone Is Not Ringing Off the Hook' - <AUTHOR> https://www.wsj.com/articles/charlie-munger-the-phone-is-not-ringing-off-the-hook-11587132006 <comment><USER2> This quote from Munger is what I find most interesting:

> I do think, sooner or later, we'll have an economy back, which will be a > moderate economy. It's quite possible that never again—not again in a long > time—will we have a level of employment again like we just lost. We may > never get that back for all practical purposes. I don't know.

There are roughly 2 ways this could go if what he says actually happens. One is that a lot more people are going to suffer economically because of a lack of employment. The other, which is what I'm hoping for but not expecting, is that we take this opportunity to acknowledge that Keynes was right, and we don't have to work as much as we do. If we can strengthen our social safety net so that being out of work does not necessarily imply falling deeply into poverty (not that being unemployed should necessarily be a great deal, just that folks shouldn't be losing their homes and their health insurance, and should still be able to lead a fairly basic life), then I think this whole crisis might have a silver lining.

<comment><USER3> The whole idea that 'being social' equates to 'socialism', the bogeyman edition is what will stop for instance the United States from adopting a more social agenda. Free - or at least affordable - public healthcare, public transportation, internet access and access to things like clean water should be a basic standard of living for any country that does not want to be labelled 'third world'. Instead, that whole agenda has been hijacked by parties that make it seem as though being nice & normal to your fellow human beings is somehow a bad thing because once upon a time someone else had an ideology that shared the same prefix.

<comment><USER4> The USA is effectively 50 countries with different demographics, geography, culture, and needs. Trying to impose any "one size fits all" solution won't work because it's not appropriate for a significant number of them.

<comment><USER5> The USA is a single country with what's effectively two demographics, and one- and-a-half breeds of politician.

"50 countries with different demographics geography culture and needs!" is a complete fabrication. Wyoming doesn't even have a million people in it; implying Wyoming is a country is like implying a go-kart is a jet.

<comment><USER6> I don't think culture is population dependent. Baltimore and Wyoming have roughly the same population but very different cultural attitudes, beliefs, ways of life etc. Its hard to make a case they should have the same policies and expect the same results

<comment><USER2> It's not so much population _per se_ as the urban/rural divide. Baltimore is a city (arguably a megalopolis of Baltimore + Washington DC + Northern Virginia and nearby areas of Maryland). Wyoming, OTOH, is the 10th largest state geographically, the least populous, and literally has more cows than people [0, 1]. If I had to guess, I would say there probably hasn't been a significant number of cows in Baltimore in over 200 years.

\---

[0]: [https://en.wikipedia.org/wiki/Wyoming](https://en.wikipedia.org/wiki/Wyoming)

[1]: [https://www.vox.com/2016/5/3/11504568/states-most- cows](https://www.vox.com/2016/5/3/11504568/states-most-cows)

<comment><USER6> I don't necessarily disagree, my comment was largely based in response to the OP seeming to think population was major discriminator.

Even at the city level, I think its is too broad of a generalization. Berkeley and Baltimore have roughly the same population density but very distinct cultures

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I think the challenge here is the government is probably offering better terms than can be expected from Buffet. If someone is offering me free money, and someone will give me money if I give them control of my company guess which one I'm calling first.

<comment><USER2> I wonder if that means Berkshire's recent bond offering was a mistake: [https://www.fool.com/investing/2020/04/12/this-warren- buffet...](https://www.fool.com/investing/2020/04/12/this-warren-buffett- strategy-could-bring-you-succe.aspx)

Berkshire has always held a ton of cash for just such an occasion. They can just buy up equity on the open market and take substantial control of a company. But, did they need even more money?

<comment><USER8> It's Yen-denominated debt-- mostly useful to Berkshire so they can make Yen- denominated investments without currency risk. It's at less than 1% a year, which costs virtually nothing given the options it opens up for Berkshire. And you'll note that that debt makes up less than 1% of its total cash position, it's really just there so Berkshire can buy something quickly in Yen if an opportunity shows up.

<comment><USER9> oh man. nothing you have said make any kind of sense.

if they have yen-denominated debt, then they have added currency risk

if it is 1% of their cash position, they can just use some cash and buy yens and have those yens available.

if they have hedged the bond currency risk, then they might as well have hedged it after buying yens in the open market

if it's 1% interest, it is still probably more than the interest they earn on their cash position.

just saying...

(MAYBE, maybe, its a tax issue)

<comment><USER8> You're coming at this from a "hedging" perspective-- Instead, think in terms of what the bond gives him-- a lot of Yen. That's opportunities to invest. The increased "risk" in this sense is miniscule-- since the cost of the oppurtunity is less than 1% Yen a year, even a 200% rise in Yen/USD only actually costs Berkshire 2%.

And, my bet is Buffett knows of some companies he could deploy that Yen in right now to cover the interest anyway. He's just lying in wait for better oppurtunities.

Now, there could be some other thing going on-- but taxes-wise in general U.S. companies issue US-denominated bonds to repatriate funds so I'm sure where you're going with that. My bet would be if it's not just for the opportunity, it may for their re-insurance reserves.

<comment><USER10> This doesn't make any sense. Issuers don't need to pre-fund acquisitions before making offers so BRK wouldn't need any JPY before acting and in the event of an acquisition closing, they would easily be able to issuer in any currency on earth. Don't know the name well at all but BRK issued in JPY last year as well so I'm guessing they have some recurring JPY liabilities.

<comment><USER8> What doesn't make sense to you? They're "buying" Yen and paying extraordinarily low long-term rates. Berkshire can't get USD that cheaply. If they had a cash crunch, they could exchange the Yen for USD. If things are well, they can buy Yen-denominated companies with an enormously low cost of capital and without factoring in the exchange rate.

</comment></comment></comment></comment></comment></comment></comment><comment><USER2> [https://archive.is/eAFo7](https://archive.is/eAFo7)

<comment><USER11> curious FF / Safari through up security warnings for archive.is and archive.today. going at them from a roundabout way gives me a CloudFlare DNS error page. this's been going on the last week or so. wonder what the problem is?

<comment><USER8> Don't know about the FF thing but here's the CloudFlare thing straight from their CEO--

[https://news.ycombinator.com/item?id=19828702](https://news.ycombinator.com/item?id=19828702)

<comment><USER11> that explains the trouble I'm having. i have my local network resolving to 18.104.22.168. Or was it 188.8.131.52? Or 184.108.40.206?

i'll have to dig into this a bit more. thanks!

it's always dns :-)

</comment></comment></comment></comment><comment><USER12> No amount of govt money will ever cause inflation again. The tools for govt intervention (the Fed rate, quantitative easing through the purchase of Tbills,etc) may have been effective in the time when the world was simpler (Remember 'It's a Wonderful Life' with James Stewart?). But loans from banks do not drive the economy any more. In fact many businesses look to VCs, and angels. Loans are for chumps. So what DO these tools do? Where does the money go? It goes to places that will generate the highest ROI - other financial opportunities and investments removed from the real world. In fact, I would interpret that skyrocketing stock market as evidence of too much money chasing too few equities. There may be 'inflation' of equities prices, bond prices, REIT prices, etc. But unless the money gets into the hands of the people who need a house or need a job or need food, it won't help the economy. Adam Smith's laws and the 'invisible hand' of the market assumes a continuous distribution of currency transacted by rational agents with equal access. Instead the world is quantized and now a large fraction of the population are below the threshold where these interventions are meaningful.

<comment><USER13> Yes. The system is inherently unproductive. Pumping more money into it like giving a sedentary person more calories and expect their physique to end up like an athlete's.

But you can also pump that money into the hands of people and have the same problem. If you give everyone 10K you haven't change affordability. If you give everyone 10K you haven't changed relative food prices. There are more fundamental problems to be solved.

</comment></comment><comment><USER14> The stock market is at its most expensive on a forward p/e basis. There is nothing about this supposed recession that has made stocks cheap for a firm like Berkshire to scoop up.

</comment><comment><USER15> Value investing has been replaced by government support. Big companies like airlines are not allowed to "get cheap" anymore. From Berkshire Hathaway alone, there are hundreds of billions of dollars of private money waiting to step in during times like these. Instead, we will "bail out" aggressively managed companies and encourage all big companies to be more aggressive going forwards. Because they have a government backstop preventing them from failure. This will lead to more bailouts in the future, the burden of which falls to all American taxpayers. We are deviating from the incentives that make capitalism such an effective force.

<comment><USER16> A counterpoint and a reason for hope: After the 08 crisis, the big banks were required to keep aside a lot more money in reserves, agree to periodic stress tests by regulators, and forgo certain risky activities(proprietary trading).

Now regulators/management are pretty confident that the banking sector is robust and a 08 like crisis cannot happen again.

<comment><USER15> I spent two years studying US regional banks and I can tell you that what you're saying is factually correct. 08 effectively nationalized the big banks. "Too big to fail" means any bank over a certain asset size will be rescued by the government if it gets into trouble. Basically, bankers get the upside if loans go well, taxpayers get the downside if they don't. The worst kind of nationalization. But the 08 regulations were so stringent that it would be very hard for banks to fail. Like you said. However, since that time, politicians decided that the regulations of 08 were too constricting to banks and were hurting small and medium biz growth. So a bipartisan coalition in Congress lifted the regulations for all banks <$250Bn asset size. Deregulation. So now, these bankers are free to chase profits without the chains from 08 and if their banks end up failing, we will still bail them out. The worst of both worlds.

</comment></comment></comment><comment><USER17> [https://archive.md/eAFo7](https://archive.md/eAFo7)</comment>


Ask HN: Launching an App on Thanksgiving? - <AUTHOR>

I'm launching an iOS app specifically targeted at the HN audience, and given current appstore ETA and date of submission there's a strong probability it will be approved on Thanksgiving... What do you recommend? Launch on Thanksgiving anyway, or this is a bad launch period (people spending time with their family) and I should delay until the week after ? <comment><USER2> I've managed tons of product launches at Airbnb, Munchery and other startups as a consultant.

Do not launch on Thanksgiving. Trust me. Delay until the week after.

Also you should know that Thanksgiving through New Years is by far the worst time of year to try and launch a new (consumer) product of any kind. Every single (consumer) product in the world fights a bloody battle for attention and sales this time of year. Every store, every brand and every product category will be filled with promotions and/or slightly new offerrings.

If you must launch during that window, what you're launching must be either a) fucking amazing itself or b) your fucking amazing at marketing to cut through all that noise.

<comment><AUTHOR> Thanks, this is more or less what I thought. From your experience then, when is the optimal time of year to get attention for a new product?

This is slightly different for my app as it's only targeted at HN users, and my intention is not to make a living off it. Still I'd like to make sure it gets a fair chance to be noticed.

</comment></comment><comment><USER3> Take my, and everyone's advice, with a grain of salt. Few people have experienced enough launches to offer a very objective view of the patterns, so you're going to have to make the decision for yourself.

As a rule of thumb, from the launches I've seen and been close to, they are not make-or-break for a company/product. You might get a bit of buzz, you might have a TC or RWW article about you, but as I think of successful startups that I didn't personally know, I can remember only a few launch days.

The important factor is in one of two categories:

1) consumer app: the app produces a TON of value, and everyone tells the people they know (viral growth)

2) business app: viral growth is a factor, but there's probably going to be a lot of sales-y activity required.

Neither of these categories are largely dependent on a launch. A launch is more important when you've already got a ton of eyeballs.

Again, this is a rule of thumb, and I'm not aware of a single person who I would say is a true expert around launches.

What do you think?</comment>


Storing secret crypto keys in the Amazon cloud? New attack can steal them - <AUTHOR> http://arstechnica.com/security/2015/09/storing-secret-crypto-keys-in-the-amazon-cloud-new-attack-can-steal-them/ <comment><USER2> Direct link to paper (article is a decent summary, though): [https://eprint.iacr.org/2015/898.pdf](https://eprint.iacr.org/2015/898.pdf)</comment>


Annoying Things that VCS say or ask (and how to think about them) - <AUTHOR> https://elizabethyin.com/2019/05/17/15-annoying-things-that-vcs-say-or-ask-and-how-to-think-about-them/ <comment><USER2> >> We're going to pass but will be cheering for you from the sidelines. (@comaddox)

> This is just a ridiculous phrase and pet peeve of mine. What is this?

Don't look a gift horse in the mouth! When a VC says "we're going to pass", that is a godsend - it's a straight no. It saves so much time, and they aren't screwing with you trying to move the goal posts or ask for more traction or a lead or anything else. They're doing you a huge favor by saying no.

They only tacked on the "cheering you on from the sidelines" to be _nice_. What's wrong with being nice? Chances are quite high that they truly would love to see you succeed, they just don't want to give you their money, and there are a hundred and one reasons they might not want to give you money, most of which aren't any kind of judgement or insult on you.</comment>


Things I Learned to Become a Senior Software Engineer - <AUTHOR> https://neilkakkar.com/things-I-learned-to-become-a-senior-software-engineer.html <comment><USER2> It seems millennial achievement medals have now become job titles. Two years to become a senior engineer out of college is a joke. You only just know how to work in a general sense in that time frame, domain expertise comes much later. After a University degree, you only really know what page in your textbook to turn to when you recognise a problem. I come from a mechanical engineering background and it probably takes between 6-8 years to become a senior engineer, and it genuinely takes that long to learn enough so that you don't harm someone with your shitty design.

<comment><USER3> I agree 100% with you

Have worked as both PM and developer and now run my own very small software company

A) two years senior engineer is like one of those consulting companies where everyone in 2 years becomes DIRECTOR

B) In two years most new programmers have not even gotten their heads out of their asses

C) You should refer to Outliers

10,000 hours to master a task

And to that add

10,000 hours to make your first masterpiece

D) Even if you have managed to get 10,000+ hours of coding experience in high school and college and somehow become a very good programmer (which less than 3% of CS grads do)

it will still take you 6 to 10 years to get another 10,000 hours of working on masterpieces and making really good software that you can ship and make money from

E) a title like 'Senior Software Engineer' should be reserved for someone who has MADE and SHIPPED and GENERATED MONEY from a very good piece of software or some software product

F) Personally, I would think any company handing out Senior Software Engineer titles after 2 years is a joke

Between all the places my friends and college mates and I have worked (Microsoft, Google, Amazon, Facebook, Oracle, etc. etc) I can't think of any place that handed out Senior Software Engineer like it was candy

Even very, very good programmers had to EARN IT

<comment><USER4> _E) a title like 'Senior Software Engineer' should be reserved for someone who has MADE and SHIPPED and GENERATED MONEY_

Not all software is made to make money.

There is a more convincing argument that saving time is a motivator in a significant proportion of software either directly or indirectly; but honestly that ugly assumption of monetary motivation in everything of value is quite alienating to some of us - even in something as benign (?) as a discussion here.

<comment><USER5> Time is money

<comment><USER4> That saying is why I suggested time as a more useful (but still limited) alternative.

</comment></comment></comment></comment></comment><comment><USER6> To start with, "Senior" and related titles basically mean a person who doesn't need much hand-holding. This might be related to time spent, but often you find there's a lot of variation.

People I consider senior software engineers have a can-do-anything vibe about them. They have a wide range of skills in the field, and have that T-shaped experience profile: there's some area they seem to know everything about, and then they somehow are able to say something sensible about a whole lot of other areas. For instance I worked with a guy who wrote financial exchanges but could also write a modern front-end, understood how kubernetes worked, and knew a fair bit about databases. You couldn't throw out a term that he couldn't place (X is a language / framework / pattern / OSS project), and you couldn't come up with a problem that he didn't know the closest well-known adjacency for.

That's a vague outline of what I think a senior dev is.

To get there is a long story. I think you need the good fortune of not being siloed in something very specific or superficial. That might even include having the "good fortune" of being forced to change jobs a few times. You also need some luck in your personal life to be able to explore a bunch of stuff in your own time, plus some funds (probably less relevant today where everything is an online service).

<comment><USER7> My experience is people in "senior" roles are more often than not people who pushed to be put in those roles regardless of how much experience they may or may not have. I know people placed in "senior" roles at 19-21yrs old. I'm not saying age is a qualifier but in this case it was clear they didn't have any special skills. But once they were given the role it carried them through their career. With the title on their resume they continually got hired and higher and higher levels.

</comment></comment><comment><USER8> While it's not impossible. I find it hard to believe anyone could become _senior_ (in terms of actual skill) in two years.

<comment><USER9> This is a very subjective question. I think a senior engineer is an engineer who can develop features without hand-holding. The technical leader should be able to say, "Develop feature X. These are the requirements." and then not worry.

But what "senior engineer" means varies from company to company. So it becomes a loose term.

<comment><USER10> > This is a very subjective question. I think a senior engineer is an engineer > who can develop features without hand-holding. The technical leader should > be able to say, "Develop feature X. These are the requirements." and then > not worry.

In pretty much all companies those were just called "software engineers". Seniority requires decision making and longterm leadership skills, not just implementation work.

</comment></comment></comment><comment><USER11> A manager gave him the "senior" title. Where I am, "senior" means "experienced". When you need a senior developer in a team, means you need someone that went through many projects and know the errors and mistakes a team can make.

Building mental models is great, but you need to have used a few times in different context, to really appreciate when and how they were the most appropriate.

The experience of handling multi-years projects (and getting back to them after a few years too) has no equivalent.

You can read as much as you like, nothing beats experience, which you will get after years and years in the job.

</comment><comment><USER12> There are a number of commenters here getting hung up on what is or is not expected of a "senior" employee, which ignores the likely explanation that "senior" is something that costs a company exactly as much or as little money as they want it to. Think of it like "air miles" or "rewards points". The hiring market has been extremely tight in recent years, and so it's natural to see companies leverage job titles as part of competing for employees. (You might hear managers say "we're just not getting a high enough _quality_ of candidates for this role", and an easy thing to do is to increase the job title. Increasing the salary and benefits is much harder since it requires justifying more budget.)

True, the employee can now leverage the job title for more compensation, with their current and potential employers, but _the onus is on the employee_ to negotiate, and in the meantime the employer gets the benefits. (Note that "benefits" does _not_ mean that the employee suddenly becomes better than they are, it means that a known-quantity employee continues to do satisfactory work for the company for a time, at an acceptable price.)

</comment><comment><USER13> There is a shocking amount of ad hominem and focus on the years of experience in this article. Are people actually reading the article? Perhaps surprisingly, it's really fucking good. I'm absolutely planning to share this with junior devs that I work with.

Author may not realize how much more there is to learn than he already knows, but we all kind of have that problem, just at different scales, am I right? He's doing all the right things, learning the right lessons, and is on track to be senior whether he has that title at work or not.

<comment><USER14> Thank you, darkerside!

One meta-goal of the post was to figure out how I can grow further. Are there things on top of your mind which I should be exploring next?

<comment><USER13> One thing I'd expect to see more of in this type of article would be understanding the business domain. It sounds like you understand the value of doing so from your section on leaning what others around you are doing. But I think over time, you'll see that learning those specific business nuances is what separates the promising engineer from the seasoned veteran who hears a business problem and already knows the 4 ways it's been attempted to be solved and why they didn't work. And importantly, still has the optimism to try again in a different way! I recognize every organization is different so YMMV.

Rereading my post it may have came off as a bit of a backhanded compliment and wasn't intended as such. Terrific post. I think it will help a lot of people.

</comment></comment></comment><comment><USER15> This person has been promote one level up from the new grad level. Not exactly what I would describe as senior

</comment><comment><USER16> It's a good start but still some way to "Senior". Keep up the good work.

Now, it is easy to start giving "tips", but I think nothing replace good old learning on your own mistakes. Thus, the only tip I can give is to be reflective and honest with yourself to be able to learn and grow.

</comment><comment><USER17> I'll be honest, these kind of "thinkpieces" are usually full of generic bullshit but this one was actually interesting. So if you're like me, don't let the title put you off and read it.

</comment><comment><USER18> I live in flyover country, so adjust these numbers for your locale.

There are "seniors" who make $60,000 per year. No joke. And there are seniors who make $140,000 per year (in a rather low cost area.)

The PHBs have figured out that we are vain and can be lured by shiny titles. We shouldn't go out of our way to make it easier on them.

Software engineer is a working class profession. Lusting after title plumage hurts us.

<comment><USER19> I like this take. Personally, I know that I'd _for sure_ take a job with a greater amount of pay, benefits, and work-life balance if I was going to be "down-leveled". Heck, if I'm down-leveled and being paid more, that likely means I'm working with more skilled engineers.

</comment></comment><comment><USER20> I'm disagreeing with this statement while liking the general direction and content of it!

"There was only so much I could do to improve my coding skills. Most blogs epousing techniques to write cleaner code, repeating yourself, not repeating yourself, etc. are micro-optimisations. Almost none of them would make me instantly impactful."

I do expect a Senior Software Engineer to be good in programming. Because mastering programming is, what you do due working with it every day. The basics should just be.

Doesn't matter how impactful those are. Your role is to sure look left and right, but the road you are on is becoming an expert in what you are doing.

And generally speaking about the Senior title: I think from reading it, he does look in the right directions and it could be that he is already there but for me, Seniority become a thing not after understanding all of that stuff but actually incorporating it in a way that it became second nature and honestly, it took me years and a handful of core experiences along the way. But who am i to determine his seniority through a blog? :)

</comment><comment><USER21> I'm curious what's it like to work for Bloomberg in London? Can anyone share some info or experience? (I know Glassdoor exists, I'm asking for a more personal overview)

</comment><comment><USER22> It's been a while since I worked at Bloomberg, but certainly back then, anyone with 2+ years experience was designated a "Senior" hire.

It was (is?) more about distinguishing fresh grads from other hires, and much less about significant experience or seniority within the tech ("R&D") organisation.

</comment><comment><USER23> > Figuring out how to become a force multiplier sounds more valuable to me > than a 10x developer.

I'm always astounded by what people imagine a 10x developer is, especially some one who calls themselves a senior developer.

Hint, they aren't a lone wolf who writes 10 times as much code as the rest of the team, doesn't deign to sit in scrum planning sessions and creates chaos with every pull request they self approve. Maybe those people CALL themselves a 10x developer ...

A 10x developer IS a force multiplier. Every 10x developer I've worked with wrote easy to use APIs and Frameworks that made every other developer on the team much more productive. A 10x developer is a senior developer on steroids; they do everything this author thinks a senior developer does and more.

<comment><USER24> To add to your point: the "lone wolf that writes 10x more code" is _not_ someone you want on your team because they're not a multiplier in any sense other than simply "writing 10x more code". They're actively detrimental.

<comment><USER23> I have a draft blog article called "The Almost 10x Developer" because I have seen exactly this soooooo many times.

</comment></comment></comment><comment><USER25> What is the definition of "Senior/Staff/Principal/No-prefix Software Engineer"? All those titles always confuse me

<comment><USER26> Junior/No-prefix: In their first job. You will routinely get promoted from junior to "normal" whilst remaining at the company.

Senior: Second or third job change.

Staff: That one person who has been at the company forever.

Principal: We're an enormous engineering org and need to have a treadmill so we don't lose our people but can't just give them payrises. Most titles also have multiple levels.

</comment></comment><comment><USER14> I was a bit worried about the title saying "Senior Software Engineer" because this may trigger people.

But, surprised that _all_ the discussions are about this, instead of the content.

<comment><USER27> That's probably because the content in this post is more about "soft skills" or what many would consider fluff.

"habits of mind", "tools of thought", "force multiplier", "superpowers" "embrace fear" etc. reads straight out from a Tim Ferris-like self-help book targetting millennials than anything a senior engineer would write.

I read your last year's post - that one was much more useful and insightful. So +1 (upvote) to more of those.

</comment></comment><comment><USER28> While there is much sage advice in this blog post, the topic that I appreciated most was the gotcha about neophilia.

Not only have I seen my own natural tendency to overvalue new technologies irrationally, I've seen it in most of my colleagues as well. Stepping back and carefully weighing the pros and cons of new technologies is an excellent way of preventing neophilia from moving a project in the wrong direction.

</comment><comment><USER29> Hmm. Good read. Then I think everyone should write something about their accomplishments in their own blog like an article on how I became a tech lead and it would be mostly like, it's not fun. Being a team member was easy, you know taking up few projects which others considered hard and you know it's simple just too much action everyday. And always start a presentation saying, "it's a simple project having n,n,n,n,n things" and go slow so others would go and review all the things you did in the call itself.

But now you are working on 1 project namesake and hearing about all projects, resolving issues getting into sudden meetings and knowing requirement was understood differently and thinking about what sort of risk should be raised for this project. Then you get to a discussion with a architect on whats a microservice, he tells you a microservice can process bulk data(millions) and can run up to 20-30 mins and discussion ends like oh I was thinking microservice is like a simple unit of work and finishes off in few milliseconds to less than few seconds. Sorry I am a mainframer we caught this as it crossed our thresholds in UAT and you need to raise risk if you want this go live. (Level of risk that has good visibility to management).

Wrote an automation tool 6-7 years back for myself and let others know of it and prepared good documentation and made it part KT and now present time, saying to people not to use my tool as I am going to decommission it as there are other standard tools available to do the same thing and people pinging "please don't decom it, can you rename it and let it run, as it's easier and proven repeatedly it's error free".

Suddemly a dev contact, pings you saying I have a problem with this REXX code. You look at the code and sort of gives you thought, this comment looks like I wrote it. But I never wrote something for this application or person before and asking few more questions, you come to know that my code was used as a model in lot many places as it was easier to generate test data with it. Credit for initial work was never given few years back but looking at how many people are using gives a feeling wow.

Always seeing celebrities talking about their movies on TV. Given me the thought, how come nobody is interviewing programmers and asking what was hard for them to program and state of mind they had when programming a piece of code. What gets them to the flow state.... It would be fun to know.

</comment><comment><USER30> To be honest what he achieved doesn't need any special tricks. You just be there do your job, and you will get it. Well actually depends on how hostile and competitive your work place is.

</comment><comment><USER31> I guess the meaning of Senior has changed, that's fine - but what is the level beyond Senior now?

Ancient? Graybeard? Hallowed?

<comment><USER32> At Microsoft there is a guy named Peter Spiro who I really looked up to, in SQL Server. His official title is Technical Fellow but he called himself Village Elder, because he worked on it since 1.0. In his own words, his job is to float around and be available to everyone in the group.

</comment></comment><comment><USER33> titles are arbitrary. let's not put too much stock into them.

At google and FB, senior is considered L5/E5 which requires atleast 5 yoe.

but it looks like bloomberg doesn't have a mid level and only have junior/senior.

[https://www.levels.fyi/?compare=Bloomberg,Google,Facebook,Mi...](https://www.levels.fyi/?compare=Bloomberg,Google,Facebook,Microsoft&track=Software%20Engineer)

</comment><comment><USER34> It's easy to become a senior software engineer, anyone can do it with these simple steps:

1\. Open an index.html, include a javascript file and write an alert or console log.

2\. Create your own company.

3\. Title yourself as a senior software engineer.

Joke aside, during my career I've met several senior software engineers that are anything but and several "normal devs" that are a lot better than most people who have the senior title, even in the same organisation.

I don't think titles has anything to do with knowledge, rather it does have a lot more to do with whatever position you're given and that position could be given to you for a number of reasons. This is what has lead me to my belief that titles are unnecessary cruft that takes focus away from other more meaningful endeavors.

<comment><USER8> If I start my own company, I'll be the _Supreme and Exalted Overlord_. Not something silly like a senior dev.

<comment><USER34> That is true, I think my title would be "Dream Alchemist" or something like that. ;)</comment></comment></comment>


Darwinian evolution is not a sufficient theory of life - <AUTHOR> https://www.claremont.org/crb/article/giving-up-darwin/ <comment><USER2> About the Precambrian life, the author should read [https://en.wikipedia.org/wiki/Ediacaran_biota](https://en.wikipedia.org/wiki/Ediacaran_biota)

About the combinatorial number of 150 amino acid proteins, I think the calculation don't make sense. Nobody expect to get a 100% functional 150 amino acid protein by chance. In particular I don't like:

> _He estimated that, of all 150-link amino acid sequences, 1 in 1074 will be > capable of folding into a stable protein._

Is there a link for that calculation? Most random "proteins" fold as some kind of unuseful crap. But IIRC it's stable unuseful crap. Perhaps it's not soluble, perhaps it's not active as a enzyme, but it will not self destroy or something.

And there are smaller and bigger proteins. Probably the first proteins were only a few amono acid long, and not very effective, and then they evolved into more long and efective versions. See for example

From [https://www.science20.com/princerain/blog/whats_biggest_and_...](https://www.science20.com/princerain/blog/whats_biggest_and_whats_smallest)

> _The smallest human protein is 44 amino acids but it could be an abortive > translation from the 5 ' UTR of another mRNA. The smallest functional > polypeptide is glutathione with only three amino acids._

(more info [https://en.wikipedia.org/wiki/Glutathione](https://en.wikipedia.org/wiki/Glutathione) )

From [https://www.science20.com/princerain/blog/smallest_protein](https://www.science20.com/princerain/blog/smallest_protein)

> _Apparently it 's TRP-Cage, a protein with only 20 amino acids derived from > the saliva of Gila monsters._

(more info [https://www.anaspec.com/products/product.asp?id=59018](https://www.anaspec.com/products/product.asp?id=59018) )

One family of proteins that has a clear history of evolving between species is the hemoglobin-like proteins [https://en.wikipedia.org/wiki/Globin](https://en.wikipedia.org/wiki/Globin)

</comment><comment><USER3> "But what does generating new forms of life entail? Many biologists agree that generating a new shape of protein is the essence of it."

No, that's not what many biologists agree.</comment>


Malls track shopper cell phones on Black Friday. To opt out? Turn off your phone - <AUTHOR> http://money.cnn.com/2011/11/22/technology/malls_track_cell_phones_black_friday/

<comment><USER2> Just to play devil's advocate, how is this any different from running analytics on your websites? They are keeping track of where people go, just like most people on HN do with their own users. And to be honest, I think it's a clever hack that could give them information about how to improve the layout and offerings at the mall.

So why are people having a negative reaction to this? Because they can track your purchases? Websites could easily be doing that too, if they were willing to cooperate (the same way the stores would have to cooperate with the malls by giving records of all purchases, which seems unlikely). Or is it creepier just because it's your physical location?

<comment><USER3> It isn't, which is why I'm surprised more people don't opt out of those things.

Both physical analytics and electronic analytics are reprehensible, imo.

<comment><USER4> Really? It's "reprehensible" for a website to know how many people visit, what countries they come from, what pages they spend most time on, what buttons are most effective, etc?

Tracking between unaffiliated websites is a different story, but the mall is only tracking our movements around the mall, just like any website that gives a damn about user experience is going to track you around its pages.

<comment><USER5> This information is sufficient to track you through unrelated visits to the mall, and paired with CCTV video, sufficient to associate you with your face. It's also a small step to associate you with your credit card purchases at various stores.

<comment><USER6> _It's also a small step to associate you with your credit card purchases at various stores_

You do realize that they (the credit card companies) already do this (and have for years), right?

<comment><USER5> Do they have your face on file? Do they provide this purchasing information to malls?

</comment></comment></comment></comment></comment></comment><comment><USER7> The particular reason this opt-out is odious is that opting out requires you to _stop participating_ in a service the mall _has nothing to do with_. If an opt-out is, "to opt out, press this button before entering the mall", or, "to opt out, stay at least ten feet away from our mall maps", or, "to opt out, do not enter the food court", then they could sorta kinda make a case for legitimacy. (Those would be somewhat bizarre, admittedly, but at least they're directly related to the mall in some way.)

The "but I need my cell phone" objections are missing the point here: the opt- out is policy is bad not because it's making you forgo a convenience or even a necessary item, but because it's hijacking your commercial relationship with someone else entirely. Kind of like the technological underpinnings of the tracking, which are mitm-ing on the signal itself.

I wonder what the cell companies have had to say about this?

<comment><USER8> The high school production of King Lear has nothing to do with your cell phone, either. But you should still turn the damn thing off. Having to forgo one relationship to participate in another is neither surprising nor odious. You don't have to shop at this mall.

<comment><AUTHOR> > The high school production of King Lear has nothing to do with your cell > phone, either. But you should still turn the damn thing off.

Nope. You should simply set the ringer to silent.

</comment></comment></comment><comment><USER9> I really want to know more about how they're accomplishing this technically, and what kind of carrier cooperation is required.

If all they're doing is putting up Rx antennas and using them to intercept subscriber IDs from the non-encrypted part of the handshakes with the towers, without any cooperation from the carriers themselves, I guess I'm not too concerned, as a subscriber ID alone is meaningless without carrier records.

If they're doing something that requires carrier cooperation, however, that's something different entirely. Suddenly we go from "anonymous by nature" to "trust us, we're anonymizing it."

Any wireless engineers want to weigh in on this?

</comment><comment><USER10> Once you have this data, you can correlate it with records of purchases to link a given phone to a given credit card number. I'm guessing it would take just two or three purchases at the mall to be able to do a match with high confidence.

But we all know retailers care too much about their customers' privacy to pool that kind of information, so there's really nothing to worry about. And anyway, the fact people are reading the little signs and then continuing to shop without turning off their phones is a pretty clear indication that they're opting into this kind of data collection anyway.

</comment><comment><USER11> This technology makes me uncomfortable. By itself it's rather harmless but it's not a huge leap to imagine a network of surveillance cameras using this technology.

Stuff like this makes me think I'm living in a scifi novel and I'm not sure that's a good thing.

</comment><comment><USER12> There's a startup in Palo Alto that uses phone signals to track consumers and generate analytics. Perhaps their technology is being used. <http://euclidelements.com/>

<comment><USER9> Interesting. Euclid only works with smartphones, in that it appears to simply sniff MAC addresses, and triangulate them with off-the-shelf wi-fi equipment.

I'm guessing the mall tracking systems are using something on the GSM and CDMA spectra, and are sniffing UDIDs?

</comment></comment><comment><USER13> Isn't this similar to the way phone data is used to estimate traffic speeds on streets and highways?

Also, when I saw this: "To make it harder for hackers to get at this information, Path Intelligence scrambles those numbers twice", my first thought was "with XOR?".

And third, are these the same malls and retailers that want to block data connections to prevent people from doing on-line comparison shopping while in the store?

<comment><USER14> >"XOR"

Probably using 2ROT13 because they heard it was more secure.

</comment></comment><comment><USER15> No, the title is incorrect. Opting out is not going to the mall (private property).

I kind of see it like saying "I want to buy something on your website - but I don't want to give you an email address or credit card!" Obviously not a perfect analogy, but really, you are going on their turf and utilizing their services. If you don't want to play by their rules, don't patronize them.

<comment><USER16> That's an entirely different discussion on the increasing privatization of public space.

We've long established that companies don't have a right to "play by their [own] rules." For example, in the US a mall cannot discriminate on basis of race, and it must follow ADA, OSHA, and other requirements.

Remember, companies exist only because of government regulation. They exist because otherwise individual people (the owners) would be responsible for mishaps and debts, and that's too much risk for most people. Since we set the law, companies must abide by our rules.

And that leads to an entirely different discussion on the influence of companies on lawmaking.

</comment></comment><comment><USER17> I shouldn't have to turn off my phone, I should be able to shop (using the malls services) and use my cell phone (a service entirely unrelated to the shopping mall) without having to worry about this nonsense.

I honestly don't see what business the mall has using a tactic like this. I hear the 'it's no big deal' argument, but something about the path we're on with this feels sinister.

I don't have a technological, philosophical, political argument for not liking this, I just do not want to be tracked. I feel akin to a toddler throwing a tantrum, I want to heap all of my electronics in a pile and stomp up and down on them screaming "I DON'T WANNA BE TRACKED!"

Unfortunately gadgets, phones, etc have a pretty good hold on me so I'm stuck grumbling on the internet, where I'm tracked.

edit: changed reason to argument, since thinking about it I probably do have some philosophical reasons but not anything broad and clear enough to form an argument.

<comment><USER18> Then don't go there. Seriously.

<comment><USER17> I don't plan to, but that's not really the point. Because at some point it becomes, "Don't go where?"

<comment><USER19> Yeah I don't go to malls because they seem like disease incubators and smell like human flatulence. But it's really not about the malls.

</comment></comment></comment></comment><comment><USER20> The privacy concern should be on the part of the cell phone holder. Blaming the mall for using data that you are transmitting is like firing someone for finding a security hole in the corporate web site. If you don't want anyone to know your top secret phone id, stop transmitting it. You should be much more worried about the people who aren't telling you that they are collecting it than the mall that's announcing the fact that it is.

<comment><USER21> And if you don't want your private conversations recorded simply refrain from speaking? There is a long history of privacy protections afforded to the general public.

<comment><USER20> What do you mean by private conversations? If you're trying to transmit sensitive information, you don't use a postcard. People are jumping on the wrong bad guy here. "If we can just stop the people who are admitting to tracking us in ways we don't like, we can drive back this menace."

The reality is that if you don't like the idea of people doing this kind of tracking, stopping the people that are publicly admitting to doing it is the least of your concerns.

</comment></comment></comment><comment><USER22> Turn off your phone in the mall? Yea, right. Now there's great advice from someone who's in touch with modern reality:

1985 - If I don't see you again, I'll figure you ran into your friends and went home with them.

1989 - Meet me at the fountain at 6:00.

1992 - If you need anything, see Linda at the Gap. She'll know where to find me.

1996 - If there's an emergency, beep me and go to mall security.

1999 - Find a payphone and call my mobile phone when you get hungry.

2003 - Call my cell when you're ready to leave.

2006 - Post any good bargains on my Facebook wall.

2008 - Follow me on Twitter to see what I'm up to every 7 minutes.

2009 - Foursquare will let you know where I'm at.

2010 - Just check the Groupon emails I sent you to see where I plan to shop.

2011 - Text me immediately if you see a line _anywhere_. It's probably an early unpublished Black Friday special and we should get into that line _now_. I'll stop by REI and buy a tent and sleeping bags; you get some protein bars and Gatorade.

<comment><AUTHOR> > 2011 - Text me immediately if you say a line anywhere.

Wow. I'm getting flashbacks to growing up in Soviet Russia. The irony is hilarious.

</comment></comment><comment><USER23> This is a pretty bold move. It would be fun to have a basket of say 500 pre- paid phones scattered around so that folks could pick up a phone and drop it off to poision the data with a bunch of bogus stats. Except you could probably defeat that with ESID or IMEI filtering.

I am surprised that this is legal in California, there is legislation that forbids this sort of thing.

<comment><USER24> Even with the pre-paids, they'd stil be able to see where a person with one of those is going and their shopping patterns, therefore giving them exactly what they're looking for. They're tracking the movement of dots to analyze shopping patterns. If a dot is prepaid it doesn't make it a "fake" dot. What would really confuse them (maybe?) is getting as many phones on your person as possible then running around in circles.

Why they would choose to attempt to discover patterns on black friday though is beyond me - consumer behavior on that day is completely wacky and inconsistent with any other day of the year.

<comment><USER14> This makes me want to invest in a CDMA/GSM dev kit so I can spoof IMEIs and ESNs. I'd send them:

AA-BBBBBB-CCCCCC-'); DROP TABLE imei;--

EDIT: another thought would be to use a directional antenna with a high-power transmitter (should only take a few watts with a +23DB panel or something) and have a script run through IMEIs and ESNs a few hundred a second, then just wave the thing around wildly.

If you want to stop this, you have to make it not economically viable for them. Real-life tracking calls for real-life DoS.

</comment></comment></comment><comment><USER25> Well, if you are doing comparison shopping by scanning in the barcode using your phone it seems like you can't have your privacy and try to get a better deal at the same time.

</comment><comment><USER26> Is this even legal?

My question is if they are just monitoring cell phone signals they must have some way of intercepting them. Is this not akin to wire tapping?

</comment><comment><USER27> I'm only 5 miles away from Short Pump mall... this is really interesting. I'm pretty confident that they don't even care about attaching this kind of information to an actual person's identity or purchases. Still, even if I was concerned the likelihood of me turning my cellphone off just to avoid being tracked is close to nil. It's something that needs to be watched closely...

</comment><comment><USER28> Many years ago, before smartphones, my family was entertained by a group of families that were using long distance walkie talkies (multi-mile range, no FCC ham radio license required) to communicate.

"(BOOP) Where are you?"

"I'm near The Gap"

</comment><comment><USER29> Seriously? This is a privacy concern? I really should get into the tin foil hat business.

<comment><USER11> It's not a privacy concern until someone takes the small step of being able to track a phone with surveillance cameras. With technology like this, I can't imagine it being much more difficult than plotting the viewing areas of the cameras and then overlaying the positions of various phones on the same map. This approach won't immediately point out the person the phone belongs to but you could easily have video coverage of the person available for review. You can always pick them out of the imagery later.

<comment><USER5> It's trivial to associate people with CCTV ...

       1. Point a camera down a narrow traffic area -- like each door to the mall.
       2. Capture their cell signal at the entrance.
       3. Correlate using face-tracking.
       4. Prune errors by tracking exits and entrances.

Now you have a pretty good idea of which face has which phone, for that visit and all future visits to anywhere the mall sells their tracking database to.

</comment></comment></comment><comment><USER30> You'd think that in a soft retail economy they'd be less brazen. Well, time to teach them a lesson, I suppose.

</comment><comment><USER31> Its completely amazing to me how companies fooled us into paying for devices which are used to expose our habits. If cell phones were free, perhaps there would be less complaints. The fact that we each finance devices that can be used against us by companies and even government is bewildering. Make no mistake, turning off your phone does nothing.

<comment><USER5> Actually, this is true, you need to disconnect the battery. Which, of course, is impossible on many smartphones.

<comment><USER32> what about 'airline mode'?

</comment></comment></comment><comment><USER33> Isn't this prohibited by the FCC?

</comment><comment><USER34> _"We won't be looking at singular shoppers," said Stephanie Shriver-Engdahl, vice president of digital strategy for Forest City. "The system monitors patterns of movement. We can see, like migrating birds, where people are going to."_

Read: We're invading your privacy, but in a good way.

</comment><comment><USER35> "It's nt a privacy concern" What?! Depends who you ask! Since when are the people collecting data the ones who decide what a privacy concern is? I don't mind right now but others might and I may change my mind!

"Hardly anyone opts out". This one is disgusting! Of course they won't opt out! Do I lose touch with the people I need or want to co,mini ate with and lose the ability to comparison shop as I go or do I opt in to being tracked by default?

They've done this totally backwards. People should have the option to opt _in_ not out. There really isn't much choice here. It all seems innocent enough right now but we all know it'll start going further as the years go by.

<comment><USER36> How do they know if someone opted out if their phone is off? Do they divide the number of cell phones by the total number of people in the mall? What if I forget my cell phone in the car or at home? Am I considered an "opt-out"?

When I see this kind of stuff, I always think what is the best way to disrupt this kind of technology. The ideas that come to mind is to organize a bunch of people to randomly walk in the mall, or to leave a bunch of cell phones lying around to skew the data (although the first would be a LOT more effective).

<comment><USER37> If you were determined you could jam the wireless spectrum, as long as your signal was strong enough you might be able to block subscriber IDs from making it to the tracking antennas.</comment></comment></comment>


Goldman Sachs Reaches $3.9B Settlement with Malaysia over 1MDB Corruption Case - <AUTHOR> https://www.hollywoodreporter.com/news/goldman-sachs-reaches-39-billion-settlement-1mdb-corruption-case-1304274 <comment><USER2> Good to see, I guess. But I'm so tired of "settlements" where no-one has to admit guilt or face criminal sanctions.

BTW, The Netflix series "Dirty Money" has an entire episode titled "The Man at the Top" that provides very good background on this _(almost unbelievable)_ corruption scandal.

</comment><comment><USER3> If you're interested in the background of this, Billion Dollar Whale by Tom Wright and Bradley Hope would be a good intro.

An unbelievable amount of corruption on the part of the former Prime Minister and his family, and enabled by Jho Low and Goldman Sachs.</comment>