Ask HN: How do you backup your files without depending on a third party service? - <AUTHOR> I'm using Github, Dropbox and iCloud, but this makes me nervous about my data's privacy and longevity for a number of reasons. Among the three services, I have ~700GB of data.
But I got to thinking, aren't USB thumb sticks reliable and big enough nowadays to fit this much data? I could just buy two 512GB sticks and use rsync to backup to them a few times per week. This way I wouldn't have to lug around an awkward hard drive if I'm ever traveling.
What strategy do you use to keep your data safe and private for the long term? Do you have a portable solution, or do you recommend something else? <comment> old-gregg Synology or QNAP NAS. They collect backups from all computer in the house, encrypt them and ship the encrypted blobs to AWS Glacier.

Synology in particular is a fantastic platform which does way more than a traditional NAS. It's quite polished personal cloud platform (way more so than FreeNAS) and includes hundreds of apps, even the backups into the cloud can be done in different ways.

I also place a premium on the fact that Synology is a piece of hardware. The software comes built-in and taken for granted. What this means is that it's been sitting somewhere in the dark corner of my house since 2012, self- updating and not bothering me with upgrades or expired credit card / subscription, etc. It doesn't care if I run Linux/MacOS/Windows, it's just dumb storage that all of these OSes can backup to using built-in tools.

Another tool I like is Resilio Sync [1], it's a cloudless Dropbox and it's perfect to sync /Documents and /Desktop across computers at home and at work. It's not a backup tool, but very much related, i.e. if I put a file on my desktop at work I know it will end up on Synology at home and eventually will get encrypted and backed up to Glacier, and yes, without any 3rd party servers involved.

[1] [https://www.resilio.com/individuals/](https://www.resilio.com/individuals/)

<comment><USER5> I would stay away from QNAP, their quality is terrible. I had a QNAP QVR and it just reeked of insecurity.

My friend has one of the smaller Synology boxes with 20TB and it is pretty nice. You can think of it as the Apple of the NAS systems out there, everything just works.

However, if you like to tinker with your NAS a bit more, FreeNAS is excellent. It's pretty comforting running zfs over standard RAID, and you have a FreeBSD system where you can run anything you want in native jails.

<comment><USER6> Agreed, QNAP os/distro/apps just feel shoddily made and maintained. If you maintain systems for a living you'll go berzerk trying to track down just exactly what it is doing and why and the constant (weekly?) firmware security updates.

I haven't tried Synology in a long time. I'm looking to get my few TBs off of the QNAP and sell it in favour of something custom built.

</comment></comment></comment><comment><USER7> I have a 4TB Hard Drive attached to an OpenWRT router (Rasberry Pi's are also a popular choice). The router exposes a locked down SSH port (SFTP only) through a cheap $5 a month VPS.

I also use Jottacloud [1] who provide unlimited (yes unlimited) storage for 7.5 EUR a month. Based in Norway, they keep an up to date warrant canary.

Client side, I backup to both of these services using Duplicati [2] which offers client side encryption, block level deduplication and excellent integration with Jottacloud and SFTP. For synchronisation, I use Syncthing [3] since I don't want to expose plaintext documents to Jottacloud. All in all, I'm very pleased and it has required no maintainence since I set it up a year ago.

[1] [https://www.jottacloud.com/en/](https://www.jottacloud.com/en/)

[2] [https://www.duplicati.com/](https://www.duplicati.com/)

[3] [https://syncthing.net/](https://syncthing.net/)

<comment><USER8> I just started experimenting with Syncthing because Dropbox no longer meets my needs.

So far I'm pretty happy and impressed, it's a decentralized piece of software that Just Works (TM). My plan for backups is to spin up a VPS somewhere and have them back it up.

I also love that it can use LAN; I can finally sync up my giant mp3 collection.

<comment><USER9> +1 on syncthing.

I have one on my computer, one one our Raspberry Mediabox (with a dedicated drive) and one on a dedicated VS.

New version using inotify really helped the Pi !

</comment></comment></comment><comment><USER10> Go by the 3-2-1 rule: 3 backups, 2 different formats, one offsite.

Similar to the military mantra: three is two, two is one, one is none. (Meaning your "spare" should already be considered in production or broken, so you need a "spare spare" to really have a "spare").

Time Machine your Macs to a drive and also perform an image backup to a second drive, keep them both in separate places and implement a rotating image or Time Machine backup.

On your PCs File History is probably adequate, and you can image the drive with something free like Acronis.

Linux there are a hundred ways, but the o'reilly 'crocodile' book (backup and recovery) has many good solutions.

Also as a tip you can get solid LTO5 mechanisms for a good price these days on eBay and they're pretty robust and hold a good chunk of bits.

Synology NAS are good machines.

</comment><comment><USER11> If you're tech savvy and want the easy answer then check out Tarsnap[1].

If you're tech savvy and want to save a few bucks by doing it yourself, check out borg[2]. You'll need to set up an external server for it but at scale (TB) it's an order of magnitude cheaper than Tarsnap.

Regardless of off site storage I'd suggest also buying two large USB drives and formatting them with LUKS. Keep them offline and only sync them occasionally as live storage isn't really a backup.

If you're not tech savvy I'm convinced what you're asking for is impossible. The best a layman can do is pick a reputable provider (like the ones you've listed).

[1]: [https://www.tarsnap.com](https://www.tarsnap.com)

[2]: [https://borgbackup.readthedocs.io/en/stable/](https://borgbackup.readthedocs.io/en/stable/)

<comment><USER12> Tarsnap is a third-party service which in turn depends on S3. The author specifically requested solutions which _do not_ depend on a third party.

<comment><USER11> I know and I still gave the answer I thought was best.

Unless you're going to run your own servers in multiple locations (or convince you friends to let you host a NUC at their homes), you're going to rely on a third party. All that changes is the type of service that you're receiving, i.e. whether it's an object store (S3, B2, etc), a virtualized server, or even a rack in a data center.

</comment></comment></comment><comment><USER13> I use an external USB HD and automate my backups with rsync and cron. Works great.

Here's a blog post showing everything from which drive I use to the backup script: [https://nickjanetakis.com/blog/automatic-offline-file- backup...](https://nickjanetakis.com/blog/automatic-offline-file-backups-with- bash-and-rsync)

I've been using this strategy for about 20 years and it hasn't failed yet. Although in the older days I had a slaved HD and also used CDs on occasion.

I would never trust a consumer grade USB flash stick. I've had so many fail on me over the years.

</comment><comment><USER14> I switched to ARQ ([https://www.arqbackup.com/](https://www.arqbackup.com/)) a while back after a near miss with a hard drive failure, and think its an amazing product - the key elements to me are that:

1\. It is storage location agnostic (backup to a usb, external HD, network HD, dropbox, amazon, etc)

2\. your backup data is encrypted locally before being backed up to any medium

What's great is that i can back up one set of data to an external hard dive manually as needed, another set of data to say dropbox on a nightly basis, and another set to a B2 bucket on a monthly basis (all of which are encrypted so i retain my privacy/data security).

Edit: i suppose that it is a "third party service" but i think it reliably solves for the lock-in and privacy problems you reference

<comment><USER15> I use arq as well. Some things I don't like about it are:

1\. There's no information about what it is doing (which file are currently being backing up, what's the current upload rate, what's the estimated completion time, how much data is left, etc)

2\. Large files (like VM images, or crypto containers) block small files from being backed up. Essentially, your backup frequency can be no more than largest_file/upload_rate (well, it's more complicated than that because of deduplication)

<comment><USER14> #1 the information is limited, but it is available [https://goo.gl/images/9zCMNR](https://goo.gl/images/9zCMNR)

#2 is an issue I've encountered as well

</comment></comment></comment><comment><USER16> Two FreeNAS servers on premises and in different locations with ZFS replication.

Then use SMB, NFS, Time Machine, rsync, Syncthing, sftp or anything else you like to push data to one of the FreeNAS machines.

Periodic ZFS snapshots prevent common cases of PEBCAK and ransomware.

Fully redundant, encrypted & open-source solution that can saturate 10GbE!

<comment><USER17> If you have ecc memory and two locations this is probably the best option.

<comment><USER16> If you don't have a second location you can still replicate to [https://www.rsync.net](https://www.rsync.net) with all the benefits ZFS provides.

ECC is highly recommended but even a low powered CPU will do.

</comment></comment></comment><comment><USER18> A lot of the replies either rely on third party services (albeit encrypted) or forget about the third part of the holy backup trinity of having something offsite.

It sounds like you're thinking of local backup while you're traveling, which is great. The portability of USB sticks seems perfect for your use case, although I think a 1TB stick is still a stretch, maybe look into a small self- powered external SSD drive. If using OSX you can encrypt it and use Time Machine to auto-backup when plugged in (easy) or just use an rsync script (manual).

But don't forget to ship these backups offsite once you're home. If you get a couple of 2TB drives to account for growth, you could get into the habit of depositing the current backup into offsite location, grabbing the old backup from offsite, and just rotating every couple of weeks. Offsite could be a local bank safe deposit, a work office, or out of town family. (I consider family second-party, not third-party.) Local backup means nothing if you have to evacuate due to flood (east coast hurricanes), fire (california wildfires), or any unforeseen disaster.

I use this method to backup 10TB of photography that I can't do online without a fiber uplink. Thankfully 10TB platter drives are possible these days for me to flat-rate mail to my parents across the country. (And yes, Synology for local backup, that seems to be the hit here.)

<comment><AUTHOR> The common wisdom always says have an off-site backup. But what if the backup is small enough to fit in your pocket? I always have a Swiss Army knife on me anyway so if I have a backup thumb drive that's the same size, it should fit just fine, and be as safe as my house keys. I really think we're in a new age of self sufficiency because of advances in technology and physical storage size.

<comment><USER18> One of the biggest benefits of off-site backup is stability. That's why something like a bank's safe-deposit box or my parent's firesafe are my preferred locations. A backup in your pocket is great until you lose your keys, your pants get a hole in the pocket, you get pushed into a pond, etc.

</comment></comment></comment><comment><USER19> You can buy USB3 M.2 SSD enclosures for ~$20. They are larger than normal flash drives at about 5" long but still reasonably pocketable and much higher performance than normal flash drives. Drop in a 1TB SSD for ~$200 and you're good to go.

I had a friend in college that backed up all of his files on a flash drive but he used git rather than rsync.

<comment><USER20> > Drop in a 1TB SSD for ~$200 and you're good to go.

O_o ...For some reason, my mental model of SSD rates was stuck in 2014 at $0.50/GB. As I type this, my laptop is busy moving a VM image over to the NAS to free up some space on my 256 GB SSD.

But no, according to [https://pcpartpicker.com/trends/price/internal-hard- drive/](https://pcpartpicker.com/trends/price/internal-hard-drive/) and [https://pcpartpicker.com/products/internal-hard- drive/](https://pcpartpicker.com/products/internal-hard-drive/), you can indeed find SSDs at $0.20/GB (the low end being currently dominated by Crucial MX500 drives at $0.18/GB). Looks like it's long past time to upgrade!

<comment><USER21> After my last SSD died, I'd have a hard time trusting SSD's again for backup purposes (this is probably 8-10 years ago though I suppose).

It was more the way it failed - I had one or two boots where a few errors started to pop up, and then the next boot, nothing - the disk had disappeared to the BIOS' eyes and any other tools - just dead as a doornail with no easy way of getting any of the data off it.

I assume they've improved in that regard, or are spinning platters still a safer proposition over the long term?

<comment><USER22> 8-10 years ago is a very long time, especially for what was still a relatively new, low-volume product in the consumer market.

> I assume they've improved in that regard, or are spinning platters still a > safer proposition over the long term?

I don't think you need to assume..just check out what statistics are out there. Sadly, I don't know of anyone publishing numbers for consumer SSDs like Backblaze does for spinning disks.

</comment></comment></comment></comment><comment><USER23> The issue with "simple" backups is that, should your house/office burn down, you lose everything, including the backups. Any alternative (like bringing the usb sticks to a safety box etc) is much more cumbersome than standard cloud- based solutions.

I have a SpiderOak subscription for 2TB that is private enough for my needs, and that's where I backup pretty much any machine i have. I also keep a low- power Linux server at home (a cubox) with two 1TB disks in raid-1, that acts as a Time Machine for the occasional quick restore. Most of my code lives in Gitlab or Bitbucket, and some business stuff in OneDrive. Family pics and videos, that are massive, get pushed every few months to Amazon Glacier.

<comment><AUTHOR> Not if I carry the USB sticks in my pocket at all times!

<comment><USER23> That's a recipe for losing data even more frequently...

<comment><AUTHOR> I haven't lost my house keys once. I'm sure I can manage to do the same with a USB stick? Especially if it has a keychain hook so I can put it on my house keys keychain!

<comment><USER23> I guess that's a strategy. It wouldn't work for me, I lose everything (including house keys a few times).

</comment></comment></comment></comment></comment><comment><USER24> RClone ( [https://rclone.org/](https://rclone.org/) ) synchronizes (similar to rcopy) directories with a multitude of providers and allows for client-side encryption. I use a combination of Google Cloud Storage (for really important files and pictures) with the "crypt" extension and an USB HDD Hub (4 disks) with Raid 5 hooked to a Raspberry PI for less important data. The backup scripts start on boot. It's a charm. Oh and rclone is written in Go so it works on all platforms, including Windows, macOS, Linux (and also ARM).

</comment><comment><USER25> I maintain three sets of backups - two personally, and one with a third party service.

For the personal backups, I keep one at home (second location) and another in the office. In both cases, I rely on rsnapshot ([http://rsnapshot.org/](http://rsnapshot.org/)). It's an oldie but a goodie - I've been using it for over 15 years. It solves the rotating backup problem - and thanks to the glory of symlinks reduces my disk usage.

I _also_ use duplicity to gpg-encrypt files that I save into SpiderOak - <USER2> feel free to use s3 buckets. I very much like having encrypted backups just work. In both cases I have my scripts notify my via a webhook when things fail - and every 7 days regardless, just so that I don't have a heart-attack wondering if anything happened.

SpiderOak is new - about 8 years. The webhook is newer, about 4. The rest is ancient and continues to work across everything, always.

</comment><comment><USER26> I love simple software that doesn't too much magic.

For this reason, I use rsync to a btrfs volume (both local, on a USB stick, and remote over SSH).

Then I take a btrfs snapshot, so I have versioned and unduplicated backups.

Furthermore, rsync supports gitignore-like files, so you can control what gets and what doesn't get backuped in a very fine-grained way.

Tarsnap is also a great option.

For your particular use case, I'd go for both a remote server and a local pair of USB sticks to have duplicated backups in different locations all the time.

<comment><USER27> > I love simple software that doesn't too much magic. > > For this reason, I > use rsync to a btrfs volume

If btrfs were simple software redhat/fedora wouldn't have abandoned it in favor of xfs.

<comment><USER26> Then another filesystem with snapshot support.

My point is to use utilities that do one thing, and compose well.

<comment><USER27> Ok, but this approach is pushing the complexity down the stack into the kernel/filesystem. And a general-purpose performance-oriented snapshotting filesystem is going to be making a lot of compromises that aren't really ideally suited to backup duties.

Plan9's Venti/Fossil immediately come to mind as an example of simplicity in this vein.

</comment></comment></comment></comment><comment><USER28> * "Syncthing" for keeping multiple copies of the current files, across devices in different locations, that will never malfunction at the same time. This is usually enough.

* "Back in Time" for keeping older file versions in external hard drives.

The two were chosen mainly because they have decent GUIs, both support diffs, and the backups can be viewed using nothing but a file explorer.

<comment><USER29> Syncthing also provides backup versions (if updated on a different machine). So if it pulls a newer version from another machine, it will back it up first :)

Edit: Granted, time machine provides a MUCH more 'slick' interface

</comment></comment><comment><USER30> I store my data in 3 places: 1\. A 2TB WD Mybook Live 2\. A $60 per year 1 TB Amazon Drive account (contemplating moving to Backblaze) 3\. A $100 per year 1 TB Google Drive account.

I use rclone to sync with Google and odrive to sync with Amazon. Stuff on my phone (including photos) gets synced to Amazon and Google using the respective photos apps for photos and foldersync for other stuff.

</comment><comment><USER31> I use Bvckup 2 ([https://bvckup2.com/](https://bvckup2.com/)) to backup on to a 4 TB external drive. I also have Duplicati ([https://www.duplicati.com/](https://www.duplicati.com/)) running to backup those backups onto OneDrive and Backblaze.

<comment><USER32> Just chiming in here to say bvckup2 is awesome. It's one of those rare pieces of software that has rock-solid engineering. My heart warms with glee every time I think about it.

I've been using it in place of robocopy for all my Windows backup needs for a while now, with rsync for linux. It's _fast_.

</comment></comment><comment><USER33> Hourly backups to a NAS and one of two local USB3 SSD drives that I rotate weekly.

You can get around 400 MBps write rate on the latter [1], which is pretty decent by itself, but I also use bvckup2 that does block-level delta updates and that cuts down backup time to around 10 minutes. That's on a bit less than 1TB of data mostly comprising very large encrypted file containers and VMs. Worked pretty well so far, went through a couple of restores just fine, so no complaints.

[1] [https://ccsiobench.com/s/fxkH0x](https://ccsiobench.com/s/fxkH0x)

<comment><USER34> What's your use case for such a strict backup regime?

<comment><USER33> I wouldn't call it strict. It still means an average of 15 min of work data lost in case of primary storage collapse.

</comment></comment></comment><comment><USER35> Certainly local backup has benefits but where it falls down in practice is that it requires manual intervention from the user. Also, if you don't store the backup media in a safe place (preferably multi-homed) then an event that causes loss of the original may also destroy the backup.

</comment><comment><USER36> Windows user here. I use the built-in robocopy utility to sync files to one of 2 external hard drives. One hard drive stays at work, the other at home, and I switch them periodically (usually, right after downloading new family photos onto the computer).

With this method, a virus or something like a fire that only affected one location would not be able to take out all copies of my data and, at most, I'd lose the most recently backed-up information.

It's not 100% bullet-proof, but it's good enough for my personal purposes.

</comment><comment><USER37> No exactly answering your requirement (not using 3rd party) but i use crashplan for multiple reasons:

\- they support all platforms (mac, linux, windows) - agent running on your system, detects changes, encrypts data and transparently send stuff to the cloud.

\- They support client-side encryption (key or password). If you lose password or key - you screwed.

\- they support unlimited versioning of back up files. If you screw your PPT or DOC - you can restore previous version(s).

\- they support unlimited destination size (i'm already at 0.5TB and counting)

\- they keep deleted files.

\- they support removable media attached to your system (which helps me greatly as I do lots of hi-res photography where each image is 50MB. I already got 5TB external drive ready to be sync-ed)

\- everything is $120/yr

Disadvantage:

\- above price is _per device_. So if you need to backup 2 separated computers - you'll need to pay twice, etc...

Conclusion: I been enough through semi-shitty geeky solutions and love crashplan because it's a no brainer to setup and forget. Of course - if they suddenly get out of business or cloud will explode or whatever - then you're screwed. But IMHO chances are - this backup will work for me better than anything i tried before.

</comment><comment><USER38> I have always kept it simple. A storage array in JBOD (non-raid) setup. I buy two of whatever drive(s) will contain the duplicated data and just do a clean mirror using whatever backup software you desire. I happen to use 4TB HGST drives in a Mediasonic PROBOX 4 tower hooked into a PCIe card in my computer that connects them all through one multichannel eSATA cable. The software I use is Allway Sync (free for up to a certain amount of backed up data per month, after that a one time fee for lifetime updates).

I do one additional thing, and it's for third-party storage. So if you're dead set on cutting out a third-party, I understand. But here me out. If the data is encrypted on the third-party system, it's largely a non-risk in terms of privacy unless your filenames themselves put your privacy at risk. I am fine with my filenames being seen, but the content being encrypted. So what I do is use Boxcryptor to encrypt the "destination" drive and then I use pCloud as my third-party storage provider. Both pCloud and Boxcryptor show up as physical drives on your computer, which I find convenient. So I have my primary source drive synced with the Boxcryptor drive/location and Boxcryptor is set up on my machine to encrypt the data on the fly as it is copied (surprisingly, this is not the default setting). Then, The pCloud software is set up to automatically sync that Boxcryptor directory where the files show in their encrypted format (the "drive" version shows them unencrypted because everything is done on the fly both ways) to my pCloud storage. In the end, I have 3 versions - <USER3> unencrypted source, the encrypted Boxcryptor copy, and the pCloud backup which contains the encrypted copy.

Also important to note - pCloud is based in Germany and thus subject to the EU data protection laws and even without that I find pCloud to be a much lesser risk in terms of data privacy than any company in the US.

</comment><comment><USER39> Just because nobody has mentioned it yet, there is a file format called zpaq [1] which is incremental and journaling with good support for linux, mac and windows. It support multi-threaded compression and error detection and recovery.

[1] [http://mattmahoney.net/dc/zpaq.html](http://mattmahoney.net/dc/zpaq.html)

</comment><comment><USER35> While we are on the subject I can imagine a device that would be ideal for some of my clients: A small (deck of cards/paperback book) battery powered device that connects to the office wireless network and is left on the user's desk or in a drawer overnight (when network usage is low) that communicates with the office NAS and stores a backup. The next morning the user sticks it in her purse or briefcase and leaves another for the next night. The one taken home is plugged in to charge for the next time.

This still requires the user to remember this process but it is about as minimal as I can imagine for a local backup that is mostly kept offsite.

I'm thinking about this in particular for a local non-profit that has privacy concerns with storing their data with a 3rd party.

I'm considering putting something together using a Raspberry PI or other SBC. Having the result be under a $100 USD with 128GiB-256GiB of storage would probably be necessary for it to be acceptable.

<comment><USER35> Another thought that might make it even simpler (for the user) is to have the device download the data at a throttled rate so it could be done during the workday without impacting the network too much. This way it would be unnecessary to leave it overnight or perhaps even take it out of the purse, backpack, or briefcase. It would still be necessary for the user to remember to recharge it and maybe switch it out or rotate it with other devices.

</comment></comment><comment><USER40> I have a home server with a lot of storage; it's running ZFS with full redundancy. If you're in the US, wait a few months and you can buy an 8TB external HDD when it goes on sale again. WD EasyStore HDDs regularly go on sale [0].

For documents and important files I usually keep an extra copy with two or more cloud storage providers. It's unlikely that these companies would suffer data loss, so the most likely cause for losing access to those files would probably be if they closed my account. Using multiple services reduces the chances of losing access to your files, since it's unlikely you'd be banned from all of them at the same time.

[0] [https://www.reddit.com/r/DataHoarder/comments/7fx0i0/wd_easy...](https://www.reddit.com/r/DataHoarder/comments/7fx0i0/wd_easystore_8tb_compendium/)

</comment><comment><USER41> I have a core file server that has a 9TB RAID-Z array in it. This server uses key-based authentication to connect to all of my other hosts - my desktop, VPS, work systems, etc and uses rsync to copy any changes to a locally maintained copy. It also attempts to back up laptops, if they are left on overnight.

Every night this system also reaches out to a remote system in my office that has an 8TB RAID-5 array. It "pushes" any changes, again using rsync, to this remote host. This time it uses the --link-dest argument to create nightly "snapshots." If a file hasn't changed, it simply gets hardlinked. This backup volume is also encrypted, and only the core file server has the key to decrypt it.

For the remote system, I have a script that runs periodically that purges backups according to my own specification. Right now it keeps unlimited yearly backups, three years of monthly backups, six months of weekly backups, and 14 days of daily backups.

Once a month I also run a script to back up the core file server to an external 8TB hard drive, again with --link-dest, creating snapshots. This hard drive is stored in a fireproof safe. It is also encrypted.

I have various levels of redundancy elsewhere, too. (Yes, RAID/redundancy is not a backup). For example, my desktop system has a RAID1 array in it.

In 2000, I installed Windows ME on my desktop system. It corrupted my hard drive somehow, and I lost all of my work prior to then. In case you can't tell, this scarred me for life, and I have worked hard to make sure it cannot happen again.

I'll add, every single storage device that I use is encrypted. Sometimes it's just with a key stored on a separate boot disk (usually an SSD). The rationale being if I ever have to RMA a disk, I don't want the manufacturer to be able to see any of my data.

On another tangent, the remote system mentioned above is actually a rather old GX260 with a SATA expansion card and 3 4TB disks. The boot disk is an ancient EIDE 40GB drive. I keep it around mostly for entertainment at this point. Here's why:

      9 Power_On_Hours          0x0012   001   001   001    Old_age   Always   FAILING_NOW 123756

That's right, the drive has been spinning for a little over 14 years.

Unfortunately I've recently hit a problem where e2fsck runs out of memory (it's a 32-bit CPU, so only 2GiB per process) checking the file system. I tried setting a scratch file, but that bombed for some reason too. So, I may finally have to upgrade the thing to a 64-bit system.

Oh well.

</comment><comment><USER42> I've done exactly that to a couple of transcend usb sticks and managed to kill one when deleting some files while the rsync was running (to free up enough space for the rsync to finish). I think the controllers on the sticks are just not as good as SSDs. At least it was an obvious problem (drive completely unresponsive after that), but I wouldn't make that your only copy.

The main thing I have been doing is using old hard drives, each in an inexpensive case[0] that can easily be attached to a usb to SATA/IDE adaptor[1] (there are others to consider if you don't have IDE drives, but that one seems to work well and not all of them do; for SATA only look at UASP). You might think that old drives are more likely to die randomly, but I haven't had that happen once yet (good to keep a couple of copies of stuff you care about).

[0] [https://www.fasttech.com/p/1645000](https://www.fasttech.com/p/1645000) [1] [https://www.fasttech.com/p/8292100](https://www.fasttech.com/p/8292100)

I sometimes use rsync but also have an archive script that a) runs mtree with sha512 per file and leaves the file in the directory being archived, b) creates a .tar.xz with SHA256 checksum in the xz (except for already compressed stuff, then I either rsync or use gzip with a seperate SHA256 sum), and c) encrypts most things via scrypt -t 5 before hitting unencrypted external disk (ext2 with limited features for maximum portability). Not exactly push a button level convenience but it works ok for me.

If you just use basic rsync you can end up copying corrupted files from your system over the backup before noticing that they are corrupted. I think there are various ways to avoid this, so far I just have multiple copies that I update at different times but there are likely better ways.

Tarsnap seems like a good option for stuff you wouldn't want to loose in a fire, but I haven't used it so far.

</comment><comment><USER43> I use Back In Time on Linux (which uses rsync) to back up data to a USB external drive. I backup critical data on 2 USB sticks one of which I carry with me at all times, the other one in a bank locker (this version of backup runs a little behind since I have to make trips to the bank). Not the most convenient way to make backups but I find it an acceptable trade off for me.

Pros

1 No data in the cloud.

2\. Multiple copies of backup one of which is outside the house (to guard against fire etc.)

3\. I have the most critical data with me at all times.

Cons

1\. Data still in same city (does not guard against major earthquake, flood etc.)

2\. Manual back ups (not automated on a schedule - though that can be set up on a home network, I just haven't bothered).

</comment><comment><USER44> ZFS.

ZFS snapshots and clones are like git for your entire filesystem. ZFS replication over ssh is like rsync but more efficient. ZFS supports multiple compression methods so you can optimize for latency or compression ratio. Zpools let you add new disks and grow your filesystem without having to mess around reformatting. Zpools support various redundancy configurations so you can survive disk failures. It also supports checksumming so you can monitor and prevent data corruption.

[https://www.freebsd.org/doc/handbook/zfs- zfs.html](https://www.freebsd.org/doc/handbook/zfs-zfs.html)

</comment><comment><USER45> A 3TB main hard disk HD01. It has everything of mine from 1998, photos, docs, code, media (self-generated) books everything. All things sorted by type in folders (Media, Own Data, Books, Video, Cloud(Dropbox, Yandex, Mega, Drive)).

An exact mirror of above HD01, labelled aa HD02. Mirror updated every 20-30 days.

An exact mirror of above HD01 in cloud(Yandex & Mega). Mirror updated every 20-30 days. This does not get downloaded to PC back to cause recursion (Cloud on Hard Disk & Hard Disk to cloud)

Few working folders on PC, worked upon, work in progress, mirrored back to their original place on HD01 every week or 10 days.

Stuff of two phones & one tablet gets synced to Dropbox, Yandex & Mega as daily or hourly via foldersync app (Whatsapp backup is synced daily whereas Camera folder as soon as possible). This gets downloaded on PC boa Dropbox or other windows versions. This whole cloud gets synced to HD01 every week or 10 days. Also PC's Chrome's download folder also get mirrored to Cloud very often.

Stuff on gitlab, github & tumblr gets downloaded 1st of every month to Google Drive via Google Apps Script with an email report of log. This also gets downloaded to PC via Drive windows app. This Drive folder is synced to HD01 in Cloud folder.

All sync profiles on PC are setup in FreeFileSync with Drive Labels, Exclusions, Inclusions, Filters & limits.

HD02 is at different house, brought in only for updating monthly.

</comment><comment><USER46> At your scales, bluray discs are probably the most affordable per GiB year (looks like 2.5T spread out across 100x discs is about $80 right now and should last 15-25 years or more). Double or triple your data and you should just use cold hard drives. 10x or more and you should probably use magnetic tapes. Mirror everything 2-3x and do yearly integrity checks (I just write the SHA of my discs on the disc label) and your data should last a good long time.

</comment><comment><USER47> Thermaltake makes what I lovingly call a hard drive toaster. It's a SATA to USB disk caddy that's vertical so gravity holds the drive in. I use all my older .75-2TB drives and Time Machine, which you can set up to alternate backups to multiple drives. I _should_ rotate them out to a deposit box but most of my best stuff is out on the internet anyway.

<comment><USER48> We used a similar setup - for some reason the drives failed very often.

</comment></comment><comment><USER49> * 2, 1 TB on Hard Drives, 1 for each MBP. I use time machine

* A dozen or so Flash drives containing our wedding pictures and current copies of our taxes in locked / encrypted volumes.

* Facebook & Google photos for our favorites from vacations

* 4 hard drives scattered through out the house and 1 in our safe

* Typically I bring a flash drive with me when we travel and leave one in the car at the airport

</comment><comment><USER50> I recently converted all my Linux boxes to use BTRFS filesystems. That allows for snapshots of each sub volume, and you can even send them (incrementally) to another btrfs drive. Last weekend I also set up btrbk, which gives you an environment to automate the process. It let's you snapshot any subvolume to a schedule you configure, and then send backups to any destination you specify via ssh, or even USB drives. Since these are incremental it uses very little bandwidth. It even has an archive function for long term storage, and just like the other backups you can define individual retention policies for each location. Did I mention it also supports non-btrfs support, encryption, and both host/server initiated backups? Awesome. Next weekend I'll set up encrypted archives to the cloud...

</comment><comment><USER51> If you do that (just rsync every day), what happens when your primary storage gets corrupted, and you rsync the corrupted copy over your USB backup?

Much better to do some sort of incremental or differential backup.

As someone else said, borg is a good way of doing this.

Given you're using cloud storage, you could use rclone to sync (one way, from cloud to local) to a local disk, and then use borg (on your local machine) to backup the local copies to a second drive.

Of course, it's best to have this rclone+borg setup in two locations (e.g. second location can be parents' house or kids' house) so that it's very very unlikely that the borg repo(s) get corrupted due to user error or software malfunction.

<comment><USER52> borg is awesome, I once happened to talk to the developer of this. He said sometimes people report bugs to him and it turns out these are hardware errors that the integrity check of it found...

</comment></comment><comment><USER53> I have encfs folder in Dropbox, works reasonably well, but I do not have any automatic process writing to this from two different machines, that may cause trouble. That gives me privacy and keeps the most important files always backed up.

For a bulk backup, once per month I bring one of the 3 portable HDDs from another place, attach it to my server and start my custom backup script that saves encrypted zips of sensitive directories and rsync-backup of everything else to it. At any time 2 or 3 HDDs are outside the house.

</comment><comment><USER54> HP MicroServer with FreeNAS at home, it pulls down backups from my vservers and pushes encrypted parts of local data back there.

Every few months I manually sync most of the NAS onto an external, encrypted HDD (just bought a fresh 3 TB one) and that will be stashed in other parts of town/out of country with family. It's my last line of defense should the apartment burn down or something. Data might be half a year old, but the last 20 years are mostly there. Also it's not too inconvenient.

</comment><comment><USER55> Many options here for backups, but I didn't see most of them touch upon backup integrity verification and losing information through bad backups (any of the storage devices/locations suffering from bitrot or other corruption that silently stays and gets propagated) that may not be noticed until it's too late (during restore time, which may happen quite rarely).

So, how do you know your backups are good and that what you're backing up is good?

</comment><comment><USER56> I use git-annex to do pretty much what you're describing. It takes some getting used to, but it's much better than your suggested method of rsyncing to some USB sticks.

Under the hood it's basically doing that, but everything's SHA-256 checksummed so you can check its validity, and all copies of your data also sync metadata telling them who else has copies, it's easy to enforce policies that some content must have >N copies etc.

</comment><comment><USER57> I use github for all my private code, and then I backup my entire workspace as an encrypted 7zip file to Google Drive 2-3 times a year (about 10 gigs). There are plenty of services that do client side encryption + cloud service, but Google Drive is probably the only one you can do completely for free.

</comment><comment><USER58> As a private user, I just use either Clonezilla Live or an old version of Norton Ghost, and burn that to media (DVD-RW lately, it used to be CD-RW until that became unfeasible, and before that floppies). I prefer the RWs because that means I can use the discs from 2 or 3 images ago and recycle them.

</comment><comment><USER59> Do it the old fashioned way. Full backup to a hard drive, store that offsite and do incremental backups on USB sticks. There are dozens of good tools.

Personally, I manage media separately from normal files, and use hard drives for media, sticks for files.

It's easier, cheaper and more secure than any backup service.

</comment><comment><USER60> I'm just going to speak to longevity. If you are worried about the longevity of your data I would keep it simple.

1\. Primary data storage 2\. Local online backup 3\. Off-site backup (rotate/sync regularly) 4\. Online backup - <USER4>

</comment><comment><USER61> All hosts backed up to a NAS w RAID 1. I have an extra disk that gets hot swapped every 3-6 months and it goes into my safety deposit box. No encryption although I might add that after reading this thread.

</comment><comment><USER62> I use duplicity for create, encrypt backups. To store them I use two USB SSD drives (in two separate locations); for off-site I use AWS' glacier.

The backups are scheduled with jobs in self-hosted Jenkins instances.

</comment><comment><USER63> We use Synology NAS (with OpenVPN support). It offers hardware RAID 1 as well as encryption. We used to backup into this for ~4 years and it served its purpose.

</comment><comment><USER64> roughly, my $HOME ( 400Gb ) is rsync'ed to a external RAID ( [https://www.amazon.com/Oyen-Digital-MobiusTM-FireWire- Enclos...](https://www.amazon.com/Oyen-Digital-MobiusTM-FireWire- Enclosure/dp/B00CH94GMK/) ) , my preferred media is burn on DVDR , a few specific files go to dropbox and/or gdrive , and all my source code sits on bitbucket.

</comment><comment><USER65> [https://www.jwz.org/doc/backups.html](https://www.jwz.org/doc/backups.html)

</comment><comment><USER66> Backblaze for my desktop backup.

Then for large archival files I use: [https://www.backblaze.com/b2/cloud- storage.html](https://www.backblaze.com/b2/cloud-storage.html)

And just use Cyberduck to move the files over. Super cheap and gets the job done. Beauty of B2 is you can use a plethora of clients to move files: [https://www.backblaze.com/b2/integrations.html](https://www.backblaze.com/b2/integrations.html)

</comment><comment><USER67> My upload bandwidth is low enough to make offsite backup not practical (~1mbps). Anyone else with the same issue? How do you handle it?

<comment><USER68> You can have two encrypted external HDDs and mantain one with you, and the other in a friend/family house. Rotate frequently.

</comment></comment><comment><USER69> A bunch of RAID disks at home. If you value your data, you should own your data.

<comment><USER70> RAID isn't a backup

<comment><USER69> Context. The question was "how do you backup your files." My answer: on my RAID system at home. The RAID system IS the backup.

</comment></comment></comment><comment><USER71> how about a good old hard disk!?

</comment><comment><USER72> restic to Google Cloud Storage. Their Coldline storage costs a few euros per month for ~1Tb. And I can easily change backends if I want, restic supports many options.

The only problem is low upload speeds for residential customers.

</comment><comment><USER73> I have multiple harddrives synced on a daily basis.

<comment><USER74> Are the hard drives stored in the same location?

</comment></comment><comment><USER75> Onsite NAS Google Drive

<comment><USER76> So.. a NAS? AFAIK you can't self-host google drive.

<comment><USER77> I mentally added a comma between "on-site NAS" and "Google Drive". Might be wrong.</comment></comment></comment>


Full Draft of the Rails Tutorial 3rd Ed - <AUTHOR> http://news.railstutorial.org/rails_tutorial_full_draft/

<comment><AUTHOR> There are still a bunch of little things I want to tweak in the 3rd edition, but this draft should give you a good idea of what the final book will look like. Comments and feedback are welcome.

<comment><USER2> For someone who has been coding in Rails for years but hasn't ever done the testing side of things, would you recommend working through your book or looking at other resources to get up to speed?

<comment><USER3> As someone who is very familiar with testing from a JavaScript perspective yet is just getting started with rails, I have to really applaud the testing approach in the latest draft edition. It is very well done as well as a marvelous introduction.

</comment></comment></comment><comment><USER4> Michael Hartl's Rails Tutorial was the best book I have read for learning Rails. I picked it up during university and quickly moved onto my own projects and from there into a career in web development. Without a doubt this book is the biggest contributor to me finding my first contracting job and I recommend it to anyone who shows interest in learning how to develop for the web. I will definitely be purchasing the third edition when it comes out, purely to show support for such a great resource.

Thanks Michael, I hope the third edition's launch goes well.

</comment><comment><USER5> Michael, I'm currently working through the second edition - it's fantastic. I'm on chapter 5 but I'd like to switch over to the third edition. Is it worth restarting? Again thanks for such a great resource.

<comment><USER3> Its worth switching over if only for his use of minitest over RSpec

</comment></comment><comment><USER6> Hello - will the new 3rd edition come with an updated screencast series? How will you price the screencast + ebook bundle?

<comment><AUTHOR> Yes, there will be a new screencast series. I haven't decided yet on the pricing, but it will generally be in line with previous editions.

<comment><USER6> ty

</comment></comment></comment><comment><USER7> I wonder if you should just bump into 4th version so people don't think it goes with Rails 3.

</comment><comment><USER8> Going through learn ruby the hard way, excited this is finished in perfect timing.</comment>


Ask HN: eBook about Developers' (tech) Path - <AUTHOR> I'm trying to find a book I remember seeing a post/comment about. It was for an ebook about the path of developers or technologists within companies. I also remember someone commenting about how the author was advocating for those who seek a technical path to possibly establish their own.
I also think the title included an unusual word. <comment><AUTHOR> I've found it through Hacker News Books [1]. The book is Developer Hegemony [2]

[1] [https://hackernewsbooks.com/](https://hackernewsbooks.com/) [2] [https://hackernewsbooks.com/search?q=Developer+Hegemony](https://hackernewsbooks.com/search?q=Developer+Hegemony)

</comment><comment><USER2> Might it be "living by the code"?: [https://store.raywenderlich.com/products/living-by-the- code](https://store.raywenderlich.com/products/living-by-the-code)

<comment><AUTHOR> It's not the book, but looks interesting. Thanks.</comment></comment>


Swogo: What's it like to be a young startup in Amsterdam? - <AUTHOR> http://startupjuncture.com/2013/04/22/swogo-whats-it-like-to-be-a-young-startup-in-amsterdam/

<comment><USER2> Great to see another team comment on their experiences as a startup in Amsterdam!</comment>


How to Defeat Purposelessness - <AUTHOR> https://medium.com/swlh/how-to-defeat-purposelessness-a52a1714ce82 <comment><USER2> Just logged on to comment that this article has a different take on the matter than most of the other stoicism-related pieces that have been floating around HN over the last months. Very refreshing

Thanks for sharing</comment>


At Uber, a New C.E.O. Shifts Gears - <AUTHOR> https://www.newyorker.com/magazine/2018/04/09/at-uber-a-new-ceo-shifts-gears <comment><USER2> _"The company brought me on board because of a lot of things that happened in the past," he said. "We were probably trading off doing the right thing for growth, and thinking about competition maybe a bit too aggressively, and some of those things were mistakes."

When I reached Khosrowshahi by phone shortly afterward, he seemed disheartened, and disarmed by the intense scrutiny that comes with his new job. He told me that the autonomous division had been working toward offering driverless-car service by the end of the year, and that there would inevitably be "bumps and bruises" along the way. "What happened last week was truly tragic," he said._

Are there any instances of Khosrowshahi condemning these mistakes more forcefully? If this is all he has to offer in response, then I don't see much shifting besides the language the problems are couched in.</comment>


Sunken World War II German U-boat and Freighter Found Off Coast of Cape Hatteras - <AUTHOR> http://www.washingtonpost.com/local/sunken-world-war-ii-german-u-boat-and-freighter-found-off-coast-of-cape-hatteras/2014/10/21/5374c262-5938-11e4-8264-deed989ae9a2_story.html

<comment><USER2> Shadow Divers is an excellent book about finding sunken U-Boats in the Atlantic as well. Highly recommend.

[http://www.amazon.com/Shadow-Divers-Adventure-Americans- Ever...](http://www.amazon.com/Shadow-Divers-Adventure-Americans- Everything/dp/0375760989)</comment>


PyPy on Pi - <AUTHOR> http://www.raspberrypi.org/archives/3881

<comment><USER3> It's funny how the exact same news on the pypy blog did not make it to the front page. Anyway, here you go for a full announcement including benchmarks: [http://morepypy.blogspot.com/2013/05/pypy-20-alpha-for- arm.h...](http://morepypy.blogspot.com/2013/05/pypy-20-alpha-for-arm.html)

<comment><USER4> Yep, and it's not even specific to the Raspberry Pi-

"This is the first release that supports a range of ARM devices - <USER2> with ARMv6 (like the Raspberry Pi) or ARMv7 (like Beagleboard, Chromebook, Cubieboard, etc.) that supports VFPv3 should work. We provide builds with support for both ARM EABI variants: hard-float and some older operating systems soft-float."

</comment></comment><comment><USER5> Someone should host a mirror of the package repository and call it PyPIPyPyPi.

<comment><USER6> And then bake the URL into confectionery and call it a PyPIPyPyPi pie.

<comment><USER7> And make it in the shape of π and call it "PyPIPyPyPi π pie".

<comment><USER8> This was all just too irresistible. Well, I was here for the same reason.</comment></comment></comment></comment>


When you install un-signed code into your editor, it might as well be malware - <AUTHOR> https://glyph.twistedmatrix.com/2015/11/editor-malware.html <comment><USER2> The point the author is making is that at least your third-party plugins should be protected from tampering in transit.

Don't think this is only restricted to state-level actors. With even commercial routers like Cisco and Juniper shipping with backdoors, and of course personal routers with vulnerabilities all over the place, it's not an especially heavy lift to take over a bunch of last-mile routers.

There are tons of these unprotected attack vectors, and the author is right that we need to start rooting each one out. It all starts with your OS's keys (or below your OS, in UEFI!)

This is probably even more of an issue for Linux distros that serve their initial install CD's (or bittorrent links) over HTTP. That's an easy vector for a third party to slip in a replacement CD/DVD and checksums, or even just slipstream in the changes without bothering with the checksums, since probably most people never check the digests and if they did and they didn't match, they'd just figure it was a bad download and never suspect a thing.

When people say "oh, no one cares about me", it's simply not true. That's why there's > million viruses out there. That's why ransomware exist. Oh, yes. they care.

</comment><comment><USER3> Was hoping to see a mention of Sublime Text...because I most definitely haven't taken the time to audit the packages I install, nor do I even really have much insight to how the central package repository is maintained. I did a couple of Google searches for "sublime text package malware"/security/sandbox and didn't see articles specific to the topic.

<comment><USER4> Package Control protects package information in transit using TLS, verifies TLS hostnames, and requires that package metadata source URLs are HTTPS. The source URLs for package information are all tracked in an open source repo on GitHub.

For the past couple of years a volunteer who goes by the handle FichteFoll does most of the review process, and I tend to fill in when he is unavailable. We check for common packaging issues, areas of confusion for users and sometimes even code suggestions.

In terms of hosting, it is all done via a private server that I run, configured to only allow TLS 1.0+ connections. I am the only user with access to the box.

All of this is to say that Package Control generally tries to vet packages to get them info the default channel, and then protects them in transport. However, packages are in no way audited, and could (obviously) be subverted by anyone with access to the original source code repo/hosting.

</comment></comment><comment><USER5> Someone really should take the time to sort this out … I guess that I'm someone.

</comment><comment><USER6> If a secure server is compromised, then none of this matters. You have to trust someone at some point.

<comment><USER7> There's a difference between bowing to practicality / trusting someone, and trusting everyone in the chain that gets the packets from the server to your device.</comment></comment>


Salary Negotiations, Don't be Tough, be Honest - <AUTHOR> http://jnorthrop.tumblr.com/post/16631034370/salary-negotiations-dont-be-tough-be-honest <comment><USER4> Negotiating does not have to be adversarial, but it has to be _negotiating_. That means both sides are willing to walk away amicably from the table.

If you're not willing to walk away, you're not negotiating -- you're just having a conversation about salary. You've already decided you're staying; the only thing being decided is how much money your feelings are worth. Not a good spot to be in, for either you or your boss.

I like this author's advice to do a lot of research beforehand and have a realistic idea of where the market is. You should also have a realistic idea of what it would cost to replace you -- probably much more than market salary for a similar job. You need to have an honest -- and fun -- conversation about rates. To start that conversation, you need to be clear with your boss that the starting point is your leaving to find a better job. (But this must be a true statement!) Given that starting point, you both talk and share information about how to reach an agreement you both like.

Yes, the emotional part is the worst. That's why you make those tough emotional decisions before you walk in the door. It's also why you give your boss plenty of time to step back and think through things dispassionately as well. Coming in half-assed, with aggressive demands, is a good way to get fired. Coming in well-studied, with no pressure and just trying not to rock the boat, is a good way to stay at the same job and salary for the rest of your life. You have to learn the art of working between these two extremes.

It has always amazed me the lack of education we provide people in negotiation. It's the one business-related practical life skill that nobody can do without.

<comment><USER5> I don't think that both sides have to be willing to walk away for it to be a negotiation. Both sides just have to believe that the other side is willing to walk away.

</comment></comment><comment><USER6> I've found, more often than not, when a company takes a hard negotiating position upfront with engineers, it ultimately proves to be penny-wise and pound-foolish. Many times, what a company "saves" in negotiations is immaterial relative to the hiree's compensation. In exchange, the company immediately begins a relationship with an engineer on a sour note and sends a huge signal about company loyalties and values.

I'd recruited an engineer to join my team, and he tells me his comp requirements (90K salary). For the position, we budgeted 96k. A stellar engineer and ideal team fit, I thought he was underpaid at that, but that's what he asked for so I prepared an offer.

In preparation, the CEO (who signed off on such things) sets our initial offer to 85K. I was surprised -- why would we not offer the candidate 90k salary? The conversation went something like this:

      CEO: Offer him 85K.
      Me: Why? He asked for 90K, and we've budgeted 96K.
      CEO: I want to leave some room for negotiation.
      Me: Room?
      CEO: Yeah. I think we can get him to come down from 90K.
      Me: You haven't met him yet. Why do you believe he would accept a lower offer?
      CEO: I never take the first offer at face value.
      Me: I've talked to him, and he earns 90K in his current position. He doesn't want to
      take a pay cut.
      CEO: Well, let's see how much he wants this job.

I make the offer, and the candidate responds "I don't want to take a pay cut, and can't accept your offer." The back-and-forth begins, and we finally come to agreement -- at 90K.

And while the engineer accepted and joined our team, I could tell that the offer negotiation made him uncomfortable and left a bad taste in his mouth. He did a great job for well over a year, until he left for a new position. He explained to me that he received a better offer, and that the other company was "more inviting".

After his departure, the CEO lamented how engineers seem to have no loyalty.

Indeed.

<comment><USER7> This is a great story. It illustrates everything perfectly:

Why, as employee, you're probably getting played and that you should ask for more money.

Why, as employer, it's advantageous to be magnanimous and not lowball the employee.

And it illustrates the power imbalance.

<comment><USER6> Very prudent. I try to be as straight-forward as I can with candidates, and I insist on honesty from both sides.

As a side note, I originally wanted to offer the candidate 96K because I knew he was worth it (more, actually.) But, the CEO decided to press on an engineer who wasn't all that driven by money. A phenomenally poor decision.

I resigned from my position at a later date, and our hiring practices were not without consideration.

</comment></comment></comment><comment><USER8> A worrisome mentality in the post and in some comments here: the words "should" and "shouldn't", the concept of "fair", "feeling sorry" for people who have to negotiate, the word "ridiculous".

I think you should be careful with sentiment analysis on a forum like HN. This place is overwhelmingly populated with people for whom the concept of salary negotiation is repellant. One could get a seriously skewed idea of what to expect from negotiations from comments on HN.

The fact is, a huge number of places _that you'd actually want to work at_ are going to treat salary negotiation as the business transaction that it is. Not taking the transaction seriously is going to cost you thousands and thousands of dollars.

It's true: the worst places to work will be the ones who are most aggressive about negotiation. But that observation _totally misses Patrick's point_. You don't have to get screwed by a hard-nosed negotiation to lose out on thousands of dollars of comp. In fact, if you don't take negotiation seriously, you'll lose thousands of dollars without even noticing, because your social norms will blind you to what's happening. Patrick isn't just talking about how to handle stupidly tough negotiations. He's talking about _all_ of them, even the nice and friendly ones.

The range between your negotiating floor and the employer's negotiating ceiling is the spread. Any dollar figure you accept below their ceiling is a dollar you gave them. From the way people talk about negotiation on HN, my guess is that 9 times out of 10, HN'ers take a number smack in the middle of the spread --- meaning, they've coughed up high 4 digits (and often 5) back to their employer. And they feel good about it! They write blog posts about it!

If you think you work on a team where you don't have to negotiate, because everyone's grown-up and knows the score and pays people what they're worth, seriously consider that you may (probably not intentionally, but still) be getting played.

<comment><USER9> "It's true: the worst places to work will be the ones who are most aggressive about negotiation."

I'm not sure that's true. Google is a notoriously tough negotiator - not just for salaries, but for their food suppliers, data center locations, acquisitions, basically everything - but it's also a pretty good place to work. I've heard Warren Buffett and the Berkshire Hathaway properties are too.

The best people to do business with seem to treat negotiation as a business transaction that they will press every advantage they have on, but then once you're in, you're in, and they'll be loyal to you. And they expect you to do the same. It seems to be worth cultivating that skill - respecting the other party, but also respecting _yourself_ enough to ask for what you want and be willing to walk if you can't get it.

Come to think of it, this is generally called "assertiveness" and is typically seen as a desirable quality in life.

<comment><USER10> You'll still need to renegotiate regularly since the value of the relationship drifts over time. Are you still worth exactly what you were on the day you started your current gig?

</comment></comment></comment><comment><USER11> This also depends on the nature of the organization you're negotiating with. The people first asking about your current salary / expectations of salary in a larger organization will often be from HR, collecting information that they'll feed up the organization, probably your boss-to-be's boss. The higher up this goes, the harder the heads are at negotiation; frequently, your boss- to-be, at the salary negotiation level, is just a go-between. He'll have an expected budget, but to push higher he'll have to go to his own boss, and that dynamic favours the company rather than the employee.

You need to balance the risk of getting off on the wrong foot, with the potential that you can be leaving a _lot_ of money on the table - I mean, on the order of quarter of a million to half a million dollars over the course of your stay with that company is quite likely if you don't negotiate well - <USER2> to mention a bitterness that can grow over time. And switching jobs may not even be a cure here; if it's a job you enjoy, it's not much fun having to leave it in order to get your worth on the market. It's best to get both.

<comment><USER12> _frequently, your boss-to-be, at the salary negotiation level, is just a go- between._

At most larger corps this is very true, I was a VP at a large company and I would project my personnel need, I would also give a top end salary, which I would provide as market + 10%. From there I never heard about salary, I gave a go no go on hiring and HR worked out salary. It is a pattern that I have seen a good deal in larger orgs.

</comment></comment><comment><USER13> I'm in an interesting position because I just negotiated a raise, and am also negotiating with candidates for an upcoming hire.

I earned my raise by first earning it in effort, but when it came time for the negotiation I know without a doubt that if I hadn't made it clear I was willing to walk away, I wouldn't have received the raise. The boss thought he could appease me with talks on potential numbers, but I stood my ground and said that I needed an answer within 24 hours. It wasn't until I, politely of course, demanded a yes or no that I received a yes.

Now, in the hiring process, I have a limited amount of money available to pay a new employee. I may be able to get another 10%, but not much more than that. I do ask candidates to offer a number, not to screw them on salary but to know how apart we are. If we're 20k apart, why should I waste their time stringing them along?

<comment><USER14> If getting the potential employee to offer a number is genuinely, purely in the interest of not stringing them along, why don't you offer the first number? "This is the salary allocated for the position. Is this a salary you would be comfortable with?"

Now you have a way to both not string them along if you're $20K apart and to not let them accidentally undervalue their own worth by a significant amount.

</comment></comment><comment><USER15> One little quick thing I've learned over the years, the more HR is involved, the more likely it is that you'll be mislead and deceived.

<comment><USER16> Human resources look at you like you look at a server.

</comment></comment><comment><USER17> Harvard Law School's free course on negotiations. Covers all aspects of negotiations.

[http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewPodcas...](http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewPodcast?id=379064206)

</comment><comment><USER18> I like not giving a number.

It makes the other guy squirm.

He's worried not just that you'll get more chips, but that the whole deal that he's worked hard to put together will fall through.

If you throw some number out at this point, they can just work you down. If they throw out a number, you can typically work up, and if the number they give is way too small you understand what you're dealing with.

<comment><USER6> If someone won't tell me their comp requirements to start, there is no possibility I make an offer.

I need to know first-hand if we're in the same ballpark. If the candidate's comp expectation exceeds the range we've selected, we can either move on or adjust our pay scale for the position. If the candidate's comp expectation is lower than the pay scale we've set, we need to evaluate if the candidate really meets the position (assuming lower pay = less qualified candidate.)

Not to say the strategy doesn't work for some people, but it definitely fails with me.

<comment><USER19> I find it hilarious that you are trying to act as if this is anything but a negotiation ploy on your part. If it's so vital that you know you're in the same ballpark, why don't _you_ give the salary range up front?

When someone insists on a number "up front" with me, they get a high range. If they insist on a specific number, the get one in the stratosphere. They've forced me to price in all the risks. Without the interview I have no idea what your organization is really like on the inside (I'm interviewing you as well). By insisting on a number before the interview starts you send a very strong "bargain shopper" message. So I'm pricing in the likelihood of:

-crappy benefits -unpaid overtime -future trouble with raises -my peers will only be people who fell for your tactics

Ask yourself if you want employees that think ahead, and evaluate a situation like I do. You won't get them with your current mindset.

<comment><USER6> We pay better than market salaries. I don't "give" the salary range because I'm searching for the right candidate. In most cases, we adjust our offers higher than what we expected we would find in candidates.

These aren't tactics, they're filters to see where candidates are in line with our evaluation and what we expect to pay them.

I can tell from your comments that you already assume I'm trying to screw you over and repress your compensation. If you ever dealt with me, you would know that's not the case.

Given the team we've constructed, I'm pretty sure we've got the right folks. Thanks for the suggestions.

</comment></comment></comment></comment><comment><USER20> But a lot of times the other part is not being honest nor nice. See <http://news.ycombinator.com/item?id=3521817> for an example.

I believe in tit-for-tit. Why should a potential employee be upfront when the employer is not upfront?

<comment><USER21> Personally, I would not work for anyone who wasn't being honest with me, but I'm a bit old and gnarly like that. I believe integrity to be one of the key ingredients in any work relationship, and I regret all the time I've wasted working for and with people who lack it. Conversely, honest people are always a pleasure to work for.

The last job interview I went to, I took with me the attitude that "if this job isn't exactly right for me, I will say so and politely walk away." I put on the table what I wanted to do, what my aspirations were, and how much money I wanted. I made sure I was scrupulously polite and scrupulously honest. It helped with the negotiations, and it helped now I've started the job - <USER3> removes a lot of the confusion about my role, because we agreed it in advance. (I've found too many people seem to think "sys admin" or "programmer" means "general-purpose IT skivvy", which is another thing which ruins the work experience for me. It still happens, but less so because of the prior agreement.)

Still, things aren't 100% perfect, but I feel the way I conducted the interview for this job is one I will use again, whether it be full-time employment, freelance or contract work: be honest, be polite, and be prepared to walk away.

<comment><USER22> "I would not work for anyone who wasn't being honest with me".

The big point in the earlier discussion this week was that _you don't know_ if the other party is being honest. They can do background checks on you, credit checks, employment history checks, etc (with your consent of course), but you have no idea about their background. With public companies you can read some info about them, but it's not personal, nor does it go in to departmental politics and budgets and such.

A potential employer saying "our hands are tied, we can only go up to $75k for this position" may be telling the truth, or they may be lying. _You can't tell the difference_. That was the gist of the earlier posts.

"Be prepared to walk away" is core negotiating advice for any commitment - marriage, car purchase, job search, housing, etc. Not having the guts to walk away means you will make decisions based out of fear, rather than out of a position of strength.

<comment><USER21> > "our hands are tied, we can only go up to $75k for this position"

If I needed $80k, I would then say "I'm sorry, but I have expenses to pay, a family to keep. I can't work for less than $80k." If he insisted, that's when I would shake hands and walk. It wouldn't matter, in fact, if he was being honest or not. That's my limit. In this case, it's no different to bidding on eBay: I have $80 for this purchase, if it goes higher I will maintain self- discipline and drop out of the auction.

<comment><USER22> The overwhelming majority of people won't just walk away. They get hyped up in to 'negotiations' and start panicing if they can't get what they want/need.

It's less so in the IT world right now, but in most other fields, there's much higher unemployment. People don't "just walk away", and often accept a situation that doesn't fit their wants/needs, because _needing_ income ends up trumping everything else.

For someone not in IT right now, who needed a job, they're at a strong disadvantage because of the information imbalance during interviews. Congrats on you being a rather rare individual who actually does what is recommended (walk away) - most people don't. And it comes back to not being able to tell if the other side is lying. And in some cases, being desperate enough to work for/with someone who they suspect or know is lying, but needing the job bad enough.

<comment><USER21> It has occurred to me that being in IT is possibly one reason I can do this, but otoh I have noticed that companies increasingly want to "commoditise" IT workers, so repeatedly low-ball their offers until they get someone who is willing to work for low pay and goodwill. I must admit, that has sometimes been me, but it won't happen again ;) Also, I have been in situations where I _needed_ work, and I think now it would have helped if I had adopted my current strategy. It's a bit like dating: look too needy, get neglected. Look confident, people think you're worth having.

</comment></comment></comment></comment></comment></comment><comment><USER19> Don't use honesty as an excuse for letting someone pick your pocket. Here's what happens when Mr. Niceguy mentions his requirements first.

You: I'm looking for $90k

Boss: Oh I think we can get you there, we start everyone at $70k then adjust based on performance. Perform well and you'll get there (you won't).

You: Oh, well I'd prefer $90k to start, and the position is worth $90k.

Boss: We don't make exceptions, and you don't really meet requirements X and Y for the position. But we'd like to give you a chance to learn here.

You: No I really deserve 90k, I might go 85k with the proper benefits.

Boss: Ok so will start you at 75k, and our normal benefits package of barely subsidized medical/401k/2-weeks vacation is easily worth 10k. Glad we could come to an aggreement.

You can be tough _and_ honest. Negotiation isn't about being dishonest. You can negoatiate very well and be honest the whole time.

<comment><USER23> Presumably then Mr. Niceguy then walks out the door, if he was actually being honest about requiring 90k.

</comment></comment><comment><USER24> This is a game which is in general one sided. The employer knows more, and has less stake in this deal (more market power).

A one sided information delivery from you essentially makes you even less powerful.

The only way this works is if your boss decides to be fair or good for you for their own reasons.

</comment><comment><USER25> Remember companies need _you_ in order to make money. I had lunch with a guy I used to work with the other day and he was telling me that he was having a horrible time finding engineers to _even come in for an interview_. This is north of Boston, not Silicon Valley either. Good engineers have more options now than we're accustomed to.

When a recruiter/HR person/interviewer asks you about your salary requirements, ask them what sort of engineer they are looking for:

A) average (you don't want to work there) B) above average or C) way above average

If they answer "way above average" you can say "Well, there is your answer!"

When a company doesn't want to pay much, its a signal that they don't place much value on engineers.

</comment><comment><USER26> Work with a recruiter, get lots of offers, let them bid the salary up, then take the best offer/job.

It's really that simple.</comment>


Climate experts call for 'dangerous' Michael Moore film to be taken down - <AUTHOR> https://www.theguardian.com/environment/2020/apr/28/climate-dangerous-documentary-planet-of-the-humans-michael-moore-taken-down <comment><USER2> I disagree with trying to deplatform ideas you don't agree with.

Engage with them, show them the error of their thinking, but if you drive it underground you just trap those people in a bubble filled with like minded people and the chance they change their mind approaches zero.

Plus there is always the chance you're the one who's wrong - even if you're on the side with the widely accepted viewpoint.

All innovation at least begins with a dissenting voice.

<comment><USER3> What if it's not an "idea", but actually a provably false statement?

Sadly, it's beneficial to media companies to give provably false statements airtime because they are controverial, which drives views and clicks which drives revenue.

But for society is it beneficial to let false statements have a platform?

<comment><USER4> How many times does your tired old argument have to be refuted? Your idea only works if there is a perfect arbiter of "truth." There are nearly no truths in human existence; math probably comes closest, and yet even there look how many things in history were "true" based on knowledge of the time (Earth as the center of the universe is an obvious one).

You fail to consider that _humans_ implement rules (e.g., your movie is illegal because it's not true) and humans are fundamentally corrupt, selfish creatures.

<comment><USER3> Your comment is a straw man attack, so perhaps cool it with the "tired old".

Provably false statements do not require perfect arbtration of truth.

For example, the president says something on TV, and a talking head straight- face states "that never happened". This is the current level of discourse in the USA.

<comment><USER5> It'll never stay limited to just provably false statements. The article we're discussing is evidence enough of that.

<comment><USER6> The article linked cites various rebuttals (by actual scientists) of what seems like a large amount of factually incorrect information in this documentary - are you saying that the documentary actually _is_ factual?

</comment></comment></comment></comment></comment></comment><comment><USER7> As someone who disagrees with Moore 99% of the time, this is absurd, and tells you more about the state of institutional "experts" and "science" than it does about the contents of Moore's movie.

Moore can publish (obvious!) bullshit for years and never really get called on it by "experts" or popular media. Now, he publishes something that goes against the dogma of a highly cathedralized and politicized field with such low predictive power that it hardly qualifies as a science at all, and there's a huge (and very successful) censorship effort.

I wonder, is the divergence between the predictive power of the field and the strength of its dogma enforcement an anomaly, or is it to be expected that fields with low predictive power will more aggressively defend their orthodoxy?

<comment><USER8> 'Moore can publish (obvious!) bullshit for years and never really get called on it by "experts" or popular media'

He gets called on it constantly. His reputation is so bad that it would never occur to me to bother watching this film.

'goes against the dogma'

Or, contains objective falsehoods and libels.

<comment><USER7> When's the last time the publisher canceled a release of one of his films?

> Or, contains objective falsehoods and libels.

All of his movies have this, and they still don't provoke this kind of reaction.

</comment></comment></comment><comment><USER9> There is nothing more disturbing than this poison in the minds of young people that an idea they don't agree with should be destroyed.

It just feels like it is a matter of time until we have something as insane as the French Revolution in the US.

<comment><USER10> On the perfectly opposite side, personally, I feel that the encouragement to think of any content removals and user bans, regardless of context or platform, as "censorship" and "destroying ideas you don't agree with" is easily the most disturbing social trend of any significant popularity that I've seen in my life. I think it may be extremely poisonous to the minds of the young, and this trend, if any, is the one I think could lead to violence - especially when proponents frequently like to throw out such ironic phrases as "this can only end via a French Revolution" and "they (the bad guys! not us!) want a civil war".

<comment><USER9> Makes no sense.

</comment></comment></comment><comment><USER11> I found a more substantial rebuttal to the film than "we need to deplatform this ASAP"

[https://www.filmsforaction.org/articles/skepticism-is- health...](https://www.filmsforaction.org/articles/skepticism-is-healthy-but- planet-of-the-humans-is-toxic/)

<comment><USER12> Very informative thank you. From this rebuttal I see that the movie probably packages true information, some of it outdated, in a provocative way. The only fully scientific rebuttal is to run the experiment: run the whole economy without fossil fuels or nuclear, and see how much it looks like the middle- ages, how much it looks like utopia. My guess is 80/20 on the middle-ages side, but who know.

</comment></comment><comment><USER13> I think it would be a great cultural event if scientists made a documentary as a rebuttal. I've seen this before where they rather deplatform than confront. Maybe they don't want to confront certain facts. Should be interesting to watch.

<comment><USER8> Should a planetary scientist spend her time making documentaries to rebut the flat earth people? Who is "deplatforming"? They are asking for the film's creators to face up to their mistakes, retract the film, and apologize. Nobody can take Moore's platform away.

<comment><USER14> Er, a film distribution company already dropped the movie and refused to distribute it further. Moore's platform is film. That's actually people taking his platform away.

<comment><USER8> They (regrettably) decided to continue to distribute it after all, even though they say they know it is garbage, so as not to seem to be censors. Also, it was far from the only platform that the film had. This is not analogous to actual deplatforming, that goes on on college campuses, for example.

<comment><USER14> Glad to hear it! I don't actually like Moore, not being a left leaning activist type myself. But he should be able to speak if people want to listen.

As for deplatforming, come on. There is more than one college campus in the world. If it's deplatforming to kick people out of colleges it's definitely deplatforming to bully film distributors into dropping films.

</comment></comment></comment></comment></comment><comment><USER15> I'm definitely going to watch it, now. Heterodoxy is more important than ever in society. I'm capable of disagreeing with an argument and want the freedom to do so.

If what Moore presents is taken out of context, which is probably what is happening here, it doesn't matter what he presents.

</comment><comment><USER16> One thing I see parroted often and that the article alludes to, is the "fact" that electric vehicles pollute almost as much as regular cars because the electricity they use is generated in coal-firing plants.

What I hate the most about this argument is that it's often presented as a universal fact, and while it may be true in some areas in the world, it's definitely not true everywhere. A lot of Europe has nuclear electricity, for example, and here in Canada we're mostly on hydro power.

The overall numbers start to look very different when you assume hydro power instead of coal, for example, and I bet the film doesn't mention that (haven't seen it, though).

EDIT: I found a source describing my province's electricity mix: [https://www.cer-rec.gc.ca/nrg/ntgrtd/mrkt/nrgsstmprfls/qc- en...](https://www.cer-rec.gc.ca/nrg/ntgrtd/mrkt/nrgsstmprfls/qc-eng.html)

Turns out all fossil fuels combined contribute less than 1% of out electric capacity. A significant part of that 1% is in remote communities such as the Îles-de-la-Madeleine, which uses a diesel plant. This means that the percentage is even smaller in the "general" mix outside of these communities.

<comment><USER17> Said as someone who lives in a hydro power province. Hydro is incredible harmful. It ruins whole ecosystems in ways that an oil spill never could.

<comment><USER16> Somewhat true, but it doesn't harm the environment from the same angle. The #1 enemy right now is greenhouse gases, and you can't deny that hydro power produces much less of it than coal.

You're right that there's a real impact on ecosystems; flooding large areas and such. However, I'd describe it more as a disruption than a destruction; 30 years later the ecosystems around it have adapted and the reservoir serves the ecological function of a large lake. Sure, it's not perfect, but it's better than burning coal.

<comment><USER18> > and you can't deny that hydro power produces much less of it than coal.

I can't vouch for this but I read stuff like this

[https://news.wsu.edu/2016/09/28/reservoirs-play- substantial-...](https://news.wsu.edu/2016/09/28/reservoirs-play-substantial- role-global-warming/)

td;dr: Bacteria in reservoirs decompose organic material trapped behind the dam releasing CO2 and methane.

<comment><USER19> Ok, but the link doesn't seem to say what would happen to that organic material if it weren't trapped behind the dam. Wouldn't it decompose anyway? (or get turned into fish, but I would expect that to happen either way)

<comment><USER17> generally organic material in a forest doesn't get decomposed into methane.

</comment></comment></comment></comment></comment></comment><comment><USER20> Instead of censorship, perhaps we should codify universally acceptable ideas and put them into a book. This book would be distributed to everyone that wants one and once a week we would gather and read a portion of it together and receive guidance from an expert on the subject. Over time this should lead to a more virtuous society.

I think this would be preferable to the clumsy "whack-a-mole" system we currently use to silence unacceptable ideas.

<comment><USER21> What happens when one of your "universally acceptable ideas" aren't acceptable anymore, or gets proven wrong? More importantly, who gets to decide what's included in the first place?

<comment><USER22> The Council of Niceties obviously

</comment></comment></comment><comment><USER23> If you claim your film is a "full-frontal assault on our sacred cows" and the immediate reaction from the 'priesthood' is that this work is heresy and must be banned... then it looks like you've really hit the mark.

<comment><USER24> Maybe.

"Cancer can be cured by drinking methylmercury."

"That's dangerous and you should stop saying it."

"Looks like I hit the mark!"

<comment><USER23> My point is that the film claims to challenge sacred cows and that the reaction alone is enough to show that _that_ claim is correct, not that all or any of the specific claims in the film are.

There are likely many films that make ludicrous claims about climate change but even absurd ones rarely get called out as dangerous enough to warrant being banned. When films/books/etc get this strong of a reaction there is usually something in there that is worth understanding why it hit such a nerve.

...or it could just be good marketing.

<comment><USER24> > My point is that the film claims to challenge sacred cows and that the > reaction alone is enough to show that that claim is correct

And it's a bad point.

People who claim to be "challenging sacred cows" are _often_ just making provocative, misleading, or downright false claims. This has been Moore's shtick for decades now, in fact.

A strong reaction is not always proof of "sacred cows". Sometimes it's just warranted.

</comment></comment></comment></comment><comment><USER25> From the letter "calling for [the film] to be taken down" that the article is based on: [https://twitter.com/joshfoxfilm/status/1253572812591247360](https://twitter.com/joshfoxfilm/status/1253572812591247360)

>Summary: The new movie Executive Produced and promoted by Michael Moore, Directed by Jeff Gibbs and distributed by Films for Action, PLANET OF THE HUMANS is unscientific, flies in the face of decades of renewable energy science, engineering and research and is counter productive in the age of urgent need for Climate Action. Because the film is based in misinformation and not in truth, we request that the film be retracted by its creators and distributors and an apology rendered for its misleading content.

</comment><comment><USER26>
        Describing itself as a "full-frontal assault on our sacred cows"
        temporarily took down the film after describing it as "full of misinformation"
        "trades in debunked fossil fuel industry talking points" that question the affordability and reliability of solar and wind energy.
        the film includes "various distortions, half-truths and lies"

It is written, therefore it must be true. They crossed my accusation threshold, no more thinking required, case closed. But seriously I'd love to see their actual rebuttals to the film. In the meantime I'll check out the free YouTube link they include in the article.

<comment><USER8> "I'd love to see their actual rebuttals to the film"

Then all you have to do is follow the link in the article to the letter that contains those rebuttals.

<comment><USER26> Good eyes, I definitely glossed over the linkage in the parent article. Nice stance they're taking with all the transparency about their decisions. Pretty level headed public response.

> Ultimately, we decided to put it back up because we believe media literacy, > critique and debate is the best solution to the misinformation in the film. > [https://www.filmsforaction.org/watch/michael-moore- > presents-...](https://www.filmsforaction.org/watch/michael-moore-presents- > planet-of-the-humans/)

I can't tell if that's the climate experts they refer to but these film advocates breath of freshair response is equal to or more newsworthy than the original article. I'm really digging their tone and open invitation.

</comment></comment></comment><comment><USER27> The main thesis of the film, that the _essential_ issue is not climate change but runaway consumption, is hard to deny.

</comment><comment><USER28> wow, this is great marketing for the film. now i want to see it to see what all the controversy is about.

i've seen a couple michael moore docs before, and while i often sympathize with his position on a given topic, i'm rarely impressed by his persuasive documentary powers.

</comment><comment><USER29> High energy civilization is not a birth right. Just thought I would put a line out there for both leftists and right wingers to censor. And I will be happy when they do and they will.

</comment><comment><USER30> I see dangerous is in quotes - having read the article and seen the vitriol and scorn heaped on this movie, that fact begs the question, who is actually in harms way here?

</comment><comment><USER31> But we all agree even if true, this is less bad than global warming right?

</comment><comment><USER32> Perfect is the enemy of the good.

</comment><comment><USER33> this doc illustrates the enormous realities of energy challenges with sober clarity often exposed by Jancovici [https://m.youtube.com/watch?v=wGt4XwBbCvA&feature=share](https://m.youtube.com/watch?v=wGt4XwBbCvA&feature=share)

</comment><comment><USER34> Michael Moore is ultra-leftist environmentalist.I watched the video entirely because climate experts are so angry.

The video starts off explaining that he is an environmentalist. Certainly makes the video provocative.

The actual video seems to suggest what the right-wing has been saying for 20 years. VERY interesting to see Michael Moore agreeing with the right-wing folks.

Makes you wonder if perhaps that he is right here.

</comment><comment><USER35> I think Moore makes some really good points that need to be addressed by environmentalists but taking down the film should not be the first form of action.

3 points that are absolutely true. 1) that most green power is backed up by fossil fuels. 2) that solar and wind power hardware needs to be replaced on a regular cycle and that every cycle deals with adding pollution to the environment. and 3) that the real problem is the size of the human population. There are too many people overpowering the planet's available resources.

They are uncomfortable issues but they need to be addressed rather than swept under the floor because we don't like them. If we don't address them they will never be fixed.

<comment><USER36> What good points?

1)Duh. Green power (except nuclear) cant just scale whenever it is needed, sun is there during the day only, wind is there when wind is there, etc. Why is this even an issue? Over time green power and power storage technologies will get cheaper and flexible, allowing us to use green power as higher and higher percentages of our power needs.

2) Who ever said that green power hardware had some magical resistance to wear and obsolescence? Obsolescence is great because it means newer hardware works better and can have lower environmental impacts.

3) Something that's been a mainstream topic for over 50 years, so what's the point? what's their and your solution? We know that increasing living standards and empowering women leads to lower birth rates, the US and Japan are supposedly already below replacement level birth rates. What else do you propose?

<comment><USER27> The first two points are under-appreciated and it shouldn't be assumed that the environmental cost is negligible.

As for the third point, I don't think the film comes right out and says there are too many people, though it is implied. Specifically the film claims that in the last 200 years the population _as well as_ the consumption rate per person has increased tenfold, for a total increased impact of 100 times.

<comment><USER36> Under appreciated or not, why the complaints? What alternatives are there that are economically competitive?

It's ridiculous to complain that technologies that significantly reduce our environmental impact aren't zero impact. It's throwing babies out with the bath water levels of cluelessness.

</comment></comment></comment></comment><comment> globular-toast I disagree with censorship in principle so don't support these "climate experts".

I am no climate change sceptic. It's easy to see that our way of life is far beyond sustainable and has developed in ways which are now harmful to us individually and as a species. It's easy to see and I will support any change which is driven by sustainability first.

But I'm now beginning to see why people are against the "green" movement. They are not starting with sustainability. They are simply trying to profit from giving people the same conveniences but with a "green" badge slapped on it. If it was about sustainability it would be easy to debunk a film like this, but instead they just want to silence it.

</comment><comment><USER37> Everyone is so angry at Michael Moore because they are terminally anthropocentric. The point of the film is that we need to achieve fewer humans, and this makes the anthropocentrists rabidly angry.

Moore makes an excellent point: creating solar panels and wind farms requires fossil fuels. Doing so in such a way as to accommodate perpetual growth is unsustainable.

We need to prune the human species to a sustainable level and keep it there.

We need forced sterilization, now. We need to limit waste and useless economic activity, now. Or else we will become extinct.

COVID-19 is clear and unequivocal evidence that population density has reached unsustainable levels. We are looking at The Great Filter.

We can have innovation, technical progress, and a good life. But we can only do that on a smaller scale.

<comment><USER38> Millions have viewed the video, yet so few understand its message. "Growth is Good", but population growth without limits is suicide.

Forced sterilization is not the only answer. Fifty years ago, Paul Ehrlich explained the problem in considerable detail, and he has offered numerous solutions. Today, most people have never heard of him. ( [https://en.wikipedia.org/wiki/Paul_R._Ehrlich](https://en.wikipedia.org/wiki/Paul_R._Ehrlich) )

Perhaps Covid-19.is too tame. Just wait. If we are unwilling to live in harmony with nature, the problem will soon be resolved - one way or another. ( [https://www.youtube.com/watch?v=qWMyWr9_CVo](https://www.youtube.com/watch?v=qWMyWr9_CVo) )</comment></comment>


AWS VPC Traffic Mirroring - <AUTHOR> https://aws.amazon.com/blogs/aws/new-vpc-traffic-mirroring/ <comment><USER2> What's really interesting is that you can capture amazon-dns traffic. This is gold for security purposes.

</comment><comment><USER3> It's about time. Finally, IDS/Session monitoring that is external to the hosts one is monitoring.

</comment><comment><USER4> Awesome feature that will likely unlock a bunch of services or service providers like Iceberg, Snort and Suricata to be able to capture and inspect traffic inside the cloud.

<comment><USER5> the floodgates are open! my favorite, from the folks behind bro: [https://www.corelight.com/company/newsroom/news/corelight- cl...](https://www.corelight.com/company/newsroom/news/corelight-cloud-sensor- for-aws/) [https://www.corelight.com/products/corelight- sensors/#cloud](https://www.corelight.com/products/corelight-sensors/#cloud)

</comment></comment><comment><USER6> Oh interesting. Could you use this to test a system using live traffic before a release?

<comment><USER7> I'm pretty sure you could. You could mirror your live traffic to a test, but that's generally a bad idea. You have to make sure no data gets out of your test system either towards the client or towards the database. Gotta be real careful when mirroring real traffic.

Of course, using it to capture raw requests and replaying them would be a decent use case.

</comment></comment><comment><USER8> This looks really useful. I think you can now offer a full intrusion detection service as a marketplace service on AWS with minimal configuration.

</comment><comment><USER9> Slightly off-topic:

Amazon Polly breathing in drives me nuts.

<comment><USER10> I know, it hasn't improved since they launched it. I feel like an hour or two tweaking it could make it sound fine. I can't believe someone listened to that and said, ya, that sounds really good, let's launch it.

Maybe they were using Christopher Reeves as the voice model.

</comment></comment><comment><USER11> I wonder if this could be used for high availability between two ec2 instances (vrrp/hsrp style)

<comment><USER12> VPCs would need to support multicast for VRRP to be an option.

<comment><USER13> There are unicast options for VRRP</comment></comment></comment>


WiFi Triangulate Using NPM - <AUTHOR> https://github.com/watson/wifi-triangulate <comment><USER2> Developers and creators: Cool project and a good hack!

InfoSec and end-users: Potentially scary (Can find location of victim) and a risk to my privacy (using Google to triangulate location).</comment>