Ancient "su – hostile" vulnerability in Debian 8 and 9 - <AUTHOR> https://j.ludost.net/blog/archives/2018/06/13/ancient_su_-_hostile_vulnerability_in_debian_8_and_9/ <comment><USER2> For those unaware, ioctl(TIOCSTI) allows injecting characters back into the tty, where they will be read by the next process to read from the terminal. In this case, that process is the root shell that execed su.

<comment><USER3> I guess you're the right person to ask - why hasn't this just been ripped out of the likes of OpenBSD?

edit: seems it already has! [https://marc.info/?l=openbsd- cvs&m=149870941319610](https://marc.info/?l=openbsd-cvs&m=149870941319610)

</comment></comment><comment><USER3> Another variant of using TIOCSTI with poor permissions. FWIW this exact same bug impacted Docker and LXC at various points. In the case of lxc-attach, when stdio is connected to a TTY, it creates a new pty within the container and multiplexes between them to avoid the issue. I don't think there is a single legitimate use for that ioctl.. it should just die already

tl;dr passing a TTY with stopped privileged jobs reading from it (like an interactive root shell) into an unprivileged location is deadly, as the unprivileged location can use TIOCSTI to load up the TTY's input buffer and then exit, causing the stopped jobs to read that input when they're resumed

<comment><USER4> "Terminal I/O Control - Simulate Terminal Input" ah okay

</comment></comment><comment><USER5> PaX/grsecurity has mitigation to this issue, at least for 10 years.

From grsecurity's config for GRKERNSEC_HARDEN_TTY.

        | There are very few legitimate uses for this functionality and it
        | has made vulnerabilities in several 'su'-like programs possible in
        | the past.  Even without these vulnerabilities, it provides an
        | attacker with an easy mechanism to move laterally among other
        | processes within the same user's compromised session.

Has one run a grsecurity kernel, the system would not be affected.

Some independent developers and KSPP people are also trying to submit this mitigation to the mainline kernel for many years, but so far none of the patch went into the kernel. Since grsecurity is now a private product, you may want to check them out and apply this mitigation to the mainline kernel.

        [PATCH] drivers/tty: add protected_ttys sysctl

* [https://gist.github.com/thejh/e163071dfe4c96a9f9b589b7a2c24f...](https://gist.github.com/thejh/e163071dfe4c96a9f9b589b7a2c24fc6)

        tiocsti-restrict : make TIOCSTI ioctl require CAP_SYS_ADMIN

* [https://lwn.net/Articles/720740/](https://lwn.net/Articles/720740/)

</comment><comment><USER6> I'm increasingly feeling that terminals and bash are just too complex and have too many edge cases and footguns and that we'd be better of just starting over with something were security was a focus from day zero.

<comment><USER7> Yep. Unix has zillions of ways for processes to interact with each other, which makes for an enormous attack surface. The future is something like unikernels on the server and something like Qubes running them on the desktop, so that each "process" is properly isolated and can only communicate through channels that are deliberately designed for it.

We're going to have to rediscover how we do things like pipelines in a safe way, but the current unix design of small processes interacting via unstructured interfaces that mingle commands and data is just untenable.

<comment><USER8> They fixed a lot of stuff in plan 9 and it's a pleasure to tinker with. Everything is partitioned in namespaces to isolate processes. Since the entire system is file system based, you manipulate the process namespace which is really just a file that lists the mounts and binds which build that namespace file system. Binds and unions are a blessing and eliminate the headache of environment variables. Every object is a file and everything is communicated via the network transparent in-kernel file protocol, 9p. And because of that, Plan 9 is fully distributed.

For example: I can share the internet without a router or nat by exporting my internet facing ip stack and mount it on the machines needing net access. As far as the isp knows, a single machine is talking to it. I can do the same with file systems, file servers, network cards, sound cards, disks, usb devices, etc.

It's far from usable in production and 9p is a dog over high latency links. but the ideas it has are simple yet brilliant. Best distro to check out for newcomers is 9front (they're silly fellows but don't let that fool you. serious top notch hackers that lot.)

</comment></comment></comment><comment><USER9> This explains the problem a little clearer I think: [https://bugzilla.redhat.com/show_bug.cgi?id=173008](https://bugzilla.redhat.com/show_bug.cgi?id=173008)

<comment><USER10> So if I understand correctly, the issue is that when su-ing to _more restricted_ privileges a hostile program (immediately executed via -c) can use TIOCSTI to inject commands which will escape su and execute as the more privileged user?

Is that also an issue using `su; ./hostile; exit`?

<comment><USER2> You mean su to root? The same mechanism still exists, though root already has other powers.

<comment><USER10> No, I mean su to a new shell and execute a command there rather than su -c.

<comment><USER11> That would be weird if "su -c" was vulnerable but interactive "su" was not. The former is much easier to fix.

In fact, "su" in Debian (which the subject of the submitted article), calls setsid() when you use -c, which defeats TIOCSTI.

<comment><USER10> > That would be weird if "su -c" was vulnerable but interactive "su" was not.

Not necessarily, if TIOCSTI just pushes stuff to the term input buffer, this is going to get popped on the next prompt of su, so on an interactive su it's not going to be executed under escalated privileges but is instead going to be executed as the same user that executed the hostile program, while with a non- interactive su it's going to get popped on the next prompt of the su _caller_ and thus get escalated privileges.

That's my understanding of it anyway, I could be completely off.

<comment><USER11> I see what you mean.

Yes, the exploit won't work if the payload is read by the attacker's shell, rather than the root shell. But it's easy to ensure that this won't happen. The laziest way is to kill the shell before issuing TIOCSTI ioctls. :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> As I remember, `login` program (that asks for your login and password on terminal) does a "virtual hangup" to prevent such things.

<comment><USER13> Well, on *BSD the way this works is that when the session leader exits the pty/tty will internally call vhangup(2), which in turn does all that revoke(2) does on the tty FD plus it sends SIGHUP to any processes with that tty as the controlling tty.

Linux for a long time had nothing like this. It has a vhangup(2), but looking at its implementation it doesn't seem to do what the BSD vhangup(2) does by calling revoke(2): replace all open file descriptors pointing to the tty with one that returns EIO for read(2)/write(2)/etc.

Linux does NOT have a revoke(2), or at least I can't find it. There was a patch for that back in 2006 and 2007. I don't know what happened to that.

EDIT: Some trivia as well. On BSD SIGHUP is generated by the tty. On Linux and Solaris/Illumos it's only generated by the session leader process on exit, and only if it wants to. This is how bash's disown builtin works: it just doesn't HUP the disown background jobs. The C shell (csh) historically never generated SIGHUP because it's a BSD shell. Back in the early aughts there was some controversy where csh users wanted OpenSSH's sshd to close a session when the pty session leader exits, as otherwise the session would stay open indefinitely. The OpenSSH developers feared this would lose data, and they were right. The source of this problem was that csh wasn't generating SIGHUP on Solaris and Linux, so background jobs stayed alive and held an open file reference to the pty, which meant that they kept sshd from seeing EOF on the ptm, so sshd would not terminate the session as long as those bg jobs stayed alive. This is all still the case today.

<comment><USER14> When a tty is hung up on Linux, the file operations of all open file structures associated with it are replaced with hung_up_tty_fops, which means all subsequent read(2) returns 0 (EOF), write(2) returns EIO and ioctl(2) returns ENOTTY or EIO.

This is basically a tty-specific implementation of revoke(2).

Also, when the session leader exits on Linux, the kernel _does_ send SIGHUP and SIGCONT to session leader's process group and the foreground process group (this is in tty_signal_session_leader()).

<comment><USER13> Oh, that must be pretty new (relative to the early aughts anyways). Sorry I missed it.

</comment></comment></comment></comment><comment><USER15> Ah, this looks like the old ungetc() exploit, where (back in the 1980s at utexas.edu) we'd leave a process connected to a terminal, wait for another user to log in, then push characters to their shell from our program using ungetc(). Essentially, each character pushed ends up looking like a fresh input character to the other program. The basic issue is whether all open file handles that shouldn't be there (our hack program, for example) got closed out by the new login session. For something like login, the question is easy, _ONLY_ itself should be connected early on. For su, it's much weirder, since the user may have created background jobs before running su, and su and sudo can't reasonably close all other handles on the original tty device.

Further su and sudo can't close all file descriptors of the "sub-session" as it exits, because that the "sub-session" is created by forking, so su/sudo aren't around at the end.

Creating a separate pseudo-terminal device to allow for draconian cleanup, and prevent even having both user IDs connected to the same tty device, seems like the best place to start.

Hmm, now I want to go update the user-group-setter program I use (which also can set auth user IDs on Solaris, etc) and try having it do ptty allocation for the subjob.

In the meantime, try this to get a session and run through the same demo steps:

        setsid -w su - <user>

Won't for _everything_ (no /dev/tty), but it does block the example. You can add a tty if you have one handy, too, by using redirection in the spawned process in this general form, but I don't currently have the cluon for how to create a /dev/pts/<num> from the shell level - if someone can construct the full command, I'd like to see it :-)

        setsid sh -c 'exec command <> /dev/tty2 >&0 2>&1'

<comment><USER11> > I don't currently have the cluon for how to create a /dev/pts/<num> from the > shell level

As I recommended in [http://www.openwall.com/lists/oss- security/2018/06/14/2](http://www.openwall.com/lists/oss- security/2018/06/14/2) , use screen or tmux:

      screen su - <user>

script(1) is more lightweight than screen/tmux, but it can't be easily persuaded to run arbitrary commands, such as "su". :-/

<comment><USER16> How is persuading _script_ to run _su_ not easy? I just tried _script -c su /dev/null_ and it worked as I expected. ( _/ dev/null_ is there to prevent _script_ from logging the interaction to a file)

<comment><USER11> D'oh, you're right. I don't know how I missed this option.

</comment></comment></comment></comment><comment><USER17> TIOCSTI ioctl [https://events.ccc.de/congress/2008/Fahrplan/events/2992.en....](https://events.ccc.de/congress/2008/Fahrplan/events/2992.en.html)

</comment><comment><USER18> Posix TTY and more precisely stdin/stdout/stderr inheritance and internals of FD have a completely insane design. There is the famous divide between file descriptors and file descriptions. Hilarity can and will ensue in tons of domains. I nearly shipped some code with bugs because of that mess (and could only avoid those bugs by using threads; you can NOT switch your std fd to non- blocking without absolutely unpredictable consequences), and obviously some bugs of a given class can create security issues. Especially, and in a way, obviously, when objects are shared across security boundaries.

Far is the time when Unix people were making fun of the lack of security in consumer Windows. Today, there is no comprehensive model on the most used "Unix" side, while modern Windows certainly have problems in the default way they are configured, but at least the security model exist with well defined boundaries (even if we can be sad that some seemingly security related features are not considered officially as security boundaries, at least we are not deluding ourselves into thinking that a spaghetti of objects without security descriptors can be shared and the result can be a secure system...)

<comment><USER14> There _is_ a model, it's just not particularly well publicised: a file descriptor is a capability.

That's it.

<comment><USER18> Is it efficient and sufficient though? And can and do we build real security on top of it?

This issue shows systems have been built for decades with blatant holes because it was not taken into account in even core os admin tools.

There is the other problem corresponding to the myth that everything is a fd. Which has never been true, and is even less and less as time passes.

Also, extensive extra security hooks and software using them are built, but not of top of this model.

Finally, sharing posix fd across security boundaries often causes problems because of all the features available for both sides, for which the security impact are not studied.

A model just stating that posix fd are capa is widely insufficient. So if this is the only one, even in the context in pure Posix we already know this is an extremely poor one.

</comment></comment></comment><comment><USER19> Nobody else has pointed this out (!): whatever platform is running at this URL doesn't sanitize input.

Notice how the C #includes seem to be including emptiness. Well, <stdio.h> et al weren't stripped; they're still in the source code, un-converted < > (ie NOT converted to < >) and all.

</comment><comment><USER20> We used TIOCSTI to attack Unix terminal sessions left open to "write" — in 1985. I was wondering when/if this would show up again!

</comment><comment><USER21> This is old news, that keeps being reported over and over. Part of the problem, I suspect, is that people keep pointing to the wrong locus of the problem. Even here, this is being characterized as a _Debian_ problem.

This is a _kernel_ mechanism.

* [https://nvd.nist.gov/vuln/detail/CVE-2013-6409](https://nvd.nist.gov/vuln/detail/CVE-2013-6409)

* [https://nvd.nist.gov/vuln/detail/CVE-2015-6565](https://nvd.nist.gov/vuln/detail/CVE-2015-6565)

* [https://nvd.nist.gov/vuln/detail/CVE-2016-2779](https://nvd.nist.gov/vuln/detail/CVE-2016-2779)

* [https://nvd.nist.gov/vuln/detail/CVE-2016-7545](https://nvd.nist.gov/vuln/detail/CVE-2016-7545)

* [https://nvd.nist.gov/vuln/detail/CVE-2017-5226](https://nvd.nist.gov/vuln/detail/CVE-2017-5226)

Some kernel people take the view that TIOCSTI is of no Earthly use, and there are other ways to implement line editing, and just make using it an error.

* [http://undeadly.org/cgi?action=article&sid=20170701132619](http://undeadly.org/cgi?action=article&sid=20170701132619)

* [https://github.com/openbsd/src/commit/baecf150995d4609cd1479...](https://github.com/openbsd/src/commit/baecf150995d4609cd147948779361c3152f355d)

Others take a different view.

* [http://www.openwall.com/lists/oss-security/2017/06/03/9](http://www.openwall.com/lists/oss-security/2017/06/03/9)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/15/8](http://www.openwall.com/lists/kernel-hardening/2017/05/15/8)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/17/1](http://www.openwall.com/lists/kernel-hardening/2017/05/17/1)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/29/16](http://www.openwall.com/lists/kernel-hardening/2017/05/29/16)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/30/9](http://www.openwall.com/lists/kernel-hardening/2017/05/30/9)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/30/26](http://www.openwall.com/lists/kernel-hardening/2017/05/30/26)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/30/27](http://www.openwall.com/lists/kernel-hardening/2017/05/30/27)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/30/32](http://www.openwall.com/lists/kernel-hardening/2017/05/30/32)

* [http://www.openwall.com/lists/kernel-hardening/2017/05/31/16](http://www.openwall.com/lists/kernel-hardening/2017/05/31/16)

<comment><USER22> Usually when something is reported as being a distribution bug, it's because they have some patch specific to their packages that causes the issue.

Is that not the case here? Are other distrbutions affected right now?

<comment><USER21> I say it again: This is a _kernel_ mechanism.

Every operating system based upon Linux provides programs with this mechanism. This is not some ioctl() introduced by a Debian patch. This is a mechanism added to Linux by Linus Torvalds on 1993-12-23.

* [http://repo.or.cz/davej-history.git/commitdiff/9d09486414951...](http://repo.or.cz/davej-history.git/commitdiff/9d0948641495169728d4074f976fd655e30afedf)

Pete French added it to FreeBSD against his better judgement on 2010-01-04. It might have been in an earlier implementation of the terminal line discipline, too.

* [https://github.com/freebsd/freebsd/commit/74b0526bbe6326adb7...](https://github.com/freebsd/freebsd/commit/74b0526bbe6326adb72e26dabfe79ab1fe00ca4b)

OpenBSD, which no longer implements the kernel mechanism, _had_ had it since the initial import from NetBSD in 1995.

* [https://github.com/openbsd/src/blob/df930be708d50e9715f173ca...](https://github.com/openbsd/src/blob/df930be708d50e9715f173caa26ffe1b7599b157/sys/kern/tty.c#L847)

Illumos has it, and has had since at least the OpenSolaris launch.

* [https://github.com/illumos/illumos-gate/blob/9a2c4685271c2f0...](https://github.com/illumos/illumos-gate/blob/9a2c4685271c2f0cb4b08f4cc1192387e67af3f9/usr/src/uts/common/io/tty_common.c#L263)

It was even in 4.3BSD.

</comment></comment></comment><comment><USER23> Just tested this out, can confirm it works on Debian 7 as well. Genius little trick! Not sure about practical exploitation, though.

</comment><comment><USER24> I'm not a shell pro; what is happening on the sleep line?

<comment><USER25> $ (sleep 10; /tmp/a.out id) &

$ -> the end of the prompt of a "normal" (i. e. non-root) user

() -> run everything inside in a forked subshell of the current shell

sleep 10 -> "block"/sleep for 10 seconds via the `sleep` executable in your $PATH

; -> after the left-hand side terminates, proceed with the next command on the right-hand side

/tmp/a.out id -> fork and exec the program located at /tmp/a.out with the literal byte sequence "id" on its argument vector

& -> run this command (the whole subshell that () requests) as a background job

When the user exits the shell that spawned the subshell, the whole process group will receive SIGHUP. The backgrounded subshell will still continue running, and after its `sleep` child process terminates, go on to run `/tmp/a.out`.

<comment><USER24> Ah thanks, I didn't understand the subshell forking part before.

</comment></comment></comment><comment><USER26> Lol. Thanks. Work machine. Must have ctrl-tabbed without realizing.

<comment><USER27> Pretty sure you're in the wrong thread, mate.

<comment> qu4z-2 I guess they ctrl-tabbed without realising it...</comment></comment></comment>


Twenty legal battles that stand out across Ars' 20 years of covering them - <AUTHOR> https://arstechnica.com/tech-policy/2019/01/20-legal-cases-across-20-years-these-are-our-favorites/ <comment><USER2> Tangentially related to the article: I miss Groklaw.

It's been over six years since PJ stopped posting to Groklaw, around the time that Lavabit shut down (see [http://www.groklaw.net/article.php?story=20130818120421175](http://www.groklaw.net/article.php?story=20130818120421175)), because PJ relied on email to receive documents and tips.

From the time I discovered Groklaw, I grew attached to the way that PJ not only managed to keep a handle on the crazy machinations of long-running cases (SCO v IBM being one of the biggest), but was able to tie all of the different threads together into a cohesive narrative. I'm not sure any single news source has managed to step up to Groklaw's level.

PJ, if you ever read this, please consider coming back! Since you left, groups like the Freedom of the Press Foundation ([https://freedom.press](https://freedom.press)) have formed to provide tools that sources and journalists may use to communicate as securely as possible. Groups from different ends of the political spectrum — from the Washington Post ([https://www.washingtonpost.com/anonymous-news- tips/](https://www.washingtonpost.com/anonymous-news-tips/)) to the Wall Street Journal ([https://www.wsj.com/tips](https://www.wsj.com/tips)) and beyond — provide ways for sources to submit tips using Signal and SecureDrop.

In the time since you have left, there have been leaks of documents orders of magnitude more damaging than those of corporate lawsuits; and the news organizations which convert those leaks into reporting are doing a good job of keeping their sources secret. Government agencies continue to press for backdoors to encryption. And I take all of that as a sign that things seem to be working.

So I hope you consider coming back one day!

</comment><comment><USER3> Funny, in 1999 the 9th wrote "Whether we are surveilled by our government, by criminals, or by our neighbors, it is fair to say that never has our ability to shield our affairs from prying eyes been at such a low ebb."

The list of things that have changed since then makes 1999 that quote look downright insane. I'm not even going to explain how much less private everyone is. But lets just say, back then, for the most part the government (and via 3rd parties) was probably surveying people under actual investigation less than they currently surveying everyone in the country.

<comment><USER4> > But lets just say, back then, for the most part the government (and via 3rd > parties) was probably surveying people under actual investigation less than > they currently surveying everyone in the country.

Only if we selectively ignore COINTELPRO, the Red Scare witch-hunts, the attacks on the Civil Rights & Black Power movements...

<comment><USER5> The VENONA papers actually proved McCarthy right.

There is some really interesting vintage crypto associated with them. The Soviets reused their one time pads. Whoops!

[https://en.wikipedia.org/wiki/Venona_project](https://en.wikipedia.org/wiki/Venona_project)

<comment><USER6> > The VENONA papers actually proved McCarthy right.

That's a pretty ludicrous claim, and the link you posted does not support it. It says only that a Texas school board was criticized for making similar claims.

<comment><USER5> Read them: [https://www.nsa.gov/news-features/declassified- documents/ven...](https://www.nsa.gov/news-features/declassified- documents/venona/)

And read the link I originally shared more carefully this time.

<comment><USER6> Again, the wikipedia link says nothing about the claim you're making except that a Texas school board controversially tried to promote it in its curriculum.

From further reading, the claim itself seems to originate from an Ann Coulter book.

<comment><USER5> "Significance

The decrypted messages gave important insights into Soviet behavior in the period during which duplicate one-time pads were used. With the first break into the code, Venona revealed the existence of Soviet espionage[23] at Los Alamos National Laboratories.[24] Identities soon emerged of American, Canadian, Australian, and British spies in service to the Soviet government, including Klaus Fuchs, Alan Nunn May, and Donald Maclean. Others worked in Washington in the State Department, the Treasury, Office of Strategic Services,[25] and even the White House.

The messages show that the U.S. and other nations were targeted in major espionage campaigns by the Soviet Union as early as 1942. Among those identified are Julius and Ethel Rosenberg; Alger Hiss; Harry Dexter White, the second-highest official in the Treasury Department; Lauchlin Currie,[26] a personal aide to Franklin Roosevelt; and Maurice Halperin,[27] a section head in the Office of Strategic Services."

<comment><USER6> McCarthy's claims were far broader than that (and virtually all spurious). From a specialist historian:

> But if McCarthy was right about some of the large issues, he was wildly > wrong on virtually all of the details. ... virtually none of the people that > McCarthy claimed or alleged were Soviet agents turn up in Venona. ... The > new information from Russian and American archives does not vindicate > McCarthy. He remains a demagogue, whose wild charges actually made the fight > against Communist subversion more difficult.

[https://www.frontpagemag.com/fpm/212053/setting-record- joe-m...](https://www.frontpagemag.com/fpm/212053/setting-record-joe-mccarthy- straight-harvey-klehr)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> It's strange to me that they mentioned Oracle vs Google in the introduction but not the body of the article.

It seems like in a lot of the cases involving new tech take a couple years to get started and then ~5 years to resolve. So we got a ruling about the phone searchers 7 years after the iPhone, a ruling about streaming 6 years after the launch of Napster, and a ruling about "decency" 8 years after the launch of the web.

I wonder what the big issues over the next 10 years will be. Self driving cars? It's a bit tedious to have every prediction about the future reduce to that.

<comment><USER8> The Oracle v Google case was interesting at a corporate/technical level, but has less impact on average people than surveillance rulings.

<comment><USER7> I agree with respect to many of these cases. But the Waymo case or the Ross Ulbricht case were pretty routine from a legal perspective as I understand it. The Oracle one is establishing novel law about whether or not you can copyright an API.

</comment></comment></comment><comment><USER9> No SCO vs IBM?

And did that ever finish? It was still twitching as recently as 2017 ([https://www.theregister.co.uk/2017/11/02/ibm_vs_sco_revives/](https://www.theregister.co.uk/2017/11/02/ibm_vs_sco_revives/)).

<comment><USER10> I don't know how much Ars covered it but it does seem like an omission. In general the list seems to be biased against cases that are strictly about software as opposed to bringing in criminal and other areas of law. Yes, the case is technically still alive.

</comment></comment><comment><USER11> >Result: Police cannot obtain 127 days' worth of cell-site location information about a criminal suspect without a warrant.

This was a weird one, because it seemed like they were cool with about 6 days of unwarranted cell-site data. What's so special about 6 days?

>Result: Workers that sign arbitration agreements are bound to them and can't use the federal court system to adjudicate labor claims—making class-action lawsuits in such scenarios all but impossible.

Ouch. This one sucks.

<comment><USER12> Just had a law class (in Europe) and our professor told us that this is one of the main reasons that arbitration exists (and is so prevalent) in the US: to prevent class-action lawsuits.

<comment><USER11> The sentiment regarding unions and labour rights in the U.S. isn't really moving in the right direction.

This type of clause is _especially_ scummy, however... see the following article: [https://www.cbc.ca/news/canada/toronto/ontario-uber- appeal-1...](https://www.cbc.ca/news/canada/toronto/ontario-uber- appeal-1.4963792)

EDIT: Especially read the bottom of the article. The arbitration clause required over $10k USD to even begin, and takes place in the Netherlands... What. the. actual. fuck.

<comment><USER13> How exactly did uber try to move the case to an EU country for Canada?

There are some super rare edge case legal arguments about jurisdictions and which laws apply within the eu for employees/workers who regularly work in different countries but not non eu countries and eu ones.

<comment><USER11> It's not "a case", it's "arbitration". Arbitration is extremely... arbitrary.

<comment><USER13> Sorry was using HR/IR slang and legally binding arbitration is not normally arbitrary.

</comment></comment></comment></comment></comment></comment><comment><USER14> I think that 6days for most property based crimes is plenty of time for "smart" criminals to clear up physical evidence and establish an alibi. for crimes like kidknaping or assaults [of various types] there is a window of opportinity to rescue a person and preserve life, then after a week, a shift into recovery mode so the family of/and a decedent will have dignity.</comment>


Don Norman on how design fails older consumers - <AUTHOR> https://www.fastcompany.com/90338379/i-wrote-the-book-on-user-friendly-design-what-i-see-today-horrifies-me <comment><USER2> My partner's mom, age 94, got new hearing aids and the app that can control them (adjust focus on front/side/back, high/low/midrange, etc), runs only on iOS. We got her an iPad mini and I set it up so she can (A) read the Washington Post, (B) read a poetry app, (C) control her hearing aids, and (D) not much else (so as not to be confusing).

Much to my surprise, the hearing aid app does not adjust it's font size per the iOS system settings, and it does not have any font adjustment of it's own. It also has a background picture that interferes with focusing on controls. I'm boggled that a company producing a product for those with hearing- impairment doesn't recognize that many of it's users may be in age-related decline, and that can include vision and cognitive impairment.

<comment><USER3> Most likely the app was written by a third-party contractor who didn't know much about who the users are, they only received the requirements (app must do X and Y) and delivered.

<comment><USER2> Absolutely. That's why I'll be contacting the hearing aid company, who is ultimately responsible for those requirements.

</comment></comment></comment><comment><USER4> The trend towards lack of physical controls in cars is absolutely bonkers. I'm gobsmacked anyone thinks the Tesla Model 3 is good design.

Same with desk phones. Anyone who deals with customers at a counter doesn't have time to constantly look at a touch screen for buttons that may or may not be there. Nothing like chucking muscle memory out the window in the name of aesthetics :p

<comment><USER5> Unfortunately I think it's more about pricing as oppposed to better design paradigms. Replacing embedded system engineers with cheap java engineers? Yea that requires a screen.

<comment><USER6> Similar to capacitive touch panels on appliances. You'd think this sci-fi look is more expensive to make, but it's actually cheaper. The "buttons" have no moving parts.

<comment><USER7> And should last longer, make it easier to clean and not get gunk stuck in it causing it to jam up.

<comment><USER8> And make the driver look at a screen to adjust temperature / fan or whatever.

<comment><USER9> I already have to look at the knobs in my car to see what I'm doing with them (or even find them in the first place). Is this true for anyone else? I'm reading this thread totally unable to understand what we are arguing about haha.

<comment><USER10> Temperature settings have famously bad controllers. I guess it's because they are new, and car designers didn't have time to compete on quality of those yet.

You can control the radio of any high-end 00's car without looking at the controls.

<comment><USER11> Back in the early 70s, before the energy _crisis_ when the speed limit had never been reduced below 70, everybody went 90 (and I passed everybody).

Auto air conditioning was a great luxury to have, especially in the deep south on a multi-hour tollway through wilderness with no exits for miles on either side of the pavement.

Of course gasoline was still commonly available with over 100 octane rating for prices less expensive than milk.

And most cars had a regular ordinary V8 engine.

On the typical GM car, AC controls were like this:

[https://www.rickscamaros.com/productmedia/catalog_product_ga...](https://www.rickscamaros.com/productmedia/catalog_product_gallery/index/id/21539/image/0/)

Many drivers never went anywhere without their good buddies "MAX" and "NORM".

And this is what was in a Ford:

[https://secure.cougarpartscatalog.com/c9zz-19a884-a.html](https://secure.cougarpartscatalog.com/c9zz-19a884-a.html)

Notice how there is only one sliding selector for all the main exclusive functions, each well separated physically and tactically and labeled well. Each company has almost the same identical functions arranged with a similar but not identical order and nomenclature. Regardless each company shows a logical spectrum of functions from left-to-right.

The other continuous slider is for temperature, and a third slider on an opposing axis for the fan setting (closer to the driver when center-mounted) since that's the one you change most often. Other than the fan, the other settings often remain unchanged across multiple rides in the most ideal expected usage scenarios.

Obviously Max was quite popular with both Ford and GM, and it seems intuitively instinctive as the most cold you are going to get, but it's really just the Recirculate setting, while Norm is for Fresh outside air coming in across your cooling coils, which is what it says on the Ford.

All of this being fully documented in the handy owner's manual in the glove compartment, but even the least technically oriented people usually figured it all out quite easily on their own. Without even looking. If you did have to page through the book at least it was (much) faster than a PDF.

You could say there is very great similarity between both of these major competing control panels, or alternatively maybe there are only superficial differences in these co-operating engineering approaches.

The temperature can be completely set tactically across the entire range with no unanticipated discomfort, even though there is no thermostat, you are simply choosing across a continuous range of what is available under the prevailing environmental conditions. Which therefore required occasional tweaking en route, on this type of early 70s fully-analog system this critical physical adjustment was most-often accomplished when needed by real-time fine- motor actuation under the direct control of _usually_ natural intelligence. Yeah, there was some total system latency, with largely unavoidable contributions from this type of hardware, but occasionally the intelligence level itself was not up to even average expectations which can add the most noticable deficiency. Some things never change.

On some Cadillacs there was an actual system thermostat handled transparently by the same control panel, and when "digital" there was a fancy numerical indicator but you didn't need to take your eyes off the road to set the temperature as exactly as you would like using the same control panel either.

Well, that's most of the cars on the road having AC, Chrysler/AMC was much smaller and most imports were Volkswagens (without AC) still concentrated in and nearby port cities where there were foreign-car dealers, parts, and mechanics having metric tools. If you drove a Volkswagen micro-bus across a number of states to get to Woodstock in 1969, during most of the trip there was no expected source of repair, tools, or supplies, even tires.

Out on the Turnpike they had some good pavement designed for 100mph along all arcs (even when iced over as often as _that_ happens in Florida) but the regular two-lane roads out in the middle of nowhere were quite wavy after decades of overweight citrus trailers and going 100 on them was like constant air turbulence. It made your voice wavy while the occasional semi was bouncing toward you at 80mph themself. Sometimes when you are in their lane passing one of them simultaneously. The approaching big truck required a certain amount of pavement on your side of the center line since the roads were built when semis were narrower and there was not a lot of traffic out there way back then anyway.

At least the cars were over-engineered for better structural integrity (using a slide rule), but were mostly less capable of precise handling compared to 21st century offerings.

But you really didn't want to take your eyes off the road.

Well that was when Moon landings were a regular occurrence too, so you have to figure at certain times in history you had to be a lot further above average to get very far in engineering or technical areas compared to today.

Even though technology has come a long way over the decades (and centuries) in some ways (in some places) average people themselves were more advanced then compared to now.

A lot more effort is needed to build _foolproof_ systems simply because there are a lot more fools and they are getting more determined than ever.

This of course can be confirmed by direct observation over the long term.

There is still no indication that less-than-natural intelligence will ever be an adequate substitute when performing difficult (but commonly expected) efforts like in the old days. Especially when the natural stuff is trending downward at an increasing rate itself.

<comment><USER10> Well, by late 90's and early 00's, designers where exploiting the all- electronic properties of radio systems so that the driver could operate them not only without looking, but also without taking the hands out of the wheel. Yet, those 70's temperature controls would still be as good as the state of the art.

There was evolution. But it only happened when manufacturers would lose market share if they didn't do something that doesn't suck.

By its turn, nowadays cars are making it so that drivers must take their eyes out of the road to even look at the fucking speed indicator. We have seen some incredibly quick technology loss.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Thoughtless design is everywhere. My company uses Discord for comms and I'm active in several Discord communities, but my vision impaired co-worker isn't. Not because of a lack of want, but because Discord has been coasting on accessible design for years. [https://www.reddit.com/r/discordapp/comments/4tn00z/when_wil...](https://www.reddit.com/r/discordapp/comments/4tn00z/when_will_discord_be_accessible_to_those_who_use/) Everything takes more resources than we expect, but surely a theme for their client (we do have some proof that it is theme-able) that is friendlier for screen readers shouldn't take more time than an entire games store?

For me, the big takeaway from this article and companies like Discord is that people just don't seem to care. And that's often the status quo until an Apple comes along. We forget this, but back before the resurgence of Apple design was an afterthought, not a forethought even though there were obvious gains to be had and a better future to lead towards. But the vast majority of companies avoided the obvious win until Apple's stock price shocked them into caring.

A significant fraction of everyone's user base (including the core users) would benefit from accessible and thoughtful design, because like the article says, we're all disabled sometimes. Now, we just need to figure out which company will have to show the world how to do it.

<comment><USER13> The dismal accessibility adoption on the web is horrendous, but working for a company that has to deliver accessible web apps to comply with Federal law has really opened my eyes to how terrible to ecosystem of accessibility is.

My team spends about a quarter of our time working strictly on accessibility, and we find ourselves straying from the beaten path often in order to accommodate a specific screenreader/OS combo. We run into situations all the time where we're unable to get insight from the docs because something is buried deep in the spec.

We also have to draw a line in the sand about which screenreaders to support and which ones to pass on, which pisses off clients that use screenreaders that we don't support.

Automated accessibility audit results sometimes contradict documentation around best practices, which can be frustrating.

The other thing I've learned is that developers usually hate working on accessibility issues because the screenreaders are much less intuitive to use and can really muck up your workflow if you're trying to ensure that an interface is completely accessible.

While I agree that we as a community can do better, I think that web accessibility in its current form is largely a failure because people see it as a cost that they're not interested in incurring, possibly because of the issues I've listed above.

<comment><USER14> Since website frameworks like Bootstrap are a thing, would it make sense to implement accessibility guidelines at that level, so that designers/people who don't know are encouraged to use sane defaults?

Or is it too content/layout specific?

Eg: I might like to roll my own static blog, but I don't know how to ensure that it is accessible.

<comment><USER13> I think making frameworks like bootstrap accessible-by-default is a great idea, but it won't be catch-all solution. A11y needs to be a conscious part of the design/development process, just like security.

One of the things we've learned is that much of the complex, dynamic UI things one can do with frameworks like React/Angular is really, really, really hard and frustrating to make fully accessible because people never design React components that are easy to use with a keyboard.

We live in this world where the capabilities of UIs for enabled people continue to grow at the cost of accessibility for the disabled. With the shift towards frontend frameworks, the problem needs to be addressed at the markup level IMO.

</comment></comment></comment></comment><comment><USER15> I characterize this as "all PMs have perfect eyes and skin". The first iteration of the Microsoft Surface featured a micro SD slot that was unusable if you had anything less than perfect, pliable finger nails. I cracked a nail so many times using that slot I gave up.

Current generation Apple designers clearly have amazing vision: part numbers on light grey on white in microscopic fonts.

<comment><USER16> I've had a lot of trouble entering the Windows serial numbers when installing Windows. The B and 8 look alike, ditto for O and 0. I've had to use a magnifying glass on it.

Apple's online documentation pages have also tended to be light grey fonts on white. My eyes would ache trying to read them. I find their choices baffling. It's like they were so focused on design they forgot about people simply wanting to read it.

<comment><USER17> _I 've had a lot of trouble entering the Windows serial numbers when installing Windows. The B and 8 look alike, ditto for O and 0. I've had to use a magnifying glass on it._

This kind of thing is a pet peeve of mine. So many codes require digits _and_ letters these days -- why not _just_ digits?! It would be so much more user friendly, especially when using a smartphone keyboard.

<comment><USER16> Yes, I'd rather just use a longer password that is easier to type.

</comment></comment></comment></comment><comment><USER18> For some reason companies hate text now. Instead of a menu, you get icons with as minimalistic a design and as little difference between them as possible. Entering your user name and password is two separate pages for some reason now. Window borders have disappeared so instead of knowing at a glance where you can click and drag you have to closely watch your mouse pointer change. A big "Hewwo 2 U!" screen is added between turning your computer on and being able to enter your password as if you foolishly left your desktop in your jeans pocket and Windows wants to make sure you're not pocket-PowerPointing.

It's like they're trying to alienate everyone not intimately familiar with the system and appeal to the lowest common denominator at the same time.

<comment><USER19> I for one like the material minimalistic menu items we get now. (Assuming they use standard material design icons) it makes it quickly recognisable and accessible.

<comment><USER18> If you use them constantly. For example, most of my Gmail use is on an android device, which has a radically different UI than the web mail. When I use the web mail, probably once a month or so, I have to use tool tips every time because I've forgotten which tiny grey on grey button is reply, which is spam, etc.

</comment></comment></comment><comment><USER20> I'm 51 and work in tech. I now understand the nuances in this article. I'll probably understand them better as time goes on.

Young readers probably skimmed over the bits about floaters in the eyes. Everyone older than 50 gets it.

Young readers probably skimmed over the bit about frequency definition, captions etc. Everyone older than 50 gets it.

I don't get the bit with walking sticks yet, but I am not there yet. But I realise that.

I was young and bulletproof once - even up until 5 years ago I didn't understand what this article was about. I gather by reading the comments here that most don't. The challenge is explaining ageing to anyone under the age of about 45, when it is entirely out of their scope of experience, in a demographic who think they know it all. Ageism is embedded in our society, whose best attempt at inclusion and diversity is based on colour of skin and gender. I don't think it will change, it has probably been the same for thousands of years.

I had to go around to a friend of my mothers the other day - in her 70's, her younger relatives had switched off captions on her Samsung TV. She had no idea how to turn them back on. It is hidden about four layers deep in the fu.king menus. Why isn't it a button an on/off button on the remote? Another button amongst the 20 already there? In the manual - It got a paragraph mention about 30 pages in, in a tiny font. So discriminatory. I am seriously thinking of making a career of this, while I still can!!!

<comment><USER21> Is it just me, or do TVs have the WORST user experience of all tech? Somehow, they can get away with it.

I've always wanted a consumer electronics brand that was known specifically for usability. For commodity tech, like TVs, radios, monitors, music, I don't want the most impressive specs -- I want a brand that means "we will be easier to use than the other brands".

Choosing between Panasonic, Sony, LG, etc etc.. it's all meaningless. Give me a BRAND that says "easy-to-use".

<comment><USER22> I honestly don't find TVs that hard to use--but then I don't try to use "Smart TV" features, which are indeed pretty bad across the board. I mostly just use a Chromecast--a much underappreciated device--and my tablet or laptop. Hopefully Google doesn't discontinue it when they get bored in a year or two.

<comment><USER23> Is there a term for comments which are indistinguishable from astroturfing? A kind of Poe's Law of advertising?

</comment></comment></comment></comment><comment><USER24> I'm a technology enthusiast in my 40s. Even I lose my patience, to say nothing of people of my parents' generation, when I try to travel to a new country which has a different set of showers, cooking ranges and washing machines/dryers.

To say nothing of older people I've seen on flights who struggle to turn on their entertainment consoles.

Turning on a device should not be a puzzle-solving exercise. As Alan Kay said, "Simple things should be simple, complex things should be possible." Too often, the user interfaces make complex things doable, and simple things possible, with great effort.

(Also I don't know if this is a thing in design methodologies : I prefer if designers avoid having basic functionalities as a result of a sequence of steps, rather, I like to have them as separate top-level buttons)

<comment><USER6> > _Also I don 't know if this is a thing in design methodologies : I prefer if > designers avoid having basic functionalities as a result of a sequence of > steps, rather, I like to have them as separate top-level buttons_

It is if you care about ergonomics - the rule is, the more frequent an action, the less key/mouse/fingerpresses it should take to invoke.

It is not if you only care to make it look pretty, good for the demo or to encite first-time users to subscribe to your SaaS.

</comment></comment><comment><USER14> I speculate whether this observation indicates that most of the chatter around "design" is signaling focused on appearing hip/trendy -- largely a branding effort overlaid on top of company goals, rather than an effort to think through actual user needs from the ground up. That would explain why so much of the focus is on fads.

<comment><USER25> There is a hive mind of designers, but one must follow this hive mind to remain relevant. It is actually the case that skeuomorphic design, all the rage less than a decade ago, would be a turnoff to users today. Now, could this be because people associate good design with successful new products, and those new products have happened to use a different UI mentality for no other reason than signaling to a design-minded minority? Perhaps. But those new products do indeed exist, and they have truly moved the goalposts. One must follow design trends or perish.

<comment><USER26> Or maybe design is just entertainment. It's a story that keeps the monkey mind engaged in what is most likely a banal exercise.

</comment></comment></comment><comment><USER27> As usual, design is mostly universal. Besides issues of strength, there's actually not much here which is specific to age. These are design issues for all.

> Loud restaurants are torture. So, more and more, my wife and I select > restaurants by their noise level rather than by their food quality. At home > while watching TV, whether shows, streaming events, or movies, we always > turn on the captions, which often block critical parts of the image. Even > worse, when a film shows someone speaking in a foreign language, the film > often translates the words, but so too does the closed captioning, and the > two are placed on top of one another, making both attempts to help the > viewer completely unhelpful.

I'm (only) in my 30's and every one of these applies to me and my friends, as well.

<comment><USER28> Loud restaurants do that intentionally to scare off old unsexy people and to make customers leave sooner for faster turnaround.

Netflix does captioning very well.

</comment></comment><comment><USER29> Thought provoking article.

One difficult thing to grapple with here though is that my impression of the elderly is that the bulk of them are living on a tight budget to make sure that their retirement savings last them through their remaining years. Well designed, hip and beautiful products typically come at a hefty premium (think Apple tax). How many elderly people are willing to pay a premium for good, user friendly design?

Could it be that the reason we _don 't_ see better design for the elderly is because most of them are unwilling or unable to pay extra for it, unlike the young?

<comment><USER30> As a group they have much more money than poor college students.

<comment><USER29> I think that's a shallow analysis.

The difference is that college students expect to make more money in the future so they don't put any thought into stretching their dollar. Retirees are the opposite. They may have bigger bank accounts, but for most of them, they know that's all they'll ever get.

</comment></comment></comment><comment><USER31> The article makes some good points about not talking down to older people, but here's the thing the article misses: aspiration. Advertisers test all sorts of messaging before they roll out a large campaign, if empowered old people sold units we would already see more of them in ads. Advertising is largely playing on the target audiences emotions, selling them an idealized form of themselves if only they brought X product.

Old people dont aspire to be old. They are, for the most part, quite happy to buy products fronted by younger people who remind them of their younger selves. So the missing grey dollar goldrush this article bemones is largely already being served, and its worth considering that most ads must simultaneously reach multiple demographics, would you aspire to drink old lady coke?

Advertisers are not stupid.

<comment><USER32> The Coke ads currently in Australia (and apparently from the UK) feature an elderly man trying a Coke No Sugar for the first time, who then goes on to ask "What else haven't I tried?" and tick off a bucket list while Queen's "I Want To Break Free" plays in the background. There's absolutely ways to do it if you want to.

[https://youtu.be/O223tQkCuag](https://youtu.be/O223tQkCuag)

</comment></comment><comment><USER33> There are some places where this is going well, such as the firefox reading pane. Nearly every article can be switched to the pane, and you can choose the font size and readability. (Sepia is high contrast, but easy on the eyes.) I'm glad this is being brought up, and I love the tone of article, too. What's merely annoying for me right now (I'm in my mid-30s) will be untenable when I'm 65. Design can be better.

The other alternative, of course, is to opt out of some of this technology. iPhones aren't great for the elderly? Well, dumbphones are making a small comeback and are much easier to use.

</comment><comment><USER34> Don Norman's book _" The Design of Everyday Things"_ is a classic and very relevant today: [https://www.amazon.co.uk/Design-Everyday-Things-MIT- Press/dp...](https://www.amazon.co.uk/Design-Everyday-Things-MIT- Press/dp/0262525674/)

<comment><USER35> I've read this book three or four times and it's kind of crazy he was at Apple as an executive and had no lasting impact, iOS is now full of hidden gestures/features with low discoverability/intuitiveness. Nobody there with the power to make decisions agrees with the basic premise of this book.

<comment><USER22> On the other hand, Donald Norman also came to embrace (and somewhat found) the idea of User Experience design. He pretty much admitted that his earlier focus on design was too narrow. And I'd argue that Apple very much likewise broadened their focus to the entire user experience.

</comment></comment></comment><comment><USER36> Regarding a comment the author made in passing:

 _For the increasing number of people who have cataract surgery, the eye's lenses have ben replaced with plastic, which usually have a fixed focus. (Artificial lenses that can be focused are under development.)_

My dad recently had cataract surgery and I just assumed he was getting would be a deformable lens that would give him the ability to focus again. Does anyone know why it is so hard to develop such a lens ? As far as medical breakthroughs it seems like low hanging fruit and most people over the age of 45 could benefit from such a surgery since that is the age at which our lenses begin to harden and can no longer be shaped by our ciliary muscles.

<comment><USER37> > Does anyone know why it is so hard to develop such a lens ? As far as > medical breakthroughs it seems like low hanging fruit ...

Not in medicine or medical research, so great grains of salt required.

1) immune rejection

2) non-degradable

3) same modulus of elasticity as a biological lens (and maintains elasticity)

4) (relatively) cheap source materials

5) (relatively) cheap manufacture

6) survive all testing; up to FDA approval

Can anyone in medicine comment on this?

<comment><USER38> There's a relevant article on the HN front page now. [https://www.bloomberg.com/features/2019-gore-artificial- corn...](https://www.bloomberg.com/features/2019-gore-artificial-cornea/)

<comment><USER39> No, that's about cornea replacements and is irrelevant for the current discussion.

</comment></comment></comment></comment><comment><USER40> A glaring example of this is the Canada Revenue Agency. It asks 5 different security questions, you need to type in the answer to, before you can set up account.

The problems I observed my elderly father having is:

1) The website times out way too soon. Before my father could type up three answers it timed out. Each time he has to start from scratch.

2) An answer to security a question, like "who was your first teacher" Can have many variations.

Did he type in first and last name? Was the first name before the last name or the last name before the first name? Did he capitalize the letters? Did he spell the name correctly, its been many years. Did he make any typos.

<comment><USER41> I'm not even old and I hate security questions like this. I'll never forget the name of my best friend in 2nd grade, but I will forget whether I input his name as Billy Bob, Billy, William, William Robert, etc.

<comment><USER22> I'd say in a typical list of security questions I would consistently answer maybe a third of them (and those are mostly ones that a determined scammer could find the answers to). And that's assuming that the service is forgiving in terms of abbreviations, spelling variants, the presence of words like Road, etc.

The worst I saw recently was a mandatory security question about "What was the first city you visited?" The answer was multiple choice with about 6 city names.

</comment></comment></comment><comment><USER42> My theory on this is that it is easier for designers to empathize with users who are the same age or younger, since in these situations they've had the experience of the user's age, whereas very few designers have had the experience of being old (save for the author of TFA).

<comment><USER43> It's hard to empathize with abstract people, you need to observe and engage actual people in their environment, which costs time and money. Too often people are stuck in a conference room talking about personas. I've ended up frustrated at clients telling them "you are not your customers" endless times.

It's amazing how much you learn getting out and talking to customers. One of my favorite examples is for a company that sold plumbing supplies to contractors. The biggest feedback was that these guys spent most of the day in a truck and needed to be able to place orders on their phones and they begged the team to make sure that all the buttons (and links) were much bigger so that their fat fingers could click on them: "this was designed by a pianist".

There's so many examples of interactions that show that the designer didn't understand what the end user is really trying to do. My bank makes me enter a first and last name for transfer recipients, but only use the last name on the confirmation step, however the bulk of my transfers are to family members!

<comment><USER28> Personas are a massive improvement over designing for yourself or worse designing for what's fun to design.

<comment><USER10> Are they?

If you design for yourself at least you are using a real person. Personas are invariably about the same as designing for what's fun.

</comment></comment></comment></comment><comment><USER44> Strap wrenches are great for jar lids. I sometimes use two. One for the jar, and one for the lid.

</comment><comment><USER45> I fear the effects of this are amplified by the current unfortunate trend of using dark pattern and strategic use of friction to steer the user into desired directions.

Congrats, your gray-on-white "decline" button that looks like a link is probably annoying for young and able-bodied users but it may be a serious obstacle for the others.

</comment><comment><USER46> An issue I hit yesterday, I installed Chromium and I went in the Settings to disable the Google auto login, it did not work for me and I was very frustrated. After a few attempts I noticed that when you change the setting a small notification appears on the lower corner of the screen that I need to restart the program. Maybe that kind of notification is cool and slick (I don't think it is) but it is easy to miss for people like me with mad eyes (not sure if normal eyes can catch the notification if you are focusing on other corner of the screen)

</comment><comment><USER47> I'm 33, my car had a touch screen display and the Bluetooth sync function is 3 clicks deep. If I were to start driving right away, it becomes a huge hassle to try to sync to Bluetooth. Doesn't help that you can access the first 2 screens but the 3rd is locked since I'm driving. It's as if some engineer somewhere thought the 3rd screen is more distracting than the first 2. I always imagine how easy it would be to have a physical button I can just click any time. Ahh the days of modern design... gotta love it.

</comment><comment><USER48> I like his criticism of difficulty in iPhone screen navigation, My Dad is 97 and has to carry a tiny pointing device to get full use from his phone. He is much better using his iPad, but neither small device is natural for him like using his Mac Desktop Pro or his iMac. When using his computers, the full size keyboards and wireless mice work really well for him. Norman's suggestions for iPhone navigation would help my Dad a lot.

</comment><comment><USER49> Case in point. This article does not display when cookies are disabled.

</comment><comment><USER50> > Even worse, when a film shows someone speaking in a foreign language, the > film often translates the words, but so too does the closed captioning, and > the two are placed on top of one another, making both attempts to help the > viewer completely unhelpful.

This drives me nuts. Especially when the closed captioning blocks the film's translation with something completely unhelpful like _(speaking foreign language)_ Why even bother putting that in there?

</comment><comment><USER51> > As a result, even a manual is not enough: all the arbitrary gestures that > control tablets, phones, and computers have to be memorized. Everything has > to be memorized.

 _If_ they're documented at all. I only discovered the difference in iOS between a "long press" and "hard press" on the touchscreen by accident. The extra useability thrilled me, but I wish the feature were better documented.

</comment><comment><USER52> Hacker News has room for improving too. While I have normal eyesight, I have to zoom up this page because the letters are too small.

</comment><comment><USER53> I'm hoping one of the big tech companies will invest into creating an inclusive design language that is accessible, functional and sexy from the get-go.

</comment><comment><USER54> If you succeed in creating technology that will change the world, you will then have to live in said changed world as an old person.

</comment><comment><USER55> Ironically the usability blog pops countless cookie consent dialogs to distract the reader

</comment><comment><USER56> Irony is my favorite form of humor. This is how the article shows up for me:

[https://ibb.co/6XqtQGs](https://ibb.co/6XqtQGs)

<comment><USER57> That's horrible. Let me recommend 1BlockerX:

[https://ibb.co/yNQ4T08](https://ibb.co/yNQ4T08)

Or use Safari reader mode. Or both.

<comment><USER58> Using an add-on to get a usable experience is nearly the same as admitting defeat.

<comment><USER6> It's also a necessity.

Beyond uBlock Origin for the abusive parts, I've also recently started to use Stylus to fix bad design of sites I visit frequently. Few minutes with browser's Inspector and I can usually whip up a little bit of CSS that removes unnecessary whitespace, UI trinkets, and densifies the site by factor of 2 to 5.

<comment><USER59> I've been doing that Stylus thing for years.

</comment></comment></comment></comment></comment><comment><USER60> Well, they're _old_. They're difficult and boring to talk to. Besides, they aren't going to buy enough of our stuff now or in the future. They aren't the long-term loyal customers we're trying to cultivate, because they're - ahem - _old_.</comment>


Ten Years of Bootstrapping: Lessons Learned - <AUTHOR> http://davegooden.com/2013/08/our-story-10-years-of-bootstrapping/ <comment><USER3> TEN years of bootstrapping. This just got removed from the title for some reason. Good thing Gabriel García Márquez didn't have the same editor.

Wow. This is interesting on its own, as others mentioned, but it's _really_ interesting to me personally, as the co-founder of a bootstrapped local real estate referral company.

One thing I didn't see mentioned much was the 2008 housing crisis, which was disastrous for us. We were in acquisition talks in late 2007 which were suddenly canceled, seemingly in anticipation of the horrors to come. Our revenues were devastated and I went back to consulting for several years. Basically, our site was on autopilot until January of this year, when the real estate market showed signs of long-term strength and we started our current development drive.

We're still bootstrapping off consulting revenue, so it hasn't exactly been fast-paced, sadly. Let me say, still running a business you started after Startup School 2005 gives you a much different perspective than the usual startup narrative. When you bootstrap, you can press pause instead of eject. You're not on fire, so you don't turn to ashes the instant you run out of fuel, but you sure do have to keep smoldering.

For those who aren't familiar, I would describe real estate startups as being similar to a closed game of chess. Lots of long-term possibilities and plans, but not a lot of good moves available. The market is sharded, guarded, scattered and smothered.

We haven't explored (or had an opportunity for) an agency conversion, so it's really interesting to read this account, thanks. Instead, we are trying to rework our regional site into a niche national site. I'll share how it goes, hopefully before our company's own tenth anniversary. Congratulations and thanks again for writing this history.

<comment><USER4> > the real estate market showed signs of long-term strength and we started our > current development drive.

It's not long-term strength, by the way. The US economy[1] is in shambles, and ready to implode any moment. What you're seeing in the real estate market is a new bubble. The buyers are investors, and the current craze started when people thought the bottom was in. The zero-interest rate policy "helps" too.

Just thought you might want to know. Be careful.

[1] Not only the US, but pretty much all Western economies (+Japan) are ready to implode.

<comment><USER5> Sigh, I'll bite. Tired of cable news quality comments presenting very debatable opinions as fact, especially without any concrete arguments, evidence, sources or otherwise real facts. On top of that being tangential to the post. Here is just one indicator that points in the opposite direction of your claims.

[http://data.bls.gov/timeseries/LNS14000000](http://data.bls.gov/timeseries/LNS14000000)

<comment><USER6> The U6 unemployment rate is more indicative of the current state of the economy: [http://research.stlouisfed.org/fred2/series/U6RATE](http://research.stlouisfed.org/fred2/series/U6RATE)

</comment></comment></comment></comment><comment><USER7> Wow...Lesson #1 is SOOO on-point. I think that is what is missing from the free-to-paid conversion narrative.

The only people that will convert from free to paid is those that have received value. SaaS apps need to start paying attention to the 'value indicators', and provide an upgrade path on that - rather than a time limit.

This is one of the reasons that companies that charge per transaction are so awesome - because the only time you pay, is when you make money (which is the implicit value there).

This concept needs to be blown into a blog post - I just may do it - <USER2> this is so important and so easy to miss.

Your conversion rate may suck, not because your product sucks....but because your internal value metrics suck. You aren't measuring the right thing.

</comment><comment><USER8> This is interesting article. I was the initial and primary developer of another lake realty discovery site, that used some NLP to process MLS feeds and discover lake based properties. Lakeplace.com was the main competitor and our goal was to make sure that we have more accurate listings and more listings then Lakeplace. It's nice hear the lakeplace side of story.

<comment><AUTHOR> Author here. So in your case, we were "the enemy" who's head you wanted on a stick. Great. ;)

<comment><USER9> Question for you in regards to your 3phase goal setting.

What does that look like on day to day basis.

How do you make all three phases work together.

Great READ!

</comment></comment></comment><comment><USER10> Great post. Going to add this to my list of ones to pass around to people who think killing and crushing it gets things done. Learning to survive and then thrive is just as important.

How many entrepreneurs are willing to commit up to 10 years to find their path? Supporting this is what we need more of, and not as much echo chambers.

To the author: write more. Experience over time speaks volumes.

<comment><USER11> Do you actually have a list of similar stories? Could you share that list?

<comment><USER12> I think most businesses that aren't TechCrunch headlines follow similar paths and time lines. Today everything seems to be MVP and pivot, which really isn't accurate for long-term Entrepreneurs/business owners.

<comment><USER10> I think MVP and pivoting fits Bootstrapping just fine -- adding the mix of doing an idea that lets you charge from day 1 to finance it over the long term is the key difference in my mind.

</comment></comment></comment></comment><comment><USER13> Good story, great lessons for entrepreneurship.

The big thing I couldn't help noticing was how inefficient the real estate industry is. There's so much regulations and people taking a huge slice out of the consumers pocket.

Even the notion of ownership by consumers is at odds with modern times, after all, we hackers are finding it too onerous to even maintain physical servers and off-loading that to the cloud, while most people are still plopping down huge sums of money and mortgages to lay claim to small patches of land, in a clumsy procedure where we fork over almost a tenth of that large sum to people who provide little value (real estate agents, lawyers, city fees).

PG should put out a call to kill real estate like he did with hollywood. There's huge profits for hackers if we wrestle it away from the current players (bank, agent, lawyers), and a lot of good for consumers.

AirBnb's a good start, further steps might be to unify it with Uber, Shopify, SpoonRocket, Exec, and Mechanical Turk and reduce consumers experience down to a few button presses. There's a big opportunity for a company to offer complete life management in an app.

<comment><USER14> As someone who has been in the RE industry for 6+ years now (loan officer and now processing):

> how inefficient the real estate industry is. There's so much regulations

My biggest time consumer are boilerplate disclosures and astonishing conditions, which have become nightmarish since the housing crisis. That 10 day delay in closing? Someone mis-dated and now we have to wait out Dodd-Frank before proceeding. That 41 page package of forms you need to sign and return before we can even begin underwriting? Sorry, required. The $150 you received from your grandmother for your birthday? Yeah, we're going to need a gift letter. I wish I was being facetious.

> people taking a huge slice out of the consumers pocket

Unfortunately, RE and mortgages are just high-touch industries. People need to be re-assured that someone is working on their behalf. Look what happens when PayPal shuts down an account and gives a generic response? Or Google does the same when blocking a Gmail or AdSense account? People have a complete meltdown. Imagine if that is someone's home purchase (doubly worse for first time homebuyers), and they receive an email stating "Sorry, your loan was denied" with a link to "File an appeal". The ones I work for receive calls all day every day from buyers and agents wanting updates and peppering with questions and concerns.

I automate as much as I can in my workflow (thank you Python and C#) and have considered outsourcing it, but it's a job that is 95% edge cases and one-off situations. The best targets for efficiency improvement are lenders' and RE agents' internal procedures, but that's another discussion.

<comment><USER13> Thanks for that insider perspective, that will be useful to hackers attacking the space.

An approach would be completely abstract the process. I believe the ownership model is a completely broken process that's pushed by the nefarious banks (It's easy for them to just conjure up money from thin air and indebt us for 30 years - reserve banking. This is the root cause for the relentlessly growing, but almost entirely useless, home ownership industry).

Hotel 2.0 revolution is needed. Airbnb, but with professional, heavily computerized, management of much larger property portfolios.

</comment></comment></comment><comment><USER15> Excellent post.

Entrepreneurship is hard. You, the entrepreneur, can easily become your own worst enemy. In many ways it is a mental game far more so than anything else. The tech scene sometimes highlights the "built it over a weekend" stories. It is easy for the uninitiated to get a feeling that they, too, ought to be able to spin something up over a weekend or a few days and have success. The truth is that overwhelming majority of entrepreneurial ventures look far more like what Dave Gooden describes than the "look Ma, I built a business in seven days" crowd.

The other element of note here is that your business doesn't have to be sexy in order to succeed. There are plenty of people out there doing very, very well, with businesses that lots of techies would not even think of approaching.

And, of course, a big exit is not the only definition of success.

</comment><comment><USER16> His notes at the end do a good job of distilling his lessons down into memorable chunks. #4 seems especially relevant to this audience:

 _Know your customer. Your customer is the person who gives you money in exchange for your product or service. It's easier than you might think to get confused about this one._

<comment><USER17> I really enjoyed "There are riches in niches."

It doesn't take millions of dollars in revenue to have a wildly successful small business. An incremental $250,000 in annual revenue doesn't move the needle in a 50 person shop, much less a public company. But if you're a 2 person shop filling a niche, your year just became awesome.

There are a ton of profitable niches in software that people need filled. Markets that aren't big enough for a huge company to bother with. Markets that are huge opportunities for a few dudes to make something awesome to serve a dedicated base of customers.

<comment><USER18> And don't forget that even though it's a niche and you probably have some awesome skills in the niche that are needed for running the business, BUT if you structure it correctly, you are also building up equity that can be sold if you decide to try other things or simply want to cash out.

For a recurring revenue net of $250k, it's not unreasonable value it at $750k to $1.25 mil depending on how likely you are to keep that cashflow going and how much ongoing investment is needed. (DISCLAIMER: this is napkin math, nothing more.) Although, after tax that doesn't sound like all that much, it is life-changing for most people. If you can for example pay off your mortgage and other debts, your lifestyle changes overnight.

</comment></comment></comment><comment><USER19> Great article and advice at the end- the author correctly identifies that perseverance in the face of uncertain market conditions and lots of "no's" from investors or other so-called experts is a key quality for entrepreneurs that have the guts to stick it out over the long haul.

The story also conveys about how important it is to put in _TIME_ in a marketplace. Everyone wants to quickly flip for the big exit but the real value comes over the long and arduous process of iterating, growing, and especially uncovering unmet customer needs regardless of if it's product / service

</comment><comment><USER20> > In 2006, at the height of the real estate boom, some of our 600+ real estate > advertisers were closing 6-8 transactions per month that could be directly > attributed to LakePlace.com leads. If you multiply that number out, the top > agents using our website were clearing $30k+ per month for a $59/mo > investment.

This statement was interesting as it gives the reason for the first big pivot. I have to ask though, why didn't you just change the pricing model and enforce a few limits to capture more from these transactions?

</comment><comment><USER21> Very good read. I like his approach and how his company has evolved over the years from one thing to the next.

We went through similar transitions, starting as a mobile app shop, getting more into innovative web apps powered by our own stack and now as an ad-tech company with our own proprietary DSP.

Quite a transition and a lot of what he said rings true...and I wonder if the experiences he had ahead of where we are will occur for us as well.

</comment><comment><USER22> Thanks for the writeup. I live in the area you serve and grew up at a family resort, so I saw your marketing efforts play out first hand over the past decade. Very interesting and insightful to hear the back story of your company.

I happen to work just up the road from your Crosslake office in the Liss building. Stop in if you're ever passing though.

<comment><AUTHOR> Wow. We'll have to grab a beer the next time I'm in town.

</comment></comment><comment><USER23> At what point are you no longer "bootstrapping."? This seems more like 1 year of bootstrapping.

Still a good read. I can only imagine the acrobatics OP's stomach was doing when their newly-found CEO backed out.

<comment><USER24> On a broad level, "bootstrapping" simply means building and growing a business without significant external investment. In other words, the business is entirely self-sustaining and self-growing.

Bootstrapping doesn't mean getting by on ramen and futons, _per se_ , although that's strongly implied in the early stages. Fiscal self-discipline is a nice- to-have in any startup, but it's the difference between life or death at a bootstrapped startup.

Achieving a certain level of profitability, and reinvesting those profits in the business, is still bootstrapping. Walmart, for instance, was bootstrapped until the day it listed on the NYSE.

</comment></comment><comment><USER25> In my mind the founders could have really sped up the process by figuring out something that added new or even true value to their users. By going the route of simply aggregating listing info and posting information easily accessible on other sites, they relegated themselves to being just another real estate listing website.

Their growth was then limited to how many phone calls and connections they make - in other words, no one was beating down their doors to list on their site and only after years of growing this way did they command some semblance of a home buyer audience that made it worth while for the sellers.

The model these guys implemented is tried and tired and brings nothing new to the table. That's why they resorted to the traditional broker model in the end.

</comment><comment><USER26> This is a really interesting story. It seems like the lead-gen sales were probably being under-reported, since they went from 2 to 53 sales in the same market. I am surprised that lead-gen in the real estate market is not easier to audit.

</comment><comment><USER27> Dave and Cam - you go!! I launched my startup in ecommerce/payments and can totally relate. Entrepreneurship is tough but the joy of doing it and success at the end is totally worth it

</comment><comment><USER28> #9, Pick a fight, is one of the best sales mindsets I've ever read. So true when you're scrapping and bootstrapping. Thank you for sharing your story! It's especially illuminating on what a successful business trajectory is away from the usual startup hype narrative. I wish more founders would tell these honest stories.

</comment><comment><USER29> I'm a bit disappointed in the story. It seems to me that businesses of this type represent an opportunity to disrupt the real estate industry, and it's sad to see them end up joining the industry.

</comment><comment><USER30> The outcome of them trying to build a central place to look at listings turns into them becoming what they were trying to work around, and end up still not having a central place to look at listings.

</comment><comment><USER31> Interesting and useful article, thanks. If the original author turns up, I'd be curious to know how you felt about their being two of you in it together and not just a single co-founder.

<comment><AUTHOR> Author here. I wouldn't have made it through without my co-founder. A co- founder is great support during the bad times...and added responsibility all the time. If I don't give it 100% every day, his family feels it, and vice versa.

Some people can do it on their own, but our partnership/friendship works well for us.

</comment></comment><comment><USER32> I really liked the part about everything scaling. I hate when people say, "It wouldn't have scaled." It would have. You just weren't thinking of it in the right way.

</comment><comment><USER33> Is he saying for the rentals that they entered rental properties onto their site without the lister's permission, and then contacted the lister to offer a paid version?

<comment><USER34> I think rather that he offered to do the data entry, and then later on once listing agents started to get hits through his service, started to charge them a fee. I may have misunderstood.

<comment><AUTHOR> You're correct. Sorry for any confusion.

<comment><USER33> Thanks for clarifying. I'm still a bit confused and since I've thought of doing this same thing at a potential startup I'd love to know the details.

So you searched for lake listings on other sites, contacted the lister and offered to add them into your system? What kind of response rate did you get for that? I'd imagine you wouldn't hear back from most of them?

How about adding them by default and then contacting them and saying "I've add your listing to our site so you can have an idea of how it works. If you choose not to join, let me know and I'll delete it."

</comment></comment></comment></comment><comment><USER35> Lesson: traditional brokerage selling houses turns out to be just as profitable as they were.

</comment><comment><USER36> enjoyed the read

<comment> why-el Not really a direct response to you, just a remark, but I don't know why people downvote this type of comments. "enjoyed the read" is real feedback for the writer.

<comment><USER37> It's redundant. An upvote says the same thing. Feedback needs substance, and without substance, it's just noise. People come here specifically because there isn't much noise. It all comes down to respect. Respect my time by providing insight, value, knowledge, or a unique perspective, and I'll do the same.

<comment><USER34> An upvote might mean "This is important", or "This has good lessons", though, and specifically saying that you enjoyed reading it, or that it was written well, is a slightly different compliment.

<comment><USER37> There is no value in a thoughtless "enjoyed reading" or "nice read." If that's all someone has to say, I would recommend waiting until they have more to say. If they want to spend 5 minutes explaining their thought process and why they enjoyed it, that's a different story, that's something I'm interested in hearing.

Personally, I enjoyed the post because it has a chronological order, specific names, dates, and numbers. Dave's transparency is refreshing and gives me confidence in his opinion. As for readability, it could use more of a contrast of the text and background, but I appreciated the increased line-height, which helped me to scan the article quickly.

Anyone can type a couple of words, this is the internet after all, but that's not why people come here.

</comment></comment></comment></comment></comment><comment><USER38> I have never understood the huge commissions Realtors make! It has never made sense to me. I would love a Realtor to explain their expenses on the sale of a 1 million dollar house.

<comment><USER39> Showing it to 200 people before one actually agrees to buy it _and_ makes it through the loan approval process for starters.

Imagine you're a contractor and had to spend 95% of your time pitching and doing spec work. What would your "hourly" rate be?

<comment><USER40> Irrelevant. How valuable is the work you do? You could go around 'pitching' your window washing services and land 5 out of 100 potential clients but you still aren't getting more than a few bucks per wash.

<comment><USER41> Totally relevant since all that extra time needs to be paid for or people wouldn't go into the business.

<comment><USER42> Irrelevant, since people are in window washing services despite the low pay.

Reasons for huge commissions:

1\. Restricted field: you need a license, and in general these kinds of licenses are difficult enough to get to create artificial scarcity.

-> seek employment in such a field, if you think you can get in.

2\. High stakes: A lot of money is moved around so it doesn't hurt so bad to give an important service provider a large chunk.

-> seek work where the money is. -> when dealing with Realtors etc., try and negotiate over the price anyway, just out of principle.

3\. There is probably more to this profession than is visible from the outside. I don't know what, but usually people underestimate the complexities of professions they don't know much about.

-> ...? Maybe talk to Realtors and find out what it is like.</comment></comment></comment></comment></comment>