It's Discounted, but Is It a Deal? How List Prices Lost Their Meaning - <AUTHOR> http://www.nytimes.com/2016/03/06/technology/its-discounted-but-is-it-a-deal-how-list-prices-lost-their-meaning.html <comment><USER3> There is a law in the UK that says for a product to count as being on 'sale' (introduced due to the almost legendary state of permament en-sales-ment some UK shops seemed to inhabit), it must have been for sale at the higher price for a certain minimum amount of time. Therefore on sales fliers you will see little footnotes actually specifying the dates the product was for sale at the higher rate.

Of course, one still suspects tomfoolery - the date ranges are suspiciously short, and it doesn't have to be every store in a chain. Tempted to feel sorry for some poor mark in some remote outpost who accidentally paid the higher sacrificial price...

I remember my own sad experience with sales, rushing to sign up for a new kitchen before the "Februrary 20% off" sale ended. The sale ended alright - only to be replaced by the "March 30% off" sale. I was a wiser man after that.

<comment><USER4> I work at an e-comm retailer, and we sometimes will have two sales within 28 days of each other. If a product is in both sales, we have to indicate in the second sale it had been on sale within the last 28 days.

I found it surprising when this came up, because I don't recall seeing that footnote on any other site, ever.

Also, there is a town somewhere in the North of England/South of Scotland where all the big sofa/kitchen retailers never discount their stock. As such, they can claim it's been on sale at full retail value somewhere in the UK for the last 30 days, and other such foolishness. It's silly, really.

</comment></comment><comment><USER5> The article focuses on how a high list price can deceive consumers into thinking they're getting a good deal. That's true but it's not the whole story.

Sometimes a high list price is combined with custom discounts to extract the most money from each customer. You see this more often when a market is closer to a monopoly, e.g. enterprise software with high lock-in.

In microeconomics you learn about the supply-demand curve. Normally there is a gap between the price the customer is willing to pay and the price the supplier is willing to accept. Depending on the market price, some of this gap is the consumer surplus, and some is the producer surplus (i.e. value gained by each party).

When a supplier has the power to set their price depending on the customer, they can capture all of the value under the demand curve and maximise profit at the expense of the customer.

A related strategy in retail is coupon discounts. Price-sensitive customers will take the time to use the coupon (when they otherwise would have not purchased), while others will pay the list price. This helps maximise the profit overall.

<comment><USER6> > A related strategy in retail is coupon discounts. Price-sensitive customers > will take the time to use the coupon (when they otherwise would have not > purchased), while others will pay the list price. This helps maximise the > profit overall.

But not when a simple search for 'retailer coupon' reveals a million click jacking links designed to extract a free commission.

</comment></comment><comment><USER7> "We are selling this at a discount of %30 of this completely arbitrary price point" is a meaningless statement. This kind of hand-waving around price isn't exactly new.

I used to buy these bags of frozen chicken breasts every week. They were always $10. One week, the price shot up to $13. I didn't buy them that week. The very next week was labor day weekend and they were advertised as "on sale". The price? $12. They went back down to $10 a week or two after that.

I'm a little surprised people who shop online are influenced by "list price." I'm influenced by the amount of money leaving my wallet. If it's $5 cheaper to buy an item at website X rather than website Y, I'll do it, unless shipping costs eat up the savings. It's not really that inconvenient (versus a retail store which requires you to go to another store and possibly return if the prices aren't better there). But I'm looking at "how much real money is going to leave my account" rather than "how much imaginary money am I going to save".

<comment><USER8> Tax too. Sometimes Amazon will have a better price and free shipping (and prime) but due to CA tax it'll be cheaper to order from out-of-state (free shipping is pretty common). Amazon also doesn't really do many coupons, so promo codes are more likely to work at smaller places or the mfg website (usually only worth it for larger purchases).

<comment><USER9> I've been following Amazon prices the past 7 years. I'm not doing it scientifically, but I'm trying to be fair. Im using am/fm Portable radios as a item to study. The radios are a Sony portable radio, and a Kaitko portable radio.

Both radios have gone up in price, and the price increase seems unrelated to inflation.

I like Amazon, but they are not the cheapest in town anymore, at least in the catagories I buy.

What are you people buying? What are the good deals? I don't see deals like I used too. Is it just me? I know I don't buy a lot of crap, like I used to-- so my perspective might be skewed?

<comment><USER10> I've read in multiple places about Amazon's main pricing strategy, which isn't all that different from what Walmart employs. They pick specific brands/models/categories of product at which they will absolutely be the cheapest. Everything else is just regularly priced. So if you follow a 'non- standard' product for them you would probably find that it probably is about the same price everywhere else- with one exception: there have been bot-price setting wars by different sellers that have escalated the prices of arbitrary products to insane levels. This is where you see the $200k toothbrush or $1m used book.

I do the most of my shopping at Amazom because I can build up my basket through the week/month and just do one order without leaving my house. Price checks to different retailers in my area find that usually Amazon is slightly less or exactly the same price and I don't have to spend hours going to the retail store. Finally, I can get it all in one place instead of going to Target, Home Depot, and wherever else.

</comment></comment></comment></comment><comment><USER11> This is why consumers should be ruthless in their own way in buying stuff. Don't concern yourself with the discount but rather the effective price with the product value and its alternatives. Use peer ratings on products, compare prices online, price tracking sites. I've placed stuff on my Amazon wish list and a few days later seen it for a lower price. If a retailer is pulling a fast one on me, I just stop using them.

</comment><comment><USER12> It seems to me that many of the objections in comments so far assume that people are efficient and rational consumers.

Economics often assumes that. Politics sometimes assumes that.

It's nearly always an incorrect assumption.

<comment><USER13> It's rational to claim that people are efficient and rational consumers even when they aren't, because there are clear economic and political benefits to pretending the claim is true, even though truly rational and efficient individuals can see it's utter nonsense.

<comment><USER14> We are approaching a world where every consumer can have perfect information and thus start acting truly rationally. If im buying something >$50 I'll quickly google it just to make sure i can't get it cheaper at another store.

<comment><USER15> Some markets this sucks like mattress. No two chains sell the same mattress. It may look the same and be made by the same manufacturer, but it will have different logos and model numbers between stores.

</comment></comment></comment></comment><comment><USER4> The one that annoys me is blatantly fake RRPs.

There is a Chinese watch maker behind the brand "Thomas Earnshaw", capitalising on the London watchmaker who was a pioneer in the field centuries ago. They claim their full RRP is somewhere in the region of £600 for one of their automatics. I don't think they've ever sold one for that price - <USER2> sell them in the £150 range on the basis it's "so cheap!" to so many consumer.

They're not awful watches, but really, they're £50 automatics, and should be sold as such. By insisting that they are £600 watches, and the constantly offering deep discounting, they are basically playing games with the consumer and almost tricking them into paying 3x their true worth.

If you're not that educated about automatic watches, you're not sure what the difference is between movements and which ones are worth money and which are not, it's hard to not be hoodwinked.

I think for a while certain PC and laptop manufacturers at the lower end of the OEM market played the same games, especially on bulk account deals going into education and healthcare markets, especially in the UK. Go look inside a Viglen or RM machine and tell me that they are worth the list price. They aren't, but it looks good on paper when somebody "negotiates them down because of the size of the order".

<comment><USER16> Invictafication is a word I've seen used to describe this as well. Invicta watches are at a constant 80% to 95% off retail!

<comment><USER17> Far worse are Stauer and Daniel Stieger, you can see their cheesy ads in magazines, comparing their watches to the name brands and sale prices of $69 USD with a retail of $499

</comment></comment></comment><comment><USER18> I'm from Brazil, and the government is worried that the problem here is even worse, for example the first year Dell made a brazilian black friday sale, I bought a computer discounted from 4900 to 4300, but I had to cancel the order the next Tuesday after a personal problem. The non-sale price was from 4250 to 4050... so Dell "sale" in Brazil meant bumping the actual price from 4050 to 4300 and them claiming it was a yuge discount from 4900, a price they never practiced.

</comment><comment><USER19> If I'm willing to pay $40 for a coffee maker, it doesn't really matter what other people are paying. My value judgment of the coffee maker is purely internal: Either it's worth it or it isn't. As long as the device performs to specification, I haven't actually been defrauded. I did have some greasy marketer or 'data scientist' grope around in my lizard brain, but that's to be expected. There's nothing wrong with running a search to see if anyone has a cheaper one, but this should be done after you've decided its objective value to you and not before.

Same reason you don't buy a house by comparing its list price to similar local sales, or trending house prices. That kind of thinking is how people go broke.

Here's some other strings marketers like to pull:

* Only 1 left in stock

* Only 12 hours left on this sale(possibly with a countdown timer visibly ticking down)

* $300 cheaper than our premium model, but has most of the features. What a great deal!

* 5% of your purchase goes towards starving children in Africa

* Buy it in a bundle for a discount.

You know who actually routinely has clever marketing, though? Coca-cola. When they did their campaign printing common names on all the bottles, I bought several of them for people I knew. I thought that was a nice touch. No false urgency or manipulation.

<comment><USER20> I (and I suspect most others) cannot accurately value a product without points of comparison. We rely on the market to conduct the price discovery process. If thousands of people have bought an item on Amazon, and it has many great reviews (including some that call it a good value for the money, and none that strike me as fake), then I judge that the price is a good one. There's nothing morally wrong with introducing a new product with a high list price and a heavily discounted sale price, but I'm probably not going to purchase it until I see whether the market will bear that price.

<comment><USER19> There's a couple techniques for determining the intrinsic value of something to you:

* Look at the direct labor cost: My last W-2 job was something like $45/hour after taxes. I'd probably work an extra hour to get a coffee maker that'll last about 3 years. This doesn't really help price anything below $1000 or so, since the prices tend to meld together. But I definitely want to quit work 2 weeks earlier, so the entire bottom floor of my house is devoid of furniture(which might sum to $3000).

* Look at opportunity cost: I can live on about $800/month with bills/housing/etc. So $40 is 1.5 days of runway on savings. Would I rather have an extra 1.5 days of time to launch my next project, or would I rather have a coffee maker? It's possible the coffee maker would pay off.

* Look at ROI: Someone bought me a Keurig as a gift, and the K-cups that it uses are ridiculously expensive(something like $1/cup). Buying a coffee maker that uses bulk grounds is cheaper. You can make a spreadsheet comparing the 'status quo', 'buy new coffee maker', and 'attempt to find or make cheaper K-cups' options.

* Look at risk mitigation: Suppose I lose money hiring an unreliable freelancer. Maybe I've lost $1000, and I'm considering buying a Dale Carnegie book for $20. I think the techniques in that book can turn at least 1 in 50 freelancers around, so it pays for itself in expected value on the very next freelancer I hire. Or maybe my site went down the other week and I lost $15000 and I'm considering spending $500 in dev time to go bug-hunting in that area: It pays for itself if I estimate at least 3% probability of finding another bug of similar magnitude.

Similarly, I wanted a 3rd new monitor to expand on my 8-year old dual- monitors. I estimated its value at $500, and ended up buying whatever was the best quality monitor I could get for $500. I think it was listed as half-off on Newegg.

It's worth paying someone $20 every month or so to clean the grass around my sidewalk, if you look at what the city would fine you if you don't(risk mitigation) and looking at wage costs.

A quart of ice cream is probably worth $20 to me, since I rarely eat it except on somewhat special occasions. I usually pay $4.

Actually, I'm having trouble thinking of a single thing that I can't determine an intrinsic value for that's worth buying, and which I would need to defer to the market to decide on a price.

</comment></comment></comment><comment><USER21> Seeing all the supposed $5,000 LED TVs on Amazing selling for $1,200 is always a good laugh...

A tangent, but it was a fun conversation recently with the girlfriend in Hawaii staying at the St. Regis. (Hawaii has a hotel rate 'fairness' law) Inside the closet there's the legal statement: "Suite maximum daily rate $9,600". You're never going to see that rate unless either the Olympics come to town or it's New Year's Eve... "no, we did NOT pay $10k a night" ... "wow, but that's what this costs!? Wow!" ... "No... no... but how else would you comply with a maximum rate law?"

<comment><USER22> In Romania the law requires all retailers to display the maximum price markup they have. Dutifully every single retailer displays the same notice "This store practices price markups between 0 and 300%" (over 300% notices exists, but are rare).

<comment><USER23> Wow, 300% is low for maximum markup in the US. Small clothing stores, for example, have approximately a 1000% markup. I worked at one such store, and the store only turned a profit in November and December (due to rent being so high).

</comment></comment></comment><comment><USER24> I recently bought a new screen, I went online searched for models in my price range. went over specs etc to find which model I like the most. Then did a final price search on that monitor. I got it 60 cheaper than the price I got on the first search. (in this case I bought for €180 and elsewhere it was listed €240) This is what I usually do when searching for something, if you look at the specs you don't have to be an expert to find out what is important, and if it is too confusing then read some bad reviews on the product you are searching for.

</comment><comment><USER25> I really don't understand why consumers care for relative price changes in the first place, rather than comparing absolute prices. Is price information really so scarce? My first step is always to check amazon to get at least a rough estimate on the range of prices for a given product or product category.

<comment><USER26> I think it is a deeper, subconscious psychological trick. "It's a special offer and it is limited time, I should get it while I can." Like, appeal to opportunists, or something? Of course, you're completely right and we rational people just override this and do not fall for such cheap tricks.

<comment><USER13> It's a standard marketing trick - because it works.

It's why shady online marketing sites always have a "Special discount for today only!" tag. And - protip - why some automatically offer a 10-20% discount if you try to bail on the transaction.

</comment></comment></comment><comment><USER27> I've never really considered list price to be relevant because it's not generally that hard to compare prices via relative means for luxury items.

For example, I know that a standard pack of chocolate digestive biscuits are 50p. Based on that I can figure out whether some fancy cake is worth buying.

This falls apart a bit in some places (is a home really worth 800000x as much as a chocolate bar?) but generally it works for me.

It does have the effect of reigning in spending which I consider a bonus.

To elaborate a bit - I don't particularly mind spending £2 for something that could have been gotten for £1.50. I mind spending £2 for something which is almost identical to a different item that I could get for 20p.

I think this is where many people fall down. Getting an expensive brand of shampoo at a discount is meaningless if it's still 10 times the cost of regular.

</comment><comment><USER28> I used to sell chairs online, and this particular vendor had an extremely high suggested retail price. I couldn't find anywhere that actually sold it for that price. I don't think it's aspirational like the article suggests, I think it's to help all of the distributors. If the mfg can change a number and help everyone downstream increase sales, that's a windfall for them.

That's why it's always important to compare prices. Start at Google not Amazon :)

</comment><comment><USER29> If you're in the US, go shopping for a pickup truck. Ford, RAM, and Chevy will all come off the list price (shown on the Monroney Sticker) by $8000 or more with practically no arm twisting.

Sure, it's the Manufacturer's _Suggested_ Retail Price. But the signal I get from this is that the vehicle was _never_ worth that much.

</comment><comment><USER30> All the musician's online sites do this. It's price anchoring, just like at JCPenney, etc.</comment>


The Damore lawsuit against Google is unlikely to work out well for anyone - <AUTHOR> https://www.bloomberg.com/view/articles/2018-01-12/silicon-valley-will-pay-the-price-for-its-lefty-leanings <comment><USER2> As a non-white minority in silicon valley, I can see the new direction being adopted by companies to pacify the diversity mafia. Diversity (racial & gender) for diversity sake, with merit being an afterthought is a slippery slope.

Then there's the total disregard to thought diversity. If you're not a far left advocate, your voice is systemically silenced, and you're almost made to feel guilty of holding opinions that are common place in the rest of the country. I'm sorry, but whatever you spin gender fluidity as, I do not want a grown man going into the women's bathroom while my little girl wants to use the facilities.

As with Damore, today's left won't stop till they destroy the lives of those they disagree with. Google could have chosen to ignore this memo, but they vengefully fired an innocent person at the behest of the vocal, loud left leaning faction. Do not give this illegal, militant ideology of vengeance an official platform within the company, just as you wouldn't let the KKK's manifesto dictate corporate decision making!

Let's learn to disagree with dignity!

</comment><comment><USER3> Interesting that McArdle sees Google as vulnerable because conservative small businesses will choose to advertise elsewhere. Such as? Though I'm generally in agreement that the situation she described was a fiasco, her read on the consequences feels naive, to say the least.</comment>


Seeing Through the Hangover "Fog" from 2014-2015 - <AUTHOR> http://blog.semilshah.com/2017/09/12/seeing-through-the-hangover-fog-from-2014-2015/ <comment><USER2> Thanks for this:

I only see Series As and Series Bs happening when one or more of the following conditions are met: (a) An elite executive team (bonus if they know the VC already). "the team test"; (b) Highly demonstrable month-over-month or even quarter-by-quarter growth in key metrics. "the metrics test"; and/or (c) A well-reasoned, detailed roadmap and vision for taking the company from Point A to Point B. "the communications test" — Most seed-stage companies don't have these (yet). I advise anyone serious about raising Institutional VC to ponder these conditions.</comment>


Microsoft Research has great projects for everyone - <AUTHOR> http://research.microsoft.com/apps/catalog/default.aspx?t=projects

<comment><USER2> I don't see adding WebRTC to IE on the list. #dinosaur</comment>


Version Control for Writers - <AUTHOR> http://lifehacker.com/5232049/flashbake-automates-version-control-for-nerdy-writers

<comment><USER2> Not sure I understand the target audience for this. If you're writing in text files instead of Word and are comfortable working in the terminal, wouldn't you also be comfortable with a Git GUI? What would be cool is if there were plugins that could show diffs for non-text files like Word.

<comment><USER3> Actually, MS Word have such functionality, and TortoiseSVN allows to see diff between versions of Word document

</comment></comment><comment><USER4> I don't know anyone who would ever write a manuscript as collection of text files. This is non sense.

For a book you may use one file per chapter, for an article a unique file - always in a formatting word processor. Sure, it would be nice to have a version control system working transparently withing the word processor, namely recognizing changes paragraph by paragraph.

<comment><USER5> I have to agree. If I were writing, I'd want something that had formatting, but wasn't too heavy. Maybe markdown or something. Ideally, it would create nice changelogs in Git even when dealing with markup changes.

I would think it wouldn't be too hard to write a little program that lets you edit visually, then stores the proper text file on disc and commits it whenever you save. Or maybe commits when you tell it to, giving you a chance to enter a commit message that means something.

<comment><USER4> That is a good idea. That way you could use flashbacke as main engine and add a frontend to make it work from openoofice or word.

</comment></comment></comment><comment><USER6> Interesting, but I'm completely baffled by the plugins. Why do I want the current weather and my last few twitter messages in my commit log? Isn't that completely irrelevant to what I'm committing?

<comment><USER7> If memory serves, Cory Doctorow commissioned flashbake, and he wanted it not for backup purposes but as the equivalent of old drafts of books and the like for scholarly research. Git in particular will commit with an empty commit message but is not thrilled about it, and I think there are other VCSes that are more anal about that, thus the need for _some_ text was expressed and "whatever was going on for me while I wrote it" in particular was desired.

So yes, it is completely irrelevant for most purposes to you. I suppose it might be nice to run some sort of semantic analysis that notes that someone writes depressing drippy love poems when it's raining out or something, but I'll be damned if I can figure out why the hell that would be important for me at all. OTOH, flashbake also has a plugin that supports some crude notion of _where_ the commit was written (pretty much gotten from the weather info), which might be more legitimately interesting.

<comment><USER6> Geotagged commits might actually be cool, especially on plane trips. Though I suspect most of mine would just be the latitude and longitude of my couch.

It strikes me that the other twitter/weather stuff is redundant in the face of the timestamps and geotags...

</comment></comment></comment><comment><USER8> Being a writer, I don't see a point in this. When I was writing reviews, multiple files would have made it a clogged mess and to actually write efficiently there wasn't much time to be changing things up. If it wasn't close enough that the editor would fix it, then the entire thing would be redone.

While I'm writing short stories I'd get the same problem. A few thousand words is easier to edit by mind than version control would be. For a novel I see the use in chapter control, but I fail to see how useful it really would be as a novel isn't a series of unconnected events that can be seamlessly changed without huge catastrophic changes to the entire piece.

</comment><comment><USER9> I love the idea of automatic secure saves for my writings. I can use flashbake instead of dropbox. But i'd like to have a clear understanding of GitHub free plans caveats, especially about privacy of the repos :)

<comment><USER10> AFAICT, free Github repositories are always public.</comment></comment>


Ask HN: What's the best solution for non-recurring payment? - <AUTHOR>

Stripe and Recurly seems like the best choices for recurring billing but what about non-recurring billing? Most of our users will be paying once. What's the best solution in term of good API balanced with decent transaction fees? Preferably with merchant accounts as we don't have one and available in Canada and US... <comment><USER2> Though they don't support Canadian vendors yet, I would keep a very close eye on Stripe. Their API, support and overall attitude are kick ass and a breath of fresh air.</comment>


Ask HN: How do I resign as an unpaid Co-founder? - <AUTHOR>

I joined someone in a startup 4 months ago and quickly realized I made a big mistake.  And not having worked closely with her before (we were not close friends, but did know each other from around) I found many, many things that turned me off: her poor work ethic (consistently 1-2 hours late to our agreed upon start each morning, giving all matters of excuses, also lack of focus throughout the day), her dishonesty with potential customers and investors (saying someone is invested or advising when they're not), her general lack of business and sales sense, her lack of direction and focus on a strategy or target market.  I could go on and on.
I want to leave this situation asap.  But as an unpaid co-founder only 4 months in, is it still customary to give 2 weeks notice? Should I work unpaid for another 2 weeks? If not, should it be hourly or pro-rated based on the future salary we are supposed to take after investment?  Due to the kind of person I think she is I believe theres risk in not getting paid for those 2 weeks even if we agree to it (we do have a tiny seed investment that could cover it with leftover).
What have other unlucky folks done in this situation? <comment><USER2> As a co-founder, the project just as much yours as it is hers. Is there a chance that you can reconcile your differences if you believe in the product? I thought the benefit of having co-founders is that you can pull each other into line when the other steps out.

</comment><comment><USER3> I'm not sure to what extent you've talked with her about these issues, but I think talking with her about these issues first is vital. Give her some feedback and tell her what your problems with her are and see if that helps.

That being said, if you ultimately decide to quit, I don't think you owe anybody 2 weeks of free labor in an unpaid gig.

</comment><comment><USER4> If you agree on payment for the last two have it paid up front, you already shown your commitment. If that's not possible then just leave. The hardest part of a startup is to find people you can really work with.</comment>


Show HN: Hillary Clinton Emails API - <AUTHOR> http://www.leaksapi.com <comment><USER2> There seems something a bit ironic or maybe recursive about having to provide my own email address to be able to easily search someone else's emails.

Then maybe _you_ will get hacked and someone else will put up a dataset containing _my_ email address. Ah, the world we now live in.

<comment><AUTHOR> The login requirement was only to prevent garbage requests. No intention to use the email addresses for any purpose other than authentication.

<comment><USER2> Oh, I know. I make my customers give me their email addresses, too, and I'm happy to provide it. It just felt circular, that's all.

</comment></comment></comment><comment><USER3> This is pretty good, the folks in the security space could proabably use this for analysis. Any intention to inform organizations such as the center for security policy?

</comment><comment><USER4> But why?

<comment><AUTHOR> Was this directed at the previous commenter or the API itself?

<comment><USER5> I would guess the API, since the WL page for the Clinton emails already has a search facility. Is this a school project?

<comment><AUTHOR> We decided to build this after a friend and I discovered that you couldn't really quantify the Clinton emails. Yes, you can search on WL or WSJ, but it's much harder to gain any data-driven insights from that. Yes, you can search for "Benghazi", but can you query against a list of nearby Libyan cities, or run all emails containing the strings "Bernie" or "Sanders" through a sentiment analyzer, etc.

Not a school project, though it was a hobby project.

<comment><USER5> I must have missed the parts of the API docs that describe sentiment analysis and geofencing queries.

</comment></comment></comment></comment></comment><comment><USER6> Curious why the domain was registered through Domains By Proxy.</comment>


Actually, Justin Trudeau doesn't get quantum computing - <AUTHOR> https://www.washingtonpost.com/posteverything/wp/2016/04/18/actually-justin-trudeau-doesnt-get-quantum-computing/ <comment><USER2> Actually I would be least bothered by that. He has made better policies that are brilliant. So many ppl envy that they don't have a similar leader!

<comment><AUTHOR> What policies are those?</comment></comment>


NSA: what worked and what not - direct from the future (November 5, 2009) - <AUTHOR> http://www.nybooks.com/articles/23231

<comment><AUTHOR> And Bruce Schneier's blog note covering some fragments of article. Comments are worth reading, too.

[http://www.schneier.com/blog/archives/2009/10/james_bamford_...](http://www.schneier.com/blog/archives/2009/10/james_bamford_o.html)

</comment><comment><USER2> Meh.

Wait a few years: all that stuff'll be available on Google.</comment>


Ask HN: When designing an algorithm, how can the maths be coded? - <AUTHOR> I'm a little bit confused with how the maths can be coded into an algorithm.. <comment><USER2> There are a lot of different types of algorithms. Some algorithms don't have any math at all. Consider an algorithm for sorting a list; it just tells you which elements to swap and how to know once the list is completely sorted. An algorithm for computing the roots of a polynomial just has to do arithmetic on a few numbers (it would just plug them into the quadratic equation), and computers are quite good at arithmetic. More complex algorithms are mostly just more involved arithmetic on larger sets of data, and more bookkeeping to keep track of what the numbers mean. For example, if you were simulating electrodynamics for a small set of charged particles, you would need to know the positions and velocities of the charged particles, and the current value for the electric and magnetic field at every point in your simulated space. Calculating the new value for the two fields is then just a matter of applying Maxwell's equations. It's again just simple arithmetic, but this time applied over and over to every point in the space.

Your question is quite broad, you might try narrowing it down to one specific, concrete question.</comment>


Gitlab 5.0 released, Gitolite now gone - <AUTHOR> http://blog.gitlab.org/gitlab-5-dot-0-has-been-released/

<comment><USER2> So I've been poking around the upgrade instructions for moving to gitlab-shell [1] and I notice you ask the user to do this:

        sudo chsh -s /bin/bash git

I don't see it changing to anything else later in the instructions.

Isn't that a _huge_ security downgrade from using gitolite? Am I missing something?

[1] <https://github.com/gitlabhq/gitlabhq/wiki/From-4.2-to-5.0>

<comment><USER3> If GitLab security were to be perfect, then this change would not affect security in any which way.

However, if the .ssh/authorized_keys file were to be written erroneously, it is possible that this change may increase the likelihood of receiving a shell with the privileges of the git user and thus being able to affect repositories. However, it should not be possible on a system otherwise secured for such a user to obtain access to the rest of they system.

<comment><USER2> > If GitLab security were to be perfect, then this change would not affect > security in any which way.

Yes, it does: right now users can use ssh to push and pull repos on my machine using gitolite but they do not have shell access to the computer. "ssh email@example.com" just prints a short message and exits. With this change they can all just ssh into the computer and have a bash prompt. Trying to make that secure requires a whole different level of paranoia than just not letting people in in the first place.

It also means that every gitlab user has access to every repo that's hosted and the permissions in the web interface are just for show.

If this is really the case and the attitude of the devs then I don't think I will be updating any time soon...

However, I still feel I must be missing something because the gitlab guys host private repos at gitlab.com and so they _must_ have worked these security things out, right? I can't create an account at gitlab.com and just ssh into their server. At least, I really hope I can't.

<comment><USER3> Question: What happens when you type `ssh firstname.lastname@example.com /bin/bash`?

That command doesn't use the shell set in /etc/passwd at all, and you authenticate successfully, so it _must_ give you a shell, right? No.

<comment><USER4> > That command doesn't use the shell set in /etc/passwd at all

Yes it does. [https://github.com/SimonWilkinson/openssh/blob/master/sessio...](https://github.com/SimonWilkinson/openssh/blob/master/session.c#L1815)

<comment><USER3> Regardless:

      AUTHORIZED_KEYS FILE FORMAT
      ....
          command="command"
                 Specifies that the command is executed whenever this key is used for
                 authentication.  The command supplied by the user (if any) is
                 ignored.  The command is run on a pty if the client requests a pty;
                 otherwise it is run without a tty.  If an 8-bit clean channel is
                 required, one must not request a pty or should specify no-pty.  A
                 quote may be included in the command by quoting it with a backslash.
                 This option might be useful to restrict certain public keys to per‐
                 form just a specific operation.  An example might be a key that per‐
                 mits remote backups but nothing else.  Note that the client may
                 specify TCP and/or X11 forwarding unless they are explicitly prohib‐
                 ited.  The command originally supplied by the client is available in
                 the SSH_ORIGINAL_COMMAND environment variable.  Note that this
                 option applies to shell, command or subsystem execution.  Also note
                 that this command may be superseded by either a sshd_config(5)
                 ForceCommand directive or a command embedded in a certificate.

<comment><USER2> Got it, so the shell is still /bin/bash but they specify the command in the .ssh/authorize_keys file which means it cannot be overridden by the user. (I was under the mistaken impression that gitolite overrode the shell and not the command)

So your original point was correct: as long as the authorized_keys file is not corrupted, everything is good. Thanks for helping me understand!

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Last time i was installing gitlab after having the nightmare to install and maintain a gitorious installation and was really depressed that it felt like the same nightmare. Pages of pages of copy&paste instructions, followed by half a dozen issues that needed post-install fixing... no, never again..

I ended up installing gitblit and was amazed by the quick installation and features. Unpack&run! I can recommend gitblit to everyone who needs a quick&easy to install Git web frontend..

But gitlab definitely looks nicer, probably can do even more.. it has pull requests which are (yet) missing in gitblit.

<comment><USER6> Installation is actually a problem with Rails, and web app development as a whole.

Think about PHP: Drop files in the web server directory, add a database and user, edit the app configuration file to point to said database and user, and you're done.

Then there's Rails apps. Gitolite is actually fairly typical: Install a ton of packages (including ssh, redis, and postfix daemons which need to be secured), compile your own Ruby (and keep it up to date), install the Bundler gem, configure Gitlab, configure Gitlab shell, configure Unicorn, configure the database, install gems with bundler, bundle exec rake gitlab:setup RAILS_ENV=production (I have no idea what this does), install an init script, update your rc.d, then set up an nginx reverse proxy [1].

If you're used to setting up web apps, this is typical, and very well- described by the provided instructions. If you're used to the PHP experience, or you've only ever installed distro-packaged apps with apt-get or equivalent, this process feels really unreasonably long and painful.

I remember that the Discourse folks said that they were aware that installation was a pain point, and they were working on making it easier.

Lowering the barriers to installation is actually something that web applications written in Ruby/Python/Node.js really need to do in order to begin to compete with PHP solutions among more casual administrators.

A big part of the problem is isolation from the system package manager. I have a Redmine install on the same server as Gitolite, which I manage via apt-get. I'd really like to have a version of the Gitlab instructions that keeps non- system packages (like the self-compiled Ruby) self-contained in /home/git, so they don't break anything else.

[1] [https://github.com/gitlabhq/gitlabhq/blob/5-0-stable/doc/ins...](https://github.com/gitlabhq/gitlabhq/blob/5-0-stable/doc/install/installation.md)

<comment><USER7> ...compete with PHP, seriously?

Many of the points above apply to any language. Ruby might have maintainability issue but PHP is far far from perfect.

<comment><USER8> The point is very valid.

The person who has to install some third party web application is mainly concerned with "how easy is this to install".

Not only have I steered clear of installing things with too many alien prerequisites, I'm often writing in PHP only because deployment is just so much easier.

</comment></comment></comment></comment><comment><USER9> Sytse Sijbrandij from GitLab.com here. Thank you for submitting this. We hope people like the change. We put a lot of hard working in making GitLab more stable and scaling it. Let us know what you think.

<comment><USER10> Hi Sytse,

Just for future reference:

Its common courtesy to give attributions next to contributed changes in the changelog. I gladly sponsored development of one of them (API: improved return codes and docs, <https://github.com/gitlabhq/gitlabhq/pull/2835>) and a short nod to the involved persons would be nice.

Keep up the good work, thank you!

<comment><USER9> Hi Arhorak,

Thank you for the reference. I think attributing the authors is a good idea. I've created <https://github.com/gitlabhq/gitlabhq/pull/3303>

What do you think? Is it ok to attribute to the full name?

Best regards, Sytse

<comment><USER10> Hi,

in the Padrino project, we usually attribute by (GH) nickname, because thats what most programmers build their identity around. Also, all involved are mentioned. In that case, it would be:

\- API: improved return codes and docs. (Xylakant, justahero)

See ours:

[https://github.com/padrino/padrino- framework/blob/master/CHA...](https://github.com/padrino/padrino- framework/blob/master/CHANGES.rdoc)

<comment><USER9> Good points. I've added Sebastian Ziebell.

About mentioning usernames, I figured it might get a bit confusing when we get public projects on GitLab.com, you would have to guess which platform the username belongs to. What do you think?

<comment><USER9> Thanks for understanding in [https://github.com/gitlabhq/gitlabhq/pull/3303#discussion_r3...](https://github.com/gitlabhq/gitlabhq/pull/3303#discussion_r3493319)

The attribution was merged and is live on [https://github.com/gitlabhq/gitlabhq/blob/master/CHANGELOG#L...](https://github.com/gitlabhq/gitlabhq/blob/master/CHANGELOG#L27)

<comment><USER10> And thanks to you from our side :)!

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'd like to thank the developers for this great project. I finally convinced my team to switch over from SVN to git after I showed them Gitlab. (GitHub was never an option due to corporate data security policies. Even for GitHub private repos.)

<comment><USER12> have you heard of <http://rhodecode.org/> ? It supports both HG and git.

</comment></comment><comment><USER13> This is great news as Gitolite was the one thing that prevented me from giving Gitlab a try.

What are the minimum requirements for a light Gitlab installation? I can't find any recommendations on the site.

The thought of deploying Gitlab on a Linode 512 for $20 a month with virtually unlimited private repositories is very exciting.

<comment><USER9> We don't have minimum requirements. We run GitLab.com with 3000+ users on a moderate (c1.medium, 1.7 GiB) instance. I think you will do fine with GitLab 5.0 and the 512 Linode. Might have to tune the default parameters a bit to have less processes running.

<comment><USER14> In order to run GitLab w/o any tweaks you need 1GB Linode. You can start it on 512 but you need to setup unicorn to use only 1 worker and you need at least 200MB of swap

<comment><USER15> Is 1GB really requred for personal use? I thought about buying 256/512 VPS exclusively for GitLab, don't you think it will be enough for personal projects?

Maybe someone who has the knowledge can write tutorial about configuring GL to run on average VPS?

<comment><USER9> A post about tuning GitLab for low memory consumption would be very useful indeed.

<comment><USER15> Maybe someone will write one someday ;).

And, as I have the chance, I want to thank you and whole GitLab team for a really great work! I'm using GL localy and I'm very pleased with it.

<comment><USER9> Thanks nonpme, good to hear you are enjoying GitLab.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> There is also <http://rhodecode.org/> which i highly recommend

</comment><comment><USER16> The speed at which this project is evolving is quite impressive. I find myself looking forward the the 22nd every month with anticipation for the next release! Thank you Gitlab team.

<comment><USER9> We look forward to the friendly HN comments after the release :-)

</comment></comment><comment><USER17> I set up gitlab for some "skunkworks" projects at my day job, and it's been really great. The Gitolite dep never bothered me (the gitlab install is well documented), but seems like a good thing.

Thanks for your hard work, guys and gals!

<comment><USER9> You're welcome, hope your skunkworks project becomes the golden standard :-)

</comment></comment><comment><USER18> From the front page of gitlab.org: "A fast, secure and stable solution based on Rails & Gitolite."

Gitolite is gone, long live gitolite?

<comment><USER9> Dmitriy merged my change and updated <http://gitlab.org/>

</comment></comment><comment><USER19> I have been using Gitlab since version 3 and have found it a joy to work with and I too look forward to the 22nd every month. We use it in our internal network along with Jenkins for CI and a custom built deployment application. It all works very well with 15 developers and QA personnel. The new gitlab- shell hasn't made any difference whatsoever over gitolite and the update went as smoothly as possible.

gitlabhq also offer Vagrant/Chef VM recipes to quickly get set up.

I encourage anyone considering a change to their VCS/deployment set up to give it a try!

<comment><USER9> Thank you for the kind comment m4tthumphrey!

You probably are aware of GitLab CI that is a simpler alternative for Jenkins but I wanted to mention it just to make sure.

</comment></comment><comment><USER20> The move away from Gitolite is great as I know it was the source of many of install and upgrade headaches however the new component they've replaced it with is very very closely coupled to GitLab.

This could have been a great chance to create a lightweight alternative to Gitolite for other projects to use too.

<comment><USER9> Yes, we hope to make installing and upgrading GitLab much easier this way.

We wanted to allow other projects to use GitLab-shell too, that is why we made it a separate project <https://github.com/gitlabhq/gitlab-shell>

<comment><USER20> I know that but much of the authentication and post receive stuff is hard coded to point at the GitLab API.

If you could abstract this it'd be great.

<comment><USER9> We are open to proposals and pull requests to do this. It is not very productive to abstract things without a few examples of projects it should be generalized for.

</comment></comment></comment></comment><comment><USER21> Annoyingly there don't seem to be instructions or migrating from 4.2 to 5.0 when using MySQL and Apache.

<https://github.com/gitlabhq/gitlabhq/wiki/From-4.2-to-5.0>

<comment><USER22> What parts are you getting snagged at?

</comment></comment><comment><USER23> I really want to give this a go but would like to have it set up to shadow the state of our repos in Github. Anyone have any experience with doing this?

Also, when will the docs be updated to reflect the obviation of gitolite?

<comment><USER24> For a big team you might want something else, but it's possible to configure two repos as one "remote" so that a push goes to both:

        http://stackoverflow.com/questions/165092/can-i-push-to-more-than-one-repository-in-a-single-command-in-git

<comment><USER23> Interesting, thanks.

</comment></comment></comment><comment><USER25> I think its hilarious that all the Gitlab development is occurring on Github.

<comment><USER9> We're pragmatic about the development of GitLab. A lot of people want public projects, it is the most popular request for GitLab [http://gitlab.uservoice.com/forums/176466-general/suggestion...](http://gitlab.uservoice.com/forums/176466-general/suggestions/3159951-allow- public-repositories)

<comment><USER26> Public projects and the need to add every single developer to every single project they needed access to (no concept of teams) were the main reasons we moved from Gitlab to Github Enterprise

<comment><USER9> FYI GitLab has teams of users, groups of projects and public clone now. Completely public repo's is being discussed [http://gitlab.uservoice.com/forums/176466-general/suggestion...](http://gitlab.uservoice.com/forums/176466-general/suggestions/3159951-allow- public-repositories)

</comment></comment></comment></comment><comment><USER27> Congratulations, the project looks good. I will keep it in mind. I didn't install sometime ago partially because I was already running a Gitolite instance and wasn't sure it would play nice.

Great to see Postgres support, can I ask why MySql is the recommended DB?

The install instructions are still quite long but it is really good to see them done properly with a separate non-root user. The suggested Ruby version isn't the latest (even on the 1.9.3 branch) although I'm not sure that matters.

<comment><USER9> About MySql, it is the db that most existing installations use and it is well tested. Also we had problems with deadlocks on Postgres during integration tests on Travis CI. I must admit that I think Postgres has the momentum and look forward to recommending it in the future.

Good point about the ruby version, I made a pull request <https://github.com/gitlabhq/gitlabhq/pull/3305>

<comment><USER9> The pull request was merged into master

</comment></comment></comment><comment><USER28> Just yesterday our workplace gained an interest in setting up Gitlab- can we still use our existing Gitolite install, or do we now _have_ to migrate to Gitlab-shell?

We've been extremely happy with gitolite, and I do not see us moving off of that software.

<comment><USER29> I don't think it's possible to use Gitolite with GitLab >= 5

<comment><USER22> You're correct. gitlab-shell is required in 5.

<comment><USER28> Welp, there goes an obvious good thing we had high hopes would help enrich our infrastructure! Monday is going to be a very depressing day in the office for everyone: we're going to have to go to cgit or some such, and there'll probably be screaming and crying and whaling and self flagellation over that one.

Ya'll should provide an easy to use configuration for using gitlab as a RO mirror of any arbitrary git repository.

Hope you have a lot of great new things in the pipe that gitlab-shell is providing. If configuration was the problem, why not try and scrape gitolite's configuration directly and run gitlab from that? There's certainly another acceptable path- the one you took, creating your own repo server- but I have a hard time qualifying this- as this press release does- as a feature: it's a migration, a lateral jump: there's nothing new that happens, nothing better, it's just a different configuration routine to do what Gitlab and Gitosis.

I wont be suckered by such suavity, but there's a lot of people who would be more enticed by "new super configurable way better than gitolite repo server" as a sales pitch that probably were happy enough running Gitlabs at it used to run that don't really see this as a feature, as they were already on top of it. When releasing features, put the featureful ones foremost.

<comment><USER9> I'm sorry to hear we ruined your upcoming Monday. Which features are not in GitLab 5.0 that you really need?

<comment><USER28> Only feature missing from pre 5.0 is an upgrade path, but that's an important one for us.

</comment></comment></comment></comment></comment></comment><comment><USER30> Any news on supporting a single gitlab instance fronting several load-balanced git servers as backend? Or do both git repositories and gitlab still have to live on same machine?

<comment><USER9> No news on this, the repo's need to be on a single volume (can be NFS drive or AWS EBS drive). I'm curious to know why you want this. We are looking into sharded file servers for GitLab.com Cloud but that seems a bit different from what you are proposing. If you don't feel comfortable commenting please email firstname.lastname@example.com

</comment></comment><comment><USER31> I'll look forward to bitnami building an installer for it.

<comment><USER9> BitNami just released an installer. We hope they upgrade it to 5.0 soon [http://blog.bitnami.com/2013/03/gitlab-now-part-of- bitnami.h...](http://blog.bitnami.com/2013/03/gitlab-now-part-of-bitnami.html)

</comment></comment><comment><USER32> I am running Gitlab on an AWS micro-instance which has memory problems with the previous version. Thanks for working hard and improving performance!

<comment><USER9> You're welcome, thanks for posting!

</comment></comment><comment><USER33> The installation guide link on the homepage that takes you to Git is borked at present?!

<comment><USER9> Good point, we're looking into it. For now you can use [https://github.com/gitlabhq/gitlabhq/blob/5-0-stable/doc/ins...](https://github.com/gitlabhq/gitlabhq/blob/5-0-stable/doc/install/installation.md)

<comment><USER9> And it is fixed now.

</comment></comment></comment><comment><USER34> HURRAH! Gitlab is an excellent product but Gitolite and Resque were making the baby Jesus cry, ran off with your girlfriend and kicked a kid over on his bicycle.

V5: Thanks very much, team Gitlab.

</comment><comment><USER14> +1</comment>


Got 15 minutes and want to learn Git? - <AUTHOR> https://try.github.io/levels/1/challenges/1 <comment><USER2> What helped me make Git click was learning how to use SourceTree. It has intuitive UI (compared to GitHub Desktop) accompanied by a pretty graph of commits. Can't recommend it enough for "visual" type of people like me.

<comment><USER3> I totally agree. Git is definitely a visual activity (as admitted by the existence of git tree). Kind of like how most sane people don't use text-based file browsers.

Actually I don't think SourceTree goes far enough. For example why can't I drag and drop branch labels onto commits to move them?

<comment><USER4> >I totally agree. Git is definitely a visual activity (as admitted by the existence of git tree).

Maybe it depends on the user? I don't find the git visual tool very useful..

</comment></comment></comment><comment><USER5> Hey folks, we (Code School) made this with GitHub in 2012. It keeps being plopped on HN year after year which is great but it would be nice if everybody realized that we did this as an introduction to Git — not as an end-all-be- all.

We make interactive courses, and we have an entire Git Path where we get into Git a lore more deeply. Try Git was build as a free resource at a time where a lot of people were very Git shy. It's been mostly left alone since then. I'd love for us to revise it, but sadly we haven't had the time since.

<comment><USER6> Have a link to your more advanced Git courses? I feel like I've got a solid grasp on the basics, but could use some help with more advanced features, when I get into hairier reverts, rebases and merges things can get confusing.

<comment><USER7> (Hey hey! I'm also from Code School. Normally wouldn't want to sound too market-y and respond, but also didn't want to leave this one unanswered. The follow-up courses are paid.)

Here's our git path, with covers a bunch of Git topics: [https://www.codeschool.com/learn/git](https://www.codeschool.com/learn/git)

In Git Real and Git Real 2, we cover cloning, branching, rebasing, stashing, submodules and more.

In Mastering GitHub, you move out of the browser, and all of your work is done on a fork of a GitHub repository -- with our bot collaborating and checking your work on there.

</comment></comment></comment><comment><USER3> ... then wait until you have more time? Git is confusing and definitely takes longer than 15 minutes to learn to any useful degree.

<comment><USER8> I don't think they're advertising complete mastery, here – just showing how the barrier to entry isn't high for basic use.

There's "tutorial" in the title tag and "try" in the URL; cut them some slack.

</comment></comment><comment><USER9> I really like this tutorial format. Little slow after typing some commands but the layout and instant feedback is really nice. Super easy to understand and follow.

</comment><comment><USER10> I spent 10 minutes trying to break it. Some shell-ish commands are provided and work sometimes (ls, echo, cat), but not all the time. I probably should just look at the source to figure out if there is just some js object acting like a shell, but I was secretly hoping they really were so bold as to set it up to trigger a lambda, or start a docker image with each saved state.

<comment><USER11> Hi James I worked on this course a few years back. This predates docker, so I want to say we used a combination of some sort of jail, the correct privs, app armor, and of course isolated servers. :) It is actually running the commands on a real server, its just really locked down to the point of even removing some of the normal shell commands from the user that's running.

</comment></comment><comment><USER12> This is cool. Seems a little slow to react though, and I wonder if this could throw some people off.</comment>


The human cloud: A new world of work - <AUTHOR> http://www.ft.com/intl/cms/s/2/a4b6e13e-675e-11e5-97d0-1456a776a4f5.html <comment><USER2> I call it "the crowd"</comment>


Ultimate Privacy Guide - <AUTHOR> https://www.bestvpn.com/the-ultimate-privacy-guide/

<comment><USER2> Good job on guide. I've seen many such privacy/security guides over the years, but the information gets out of date after a few years, so it's nice to have a well-written fresh guide explaining recent issues and contemporary tools.

> _If the fact that TrueCrypt is not truly FOSS, or the implications of > 'plausible deniability' worry you, there are a couple of other highly > regarded encryption programs available_

The phrase "the implications of plausible deniability worry you" sounds ominous to beginners in security/privacy issues, and might even discourage them from using TrueCrypt (which is the best such tool as you correctly mention).

It is possible to use TrueCrypt in a non-deniable way if that concerns someone: You would always create a hidden volume and then be prepared to reveal both the hidden volume and outer volume passphrases when required. Since TrueCrypt permits only 1 hidden container, your oppressor will be convinced that you're not hiding additional data when you reveal the two passphrases. Such discussion however is way too much for the intended audience of your guide, so I suggest to leave this out as well.

> _even the most modest cell phone can be easily tracked by the satellites it > uses to work_

A "modest cell phone" doesn't have GPS and is therefore not trackable by satellites. What you probably want to say is that even the most modest cell phone is easily tracked by proximity to a known cell tower. Its location can be further refined by triangular due to signal strength from neighboring cell towers.

> _A better tactic however, is to use the CCleaner utility (available for > Windows and OSX), which not only cleans out pesky Flash cookies, but also a > host other rubbish_

You should mention BitBleach[1] instead of CCleaner or in addition to it. BitBleach is open source and even Bruce Schneier swears by it. I used both simultaneously for a while on my Windows systems and I found that BitBleach found _many_ more files and junk to erase than CCleaner.

[1] [http://bleachbit.sourceforge.net/](http://bleachbit.sourceforge.net/)

</comment><comment><USER3> There is a great tool for scrubbing metadata from files from the tor/tails project that is not in the guide:

mat: [https://mat.boum.org/](https://mat.boum.org/)

It also has a list metadata option which is handy enough to warrant the apt- get invocation.

</comment><comment><USER4> Proposing Comodo free firewall made me laugh a bit. I'd rather have no antivirus. Comodo is installing its geek buddy crapware, and god knows what are they scooping from my pc with it. I installed it once to see how it works.

Proposing Ubuntu as distro that would be protecting my privacy. Canonical was grabbing user data from Ubuntu as well.

Some parts of this guide are ok, but those are points that stood out as not researched well.

</comment><comment><USER5> [http://prism-break.org/](http://prism-break.org/)

</comment><comment><USER6> May be worth adding an update due to heartbleed.</comment>


Ask HN: Could ships that convert CO2 + water to natural gas save the planet?  - <AUTHOR>

DISCLAIMER: I know basically nothing about this topic. It's just a (naive and likely stupid) idea that woke me up this morning. If anybody knows where to get more info, or how to answer some of these questions around feasability, I'd love to hear it.
# IDEA
Imagine a ship sitting in the middle of the ocean (where little life naturally occurs), with an eSolar [1] installation deployed.
A giant array of mirrors, individually small, but in total much larger than the hull of the ship, automatically adjusts to keep an intense beam of heat focused on a boiler, even as the ship rolls in the waves.
Convection carries water from the ocean to quickly cool the boiler and keep pistons that generate electricity firing.
Generated electricity is used, along with water and carbon dioxide, to create CH4 (natural gas) and oxygen, at 80% efficiency [2].
Once the ship is full of natural gas, it folds up its solar array and sails to the port where the bid for natural gas is highest.
I haven't done any math to figure out cost, but it seems interesting/compelling from a high level. What do you think?
Anybody who wants to take this idea and execute on it should feel free to do so without reserve. I claim no ownership to anything.  Execution is everything.

  [1]: http://www.idealab.com/our_companies/show/all/esolar
  [2]: http://newenergyandfuel.com/http:/newenergyandfuel/com/2009/04/01/boosting-bugs-with-electricity-to-make-natural-gas-from-c02/
 <comment><USER2> So right now, they're flaring off natural gas in North Dakota from the Bakken oil fields because it's not worth their time, money, or effort to take it to market. Figure out how to transport that to someplace they need it, or to build something that can take advantage of cheap gas there. ([http://www.nytimes.com/2011/09/27/business/energy- environmen...](http://www.nytimes.com/2011/09/27/business/energy- environment/in-north-dakota-wasted-natural-gas-flickers-against-the- sky.html?pagewanted=all))

If you're going to use a ship for this, it would also have to be able to liquefy the natural gas (you have can store about 1000 times more energy with natural gas as a liquid than as a gas)

Basically, the capital costs and operating costs for this probably don't make any economic sense.

<comment><AUTHOR> That's the most compelling argument I've seen yet for the (lack of) feasibility. Thanks for the info.

</comment></comment><comment><USER3> Seriously, your idea requires an awful lot of "holy grail" technologies.

Generating natural gas with 80% efficiency would solve _tonnes_ of problems (if the price was right). If you could do that, you could get rid of 50% [totally made-up statistic] our existing power infrastructure - a good deal of our existing stuff is only there to "smooth out" demand. It would also make wind power a lot more practical.

If a ship could simply power itself, that would be a massive boon. Shipping companies would pay a lot for a ship that doesn't need to use fuel. And shipping doesn't always need to be timely - so storage isn't an issue.

If _any_ part of your idea was economic, it would already be widely deployed. The main issue will be cost.

<comment><AUTHOR> The CO2 + 2H20 -> CH4 + 4O2 has seemingly been done (per the paper linked). I agree that the issue would likely be economic factors, but perhaps it's worth investigating those more fully. There are already tankers that transport liquified natural gas all over the world, so there's clearly enough economic incentive for that. The question, of course, is the solar bit.

</comment></comment><comment><USER4> _Imagine a ship sitting in the middle of the ocean_

Ships are expensive to operate, difficult to keep running, break a lot. Why not park this ashore and then pipe or ship the fuel where needed?

 _A giant array of mirrors, individually small, but in total much larger than the hull of the ship,_

You're going to have problems with balance. Such a large array might unbalance your ship and capsize her. Sail area should not be discounted: the wind is going to push on the array and kick your ship around.

 _Once the ship is full of natural gas, it folds up its solar array_

Where do they stow the array? If it's on deck the salt air is going to corrode everything, quick. If it's inside where do you store the fuel?

<comment><AUTHOR> All good points! In terms of parking it ashore, ships have access to plenty of water, which isn't necessarily the case in other desert areas.

Maybe a desert near the ocean though, like in Somalia, but then you still need a ship to transport the liquified natural gas to market (or a pipeline). If the economics worked, I guess either would be fine.

The reality is that if the idea were viable with a ship, it'd almost certainly be (probably more) viable without one too. If land use were the issue, then you could also imagine a flotilla of permanent rafts instead of ship.

Though other commenters have noted that the ships could move to the Southern Hemisphere in the winter to get more solar exposure.

</comment></comment><comment><USER5> This reminds me quite a bit of Green Freedom, a program out of Los Alamos which created gasoline out of atmospheric CO2 and H2O with some catalysts and an external energy source (they used nuclear). If I recall correctly, the gas would have cost around $4 a gallon, making it not quite competitive with gas where I live in Denver assuming you don't count for the externalities. When I get to work, if I remember I'll see if I can find a link and post it.

<comment><AUTHOR> Wow, thanks for the tip! I assume this is the link? [http://www.lanl.gov/news/newsbulletin/pdf/Green_Freedom_Over...](http://www.lanl.gov/news/newsbulletin/pdf/Green_Freedom_Overview.pdf)

Will have to take a closer look.

</comment></comment><comment><USER6> My first thought is that this is probably more expensive than building a solar array on land and connecting it to an electricity grid. Although potentially a ship could spend the northern summer in the northern hemisphere and then go south for the northern winter, gaining access to more sunlight.

<comment><AUTHOR> Yeah, you're probably right about it being more expensive, and much more difficult logistically, to do on a ship.

The motivation for it was threefold: 1. Less environmental impact (no covering up a large swath of land). 2. No cost to buy the land. 3. Plenty of access to water.

I hadn't even considered the possibility of moving the ships depending on sunlight conditions. That's really brilliant.

</comment></comment><comment><USER7> I believe the problem like the weight and volume of such a facility that installed on a ship, and the realibility</comment>


The Java Deserialization Bug - <AUTHOR> http://fishbowl.pastiche.org/2015/11/09/java_serialization_bug/ <comment><USER2> The linked article says "No such safe method is available for Java serialization, so your best bet in Java is not to use Java serialization unless you absolutely trust whoever is producing the data".

This is wrong. It is trivial to mitigate this issue and it only takes a couple of lines of code. For a step-by-step guide from 2013 see [http://www.ibm.com/developerworks/library/se- lookahead/](http://www.ibm.com/developerworks/library/se-lookahead/)

<comment><USER3> Another way to solve this it is to only call readResolve/readObject(ObjectInputStream) under a different security policy (a different AccessControlContext from the caller). The problem is that both approaches (lookahead or security policy) require you to use a custom ObjectInputStream class.

</comment></comment><comment><USER2> Better information on which class (InvokerTransformer) is being exploited [http://foxglovesecurity.com/2015/11/06/what-do-weblogic- webs...](http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere- jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability/)

The related Apache ticket: [https://issues.apache.org/jira/browse/COLLECTIONS-580](https://issues.apache.org/jira/browse/COLLECTIONS-580)

</comment><comment><USER4> It's not just Apache Commons that's affected - other libraries such as Spring and Groovy have similar vulnerabilities. My write up at InfoQ is here:

[https://news.ycombinator.com/item?id=10526953](https://news.ycombinator.com/item?id=10526953)

</comment><comment><USER5> This is quite serious; not sure how we didn't all start hearing about this back at the end of January.

<comment><USER6> January?

<comment><USER2> January was when some slides from a talk were posted - [http://www.slideshare.net/frohoff1/appseccali-2015-marshalli...](http://www.slideshare.net/frohoff1/appseccali-2015-marshalling- pickles)

</comment></comment></comment><comment><USER7> I don't think I've ever worked on a project that deserialized untrusted Java objects; where does this come up?

I suppose -- if you have a Java client for a (probably) EJB-based server; most of the cases where I imagine this sort of setup are with internal-only solutions, though, which mitigates the risk somewhat (but obv. it would still need to be corrected).

I've read about banks in some countries still commonly using Java applets for site access -- that could be a seriously-dangerous attack vector.

<comment><USER8> I've been trying to figure that out too. Part of it is certainly some kind of bug hunter fame that is being played for.

That just seems like bad architecture, period. Now if this can be exploited with RMI or something, I wouldn't be too shocked to see some client/server type applications using that as an interface.

are there session cookies that are serialized objects or something?

</comment></comment><comment><USER9> This is not so much a "zero-day" vulnerability, since the topic was discussed back in January, albeit with little fanfare. That it did not receive much attention until last week, doesn't mean it's really a sudden exploit discovered being used maliciously in the wild.

This was a tech talk intended to broach the subject of dangerous, but standard features of the Java serialization API, providing a demonstration of proof of concept attack vectors.

The truth is that this is not actually a bug. The code works as the design of the OPTIONAL THIRD PARTY library intends. The problem is that this is code that people carelessly deploy, accidentally exposing themselves to attack, failing to understand the full scope and capabilities of their servers and the features they've accidentally included by default.

</comment><comment><USER10> Trust is relative, of course; one should be extremely wary of data that came from an external user, or a client-side application. None of us would say one should naively deserialize such data.

But then there's data that comes from another team's server calling yours as a service; or from another server internal to your service; or off an internal message bus; or from one's own database.

Each of these has a different degree of trust, and different considerations to weigh.

</comment><comment><USER11> So it's not a Java bug, it's an Apache Commons-Collection bug. Granted, it's an extremely popular library, but it's not a "Java" bug.

<comment><USER12> The bug is that doing deserialization safely is difficult in the presence of inheritance, since it's an open-world type system.

If a serializable object contains a field of type Foo, this implies that all subtypes of Foo can be transmitted, whether they were designed with serialization in mind or not. This is especially bad for commonly used base types such as List or Exception. At the limit, if you have a field of type Object or Any, there's no choice but to use an explicit whitelist.

Contrast with how Go does unmarshaling in its standard library (which works with structs and arrays but not interfaces), and functional languages (which use unions in the form of algebraic data types, not inheritance). These are closed-world type systems where we can generate the whitelist by walking the type tree from the base type.

<comment><USER13> Restricting serialization to JSON-like objects loses the benefit of being able to "serialize objects". (However, having that separate internal format for data may well be a better way to go, in general.)

The algebraic approach, in this context, is similar to a superclass naming its subclasses (rather than a subclass naming its superclasses as java does). I'm not sure, but I suspect this open-world choice is deliberate, allowing extensibility. Java is very attentive to security considerations elsewhere. It also would be a too-dramatic change for mainstream OO programming languages.

A third approach is explicitly closed-world: naming the set of classes permitted for deserialization, as per some other commenters. e.g. JAXB does this by necessity, for binding to XML Schema's algebraic type system.

<comment><USER3> > naming the set of classes permitted for deserialization

Or simply having ObjectInputStream execute readResolve/readObject(ObjectInputStream) under a different security context. No need for whitelisting.

</comment></comment></comment></comment><comment><USER14> > arbitrary object deserialization [...] is inherently unsafe

Is it always? In a language with side-effects (like Java), maybe, but in something like Haskell, surely it would be completely safe?

<comment><USER15> In Haskell you could still escape with System.IO.Unsafe at any time.

of course you could check your desiralised code isn't doing anything unsafe, but that's fairly easy to do in Java too.

<comment><USER16> The way to do so in Haskell is putting "Safe" in the Language section of a cabal file, and it covers other stuff like partial functions IIRC.

Are you saying that Java has something similar to SafeHaskell? Are you saying they are nearly the same? If yes to the last one, I feel that might be untrue.

It's quite possible I just read through your comment too quickly though.

<comment><USER15> In Java, it's easy to run code under a SecurityManager, which lets you carefully control exactly what other classes the code can access. This gives you really fine-grained control, and lets you control very carefully what code is doing.</comment></comment></comment></comment>


What React Does (and Doesn't Do) - <AUTHOR> https://daveceddia.com/what-react-does/ <comment><AUTHOR> This quote made me chuckle. "If a tree falls in the forest and that tree didn't call setState… well, as far as React is concerned that tree is still standing". I like the clarification on what exactly react is doing, versus what some might think it is doing.</comment>


Beaker Notebook v1.0 released – open-source polyglot data science web app - <AUTHOR> http://beakernotebook.com

<comment><USER2> Can someone familiar compare and contrast it with iPython Notebook (which also has support for any language/package that writes an ipython kernel plugin)

<comment><AUTHOR> yes. contrast:

1) Beaker is language neutral from the ground-up, and not only can you mix languages, they can communicate. IPython does not have good support for multiple languages in the same notebook. And the backend is still pretty python-specific. Jupyter is working to address this, but I don't know how far along they are or how far they are going to take it.

2) Beaker UI has some nice new features: eg hierarchical sections that you can open and close, and one-click sharing.

3) Beaker is highly configurable and extensible via plug-in APIs so you or your organization can add your own languages, media types, security and authentication protocols, data sources, formats, menus, etc, and not have to worry about merging when a new version comes out.

4) Beaker has a great R backend.

5) Beaker is hiring! See [http://www.twosigma.com/careers/position/936.html](http://www.twosigma.com/careers/position/936.html) and [http://www.twosigma.com/careers/position/935.html](http://www.twosigma.com/careers/position/935.html)

compare:

1) Both have the same notebook and cell document metaphor.

2) Both are Open Source.

3) Both are great tools that I love.

<comment><USER3> It's perhaps also worth noting that Beaker's Python evaluator is an IPython kernel. So anybody who's familiar with IPython can continue using their favorite %% magics, etc.

Also, Beaker can import IPython notebooks, so it's easy to try it out and see the UI differences for yourself in the context of your actual work.

</comment></comment></comment><comment><AUTHOR> the easiest way to run it is via the docker container: [https://registry.hub.docker.com/u/beakernotebook/beaker/](https://registry.hub.docker.com/u/beakernotebook/beaker/)

</comment><comment><USER4> So cool!</comment>


Backup to the cloud by using duplicati - <AUTHOR> http://blogs.lessthandot.com/index.php/All/?p=1743 <comment><USER2> Duplicati does not yet support Amazon Glacier. For an interesting discussion about the troubles implementing it, read Kenneth's comments: <http://code.google.com/p/duplicati/issues/detail?id=689></comment>


The Other Road Ahead - <AUTHOR> http://www.paulgraham.com/road.html <comment><USER2> The original "Getting Real"</comment>


Notes on Managing Remote Teams - <AUTHOR> http://hueniverse.com/2015/02/23/notes-on-managing-remote-teams/ <comment><USER2> I made to the eighth word: Walmart (Labs).

Pro tip: if where you work is embarrassing, don't mention it.</comment>


Publishing the Unpublishable - <AUTHOR> http://www.ubu.com/ubu/unpub.html <comment><USER2> Very strongly recommend that anyone and everyone explore the entire ubuweb website! There is a lot (pretend I capitalized that entire word for emphasis) there, and a lot of it is very good. I can't really think of another highbrow art and culture site that compares to it!

<comment><USER3> It's a great site. There have been a few threads here over the years:

[https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=ubu.com%20comments%3E0&sort=byDate&type=story)

</comment></comment><comment><USER4> "Error: template '/var/www/ubu.com/ubu/unpub/Unpub_014_Stefans_Booty.pdf' not foundError: template security preferences do not allow remote access to files with that extension"

Seems like "unpublishable" was meant literally, I thought it was figuratively at first.

</comment><comment><USER5> At the risk of sounding dismissive...how is this different than fanfiction.net or any other online story repository? Are the authors submitting stories famous?

<comment> compiler-guy Many of them are, if not "famous", reasonably successful writers in their own sub field. The point is that they have work that isn't publishable through normal channels for any number of reasons: Too long, too weird, too different than their usual work.</comment></comment>


Show HN: Teleport – SSH for Clusters and Teams - <AUTHOR> http://gravitational.com/teleport/ <comment><USER2> This looks like a really cool project. I'm excited to see it develop.

How would authentication work with configuration management? I see that new nodes are authenticated with a one-time token generated from the auth server, but that seems like it could be tricky to implement in a dynamic cluster (like an AWS auto scaling group).

<comment><USER3> Thanks! One time provisioning token helps node to connect and get a host certificate signed by the right CA key. All further authentication happens using OpenSSH host certificates. This also means that new nodes can simply join the cluster as long as they have the right certs, not using provisioning tokens at all. This allows you to have an external authority bootstrapping new nodes without talking to existing auth server.

</comment></comment><comment> old-gregg Hello everyone, the Teleport team is here to answer any questions.

Internally we use Teleport as a library to connect multiple clusters into a structured system of doing ops with solid identity management, but we figured it deserves to be its own tool, especially because so many larger companies in the Valley have built something similar internally.

<comment><USER4> 1) How does session archiving work with non-line-oriented applications? (e.g. top and its brethren)

2) Does it ever capture passwords (or any other non-echoed characters) by accident?

3) Does it require a TTY?

4) Can it multiplex sessions across multiple servers?

<comment><USER3> > 1) How does session archiving work with non-line-oriented applications? > (e.g. top and its brethren)

We capture and replay the whole stream, so playback works well with top/mc/emacs/vim etc

> 2) Does it ever capture passwords (or any other non-echoed characters) by > accident?

If you accidentally type in password in your active session that will be visible, session capture will record it, yes. We plan on encrypting everything just in case at rest though:

[https://github.com/gravitational/teleport/issues/262](https://github.com/gravitational/teleport/issues/262)

> 3) Does it require a TTY?

You'd need PTY for interactive sessions, however `exec` will work through ssh just as well (as long as teleport talks vanilla SSH)

> 4) Can it multiplex sessions across multiple servers?

Yes, we just did not expose it in the UI yet

<comment><USER4> Can you post a demo of multiplexing? That'd be extremely interesting.

Also, most importantly, are there man pages?

<comment><USER3> We'll work on the multiplexing demo, sure! Man pages are a good idea, we wrote a bunch of docs:

[http://gravitational.com/teleport/docs/quickstart/](http://gravitational.com/teleport/docs/quickstart/)

but haven't packaged it all into man pages yet

</comment></comment></comment></comment></comment><comment><USER5> Also [https://www.lvh.io/posts/introducing- teleport.html](https://www.lvh.io/posts/introducing-teleport.html) via [https://news.ycombinator.com/item?id=11356008](https://news.ycombinator.com/item?id=11356008).

</comment><comment><USER6> This solves a problem we were looking at my last job: recording and replaying sessions. Identity management and bastion setup are solved problems, but it is nice to have an all in one package.

Of course, this raises a few security questions:

1\. Do I have to run this as a server on every host I intend to ssh into? Or can it use existing installations of openssh for that? 2\. Is this re- inventing any authentication mechanism? If yes, how robust is it and how thoroughly has it been tested? (I'm guess not much right now, since this isn't production ready yet, but the question will remain for a while.) 3\. Do I have to use a different client? Or are existing ssh clients fully sufficient? The article does mention compatibility with OpenSSH, but does not detail. It also mentions using HTTPS as a transport instead of SSH, which is concerning in the case of compatibility.

<comment> old-gregg Sure:

1\. You don't have to. [http://gravitational.com/teleport/docs/admin- guide/#using-te...](http://gravitational.com/teleport/docs/admin-guide/#using- teleport-with-openssh)

2\. It uses existing SSH protocol features, that's why OpenSSH clients and servers are fully compatible.

3\. See above. Regular `ssh` will work, but `tsh` may be a bit more convenient.

4\. HTTPS is used to perform 2nd factor authentication initially. Once you received your session key, it switches to SSH for the duration of a session.

Edit: formatting

<comment><USER6> Why do I need to add keys to my local authorized_keys file in order to ssh out? Does Teleport shell into MY computer?! That is a bit fishy...

</comment></comment></comment><comment><USER7> This looks great. How feasible would it be to have server and tag data synchronized between Teleport and AWS?

<comment> old-gregg Dynamic tags are implemented as external processes that run on schedule and their stdout becomes a value of a tag. So if you have, say, a CLI command which spits out AWS labels of a node, hook it up and they'll appear as Teleport tags.

</comment></comment><comment><USER8> One thing of note: though they do say it's "fully compatible with OpenSSH", it is not compatible with ed25519 keyed SSH, as Golang SSH does not support it.

Otherwise looks like a cleverly designed system. Being able to use a standard terminal emulator to connect would be nice though.

<comment><USER3> Hey, good catch - "fully compatible" was an overstatement, so we've updated the landing page!

</comment></comment><comment><USER9> Can teleport run the same command on a group of servers, then collect the output and prefix it with the name of the server it came from? For example we could run a "df" on a batch of servers and see if they have enough free space, all in one line.

<comment><USER10> Ansible-shell can do that. ([https://github.com/dominis/ansible- shell/blob/master/README....](https://github.com/dominis/ansible- shell/blob/master/README.md))

</comment></comment><comment><USER11> Awesome project! This is a step in the right direction for better access management.

</comment><comment><USER12> How is this any different from the very common LDAP + Kerberos + RADIUS solution that is usually deployed in large companies. This seems like it's re- inventing things that already exist and have been used successfully for years. It seems to me that a tool that makes deployment of LDAP/RADIUS/Kerberos easier would be more practical.

<comment><USER13> Congrats to the Gravitational team on teleport! LDAP/RADIUS/etc are often useful only for internal employee access. Teleport brings (among other things) a new level of flexibility for secure remote management (say, by a vendor perhaps), so I don't see it as a replacement for the traditional auth protocols.

In terms of making LDAP/RADIUS easier, well, we're a YC company that does just that! Foxpass (S15) [https://www.foxpass.com/](https://www.foxpass.com/).

</comment></comment><comment><USER14> Look like an amazing tool to have.

With it one would be able to connect only through wweb console ? (couldn't find it on the docs)

<comment><USER3> hey, thanks!

you can connect using standard ssh client

[http://gravitational.com/teleport/docs/admin-guide/#using- te...](http://gravitational.com/teleport/docs/admin-guide/#using-teleport- with-openssh)

or use little tsh tool we wrote:

[http://gravitational.com/teleport/docs/user- manual/#interact...](http://gravitational.com/teleport/docs/user- manual/#interactive-shell)

they all work well, as it's all standard SSH protocol behind the scenes

</comment></comment><comment><USER9> It would be nice if it made backups of small files uploaded/deleted/modified through SFTP. That, along with the session history, would allow recovery from accidental deletion or overwrite (time machine for small files edited by hand).

<comment><USER3> we don't support sftp (yet), but we emulate SCP, so we can do the backup and upload for sure. We had this use-case in mind when building SCP feature set. Where would you like to push files (e.g. S3?)

</comment></comment><comment><USER15> Is this compatible with deployment automation systems like Ansible? Do you have any plans to write an Ansible Galaxy role for installation?

<comment><USER3> Sure, Ansible works in it's OpenSSH client mode, check out

[https://gravitational.com/teleport/docs/admin- guide/#using-t...](https://gravitational.com/teleport/docs/admin-guide/#using- teleport-with-openssh) \- Ansible section

We are also thinking about deeper integration with state of the art automation and deployment tools.

</comment></comment><comment><USER16> This name ("teleport") is really close to this other piece of software, which looks to be very much in the same space: [https://github.com/petar/goteleport](https://github.com/petar/goteleport)

</comment><comment><USER17> Looks awesome! does it support mosh by any chance?

<comment><USER3> Thanks! I don't think teleport will work with mosh as mosh uses custom UDP- based protocol that we'd have to support, however if we'll get lots of feature requests for it, we'll definitely consider implementing it!

</comment></comment><comment><USER18> So, they implemented Active Directory/RADIUS, a terminal proxy, screen, and a web gui? Does this not seem to anyone else like a weird mix of features for one tool?

<comment><USER19> Perhaps the mix into one tool is what makes it novel?

I'll be honest, my first knee-jerk, HN conditioned, reaction to this was similar to yours, but I've been trying to temper my first reactions, especially when they are negative.

Not the most central thing, but something that put me off a little was that they offer a command to filter the listings...had these people never heard of grep? The playback of terminal sessions is cool though, although I swear I've seen someone else do that somewhere...

<comment><USER20> Perhaps the playback tool you're thinking of is asciinema? [https://asciinema.org/](https://asciinema.org/)

<comment><USER19> Yup, that is it.</comment></comment></comment></comment>


Hackers on a Plane is going to Chaos Communication Camp - <AUTHOR> http://www.hackersonaplane.info/back-to-where-it-all-began/

<comment><AUTHOR> The CCC webpage is pretty funny: <http://events.ccc.de/camp/2011/></comment>


How to use - and not to use - Twitter - <AUTHOR> http://adynammic.com/blog/?p=47

<comment><USER2> It seems like listing do's and don't in an opt-in network is a bit of whining. :)

But seriously, I do enjoy the way some people whine. Some comedians express great wit in whining. Why wouldn't I want to see that on twitter? I think twitter can be used for a lot of different purposes and those purposes (and the TOS) alone dictate the do's and don'ts.

</comment><comment><USER3> Don't make a list of twitter do's and don'ts and then submit to hacker news.

</comment><comment><USER4> Worth a read. A twitter writeup that isn't full of "what to do's" that everyone already knows.

</comment><comment><USER5> ontday ostpay onay ittertway inay igpay atinlay, itay oesday otnay uscateobfay oughenay.</comment>


The Evolution of Ethnocentrism (2006) [pdf] - <AUTHOR> http://www-personal.umich.edu/~axe/research/Hammond%20and%20Axelrod%20JCR%2006.pdf <comment><AUTHOR> The pdf is the full text of this article: [https://journals.sagepub.com/doi/10.1177/0022002706293470](https://journals.sagepub.com/doi/10.1177/0022002706293470)</comment>


Nearly 1 in 3 American workers run out of money before payday - <AUTHOR> https://www.cnbc.com/2020/02/11/32-percent-of-workers-run-out-of-cash-before-payday.html <comment><USER2> It's amazing to me how people well above the poverty line find a way to spend it all -- a house they can't afford, cars they can't afford, student loans to the tune of hundreds of thousands... It's a damn shame financial skills are not taught in this country.

<comment><USER3> Basic math and arithmetic are taught. We give people rope and if they hang themselves with it that's on them.

<comment><USER2> Incorrect - 30% of households don't live paycheck to paycheck because "math and arthmetic are taught" \-- basic financial literacy isn't even taught at the college level which leads many into school loans they will have a very hard time paying back.

<comment><USER3> Financial literacy is arithmetic and basic math. Addition of pay, subtraction of monthly expenses. Interest is not difficult to calculate, either.

We give everyone the tools they need. If they are still incompetent that is on them.

You have to take an online course about understanding student loans and interest before you can accept a federal loan. The idea that students don't know what they are getting into is absurd.

<comment><USER4> I can't help but wonder if everyone downvoting people preaching personal responsibility are also part of the problem. As a society today (in America at least), we're increasingly condemning those preaching personal responsibility in almost every venue, or at least every liberal venue. There's still some push for personal responsibility amongst conservatives.

In a way, this appears to be a result of recency bias and our collective forgetting that preaching personal responsibility was once the norm in western societies. While I'm an atheist myself, long before there was any government social safety net, the church provided this safety net, but when it did, that safety net came with the expectation of learning lessons like "God helps those that help themselves".

As a society, yes it's important to have empathy for other who have made mistakes. Even Judeo-Christian religion makes room for this lesson through stories like the prodigal son. But you can't just have empathy without accountability unless you're willing to accept that more people will become a burden on the productive than if you have a culture of accountability.

You've got to have a balance between both empathy and accountability and squelching voices promoting accountability, but downvoting for example, throws this balance out of whack.

<comment><USER5> >As a society today

This isn't new, most religions have something to say about usary. If anything has changed it's the increase in media manipulation, marketing and easy credit. My parents didn't have a credit card because they didn't exist at that time.

At an individual level if you are over spending then yes, sort it out. But when half the population can't deal with a financial emergency then the problem is clearly systemic.

</comment></comment></comment></comment></comment></comment><comment><USER6> This shows financial education is needed, but more important it shows that the basic income is too low for the temptations available. In my opinion there are way too many temptations and people aren't thought how to resist them. When I say temptations I'm referring to gadgets, travelling, fashion. Everybody wants to be part of the newest trends and that's the main issue. Also, nobody wants to live in a studio or with a roommate up until 35, but I feel like a house isn't a priority anymore.

<comment><USER7> is 200k too low? The data clearly shows the problem is mostly income agnostic.

</comment></comment><comment><USER8> — Will, did you really make two and a half million last year?

— Yeah, sure.

— How did you spend it all?

— It goes quite quickly. You know, you learn to spend what's in your pocket.

— Two and a half million goes quickly?

— All right, let's see. So the taxman takes half up front, so you're left with one and a quarter. My mortgage takes another 300 grand. I send 150 home for my parents, you know, keep 'em going. So what's that?

— 800?

— All right, 800. Spent 150 on a car. About 75 on restaurants. Probably 50 on clothes. I put 400 away for a rainy day.

— That's smart.

— Yeah, as it turns out, 'cause it looks like the storm's coming.

— You still got 125.

— Yeah, well I did spend 76,520 dollars on hookers, booze and dancers. But mainly hookers.

— 76,5?

— I was a little shocked initially, but then I realized I could claim most of it back as entertainment. It's true!

(Margin Call, 2011)

<comment><USER4> While this story might be about someone making 2.5 million. It's as relevant for people making $200k or even $50k. You learn to spend what's in your pocket.

<comment><USER8> "Work expands so as to fill the time available for its completion."

[https://en.wikipedia.org/wiki/Parkinson%27s_law](https://en.wikipedia.org/wiki/Parkinson%27s_law)

</comment></comment></comment><comment><USER9> Will teaching basic financial skills in school actually help? We teach basic health skills like nutrition and exercise but look at America as a whole, we're unhealthier than ever yet we still teach health in school. We can teach basic financial literacy but I don't think by and large it'll change anything.

<comment><USER4> It boils down to a common mistake: knowledge != habits

You can teach people things, but if they don't actually apply them and make them habits, then no benefit is gained from that knowledge.

What's worse is we now have a body positivity movement now de-emphasizing classes like physical education that helps form those habits and is part of having a balanced life. Besides physical education, we have de-emphasized home economics as well, which is also a class where one learns how to prepare meals at home, which is another key component of being able to make healthy affordable meals.

Coursework needs to move on from theory and into the realm of practice. Maybe we should require students to maintain a budget as part of passing each grade. What did you earn? How did you spend it? What did you do to increase the amount you earn and what did you do to increase the amount you spend. It wouldn't be a bad idea to have students maintain bank accounts and finances as part of their basic education. It's not that you can't spend it or make unwise investments, but doing so should require thoughtful reflection put down into words on paper and the idea that you need to demonstrate that you've learned something when you make a mistake of spending money on something you shouldn't have or when you make an unwise investment that doesn't produce returns.

</comment></comment><comment><USER10> Practical Advise. If this is you, you should ___________ to start building your income and and a buffer zone? I cannot seriously answer this question.

<comment><USER11> Make a budget.

</comment></comment><comment><USER12> Not sure why heartbeats' comment was flagged, but if you haven't seen it, you should definitely watch Margin Call (the movie).

</comment><comment><USER13> [Here's some free advice for you that only applies to me]</comment>


W3C and WHATWG to work together to advance the open Web platform (2019) - <AUTHOR> https://www.w3.org/blog/2019/05/w3c-and-whatwg-to-work-together-to-advance-the-open-web-platform/ <comment><AUTHOR> How did I miss this?</comment>