How our freemium plan failed - <AUTHOR> https://baremetrics.com/blog/freemium-saas-implode <comment><USER2> It sounds like the freemium experiment was a success (11% conversion rate), and the failure was your lack of preparedness to scale to support the extra load it brought with it.

The 60 customers that were lost during that time period - were they pre- existing customers from before the freemium switch, or new customers? Did they leave because the technical issues or because they saw the freemium version and decided they didn't want to pay any more?

<comment><AUTHOR> Pre-existing and they left because of tech/service issues. We interview all outgoing customers.

And I agree our lack of preparedness to scale was part of this, but it's shortsighted to only look at a simple conversation rate for determining success.

"Success" is relative and we define it on a higher level than just conversion. The fact is, software isn't infinitely scalable...or rather it takes orders of magnitude more resources for it to approach that level.

There's a certain inflection point where the time spent "getting prepared" simply outweighs the potential benefits. We could have spent _years_ "getting prepared" but there was a point where we just had to say "ship it"...and that's what we did.

<comment><USER3> Can you share your experience on getting this feedback during a cancelation? We have mixed success getting users to share. It's about 50/50 for us. We have even lower response rates from users who have finished their trial without conversion.

<comment><AUTHOR> At the crux of it is not allowing self-serve cancellation. I know, boo, hiss, burn us at the stake. ;) We wrote a little bit about that here: [https://baremetrics.com/blog/how-we-reduced- churn](https://baremetrics.com/blog/how-we-reduced-churn)

But ultimately we exchange at least a few emails with every cancellation and try to understand exactly why we were no longer addressing their need. 99% of people are extremely willing to help out here.

Also, Exit Interviews: [http://www.extendslogic.com/business/jobs-to-be-done- cancel-...](http://www.extendslogic.com/business/jobs-to-be-done-cancel- interviews/)

<comment><USER3> Thank you. We're on the same page wrt emailing us to cancel. A quarter of our churn is actually users who have their cc declined and do not fix it, despite nag emails, in two weeks. I don't think we've ever heard back from a single one of these users. For the other 75% I guess we should just be asking more questions before servicing their request.

<comment><USER4> Hey, I used to run a SaaS product that solved the failed payment problem very specifically ([http://churnbuster.io](http://churnbuster.io)) and I'd recommend you extend that 2 week period out to something like 4 to 6 weeks. Some of our most successful customers were sending out 7-8 emails over a 6 week period. Every business is different, so YMMV, but it might help. A bunch of other thoughts on the subject that may be helpful to you here: [https://www.quora.com/What-are-the-industry-average-rates- fo...](https://www.quora.com/What-are-the-industry-average-rates-for- involuntary-churn-on-credit-card-subscriptions) .

</comment></comment></comment></comment></comment></comment><comment><USER5> One of the counterintuitive things I learned fastest after entering the workforce is that there is often an inverse relationship between amount of money being paid for a product and the level of support demanded from the users. Almost without fail, our least difficult clients pay the most money, and our lowest value customers make the most demands.

<comment><USER6> I've noticed this too, but the flip side of it is that there's often an inverse exponential relationship between the amount of money being paid for a product and the number of users.

I suspect that both observations can be explained by assuming that the amount of value generated by a product follows a power law. Charge a lot, and you will restrict your market to only the head of the distribution. A nice consequence of this is that the consumer surplus (the amount of value you generate in excess of your price) is highest in this part of the distribution, which means all your customers are very happy even if you're charging them an arm and a leg. When you drop your price and service the long tail, you get a lot of customers who derive only a tiny bit more value from your product than it costs them, which means they get mad at you really easily.

<comment><USER7> This is the most insightful thing I've read on HN in a while.

The beauty of this argument is that it doesn't put customers (who are less demanding while paying more) on pedestal.

I run SaaS where there is one plan only. So all customers pay the same price. One observation I've made is that customers who are the heaviest users (thus extracting the most value) are the most forgiving ones and the easiest to deal with.

It's not about the price they pay. It's about net value they extract. The more value extracted, the higher tolerance threshold.

<comment><USER5> > It's not about the price they pay. It's about net value they extract. The > more value extracted, the higher tolerance threshold.

This is probably the single best way to explain the phenomenon that I've read. You're absolutely right. My boss and I talk about this a lot, and I'll absolutely be stealing this in our next conversation about it.

</comment></comment></comment></comment><comment><USER8> We went through this transition at CircuitLab [https://www.circuitlab.com/](https://www.circuitlab.com/) \-- now we have free demos that don't support saving to the server, so they're almost free in terms of server resources. Also, don't allow forum posts from non-paying customers.

As the article hints, the real limit isn't computing resources (CPU/storage/etc), but people resources. Committing these resources to non- paying customers is generally not a winning proposition.

Upfront-card-capture free trial periods and liberal money-back guarantees give your customers the zero-risk ability to guarantee that a product is a win-win, but filter out people who don't take your product seriously enough to consider paying for it.

I'd advise any founders working on SaaS products to provide some sort of free trial mechanism, but probably less than they imagine!

<comment><USER9> I don't know why but upfront-card-capture (by which I'm guessing you mean must enter CC number to try and cancel later) is almost always an instant NO for me. It feels scammy like a porn site.

I'm not trying to be cheap. I just have no reason to believe you aren't going to try to grab a few dollars from me hoping I'll forget to cancel. And while you might have a liberal refund policy many companies don't so the risk I feel includes previous scams. On top of which, from experience, many companies make you jump through incredible hoops to cancel and there's no way for me to know if your company is one of those.

And, if I was an employee of some company. The odds of me feeling comfortable using a company credit card to trial or even having access to one seems low.

<comment><USER8> Yup, that's completely understandable! We eventually settled on a three-tiered system:

(1) A limited free demo - just one button click from homepage and it loads in your browser!

(2) A more extended free demo - but requires e-mail signup / free account creation.

(3) Fully-featured free trial period, includes saving to server, more export options, multi-user collaboration, other operations - but requires entering CC number and choosing plan.

 _Even after all that,_ our default customer service policy is to cancel subscriptions (available on website without talking to a customer service rep) and to give refunds immediately when asked, extending into 60-days of past charges.

At the end of the day, I definitely agree with your sentiment: nobody wants to get stuck paying for something that doesn't work for you. I think we've achieved that for our customers, but it took some iteration to get all of these tiers together, and other companies will have to come up with their own free trial plans. Just like Baremetrics is doing per their blog post.

(The other side of this is chargebacks: businesses do not want chargebacks! Stripe, for instance, charges merchants like us a $15 fee for chargebacks [disputed charges reported by a customer to their bank], plus the time it takes our customer service staff to respond to the dispute, plus losing the payment from the customer! We are incentivized to avoid chargebacks.)

</comment></comment></comment><comment><USER10> Is there anything in this experience that's actually a result of a Freemium model?

It sounds like any usage spike would have resulted in the same outcome. If you had been featured in Oprah's "Favorite Things", and ended up attracting the same number of users to a _paid_ plan, which of the events would not have occurred?

1\. Server resources would have been strained.

2\. Engineers would have been reassigned to scale instead of features.

3\. Existing customers would have churned as a result of inability to scale.

The only notable difference is that you did it to yourself. On the flip side, it also enabled you to turn it "off" by limiting the free account, which you would not have been able to do if the users were from a referral source expecting to pay for account anyway.

<comment><USER11> If they had a massive influx of paid users, they would have been able to spend their way out of their scaling problems by first buying server resources and then hiring.

</comment></comment><comment><USER12> We've had to deal with an onslaught of of free users at our startup [https://glyphs.co/](https://glyphs.co/) quite a bit over the past few weeks: last week we took in something like 4k new user accounts.

I'm definitely a big fan of freemium, and specifically I really like limiting accounts by features (less by usage), but I think it's 100% imperative to control the rate at which new users are given access to your system. We're currently in beta which makes it easy (by only allowing users at our pace) but I think in your case (given the amount of processing required) it would have been very advantageous to build a line for the free account and let people wait for a bit. That builds demand, lets you control user-flow, and people who are very interested can pay to skip the line. Anyhow, just my thoughts, obviously every scenario is different and you guys know this area best.

<comment><USER13> Counterpoint: This can backfire. Scarcity can make the free plan to be perceived as having a value that is greater than free.

</comment></comment><comment><USER14> I don't think this is an indictment of "freemium" so much as the decision- making around it.

Also, there's a misnomer that you're supposed to link pricing to features or usage. No, you link pricing to the customer's ability/desire to pay. Sometimes this correlates with features and pricing but often times not. Multi-user access is a good example of a feature that naturally appeals to a company with resources (i.e., ability to pay). Automatic collections is not.

<comment> jon-wood I know its just an example, buy multi user access is something I hate not being on every tier. It's a basic requirement for any business with more than one employee in my opinion.

The alternative is shared password lists that never really go away.

<comment><USER3> Oh, interesting. We use this to segment between individuals/consultants and businesses. We want to be able to offer individuals an affordable plan while charging businesses an amount commensurate with value they are getting and the addl load they add to customer support and infrastructure. Any thoughts on this model?

<comment> jon-wood As richardwhiuk below says, this approach appears to distinguish between individuals and businesses, but many small businesses will just create an individual account anyway and share the password for a single user account.

They're still going to use customer support and infrastructure as much as other customers, but there's going to be that little bit of extra friction for users as they find out what the password is, and communicate any changes to it.

Personally in the context of Cronitor, I'd drop the user levels, and just segment on monitor counts and features. Maybe bump Slack integration up to the team level, since that's the sort of feature which is genuinely useful to a team, and less so to an individual.

<comment><USER3> Thanks for the feedback. We'll be giving this more thought!

</comment></comment></comment></comment></comment><comment><USER15> An "11.5% conversion rate" is a bit disingenuous. Their advertisement method attracted users who were not "actually eligible to even think about becoming a paying customer". I don't think you can so easily exclude them. Put them back in and you have "over 1,000 free accounts" and only 53 that upgraded.

Assuming "over 1,000" means "over 1,060" then 53 paying accounts actually means "less than 5%" which fits with their assertion that "the average B2B conversion rate is around 3-5%".

While I applaud converting 461 "potential paying customers" into 53 paying customers, the 11.5% rate seems more like an internal metric. It's important to focus on what you can achieve and so segmenting out those with the requisite "subscription revenue" to be able to convert is useful for refining internal goals, but there is a reason why the average conversion is so low: you always get customers who can't pay.

If other businesses were excluding those customers the quoted average would be greater than 3-5%.

</comment><comment><USER16> I think also freedom is not free.

I often download a 15 or 30 day trial of some program and that sounds like a lot of time, but it can take a day or more to really evaluate something and I need to multiply that against some guess of the probability we will really adopt it. Well we have lots of tasks that have a 100% probability of "must be done" and those are more important and then the trial ends and I forget about it.

If you make somebody put some chips in the pot upfront it makes them more serious, like they not only have something to gain but also to lose.

<comment><USER3> In your case, if confronted with a cc form to start a trial, what do you do? Do you need near 100% probability to continue?

It's a timely subject for me. We're preparing to test this at Cronitor and we'll write a blog post with our findings.

<comment><USER16> If I really want or need it and the pricing seems fair in terms of value I will put in the credit card number. If I am going to spend an hour of my time to evaluate your product I can spend for the equivalent of an hour of time to do the trial, more or less.

</comment></comment></comment><comment><USER17> For sure this is interesting to think about. Is all the work I need to do for the unpaid people who may or may not ever pay me a penny worth it to get a few more users?

if the "work" is just spinning up some new AWS nodes, the math is easy. If lifetime value of a free guy > cost of AWS node, do it. If < cost of AWS node, don't do it.

If the work is lots of staff related hand-holding - then it depends. If your staff is at 100% capacity and you need to hire more staff, it is closer to the AWS example above. If you have staff sitting around doing nothing anyway, then maybe it is "free" as in an already sunk cost.

In their case it seems like they had some engineering flaws in their system (who doesn't), that made the scaling up part harder. Good to think about how to scale up early so you don't hit a wall.

<comment><USER18> It's actually a bit more complex than that. If the only way you measure the lifetime value of a free guy in dollars and cents than that value will always be pegged at '0' so applying your formula literally would lead to 0 times the freemium model would be given a chance.

But free users can be put to work in other ways, and that value may be very hard to peg down accurately. A good 'free' user that promotes your service to paying users, for instance, an employee that uses the product at home that advocates its use in the business where he/she works. Or maybe free users give you content that you can monetize in some other way.

And that's the hard part, assigning a value to the contribution. The cost part is the easy bit, servers are cheap. But support is costly and even then it may still make sense to have a free tier, it's never going to be an easy decision.

<comment><USER19> Although the conversion rate to paying customers provides one simple-to- estimate portion of the value and at an astounding 11% conversion rate, that alone might pay for it if the support costs weren't so high.

<comment><USER18> Support is super hard to scale. The best way is to design your product so well that you rarely need to answer calls/emails.

</comment></comment></comment></comment><comment><USER20> This is a poster child for the value of raising money vs solely bootstrapping (I hope DHH doesn't downvote me!) It appears this added $60,000 ARR. I'm not sure how big the market is (TAM would be all Stripe subscription users?) but assuming it's 10x of what they found in just 60 days and growing (as Stripe is growing) Therefore are you looking at $500,000 to $1 mil more per year if properly resourced to go after this opportunity? Raise $1 million to staff up for it; the good news is you have real data now.

<comment><USER21> The economics don't make sense by just simply pouring more money into the problem. If they need to hire an additional employee to support that $60k ARR they'll be heading into the red in terms of net profits.

They also probably figured that's true given they already raised $500k so they actually do have additional capital at their disposal. They're not bootstrapped anymore. Smart move to pull the plug and rethink things.

<comment><USER20> Yep. Not at $60K per annum. That's why I talked about how big the opportunity overall was (what % of the market did they capture in those 2 months?) Maybe being just on Stripe it's too small vs supporting other subscription offerings.

</comment></comment></comment><comment><USER6> Did you think about technical solutions to this? You list one obvious one (limiting the Stripe import for free plans to the 30 days you actually display), but the other one I would've looked at immediately is to avoid storing the raw data for free plans entirely, compute your metrics on the fly, and store only the computed metrics. 1000 customers * 30 days * 25 metrics (based on your homepage) * 4 bytes/metric = 3MB, which is trivial for any database to process.

In general, I think most engineers these days overuse databases. At Google, common wisdom was "never, ever hit the disk during routine serving", and when I was in the financial industry we'd regularly process the NYSE TAQ data (50GB, about 2B trades) on a single machine nightly.

It'd be really, really nice to have growth gated on technical problems. :-)

<comment><USER22> The biggest problem with that plan is Stripe's API limits, which (as far as I understand) are placed on the parent key, not the account key. Also, having to maintain two different ways to compute all of the metrics shared between the two account types seems problematic from a complexity standpoint.

Edit: I can't speak for the team and I've never worked on Baremetrics' code base, but I have developed against the Stripe API quite extensively.

</comment></comment><comment><USER23> You can't do freemium unless you are prepared to upsell the crap out of your free users.*

Otherwise you're wasting your time and your users time.

* Unless you want to eat the costs for a few years. In that case you need to really develop your brand to become top of the line in your market.

</comment><comment><USER24> Additional 1k accounts crashed production servers? I think fixing the software stack is much more important than business strategical adjustment.

<comment><USER22> Why bother fixing the software stack for accounts that aren't going to pay for it? Also, remember that Baremetrics imports your entire Stripe account. Every single event, from day one, so it can analyze and chart them. For any decently sized business this is a ton of data, let alone 1000 of them.

<comment><USER24> b/c you'll have 1k paying customers sooner or later. if you can't scale, you won't have a viable business. Look, I'm not suggesting to throw away your entire stack. It's very likely that you spend few days, find out the bottle neck and fix it with a scaleable/distributed method. Computing is cheap, and will forever getting cheaper. Paying customers are rare, deserve deep appreciation.

<comment><USER22> Just sprinkle Distributed Scaling Magic on your servers and voila! Your problems are solved!

Nobody is saying scaling out to an additional 1k customers is easy. The great thing about scaling slowly is that you can grow into the problems and address them as they come up. Suddenly doubling your userbase, most of which will ultimately churn out without paying you a dime, and having to deal not only with the technical but also the _support_ ramifications, is a recipe for failure. As the article says.

<comment><USER24> If your app is impossible to scale, then your pricing model isn't aggressive enough. You should have a proper margin to grow your business b/c it'll ultimately benefit your paying customers.

If it's not, someone else would happily figure out a way to take care of your customers.

<comment><USER22> It's not a pricing issue, it's a time issue. Scaling a production application like Baremetrics isn't a turn-key thing. They can't just up the number of dynos or whatever you're thinking it's like. It takes time, time they decided was better spent servicing paying customers and new trial customers, instead of customers that statistically would never pay them.

I'm not sure what we're disagreeing on, really. The blog post literally has "failure" in the subject. It was an experiment that didn't turn out well, thus they ended it and are now moving on.

</comment></comment></comment></comment></comment></comment><comment><USER25> I think, the freemium model works best, when the resources needed for one additional customer (including computing-power, storage and support) are relatively negligible.

Many companies operate the freemium model with much less than 11% conversion rate -- but the additional customers they have to carry with the others are not so a heavy burden.

The advantage of the freemium model is faster scaling and adoption of the service -- but with the cost of an additional burden ... and you have to know, if your business can carry the weight or has to do differently.

</comment><comment><USER3> I'm sure they made a real development investment to add Freemium features on top of their free trial. At Cronitor we recently moved in the opposite direction -- from a limited freemium model to a free-trial -- for similar reasons.

Our free plans were limited to an extent that they didn't blow-up our service. Our primary concern was that as we've built out our product, introduced more advanced features, and signed bigger customers, the risk that a free user could degrade service for paying customers no longer seemed worth it. We considered isolating free users in a separate silo but maintaining that infrastructure also didn't seem worth it.

Ultimately these are hard problems to test because rolling out a change like this requires a lot of work. Even if you release it via b-test you've already made a real investment to get that far.

For those curious, we are keeping the free trial model but we do hope to continue improving trial conversion.

Edit: For clarity

<comment><USER26> Baremetrics DID move to a free trial model, as they mentioned.

</comment></comment><comment><USER27> I have witnesses several companies scale customer acquisition too quickly, scramble to get their ducks in a row, become addicted to the growth due to their bloated operations and eventually collapse under the weight.

This doesn't just go to being prepared to handle growth, but realizing that most customer acquisition strategies either decay over time or reach a point of diminishing returns, and putting yourself in a position where you need growth and volume to survive and betting on your existing customer acquisition is a formula for failure.

Like all thing, Growth is neither good nor bad on it's own, and should never be more than a means to an end.

</comment><comment><USER28> Freemium is definitely hard. We do this with Quill Engage (quillengage.com) for Google Analytics reporting and it certainly took us a long time to fully understand the workload associated with maintaining a free product while trying to support our main paid product.

For what its worth, we'll be signing up and trying out BareMetrics shortly. I love what we've seen of your product so far and look forward to seeing what your team has delivered.

One other comment -- I love how you pulled in the output of your product to so clearly support the point of your blog post. Not a bad job selling your product while discussing technical issues :)

<comment><AUTHOR> Thanks! Quill Engage looks cool. Let me know if we can help with anything!

</comment></comment><comment><USER29> > _in two years ... grew the business ... to over $30k /mo in revenue_

Combined with the fact that your About page shows 5 people, this is easily the most interesting part of the post :)

<comment><AUTHOR> Glad to hear at least one sentence was interesting. There are 83 sentences in the article for an Interesting Conversion Rate (ICR) of 1.205%. Not. Too. Shabby. :)

<comment><USER29> Oh, I appreciate all of the write-up and it's interesting in its entirety. But getting a chance to look at core numbers is that much more useful. That's it - not _interesting_ , but _useful_.

<comment><AUTHOR> Then you'll looovvveee this: [https://demo.baremetrics.com](https://demo.baremetrics.com) and [https://baremetrics.com/open](https://baremetrics.com/open) :)

</comment></comment></comment></comment><comment><USER30> Good learning and write up. Running a bootstrapped product myself, I learned that the best thing to do is to offer a Free Trial but never unlimited free account for B2B businesses like these. Also, trying to restrict with features never really works out at the end as people will always find a way to put stress on your system along with tons of support issues. Just offer a free limited trial with ALL features and when the trial ends, ask them to upgrade.

</comment><comment><USER31> I think David Heinemeier Hansson and Basecamp would love this.</comment>


Caffeine Jitters - <AUTHOR> http://cen.acs.org/articles/91/i5/Caffeine-Jitters.html <comment><USER3> I wonder how many emergency room visits (and deaths) are associated with coffee usage. I suspect the number is negligible, if not plain 0. With billions of cups of coffee consumed daily, I'm skeptical that it's really caffeine that is the villain.

The guy in the beginning supposedly consumed ~600mg of caffeine over 7 hours, which is roughly equivalent to a pot of coffee. That's high usage, but not at all unusual.

>"Your typical cup of coffee comes hot; you wouldn't usually gulp it down."

Speak for yourself. I'm a guy who one-shots his coffee before it even cools down.

<comment><USER4> The guy at the beginning of the article consumed only ~600mg of caffeine, but he consumed between 7,000 and 8,000 mg of taurine which is over 2x safe daily consumption[1]. I don't think that drinking 600 mg of caffeine is good for you, but I don't think it's the primary culprit for hospitalizations. I'm thinking the other ingredients in energy drinks, such as taurine and guarana, play a major role.

Here's an interesting quote from a recent Atlantic article[2]: "Still, despite the fact that a Starbucks venti coffee has three times as much listed caffeine as a can of Monster, some people swear they're more wired after drinking an energy drink. That may be because of the extra caffeine in guarana. Energy drinks can advertise that they have the same amount of caffeine as a cup of coffee; but when you include guarana, they have a much stronger stimulant effect."

I found this chart from the Seattle Times comparing stimulant levels in energy drinks[3]. Not only does Monster have 160 mg of caffeine in each can, it also has 5,000 mg of guarana and 2,000 mg of taurine. That's a lot of stimulants for one can. I would be interested in seeing more in-depth studies on guarana and taurine.

[1] According to the Mayo Clinic, the recommended maximum daily intake of taurine is 3,000 mg (<http://www.mayoclinic.com/health/taurine/AN01856>)

[2] [http://www.theatlantic.com/health/archive/2013/01/how- much-c...](http://www.theatlantic.com/health/archive/2013/01/how-much- caffeine-before-i-end-up-in-the-er/267129/)

[3] seattletimes.nwsource.com/news/health/links/energydrinkchart10.pdf

<comment><USER5>
        > Still, despite the fact that a Starbucks venti coffee has
        > three times as much listed caffeine as a can of Monster,
        > some people swear they're more wired after drinking an
        > energy drink.

Sugar?

<comment><USER6> Sugar has been proven not to induce hyperactivity, it's a common misconception.

[http://scopeblog.stanford.edu/2012/10/31/debunking-a- hallowe...](http://scopeblog.stanford.edu/2012/10/31/debunking-a-halloween- myth-sugar-and-hyperactivity/)

<comment><USER5> Energetic and alert doesn't have to mean hyperactive. I was thinking more of general blood sugar/glucose level.

Inserting quick carbs into your body will most likely start the engine in some way.

</comment></comment></comment></comment></comment><comment><USER7> This suggests a certain amount of safety:

"According to FDA, at least 80% of adults in the U.S. consume caffeine every day."

That is a very large scale test. That a few dozen people get sick, out of almost 200 million daily drinkers, is not very surprising. The reality is, this is a drug that is safe for the overwhelming majority of its users.

<comment><USER8> This is a great example of responsible stimulant usage. A similar drug that is consumed every day by millions of people is alcohol. It has a much higher death rate than caffeine and seems to be over-used quite often. However, the vast, vast majority of users are responsible.

I think we can agree that moderate usage is acceptable and useful. I think the major point of the article is that we have to be aware of how much caffeine is in drinks so that people can use it responsibly. The danger in energy drinks is that they are fairly opaque and people don't know how it compares to something like coffee. Most people will dislike the effects of overstimulation, but we want to make sure that everyone has the tools to protect themselves and their children.

</comment></comment><comment><USER6> TL; DR:

 _these recommended "safe" levels of caffeine are just statistical averages over the population. Some people tolerate caffeine and can ingest large quantities of the compound without ill effects, and others can't_

<comment><USER9> This is a good point. I get a little jittery from one diet coke and two diet cokes makes me feel really sped up and gives me insomnia. A cup of coffee is almost unbearable.

I'll drink a tea for a little caffeine, but that's about it. I have no idea how people tolerate drinks with multiple shots of espresso. Tolerance must vary wildly between people.

<comment><USER10> My tolerance has changed a lot going from my early 20's to my late 20's. I used to regularly drink 8 cups a day, but now start to feel awful after 2.

I think its a combination of losing the acquired tolerance, increasing a latent sensitivity, and more awareness of my physiology.

<comment><USER6> Metabolism is also a factor, which begins to slow in many people's late 20's.

</comment></comment></comment></comment><comment><USER11> "Ballpark favorite Cracker Jack will soon come as Cracker Jack'd—2-oz packages of the familiar candy-coated kernels jammed, in certain flavors, with 70 mg of caffeine from coffee."

WTF?

</comment><comment><USER10> Weekend app from a while back:

deathbycoffee.heroku.com/(yourname)

<comment><USER12> This is pretty fun, going to play with this today. Suggestion - add a button to plot when you feel an associated negative symptom?

Could be cool to hack your ideal caffeine ingestion. Also a cup here is measured as 8oz right? So a large coffee is 2 clicks?

<comment><USER10> <https://github.com/michaelkirk/death-by-coffee>

</comment></comment></comment><comment><USER13> I was hospitalized after drinking 2 cans of Monster energy.

But I still defend energy drinks.

My hospitalization was due to too much caffeine that exacerbated a pre- existing bout of pericarditis-- the actual cause was most likely an infection or cold.

The individual ingredients of an energy drink have no proven ill effects:

\- Carbonated Water - Completely Neutral. It might harm your teeth but the evidence is related to sugar + carbonated water

\- Glucose - Major energy source

\- Citric Acid - Needed for Krebs Cycle

\- Taurine - Essential amino acid that has benefits for heart and blood

\- Sodium Citrate - flavoring, used for kidneys and is an antacid

\- Panax Ginseng - amazing supplement; good for mood, immunity, cognition

\- Caffeine - good in moderation, bad in excess \- Sorbic Acid - <USER2> with no adverse health effects

\- Sucralose - sweetener with no proven side-effects. Chronic effects occur on a dosage above 9 mg/kg

\- Benzoic Acid - preservative that naturally occurs in berries. Stay under 5 mg/kg

\- L-Carintine - wonderful little supplement that is good for you, potential nootropic

\- Niacinamide - vitamin B3

\- Acesulfame Potassium - sweetener, potential carcinogen although studies lack confidence

\- Sodium Chloride - table salt

\- Glucuronolactone - aids circulation, is good for your heart

\- Inositol - good for you, prevents colon cancer, sold as a supplement

\- Guarana Seed - caffeine source, aids memory and physical endurance

\- Pyridoxine HCL - vitamin B6

\- Riboflavin - found in your wheaties

\- Maltodextrin - starch, no known health issues

\- Cyanocobalamin - vitamin B12

Beyond that, there may be a dangerous interaction between two ingredients that has yet to be nailed down.

I have another theory-- the devil's in the dosage.

I can take down a pot of coffee if I have a good night's rest, but if I am up before 7 and have a single cup, it does not go well for me. This could be related to how caffeine interacts with existing cortisol levels, and if I am stressed and not well rested the effects are amplified.

This is probably why it's so hard to figure out an accurate lethal dose of caffeine, because small changes in biochemistry can significantly amplify how your body acts with caffeine.

I would also (weakly) argue that why we don't see many overdoses with coffee is because you don't start drinking large amounts of coffee on the first go-- because the substance is bitter, it is hard to down a full pot in one sitting.

Due to a built in taste moderation, it is hard to hit your natural upper limit. But because energy drinks are sweet and easily drinkable, novice caffeine users can hit their upper limit in a short amount of time.

And because the half-life of caffeine ranges from 5 hours to 15 hours (!) you can get a strong excess build up in your body in a quick amount of time. There may be an ingredient in the drinks that increase the half-life, which leads to higher risks over time.

<comment><USER14> _"Due to a built in taste moderation, it is hard to hit your natural upper limit. But because energy drinks are sweet and easily drinkable, novice caffeine users can hit their upper limit in a short amount of time."_

It's an interesting hypothesis. I'd add that coffee is (most often) served hot, and as such, consuming a cup of coffee takes quite a bit longer than chugging down a cold can of Red Bull.

And about that chugging: it's a different use case. People are conditioned to treat energy drinks like stimulants. The drinks are even marketed as such. Coffee, on the other hand, is primarily consumed in moderation (aside from classic tales of all-nighters, etc., which probably represent a fraction of a percentage of coffee usage). People see coffee as a morning ritual, whereas they see energy drinks as -- for lack of a better word -- speed. The use cases are very different, as are the consumption patterns.

I would hypothesize that energy drinks are inherently no more dangerous than coffee, at least as far as their ingredients go. Rather, they're more dangerous because they're consumed in greater quantities and at greater speed -- rapidly injecting the body with massive quantities of caffeine, and thus shocking the unprepared system. Coffee is more of a slow drip of caffeine, as it were.

<comment><USER15> Well, there may be a bit of a confounding factor in there.

The availability of energy drinks has made them more widely regarded as the way one goes about consuming lots of caffeine, whereas coffee/espresso tends to be thought of as a smaller scale pick-me-up. Meaning that in situations where people set out to intentionally consume lots of caffeine they are choosing to do so via energy drinks instead of coffee. A study of historical data may show whether or not this is a significant effect. But it could be the case that sans energy drinks we'd still have the same level of problems, through coffee consumption, but perhaps that problem has merely been shifted to energy drinks rather than arising from nowhere.

</comment></comment></comment><comment><USER16> If you are interested in better living through chemistry then I encourage you to peruse this site:

<http://examine.com/supplements/Caffeine/>

</comment><comment><USER17> Why do energy drinks get all the heat? Starbucks coffee has around twice as much caffeine/oz and an even higher ratio per serving

<comment><USER18> Energy drinks have other stimulants in them than just caffeine. See some of the other posts here about stuff like taurine and guarana.

<comment><USER19> Guarana is just a different source of caffeine.

<http://en.wikipedia.org/wiki/Guarana>

</comment></comment></comment><comment><USER20> I wonder how green tea compares to that. After drinking 5 half liter cups of green tea throughout the day I felt in my chair like on the subway station with trains passing by. I had to lie down and sleep.

</comment><comment><USER21> According to their chart. Starbucks coffee should be killing you but the article mostly about energy drinks. Has it not occurred to anyone that caffeine isn't the only contributing factor?

</comment><comment><USER22> I wonder how many of these cases are due to the combination of caffeine and other risk factors such as dehydration or hyponatremia.

</comment><comment><USER23> Caffeine goes swimmingly with magnesium, L-Theanine and Noopept.

</comment><comment><USER24> why is an 8oz cup of brewed coffee 133mg of caffeine and a 16oz starbucks 330mg?

<comment><USER25> I'd guess starbucks uses a higher water temperature for brewing.

<comment><USER26> Caffeine content of tea and coffee will vary widely.

For coffee, smaller grind size, brewing method, the bean type (there are low/decaf cultivars,) roasting method, and water temperature (to name a few) will affect how much caffeine ends up in your cup.

Expecting Starbucks to give you a consistent dose cup after cup, month after month is probably a bit optimistic.</comment></comment></comment>


Official Snowden - <AUTHOR> https://twitter.com/OfficialSnowden

<comment><USER2> important to note that this is not verified by Twitter</comment>


Why you should NOT get a free domain name from your web host - <AUTHOR> https://purely.space/do-not-get-free-domain-name-from-web-hosting-company/ <comment> why-oh-why This makes no sense. The domain is not free, there's a reason why these plans are yearly: you're paying for the yearly domain registration as part of the domain+hosting.

The domain is still yours and you can move it later just like any other domain.

There's virtually no disadvantage in this deal unless the provider prevents you from changing DNS records.</comment>


Introducing Windows Defender Application Guard for Microsoft Edge - <AUTHOR> https://blogs.windows.com/msedgedev/2016/09/27/application-guard-microsoft-edge/ <comment><USER2> Microsoft's excellent word salad naming engine strikes again!

(Disclosure: Microsoft is my employer.)

<comment><USER3> Why not just block [http://www.atrixnet.com/bs- generator.html](http://www.atrixnet.com/bs-generator.html) from the corporate firewall?

</comment></comment><comment><USER4> Am I reading correctly: WDAGfME (for lack of a better acronum) is essentially starting a VM with a fresh copy of Windows _for every site that it is protecting_? Does this happen for every open & protected tab/window? What kind of overhead does it have?

The idea sounds similar to Qubes OS, with the exception that it's transparent to the user and doesn't have to be configured by the end-user.

I presume this kills any of the offline-storage approaches?

<comment><USER5> The idea of starting new fresh copy of Windows software stack for every site is kinda naive. I would say they are using something similar to Linux kernel namespace mechanism for sandboxing in Windows kernel, which is quite efficient and secure sandboxing without going through the pain of virtualization(Google uses this mechanism for implementing Android subsystem in ChromeOS). But how hyper-v fits to this equation, I don't know.Maybe something similar to docker service in hyper-v.

But anyhow this is quite amazing idea, Microsoft really tries hard to improve Edge.

The reason they can overcome technical difficulty of something this cool is because they have very consistent and very limited underlying platform (they don't have to support macOS, Linux, etc). Imagine how hard it would be for Firefox and chrome to pull off something similar.

>I presume this kills any of the offline-storage approaches?

Not necessarily, it depends on how they did implement this.

(I may be wrong,please correct me)

<comment><USER6> I see two options: 1) they're using Hyper-V and exposing a small number of hypercalls to allow for rendering and interaction. 2) they've overloaded the Hyper-V name for a user space sandbox.

I'm really hoping for the former, as it'll mean they finally might expose a KVM-esque API. That would mean a drastic change for virtualization dev on Windows.

<comment><USER7> Maybe I'm misunderstanding the question, but the article clearly describes that they're using Hyper-V to launch a separate instance of the kernel and the browser in a "container" (which is later "discarded").

</comment></comment></comment></comment><comment><USER8> Fewest vulnerabilities: I suspect that Chrome and Firefox being open source is a factor here. Thus it seems possible to me that they actually have _fewer_ vulnerabilities than Edge—Edge's just haven't been found yet.

This is pure speculation on my part; I have no evidence nor any investigation, deep or otherwise.

<comment><USER9> "Edge's just haven't been found yet."

Haven't been introduced and haven't been found. It's both. Microsoft's SDL has dramatically reduced number of 0-days in their products. I speculate that eliminating many common vulnerability classes also eliminates a lot of the low-hanging fruit that's easiest to spot in the binaries by reverse engineers. They have potential to raise the security even higher if they apply MS Research's tools like VCC or Dafny. I don't even know what Edge is written in, though.

<comment><USER10> You're kind of talking out of your ass here, fyi. They have been introduced and they have been found. Don't underestimate Google's resources on chrome. Especially considering that many Google security folks were previously at MS.

<comment><USER9> Im not sure what comment you read as I mentioned they both have 0-days and that number of them dropped sharply due to SDL. The numbers available prove both. Even more true given attackers are focusing on common applications more than Windows itself. That's because they're easier to attack than Windows code.

</comment></comment></comment></comment><comment><USER11> Two related projects, both with copy-on-write "forks" of disk storage and OS memory, creating disposable VMs with hardware-enforced memory isolation.

Cappsule (open-source for Linux), [https://cappsule.github.io](https://cappsule.github.io)

      virtualize any software on the fly (e.g. web browser,
      office suite, media player) into lightweight VMs called
      cappsules. Attacks are confined inside cappsules and
      therefore don't have any impact on the host OS.
      Applications don't need to be repackaged, and their usage
      remain the same for the end user: it's completely
      transparent. Moreover, the OS doesn't need to be
      reinstalled nor modified.

Bromium (proprietary for Windows, based on open-source Xen), [https://blogs.bromium.com/2016/09/26/introducing- virtualizat...](https://blogs.bromium.com/2016/09/26/introducing- virtualization-based-security-next/)

      Bromium and Microsoft partnered in 2015
      .. extends VBS – isolating the execution of targeted
      applications such as the browser, documents, executables,
      downloads, attachments and media files .. to all
      vulnerable applications on all Windows 7, 8 and 10
      endpoints

<comment><USER12> I wonder how Bromium is taking this news.

</comment></comment><comment><USER13> "We're determined to make Microsoft Edge the safest and most secure browser."

Then open source the whole thing, not just little parts of it. It has the lowest number of vulnerabilities in the National Vulnerability Database because it has the least number of eyes able to look for them.

<comment><USER14> It's been a little while since I was close to Microsoft (they were a client for a bit at Matasano), but: those people spend more on software security for WINMINE.EXE than a lot of startups do for their whole stack.

Would their software be safer if it was open source? Probably. Open code is rarely a _loss_ for security. But it's not easy to say how much safer. Probably less than you think.

<comment><USER9> I recall the Windows source leaked a long time ago. One programmer wrote an article on it saying it was actually good code. The problem areas seem to be little hacks they had littered everywhere to keep 3rd party hardware or software from breaking. My bookmark leads to a missing article that's not in Wayback Machine. Do you have a substitute link to a review by a qualified person who got to look at the source? I'd be interested in that.

<comment><USER15> Yes, it leaked during the Win2K release cycle I believe. And you're probably thinking about the kuro5hin website, where someone claimed to have analyzed it. ([http://webcache.googleusercontent.com/search?q=cache:3BlVJSk...](http://webcache.googleusercontent.com/search?q=cache:3BlVJSk8XV4J:www.theinquirer.net/inquirer/news/1030335/leaked- windows-2000-source-code-analysed+&cd=7&hl=en&ct=clnk&gl=us))

>One programmer wrote an article on it saying it was actually good code.

"one programmer" commenting about 30+ million lines of code. Yeah. uh-huh. Anyway, you can still find the kernel's source if you care to dig around. Its the Windows Research Kernel but it's mostly unchanged from the commercial codebase.

>The problem areas seem to be little hacks they had littered everywhere to keep 3rd party hardware or software from breaking.

Those are mostly relegated to the compatibility shim layer. You can turn it off, in any case.

<comment><USER9> "Yes, it leaked during the Win2K release cycle I believe. And you're probably thinking about the kuro5hin website, where someone claimed to have analyzed it. "

Yeah, my inability to evaluate the skill level or character of source was main drawback of claim. I gave a little credence to it because I knew that they were ramping up QA due to image problems and potential lost sales. Steve Lipner... who did high-assurance security with legendary Paul Karger... came in to turn it around with the SDL. Massive investment in professional programmers to find quality issues across the lifecycle implies it would have fewer issues than average software.

[https://msdn.microsoft.com/en- us/library/ms995349.aspx](https://msdn.microsoft.com/en- us/library/ms995349.aspx)

""one programmer" commenting about 30+ million lines of code. Yeah. uh-huh."

You can tell a lot by glancing at random samples while digging into a bit fewer. Good, well-commented code with various security checks stands out for people that spend years looking at the opposite. All such a review could say, though, was that people were putting in effort. Actual security would need thorough review.

"Anyway, you can still find the kernel's source if you care to dig around. Its the Windows Research Kernel but it's mostly unchanged from the commercial codebase."

Will do. Appreciate the tip.

<comment><USER15> >Will do. Appreciate the tip.

CDCFKW.zip not saying anything.. just sayin :P

</comment></comment></comment></comment></comment></comment><comment><USER16> I sense this is the same feature that is used to implement Docker containers. Possibly browser isolation was the primary driver and it got co-opted for the server.

</comment><comment><USER9> The one good thing about this is that they're relying on Hyper-V. It _may_ end up much more secure than solutions like Xen simply because Microsoft is investing in so much verification. That started with Verisoft project where they started using their VCC tool to verify the C-level source against specifications. They later extended the tool for assembly. The first report I saw indicated 20% was verified against its spec. So, it should get more robust overtime.

People interested in Microsoft Research's work on secure browsers should look at Gazelle browser and Xax plugin architecture:

[https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/gazelle.pdf)

[https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/xax-osdi08.pdf)

</comment><comment><USER17> It's using Hyper-V, so does that mean this only applies to Pro and Enterprise edition of Windows 10?

<comment><USER18> Considering the product video described it as being a tool for system administrators, I'd hazard a guess at yes.

</comment></comment><comment><USER19> Why is this an enterprise-only feature? Do regular user not deserve the same level of security for their browsers? Will this tech even be available to non- Microsoft apps in the future?

<comment><USER20> It's not very useful for regular users outside of private browsing - the WDAG windows are unable to persist any state at all since their container is discarded at the end of the browsing session to thwart malware persistence.

It does sound like an interesting capability for private browsing, but existing mechanisms mostly cover that. Even if WDAG applied to private Windows, ordinary users aren't so likely to open private browser windows just to check a link from an email.

I expect that if you had a copy of Win10 Enterprise you could configure the feature yourself for added security in paranoid cases (e.g. journalist covering abusive regimes who might be targeted by state-level malware).

</comment></comment><comment><USER21> So just to be clear, this is basically another sandbox, which starts a private browsing session implicitly for each site and disables the entire password manager?

</comment><comment><USER22> > We're determined to make Microsoft Edge the safest and most secure browser.

You should enable Ad/tracker-block by default and across the board.

</comment><comment><USER10> Ugh, they should know better than to use CVE as a metric. Should we assume that Opera is the most secure browser then?

</comment><comment><USER23> Why is this enterprise only?</comment>


Chinese Textile Mills Are Now Hiring in Places Where Cotton Was King - <AUTHOR> http://www.nytimes.com/2015/08/03/business/chinese-textile-mills-are-now-hiring-in-places-where-cotton-was-king.html

<comment><USER2> Reminds me of the episode of daily show where the overseas call center outsourced to Americans who had to fake a foreign accent.

</comment><comment><USER3> This was also mentioned in We the Economy. I live in south carolina and know a few textile owners as they are self-insured employers (my company sells health benefits programming). It is amazing how differentiated and specialized the fiber industry is. There is still a decent supply of suppliers and specialized laborers that it would make sense for chinese to set up shop in the carolinas.</comment>


Twitter, Reddit support challenge of visa applicant social media requirement - <AUTHOR> https://knightcolumbia.org/content/twitter-reddit-file-in-support-of-lawsuit-challenging-us-governments-social-media-registration-requirement-for-visa-applicants <comment><USER3> This already exists with rubber stamp FISA courts (a rejection rate of 0.03 percent) for citizens and non-citizens. It is just a difference of degree and scale (the APIization of everything).

There are also other workarounds to FISA courts including the "willful" volunteering of information and tools (or else), using the NSA and their tools, and other foreign "friendly" collaborators like the Five Eyes, or German intelligence etc...

[https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...](https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillance_Court)

[https://en.wikipedia.org/wiki/Five_Eyes](https://en.wikipedia.org/wiki/Five_Eyes)

[https://www.dw.com/en/report-us-germany-spied-on- countries-f...](https://www.dw.com/en/report-us-germany-spied-on-countries- for-decades-via-swiss-encryption-firm/a-52344255)

[https://www.rt.com/usa/qwest-ceo-nsa-jail-604/](https://www.rt.com/usa/qwest- ceo-nsa-jail-604/)

Here is some details on historical spying (a much smaller scale because of the smaller digital footprint)for the curious:

[https://en.wikipedia.org/wiki/Church_Committee](https://en.wikipedia.org/wiki/Church_Committee)

<comment><USER4> >a rejection rate of 0.03 percent

I agree that this is too low and is a sign of rubber stamp-iness, but what would be the right rejection rate to make you feel more comfortable about the FISA process?

Agencies come to the court with what they think is a rock solid case, so it's not entirely outrageous that the court would have a very high approval rate. See other similar stats like the conviction rate by federal prosecutors (93%+), where they only drag a defendant into court with very good reason.

<comment><USER5> > Agencies come to the court with what they think is a rock solid case

I think the rubber stamp reputation of the FISA courts undermines this assumption. Are 99.7% of cases ~really~ ironclad? Building a rock solid case takes a lot of work and if the FISA courts aren't actually going to scrutinize the evidence, I expect that the people bringing these cases will take advantage of that.

<comment><USER6> Having worked with people who bring cases to FISA, they spend a ton of time ensuring they are ironclad before they bother bringing them to FISA.

Previously I had assumed it was a lot of rubber-stamping, however the folks I worked with frequently bemoaned about how incredibly difficult and time consuming it was to get a FISA warrant.

<comment><USER4> I will assume good faith in your comment. I don't think you were "fed lies" or that there's some soros deep state conspiracy going on.

That being said, the approval rate for the court is pretty shocking. If this isn't a rubber stamp court, I don't know what is. Their approval rate on 41,000+ warrants in 40+ years is 99.97%.

I don't think the notion that each of those 41,000+ warrants were air tight, or wouldn't be rejected by other normal (read: public, transparent, democratic) courts, passes the smell test.

I would be curious to know what the approval rate for regular search/arrest warrants is too.

</comment></comment></comment></comment></comment><comment><USER7> And people said I was crazy to claim that challenges are mounted to US laws based on the first amendment rights of foreigners living abroad.

<comment><USER8> Foreigners living in the US also have to renew their visas or even green cards. Do you think giving USCIS their social media accounts doesn't have a chilling effect on their ability to criticize the government?

Should green card holders not be allowed to criticize the government?

</comment></comment><comment><USER9> If I'm ever required to provide social media handles when entering the USA, I'll be deleting any relevant social media accounts.

<comment><USER10> The current rules for immigrants require " _any_ account names ... over the _previous five years_ " so an immigrant could be denied entry for failing to provide the account name for a deleted account.

<comment><USER11> What if I delete the entire content?

<comment><USER12> Did you also delete the copy stored in NSA's Utah Data Center?

</comment></comment></comment></comment><comment><USER13> I hadn't heard about this law. Seems it came into effect after I last filed a DS-160 in June 2019. Can anyone provide a reasonable justification for any non-nefarious reason for requiring the social media handles of all visa applicants?

It seems pointless at best. Downright evil at worst.

<comment><USER14> You might be Facebook friends with someone linked to terrorism, or you might have Liked posts from terrorism-linked groups. Or maybe there's a specific person who the government suspects has recently joined on with some terrorist cell, and if you're their Facebook friend, that is likely fairly interesting to some investigators.

I don't expect that this sort of question catches a lot of serious terrorists, but if they don't ask, you come blow something up, and you did have such immediately discoverable information on social media, it'd be really bad press for the folks who are supposed to stop that sort of thing.

I don't think it's a particularly controversial statement that lots of extra information about who you know and what your interests are would be at least a mildly useful signal for determining if you're a threat, but I doubt it's worth the intrusion and the risk of more nefarious uses.

</comment></comment><comment><USER15> It seems like 90% of the comments here didn't read the article and think it has to do with section 230, which Twitter is also in the news for right now.

Regardless of how you feel about their moderation policies, if you care about free speech you should at least be on their side with this one. Requesting social media handles from visa applicants does chill speech. As a visa holder, I've thought long and hard over whether I should post political comments or photos from protests on social media. If you truly care about free speech, be consistent and care about that too.

<comment> ur-whale > As a visa holder, I've thought long and hard over whether I should post > political comments or photos from protests on social media.

You should consider using Tor. It was first and foremost designed for this very purpose.

<comment><USER16> Using Tor doesn't really change much.

You are still left with a choice:

a - give up your details when required to do so by the government.

b - lie on a government form and/or to a government official

If you choose b, then at any point in the future it's discovered that you did lie, then this can make life very very difficult. Not only can your Visa be cancelled, it can mean you're never again able to visit the US. It means uprooting your entire life to return to the country you were born in.

There's been plenty of stories, some posted here, where this has happened to someone who either through a mistake, or even no fault of their own - <USER2> ended up in hot water and their Visa withdrawn.

Using Tor and successfully remaining truly anonymous are non-trivial things, and endangering your livelihood and ability to remain in the US is a large risk.

This ignores the genuine possibility of prosecution for making false statements and/or lying to a government official.

</comment></comment></comment><comment><USER17> Nice PR move, tacking onto a lawsuit from a year ago in support of free speech.

That aside I personally think Reddit has far more serious speech challenges to overcome than Twitter. It's too easy to manipulate certain viewpoint to always appear on the front page. Especially blatant during election years. Too weird for me to visit.

<comment><USER18> I enjoy Reddit when logged in and unsubscribed from all the large default subreddits. I'm always shocked at how different it is when I accidentally view it logged out. The home page feels almost like a piece of carefully curated political performance art in order to somehow get a result allegedly from folks across the nation that is so perfectly aligned with a very specific agenda and advertising platform.

<comment><USER19> Certain subs are heavily curated. You will immediately get banned if you go against the mods view of the world. And they do this to even the most innocent posts.

If you are used to these subs, as soon as you leave your perfect bubble you will see a Reddit full of (to your eyes) lies and deception. Of course the same applies to outsiders visiting your sub, they will be shocked by the amount of lies casually presented as facts.

That's why everyone should subscribe to at least two subreddits they don't agree with.

<comment><USER20> > That's why everyone should subscribe to at least two subreddits they don't > agree with.

Certain subs will automatically ban you if you ever participate in another sub mods of the former sub do not like. r_offmychest will automatically ban you at the first comment for instance.

This very thing does prevent good faith people from participating in subs that are antagonistic.

It's against reddit rules but admins do no care. Admins do not care about brigading either (a sub encouraging the harassment of another sub or person), unless some specific subs/users are victim. r_ch* p* tr* ph* * s* regularly engaged in the bullying of users and subs until they attacked the wrong person and got quarantined.

I don't care what the rules are, only that they are enforced very differently depending on who violates them and who is the victim.

<comment><USER21> > r_ch* p* tr* ph* * s* regularly engaged in the bullying of users and subs > until they attacked the wrong person and got quarantined.

I'll admit I don't really understand the practice of censoring things that aren't clearly swear words from context, but in this case you've censored it so much (and I suspect thrown in spaces so Hacker News doesn't italicize bits of it) that I really have no idea what you're talking about.

<comment> cc-d I frequently read the specific sub he censored, and even I could not decipher the name initially.

The sub is chapotraphouse, based upon the podcast of the same name. I've never listened to the podcast, I tried once and within a few minutes found it obnoxious. As somebody interested in political theory/history/whatever label you want to apply to "the study of power structures", I often find the perspective of the sub interesting, and can usually be summed up as "21st century communists in America".

</comment></comment></comment></comment></comment></comment><comment><USER22> So if I don't have any accounts in sociopathological networks, will the morons deny my visa? What a br.., I mean, a cowardly new world!

<comment> kube-system > Visa applicants who have never used social media will not be refused on the > basis of failing to provide a social media identifier, and the form does > allow the applicant to respond with "None."

[https://travel.state.gov/content/dam/visas/Enhanced%20Vettin...](https://travel.state.gov/content/dam/visas/Enhanced%20Vetting/CA%20-%20FAQs%20on%20Social%20Media%20Collection%20-%206-4-2019%20\(v.2\).pdf)

<comment><USER23> So if you do respond with "none", how would they know you do actually have social media accounts?

<comment><USER24> Chances are they wouldn't (if you were reasonably cautious with, e.g., your phone). But if they find out you don't later they can throw you in jail and deport you. Lying to federal officers while getting a visa over something as innocuous as a social media account really doesn't seem to be worth it under basically any circumstances.

</comment></comment></comment></comment><comment><USER25> How would a decentralized platform be registered?

Things are about to get insane when they start banning foreign social media!

<comment><USER26> Which is decentralized? Certainly not Reddit.

And it isn't about the "platform" being registered, it's about users:

> that require nearly all visa applicants to register their social media > handles with the U.S. government and connected policies permitting the > retention and dissemination of that information.

<comment><USER25> Mastodon,activitypub

</comment></comment></comment><comment><USER27> The newspaper and news channel can be held liable for what they publish. If social media companies want to editorialize the content that users are seeing then they are no longer a platform, and they should play by the same rules as the newspapers and news channels.

They could always choose not to do that and allow users to post whatever they like, within the bounds of the law.

Again, this only came up because Twitter is taking an active role in the election process. The election process is adversarial. There is already someone on Twitter who can hold a candidate accountable - their opponent. Twitter can just pin Joe Biden's reply and fact check below any Trump tweet and vice versa. Instead they have chosen to insert a platform specific feature to qualify what someone else is publishing. Their insertion is not accountable to anyone, and as such can be constituted as a canonical truth. If they apply their insertions selectively, then they are basically manipulating the audience. If this is allowed then you no longer have a democracy. The social media platform will just pick your winner.

<comment><USER28> False argument. News organisations exercise editorial, budgetary and managerial control over the reporters they hire to investigate and write the news they report. There is a tradition/expectation (sadly in very poor condition in these times, better/worse for some media organisations) of fact- checking _before_ publication, with editor oversight of that investigative process.

This is not, and can not be the case for social-media platforms.

Drawing any equivalency between the two is simply bogus.

</comment></comment><comment><USER29> I've seen many people discuss how this ruling could kill small internet communities. Curious how people would react to simply making a separate class for excessively large websites that are effectively public spaces due to scale and likelihood of frequent encounter.

<comment><USER30> Public spaces? It's platform or publisher, you can't have your cake and eat it too.

<comment><USER29> That only feels problematic if you're a huge company, which is exactly my point. If you're a small forum, I don't see any problem with you playing both roles.

</comment></comment></comment><comment><USER31> It's not like these companies particularly care about the First Amendment, seeing their actions when it comes to things protected by 1A but too icky for their platforms. I expect a blog post(s) to come out of this containing the words "As $COMPANY, we believe the right to freedom of expressing yourself." Bonus points if they include the term "responsible speech".

<comment><USER32> > _not like these companies particularly care about the First Amendment_

Free speech versus the First Amendment.

One can believe private platforms have the right to regulate their content while holding the government doesn't.

<comment><USER33> Of course, Reddit has the right to fight for free speech while at the same time suppressing it on its own platform, or at least tolerating the suppression of a free discourse in the most popular subreddit. But doing so makes it seem reddit cares first and foremost about its own freedom, and less about freedom of speech in general. It also means reddit is a poor choice if you want to run a forum that leans conservative.

<comment><USER32> > _doing so makes it seem reddit cares first and foremost about its own > freedom, and less about freedom of speech in general_

It's a company. Of course that's its motive. I'd argue this is true for most people, too.

Which is fine. It is incumbent upon those users whose free speech Reddit impinges upon to rectify the situation, but bringing other users to support their cause or setting up a competitor.

Either way, this is all orthogonal to the First Amendment concern of this case.

</comment></comment></comment></comment><comment><USER34> Ah yes...two websites that do not and will never become profitable.

I hope everyone realizes that this was never about free speech and everything about cost avoidance.

<comment><USER35> Twitter has been profitable or neutral for over a year now. It's a public company, you can Google their finances.

</comment></comment><comment><USER36> This is E.O., and not about FCC Section 230.

Court case filing is here: [https://globalfreedomofexpression.columbia.edu/wp- content/up...](https://globalfreedomofexpression.columbia.edu/wp- content/uploads/2019/07/CRF_amicus_Knight_v_Trump.pdf)

It boils down to who has the right to block users. And how to regulate such blocking of online users and by who.

That's the gist of it.

What we are seeing by Coolidge-Reagan Foundation is long-tail legal fight to keep the First Amendment from eroding on the Internet.

</comment><comment><USER37> Good. The entire visa system is unconstitutional and a violation of human rights. Anything that curtails it is a victory for freedom.

<comment><USER38> What articles of the Constitution does the visa system contradict?

<comment><USER37> The 10th amendment. Nowhere in the constitution is the Federal government granted power to restrict non-citizens from movement or employment. The constitution only delegates to the Federal government the power to determine rules for naturalization.

You might find useful this overview of the unconstitutionality of Federal immigration restrictions: [https://tenthamendmentcenter.com/2017/12/13/the- constitution...](https://tenthamendmentcenter.com/2017/12/13/the- constitutional-solution-to-immigration/)

<comment><USER39> My understanding of the Constitution is that it sets limits on government power, e.g. it can't pass a law that restricts free speech. It does not enumerate all the things the federal government may do.

<comment><USER37> One of those limits (10th amendment) is all powers not enumerated by the constitution are left to the states or the people.

It's ironic that one of the original grievances in the Declaration of Independence was the king restricting immigration to the colonies.

Freedom of movement is a common law right going back to the Magna Carta: _It shall be lawful to any person, for the future, to go out of our kingdom, and to return, safely and securely, by land or by water, saving his allegiance to us, unless it be in time of war, for some short space, for the common good of the kingdom: excepting prisoners and outlaws, according to the laws of the land, and of the people of the nation at war against us, and Merchants who shall be treated as it is said above._

</comment></comment></comment></comment></comment><comment><USER40> This shows a double sided approach to the services like Twitter and Reddit.

The social media companies argue they are not common spaces where free speech is required. This way they can moderate as they choose. It serves them.

But, they also argue that visa applicants sharing their social media details chills first amendment free speech.

The social media companies are inconsistent here and it appears they are looking out for their best financial interests.

<comment><USER41> No it's not inconsistent. You simply do not understand.

The first amendment protects you from censorship _by the government_ :

> Congress shall make no law respecting an establishment of religion, or > prohibiting the free exercise thereof; or abridging the freedom of speech, > or of the press; or the right of the people peaceably to assemble, and to > petition the government for a redress of grievances.

The social media companies argue they are not common spaces so they can maintain 'jurisdiction' over their own sites. This isn't related to the first amendment at all, as they are not a government entity.

Being asked to share social media __does __chill first amendment free speech, because it 's _the government_ that gets to see everything you do and say online and thus there is an incentive to self-censor in fear of later retaliation.

The whole point of the first amendment isn't that you can say anything you want at any time anywhere, it's that you don't have to fear retaliation from the government.

But let's assume that your issue is with 'free speech' online in general, not just in the context of the first amendment. Then there is still a huge difference between the two.

If, say, Reddit censors the speech you wish to spread, you don't suffer any consequences beyond being unable to use Reddit as your platform. You're free to use any other social media to spread your message.

If the government requests all social media accounts your speech is chilled _everywhere_ , effectively censoring you, the person.

<comment><USER40> You make a good point on the difference in censorship.

One thing has to do with government. It isn't "the government" but rather then "United States government". The individuals involved in this process are in other countries currently under the jurisdiction of non-US governments.

Your argument is that as part of the process to let people from other governmental jurisdictions into the US, the US government should not look at what those individuals say in public because it might lead to them to self- sensor.

> If the government requests all social media accounts your speech is chilled > everywhere, effectively censoring you, the person.

If the US government looks at your social media and you live, for example in South Africa, you aren't censored as a person everywhere. That person lives in South Africa and not the US. That person may not gain entrance to the US. But, they as a person are not censored everywhere.

I point this out because _the government_ is often used where there are many governments instead of one. If there were a one world government the argument about censoring a person would be true. But, there currently isn't.

Do you think the US government should not look at what people publicly say as part of their entrance criteria to the US? If so, what about those people who publicly say they want to harm an individual or group of people? Should what they say not be considered for entrance? The US government has a responsibility to protect it's individuals as part of the entrance selection criteria to the US.

<comment><USER41> > Do you think the US government should not look at what people publicly say > as part of their entrance criteria to the US? If so, what about those people > who publicly say they want to harm an individual or group of people? Should > what they say not be considered for entrance? The US government has a > responsibility to protect it's individuals as part of the entrance selection > criteria to the US.

It's the endless debate of security v.s. privacy and potential abuse of policy. Governments across the globe are trying to use the technology boom as an opportunity to redefine the borders on this topic that I believe were perfectly fine before. And it's all smoke and mirrors to distract from the fact that it's just literally 'because technology'.

Example 1: the postal service opening your mail is a big no-no without a warrant, but suddenly 'because technology' it's okay to do to internet traffic?

Example 2: Two people having a private conversation has been possible since the dawn of time, but suddenly 'because technology' the government has the inalienable right to eavesdrop and backdoor every conversation at any time?

Example 3: The right to not self-incriminate is incredibly important, but suddenly 'because technology' you can be forced to give up encryption keys and open laptops using information that only exists in your head, or risk being detained indefinitely?

I believe that if your argument boils down to 'it's X but with technology' then the government shouldn't have any extra rights or deny any of yours.

I personally think the real issue with the social media border inspection is the self-incrimination and possibly warrentless searches.

I don't have an issue with a border agent looking you up on Facebook, finding your public profile and seeing you posted messages inciting violence against gays, and denying you entry. I do have issues with the government forcing Facebook to give up private messages without a warrant.

I also have a problem with you being forced to divulge all your social media accounts or risk being denied entry based on the fact that you lied. This is just plain self-incrimination.

<comment><USER40> You bring out some good issues. Three things come out to me...

1\. What we post through most social media platforms is direct messages rather than private messages. It's a subtle semantic difference but an important one. The things we say there isn't private. I remember reading about banks getting access to direct messages on FB. I'm not suggesting governments should pilfer this information. I am suggesting we should not have an expectation of privacy.

2\. There is a semantic difference between "because technology" being used to avoid warrants and a government looking at what one says in public. I think this is important because pushing for and informing the public on one does not inform or solve the other. The "because technology" angle needs far more general society discussion.

3\. There is another angle to the security/privacy discussion. In order to keep privacy one may need to not engage with certain things in certain ways. For example, if I don't want my neighbors to know what I'm doing in my yard I need to live in a place with a natural boundary, like a rural area. Being in a rural area means I'm not living in a city. It's a trade-off and always has been.

I totally understand the issue with abuse and the 'because technology' situation.</comment></comment></comment></comment></comment>


Package managers should be immutable, distributed and decentralized - <AUTHOR> https://evertpot.com/npm-revoke-breaks-the-build/ <comment><USER2> Asking for Immutable / Append-only is insanity, due to the fact that eventually someone WILL clutter the hell out of it, which all of your mirrors will hate you for, as well as downstream ecosystem toolchains. The only viable way to allow it is by vetting every upload, and uh, good luck finding volunteers for that.

Decentralized / Distributed is a good thing to have and prior art already exists.

Source: Experience with the grand daddy CPAN.

<comment><USER3> > The only viable way to allow it is by vetting every upload, and uh, good > luck finding volunteers for that.

Debian seems to have no problems with that.

<comment><USER4> Why parrent comment was downvoted?

Major Linux distributions (Fedora/Debian/SuSE/etc.) are excellent example of proper solution for the "dependency hell" problem for C programs. JavaScript is the new C, but for web, so same solution will appear for same problem.

</comment></comment></comment><comment><USER5> Nix ([https://nixos.org/nix](https://nixos.org/nix)), probably?

<comment><USER6> Yeah, they're getting there. The binary package cache is a start. If it cached upstream tarballs and git revs as well as builds, it would mitigate the sort of thing the OP talks about.

Nix still needs some sort of distributed trust model, though. Without that, nixos.org is a single point of failure.

<comment><USER7> You can use your own binary caches and of course your own clone of nixpkgs repo. I think moving the binary caches to IPFS would also be a fun project.

</comment></comment></comment><comment><USER8> A really powerful thing that I think is extremely underutilized for this is the ability to sign git tags. Using that it should be very possible to allow for trusted pinning against a source code version that is easily replicated in mirrors.

<comment><USER9> Why not pin against the git hash?

<comment> jon-wood Because while its difficult, I don't think its impossible to force a hash collision, making it theoretically possible to push malicious code that would look as if it was the trusted version you want to use.

<comment><USER10> Signed Git tags reference the same hash (commit id) that you could pin against directly.

</comment></comment></comment></comment><comment> cat-dev-null We needs blockchains for releases, projects, etc. are addressed by hash. Search for your project, the name can freely change, but the hashes are immutable and release hashes guarantee integrity of all subordinate artifacts (files, metadata). Perhaps if you want to public a new project, you have to first find a free "block", with basically linear (slowly increasing) proof-of- work. Then, for distribution, something like BitTorrent to distribute bandwidth and resilience across many systems (companies can choose to host their own complete public mirrors).

</comment><comment><USER11> To achieve decentralization, we need a better model of trust for OSS at Github scale. If there was a way to verify the authenticity of packages, we could even use existing centralized repositories. I've been tinkering on an approach to this at [https://github.com/chromakode/signet](https://github.com/chromakode/signet) as a proof of concept.

</comment><comment><USER12> I hope one day Cargo (package manager for Rust) will run over IPFS. :)

<comment><USER13> As far as I know (after searching), there's no IPFS module for Rust. IPFS + GPG would be ideal and I think by being one of the youngest major languages, Rust should not wait and lead in this other aspect of security!

<comment><USER14> The good thing is that IPFS exposes an HTTP API, so doing language bindings should be quite easy. For example, JS bindings for IPFS: [https://github.com/ipfs/js-ipfs-api](https://github.com/ipfs/js-ipfs-api)

<comment><USER13> Yeah, that's a way to do it!

</comment></comment></comment></comment><comment><USER15> Go technically would of been immune to such an attack unless of course they took down the project's github repository, but it's possible to host your Go code anywhere with git or other VCS. One thing that I always loved about Go was this altogether.

<comment><USER16> Not saying that NPM is perfect but you can host your node modules wherever you want as well. Supports tarballs/folders/git out of the box.

<comment><USER15> If that's the case, then why don't the users of that package update their dependencies to his github repositories? I know it sounds like a pain, but users shouldn't be so reliant on a service that could one day disappear, which is one reason I like Go's approach.

</comment></comment></comment><comment><USER17> [https://ipfs.io](https://ipfs.io) would be able to accomplish this goal.

</comment><comment><USER18> Semi related but recently Sam Boyer wrote a good article about writing a package manager. He explores the topic quite well, indicating that there are several things that are conflated as package managers

[https://medium.com/@sdboyer/so-you-want-to-write-a- package-m...](https://medium.com/@sdboyer/so-you-want-to-write-a-package- manager-4ae9c17d9527#.740o43vxi)

</comment><comment><USER19> The issues here are 1) authenticity (tampering impossible) as well as 2) distributed source control (GIT already is a best-in-class FOSS for SC). So we need to make GIT able to publish something that is a BlockChain-encoded item (File metadata + Content bytes, on a tree/directory structure) then we're done!

Come to think of it GIT already _is_ able to map commits to checksums. That's practically everything that is needed. As soon as someone implements a BLOCKCHAIN GIT protocol, we're done. The problem will essentially be solved. Or in summary: Implementing a BLOCKCHAIN that stores GIT commits, along with some metadata for each commit.

BlockChain is good for finance, as well as source control is the main point here. BlockChain can store anything but the point here is redundant, verifiable storage, of all sources.

<comment><USER20> What if an archived version of a module is found to contain errors or security holes? How would they fix that when the module is frozen in the BlockChain? Add a blacklist?

<comment> X-Cubed No, you just publish a new release with a suitable semantic version number. The point of the blockchain is immutability of each release, not limiting a package to only ever exist as a single release.

<comment><USER14> Something like an Ethereum contract could be used for this. And the smart contract could also allow for deprecating/flagging bad releases as long as the transaction comes from the original author.

</comment></comment></comment></comment><comment><USER21> A clickbait title (also not the original title) with buzz keywords.

A package manager should be fast, easy to use, with good conflict resolution —and useful information when this fail, fast downloads and a web of trust behind it.

Not incidentally, you get this from major GNU/Linux distributions.

<comment><USER22> I wonder why this article has gone 10 hours without a title change?

</comment></comment><comment><USER23> We already have the immutable repo that you are looking for. We do all our builds from a caching proxy server that pulls in new binary objects when we need them, but serves up the old one for the 99% majority of repeat builds.

Artifactory is one package that does all of this, but in the past I have rolled my own using various packages to cache maven repos, Ubuntu packages, Python Pypi packages. It is not that hard and makes you mostly unaffected by Internet outages and repos that go away for some reason.

And since the cache is under your control you can publish your own binary objects to it, and clean it up too if you really want to get rid of something.

</comment><comment><USER24> An example would be "[https://github.com/whyrusleeping/gx"](https://github.com/whyrusleeping/gx"), a Go package manager build on IPFS

</comment><comment><USER25> Happy archlinux pacman user chiming in.

<comment><USER26> Unless it changed since I used Arch last time some years back, Pacman still don't have mandatory package signing.

<comment><USER27> Pretty sure it has changed since then. At least, I used to make the same complaint as you, and a friend who uses Arch recently told me what I'm saying is way out of date.

[https://wiki.archlinux.org/index.php/Pacman/Package_signing](https://wiki.archlinux.org/index.php/Pacman/Package_signing)

<comment><USER26> Well, then it has changed. That is good.

</comment></comment></comment></comment><comment><USER28> NPM has a huge and strong community. There will be no more than a couple of days and you could see replacements of those modules again on npm, but with a different name.

Not to mention most of the modules on NPM that are maintained by one person are usually less than 1k lines of code.

If you have a small project then it would not be a huge thing to replace them, if you have a big project, you've probably already did that.

<comment><USER29> Unless one of those modules is used as a dependency in a lot of the other modules that you use, in which case a bunch of different people all need to update before your project is fixed. Which is exactly what happened in this case.

<comment><USER28> Sadly there's even something worse that can happen at this point. [https://news.ycombinator.com/item?id=11343985](https://news.ycombinator.com/item?id=11343985)

</comment></comment></comment><comment><USER30> Why even have package managers? Serious question.

Do you really enjoy bloating your projects with 3 versions of the same package because it is required by 3 other packages that have been independently maintained?

Why would you not want to know what is in your app, if you spend so many man- hours building it?

Version control for all projects seems to be a much better solution than package management.

<comment><USER31> If that is truly a serious question and not just feigning surprise, then I have a serious question for you; have you ever worked on a project with so many people and so much history there is no way that you can personally understand it all?

<comment><USER30> Yes.

</comment></comment></comment><comment><USER32> It's pretty crazy to me to think that so many people were relying on a module that merely left pads a string.

</comment><comment><USER33> I think trusting people is actually a good thing which the node community has going for them. The opposite culture of vetting everything and making it really cumbersome to publish artifacts would most likely have led to that 'left-pad' would never hav been published.

</comment><comment><USER34> > _...they can even modify already-released packages._

I keep seeing people say that, but NPM rejects it if you try to publish a version that already exists. Am I misunderstanding what the author is saying?

<comment><USER35> It may be considering unpublishing as a modification.

</comment></comment><comment><USER36> Using hashes as identity rather than names would solve these problems.

</comment><comment><USER37> What about secure? So much software, so little is being reviewed...

</comment><comment><USER38> and use dht_rss for management of versions over bittorrent?

[http://libtorrent.org/dht_rss.html](http://libtorrent.org/dht_rss.html)

</comment><comment><USER39> Another reason to use blockchain technology for trust management.</comment>


Can a Computer Write a Hit Musical? - <AUTHOR> http://blogs.nvidia.com/blog/2016/01/14/musical-machine-learning-gpus <comment><USER2> I love what's happening, but I hate the way it's worded. To me, the computer is writing it as much as a paintbrush is painting a portrait. Sure it's much more complicated, maybe a machine controlling a marionette that's holding a paintbrush, but same thing.

I'm not entirely sure how many steps I would require a computer to take on its own to satisfy my pedantry about authorship, but it would be a lot. Legal person-hood? Ability to own property? Voting? First line credits? Creating projects on its own whim?</comment>


There is nothing awesome about SRE (most of the times) - <AUTHOR> https://github.com/dastergon/awesome-sre <comment><AUTHOR> SRE as I see it being implemented in various places is a glorified name for cruel on-calls. I'm afraid that the larger the organization the worst and farther from optimal it tends to be. I'm putting this resource here mostly as a future ref as I prepare to test the waters in that role and I'm afraid that the odds are not good.</comment>


Throwing Money at Startups in Frenzy to Find the Next Uber - <AUTHOR> http://dealbook.nytimes.com/2014/12/16/throwing-money-at-start-ups-in-frenzy-to-find-the-next-uber/?_r=1 <comment><USER2> _" And in the failure of these companies, some venture capital firms will be brought down, except for the lucky few that actually catch a rising star."_ \- isn't this investment finance in the nutshell? The only thing missing is an option to be bailed out by public.</comment>


Ask HN: Most Current Kotlin/Android-Studio Learning Material? - <AUTHOR> I tried a few books, and Google changes the rules so quickly that the books were already outdated. <comment><USER2> [https://developer.android.com/docs](https://developer.android.com/docs)

Most, if not all, of the code samples allow selecting Kotlin or Java.

</comment><comment><USER3> There is also a book from Big Nerd Ranch called Android Programming: The Big Nerd Ranch Guide which had an update rather recently. The 4th edition is written in Kotlin.

<comment><AUTHOR> thanks, that looks good, I also found this free Udacity course that seems pretty up-to-date: [https://www.udacity.com/course/developing-android-apps- with-...](https://www.udacity.com/course/developing-android-apps-with-kotlin-- ud9012)</comment></comment>


Apple Watch Review: The Smartwatch Finally Makes Sense - <AUTHOR> http://www.wsj.com/articles/apple-watch-review-the-smartwatch-finally-makes-sense-1428494495 <comment><USER2> I love how the title is "The Smartwatch Finally Makes Sense" and yet his main criticism is that the software is not up to par with current market offerings.

So why does Apple's smartwatch make more sense, exactly? The fact that Apple makes it?

Garbage article.

</comment><comment><USER3> Maybe it's because the OP/WSJ review got posted a few minutes earlier, but why is The Verge's much more thorough, well-produced review flagged down into the second page?

[https://news.ycombinator.com/item?id=9340254](https://news.ycombinator.com/item?id=9340254)

Though I'm eternally miffed at The Verge for giving a high rating to the HTC One brick-of-a-phone, they generally do produce in-depth, engaging reviews.

</comment><comment><USER4> > if you can tolerate single-day battery life, half-baked apps and inevitable > obsolescence, you can now wear the future on your wrist.

... seems like a lot to tolerate for $500+ USD, and yet I still kinda want one.

<comment><USER5> Maybe I'm weird, but single day battery life is not a "knock" against the smart watch. I'm 32 and have worn a watch since I can remember, but I never wear it to bed. I currently have been wearing a Moto 360 and have no problem docking it every night.

My complaint main against the smart watch is I hate that the watch face is digital. I want a smart watch that looks like a normal watch or I'd rather the smart watch take on another form (eg: Microsoft Band) which I can wear in conjunction with a traditional watch.

</comment></comment><comment><USER6> Lots of reviews out today. Pretty mixed, definitely sounds like an Apple 1.0 product, especially on the software side.

</comment><comment><USER7> >T he battery lives up it [sic] its all-day billing, but sometimes just barely.

If a new watch barely makes it through the day, a months-old watch won't.

</comment><comment><USER8> Sounds like the smartwatch Samsung would've built (and has kind of already done it). Except I remember the idea of "smartphone on your wrist" being met with much more hostility in reviews than in Apple Watch's case. In the reviews for Samsung's smartwatches it was called a "stupid idea". In the Apple Watch's reviews it's "well...you learn to cope with it".

I'm not defending Samsung's watches. I think all smartwatches are a solution in search of a problem right now, and that most implementations are either terrible or insufficient. Just pointing out the obvious bias for one company.

<comment><USER9> Samsung's watch was a smaller, worse smartphone strapped to your wrist, down to a camera, dialer, etc. They marketed it based on that: do everything your phone can, less comfortably and conveniently, without taking your phone out of your pocket! Unsurprisingly this was not an attractive use case to many.

Apple is positioning their watch as something to get you off of your phone, rather than another way to access it (Google did this a little more than Samsung's first offering, but Apple is taking it much further). There's a reason every review is seeded with the narrative of spending too much time with technology. We'll see how this bears out—a lot of us have no problem keeping our phones in our pockets already, and many smartphone obsessives wouldn't be able to make the switch with the Watch in its current state if they even could be convinced that they wanted to—but at least it makes somewhat more sense.

(I'm not buying one, either. Yet.)</comment></comment>


FBI Rails Against Encryption – Redirects HTTP to HTTPS on Own Site - <AUTHOR> The FBI has been railing against encryption of most/all forms as-of late. However, it appears even their own website is using the dreaded encryption by forcing all HTTP connections to redirect into HTTPS:<p>http://www.fbi.gov --> https://www.fbi.gov <comment><USER2> It's part of an OMB push to use HTTPS on all federal websites.

[https://www.whitehouse.gov/blog/2015/06/08/https- everywhere-...](https://www.whitehouse.gov/blog/2015/06/08/https-everywhere- government)

</comment><comment><USER3> How is this hypocritical? They'd get the raw request one way or another.

<comment><USER4> It's hypocritical because it shows that they don't want random people reading data going to and from their website but yet they advocate that others should accept random snoopers.

<comment><USER5> This is silly. They have no problem with https, as the root CAs are compromised. If you think that ssl is secure against governments, you are wrong.</comment></comment></comment>


Uber driver looks down for seconds before fatal crash - <AUTHOR> https://arstechnica.com/tech-policy/2018/03/video-uber-driver-looks-down-for-seconds-before-fatal-crash/ <comment><USER2> Safety drivers have an impossible job. They're just the sacrificial lamb, staked out to appease the regulatory gods. The driver was looking down, probably at her phone. Shame on her and all that, but take a good long look at yourself. How many hours of mind-numbing boredom could YOU take before you pulled out yours? The car had been functioning fine until that point.</comment>


Bulgur (Cooking wheat like rice) - <AUTHOR> https://en.wikipedia.org/wiki/Bulgur <comment><USER2> I like to have spelt from time to time.

I do remember my childhood in early nineties Russia. Spelt was a rare relief from eating millet for month on end.

The difference of spelt from bulgur is that bulgur is made of hulled grain, and spelt usually from grains that have naturally thin hull.

What I noticed while living in Canada, is that in North America people eat very few grains. Even finding plain buckwheat required a trip to "European" foodstores. But yeah, quinoa and other novelty foods were everywhere.

</comment><comment><USER3> Where I live, in Tunisia, Bulgur (called "borghol") is so cheap compared to rice or oatmeal, which is why I used to eat it while dieting and training. It's also so easy to make!

</comment><comment><USER4> Also buckwheat, which is not wheat. Delicious.

[https://en.m.wikipedia.org/wiki/Kasha](https://en.m.wikipedia.org/wiki/Kasha)

</comment><comment><USER5> The wikipedia article did not mention "çiğ köfte" also a very popular (at least in Turkey) bulgur snack.

</comment><comment><USER6> I add it into my overnight oats gives a different texture.</comment>