No Company For Old Programmers - <AUTHOR> http://blogaborty.blogspot.in/2013/04/no-country-for-old-programmers.html <comment><USER3> 45 here, still enjoying it. and much of that description didn't really ring true. the obsession with computer science came at the start (i wasn't educated as a software engineer, so my first job writing code had me scrambling to understand the theory); what i enjoy most these days is crafting something _well_. it doesn't have to be rocket science - it's a pleasure just to make something that is so simple it is beautiful, yet works so well it makes others happy.

everything else - understanding inherited crappy code; fixing bugs no-one else can / wants to; listening to clients change their mind again - is just the price you pay for being able to do that craft...

<comment><USER4> 42 here, and still loving it.

I work from home, and can work anywhere in Europe, as much or as little as I want (within reason). I don't have to put up with meetings and bullshit bosses. Above all, I still love programming for its puzzle-solving side, and for its non-stop accumulation of learning and experience.

I'm currently having an awesome time in Barcelona, but I've lived in a beautiful city in France, by a beach in the Canary Islands, and in an 18th Century Norman Château (well, in its converted stable anyway).

I'm sooooo glad I stuck to the coalface and didn't move into management, or I'd probably still be swearing at tourists on the tube every day.

<comment><USER5> How do you find remote work? Are you a contractor or permanent?

<comment><USER4> I'm a one-man business doing web development.

I get my work almost solely through contacts I made when I lived in London, though I left the UK in 2007.

Sorry: probably not what you wanted to hear!

<comment><USER5> It's not that bad, I'm a web developer too and I work in London at the moment. With my day rate I could probably fund a year in a cheap part of the world on 6 months work, but it would definitely stretch further if I could top it up with some freelance work :-)

</comment></comment></comment></comment></comment><comment><USER6> I'm 38. The difference in what I know, can do, and can do quickly, now vs. 10 years ago is staggering. I can't wait to see where I'll be in 5 years.

It makes me confused about the "young founder" trope. Maybe some wunderkind can pick up a lifetime of learning before they are 22, but if so, I'd love to know how, and how this could be a common scenario. It just seems far-fetched to me. So much of what I know came from experience, but without that experience, I'm not sure how one would learn these things...

<comment><USER7> I think the young founder trope persists for social reasons, not technical. The average 25 year old "understands" the internet on a very different level than the average 35 year old- simply as a consequence of having grown up around it.

<comment><USER8> I disagree. Ask them what "recursive queries" in DNS are. Ask them to explain the difference between a forward and reverse lookup. DNS is fundamental to "The Internet" and hardly any young person I have met can answer these basic questions about how it works. Now they do "understand" how to post pictures on Facebook, but Facebook is not the Internet.

<comment><USER7> Well, I disagree with that fundamentally. You don't found a successful tech company because you know what a recursive DNS query is. You do it because you know your market and you understand your customer.

</comment></comment></comment></comment><comment><USER9> It took me almost 20 years of hardcore programming to realize it wasn't the programming that was interesting to me. I didn't give a whit about new languages and frameworks and new design patterns. What I cared about was the _creation_ of something from nothing. What I cared about was the ability to conceptualize and immediately materialize: ideas leading to moving digits on a keyboard leading to product.

Starting my own company, releasing my own software, interacting with my own users and reveling in their praises or reeling back from their complaints: that's software brought to life and that's what keeps me going.

Programming is just the canvas for getting my ideas out in the real world in the hands of real people.

<comment><USER10> Exactly this, except I've only been developing for 8 years and don't have my own company. I find myself getting into new hobbies because of the actual creation. I've built my own redwood planter boxes for tomato plants this week and it's my first year planting tomatoes. I have 8 plants and I'm obsessed. Golf is similar, but instead of creation, it's about troubleshooting what I did wrong and fixing it. My handicap has dropped from 18 to 13 and that's before buying new wedges (I've only used sand and pitching if any of you are golfers). My self-taught mentality is holding me back from going out and getting a golf lesson, much like how I teach myself new frameworks.

</comment></comment><comment><USER11> I'm not old yet [only 51, software dev. since 1985] but I still enjoy developing software. I compared myself to a golden retriever in an interview once: "You know how you throw the ball and he brings it back? If aren't familiar with retrievers, you'd think. 'He'll get tired of this in a while.' but it never happens. That's me and programming."

Admittedly I've been _very_ lucky, I've never had to do "maintenance", write CRUD apps, had horrible bosses or worked with bad developers or unpleasant people.

<comment><USER12> What's wrong with CRUD apps?

Has CRUD become a derogatory term, or do you just personally feel that they're boring to work on?

Tons of useful applications involve Creating, Reading, Updating, and Deleting database records at their core. Facebook and Twitter are essentially giant CRUD apps, so is every CRM system ever. Rails and similar frameworks provide scaffolding for automagically building functioning bare-bones CRUD apps with just a few keystrokes, relieving developers of the boring, repetitive part and freeing them to work on the unique business logic.

I dunno, maybe I'm a dork, but I guess I kind of think CRUD apps are cool.

Edit: OK, I admit that they're not nearly as cool as machine vision for aiming lasers, though. :)

<comment><USER13> > _What's wrong with CRUD apps?_

They are full of boilerplate, unimaginative uses of computing, the re-invent the same bloody wheels again and again, and that should have been automated much more already.

> _Has CRUD become a derogatory term_

Yes, for at least a decade.

<comment><USER12> While the tone of your comment comes across as a bit negative, I appreciate it because it got me thinking about ways to automate CRUD apps even more than Rails already has.

Perhaps it could be a framework or application that would allow a non- programmer user to create basic CRUD apps with some sort of "app builder wizard" GUI by simply defining the record fields and their data types. Then it would automatically generate the tables and the corresponding models, and the create/edit views just like Rails does. It could also expose basic access/permissions configurations and have a bundle of CSS files to select from for the GUI styling, and a drag-and-drop interface for selecting GUI elements.

Basically, I'm picturing something like a cross between Rails and a version of MS Access with a more user-friendly front end a "real" database behind it. Or just a GUI version of Rails, bundled with some HTML/CSS view/style templates, really. Or "the Wordpress of CRUD apps." (Maybe this exists already and I don't know about it?)

Of course, if someone made something like this and got business users to actually use it to build their CRUD apps themselves, it could put a lot of CRUD app developers out of business!

<comment><USER13> > _While the tone of your comment comes across as a bit negative, I appreciate > it because it got me thinking about ways to automate CRUD apps even more > than Rails already has._

Well, it's a little negative, but I've made my fair share of CRUD apps at one time.

> _Of course, if someone made something like this and got business users to > actually use it to build their CRUD apps themselves, it could put a lot of > CRUD app developers out of business!_

Hmm, I have a friend that attempted something like that -- his startup was featured on TechCrunch IIRC: <http://app2you.com/site/index.html>

<comment><USER12> Cool.. Is this still an active project? It says © 2011 but it's still in beta and there isn't much on the site.

What I'm thinking of is like an open source project for a "one-click" installer that deploys a default/pre-configured Rails application, with a GUI wrapper (similar to Wordpress) that allows you to visually design the database schema, generate the scaffolding with the click of a button, and swap out themes for style and plugins for added functionality.

I don't think this idea (RailsPress?) is so original that no one's thought of it before, but it doesn't seem like anyone's really executed it yet. I'm thinking about starting a Github repo for this if there isn't already an existing one I can contribute to.

Edit: It looks like there is a repo called "RailsPress" but it's just a port of WordPress to Ruby on Rails, not a framework for allowing non-programmers to generate generic RoR applications.

<comment><USER13> > _Cool.. Is this still an active project? It says © 2011 but it's still in > beta and there isn't much on the site._

Not sure, I'll have to ask him. There are some 2012 updates on the site, but I thing he moved on to something else now.

> _I don't think this idea (RailsPress?) is so original that no one's thought > of it before, but it doesn't seem like anyone's really executed it yet. I'm > thinking about starting a Github repo for this if there isn't already an > existing one I can contribute to._

Sounds like something that, if executed well, can have a real market.

I'm surprised there isn't any SaaS offering something similar for SMEs. Like the way WooForms let's you make, well, query forms.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> Over 50 here. You have to create your opportunities. Want something interesting to work on? Create the project, work on it in stealth. If it works out, it may become an official project and you increase your status.

Cultivate your interests. Learn something new. Coursera is pretty awesome - <USER2> wish I had more time for all the courses I'd like to take. The courses at MIT's OCW (and edX) are great. Download lectures to your mobile device. Search iTunes U for classes.

Write short programs for fun. Check out Project Euler, fer instance. Don't forget why you started programming in the first place.

Gear up and get a new job. Don't accumulate too much dust. Crack open a book about interviewing, get off your high horse about what people consider fair game in an interview.

<comment><USER10> As a developer, I find that designing the web app that I'm developing for makes the effort/project much more enjoyable.

Web app development is the type where you do things differently for every project. Going from writing ajax handlers on the client and server, to using KnockoutJS (or Backbone or Angular), is extremely fun because it lets me focus more on the UI.

</comment></comment><comment><USER15> I think the blogger has an Indian background, because in that culture you're seen as a failure if you're still developing software after a decade of programming. You're supposed to be at least a manager by then. Maybe the author reinforces this sentiment by disallowing himself to find enjoyment in programming when he grows older.

I'm 48, programming since 10, and it hasn't bored me one moment. I can't really relate to the problems the author poses in his article. The IT field is continuously shifting and very broad, look a bit left and right and you'll discover new things. And if you've reached your Blub Ceiling [1], try out some language which is more powerful than Blub.

[1] <http://www.paulgraham.com/avg.html>

<comment><USER16> Agreed. A manager is not a promotion, it means you can't/don't code anymore. As long as I have my wits I'll be programming.

<comment><USER17> My problem is that my company (and I don't think I'm alone in this) is ill- equipped to handle the career path for programmers in any other way than to force them into management. I've been resisting it as hard as I can, but I'm already growing weary due to factors such as the "team lead" title which instantly gives extended benefits -- like an added week of vacation -- among others. My path also upsets the existing chain of command, since I'm outside the norm, and so I'm treated like floater that just kind of gets bounced around.

</comment></comment></comment><comment><USER18> These days if you graduate at 21 and want to work until 65, the encouraged retirement age in much of the world, that's about 44 years of work. They're trying to slide things up to 72 now, and who knows, by the time anyone starting out today gets there we may live much longer or even forever.

My point is, expect to work a LONG TIME. It's not about pulling a few all- nighters for finals, collecting a piece of paper, and waving goodbye. It's a marathon, not a sprint. Do what you gotta do to keep it interesting, because no one else is going to do that for you and the "end" is so far in the future it's not even worth thinking about. Take vacation time, take on new challenges, go back to school and start a new career, stop and smell the roses once in a while. It's your life, choose it.

<comment><USER19> Why let someone else prescribe your retirement age?!

<comment><USER20> Because it is how it works in many countries?

<comment><USER19> Your ability to retire is tied to your financial situation. What does that have to do with the government?

<comment><USER12> And your financial situation is, for many people, tied to your age because pensions, 401(k)s/IRAs and the like offer tax exemptions that are conditional upon waiting until you hit a certain age before collecting distributions. If you withdraw early from a retirement account, you face something like a 10% haircut in addition to the income taxes. If your money is outside of such a tax shelter, well then you just need _more_ of it to retire because you have to pay income tax plus capital gains tax.

<comment><USER21> I think his point was that, for at least some of the readers here, the goal of "retire early" means that one has enough wealth that even without tax breaks, one has the resources to live or work or play as you see fit -- whether that means continuing to start new companies, or raising llamas.

<comment><USER12> I know what his point was. I was just pointing out that when you retire, for most people, does have something to do with your age and with the government, because the government offers tax shelters that are tied to your age, and these are what most people use to fund their retirement.

Of course if you're rich enough, you can just pay the taxes and still be rich enough. But that's a circular argument. The point is, the bar for "rich enough to retire" is much higher the younger you are--and not just because you have more years of life ahead of you, but also because of the taxes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> _I personally don't know a programmer who successfully survived the boredom, disrespect and disregard that comes with age and experience._

I've been actively programming for 30+ years. Whenever I get a "Hello World" running on a new system or language I get the same excitement as I did the first time on my Apple ][. It helps that I work for a company that values experience and has a technical track so I don't ever have to become a people manager if I don't want to.

</comment><comment><USER23> Back in the day, when the boomers were 40, they called this the "midlife crisis"

It affects accountants and carpenters and all sorts of people.

That said, I definitely recognize some of the feelings he's having.

<comment><USER24> Exactly. Programmers are not some magical subset of people that go through life differently than anyone else. It's an incredibly arrogant mindset that is rife throughout HN and technologists in general.

It's a midlife crises. Go buy a Corvette or something!

Source: None, because I'm 26. But I'm looking forward to that Corvette in a few decades.

<comment><USER25> Wait till you're 30 like me and you'll feel differently about the "midlife" bit ;) . If you're like a vast number of people (not just on HN of course, but anywhere really) there's something similar to a "premature midlife crisis" of sorts <http://en.wikipedia.org/wiki/Quarter-life_crisis>

It's just part of growing up actually. I think programmers in particular tend to frame that into something a bit different, but the reality is that it's the same thing for all mere mortals. It's just perceived differently.

<comment><USER23> Overall people have a crisis every 7 years or so in their adult life. Gail Sheehy talked about a "Catch 30" in the book "Passages" and my friends who believe in Astrology believe there a "Saturn Return" between the 20's and 30's.

<comment><USER26> [http://www.smbc-comics.com/index.php?db=comics&id=2722#c...](http://www.smbc- comics.com/index.php?db=comics&id=2722#comic)

</comment></comment></comment></comment></comment><comment><USER27> Just turned 52. I just started a new job at a great company, after 11 years with Microsoft (7 of which were my "dream job"). The new work is fantastic, and I'm learning a ton of new stuff.

I see programmers get trapped into thinking they are too old and have to manage. After a couple years of no programming they've often lost the knack and all they can do is tell other people what to do. It is incredibly hard to recover from this.

In fact, there are lots of ways to get trapped. I won't enumerate them, but "getting into management" and "not learning new stuff on a continual basis" are classic ones.

If you become the expert on something; if you're the "go-to" person in a large group for a particular piece of technology, my advice is to find something else to do, within a year or two, or you're gonna be stuck. Nothing lasts forever in this industry.

</comment><comment><USER28> Started programming at age 5, professionally since 15, now 35. I admit I've gone through short phases of this sentiment, but to me, this attitude says a lot about tolerating a crappy environment (fluorescent lights, big companies, bad clients) and how that can grind down your enthusiasm for just about anything. I'm guessing the problem isn't that you've been programming for too long, it's how you've let the situation become stale. So you've got the 'what' down? Great. Now challenge yourself on the 'how'. You're a software developer, it's literally your world right now. Work from a cabin in the mountains, a ship on the sea, or the top floor of the Ritz.

</comment><comment><USER29> I know someone who just retired from a career of software development and is in his late sixtys. He has never stopped learning new tech and innovating on behalf of his employer. He, even in retirement, is well compensated, respected and sometimes even consulted.

Watching him, I think the key is being bright and choosing where you make your career carefully.

<comment><USER30> Does that mean if an older person has a problem in this industry due to their age, it is because they weren't bright?

<comment><USER31> Maybe, but it could also mean they're too bright.

People whose brains are good at generalizing from data eventually realize that the vast majority of "new technology" in computers is really 40 (or more) year old technology with a new paint job. Once you realize that it's very hard to get excited about these things.

There are still things to get excited about : machine learning, AI, etc but they tend to be orders of magnitude more difficult to understand than the technology stuff you've spent a couple of decades working with.

<comment><USER32> For me, I see echoes of conversations I had ten years ago.

CSS preprocessors? Server-side Javascript? Anybody who proposed those in the past was flamed into submission by the community for deviating from standards or, worse, being "lazy". There's nothing new there. What's new is the community's openness to doing things differently, to accepting that web templates don't need to be written directly in the languages sent to the browser.

I've been writing Javascript pretty much since there WAS a Javascript, so I love node.js. But I'm just getting my feet wet and I'm three years behind the game because I expected it to be written off as a "toy", just like every other time someone suggested running Javascript on the server.

I know I need to get over this skepticism, but I'm having a hard time figuring out which horses to bet on anymore. I feel like I'm close to just saying "screw it" and becoming that crazy graybeard who uses a completely off-the- wall technology stack because that's what he enjoys and to hell with everyone else.

<comment><USER33> The one thing that I want to counter people who complain about the whole nothing new in heaven and earth issue is that the reimplementations are typically removing historical cruft that made the old versions untennable for contemporary development or have solved a hard problem that made things work poorly.

Now, that doesn't mean the new version _is_ tennable, but it means that it's probably time to re-evaluate the old idea.

<comment><USER32> > reimplementations are typically removing historical cruft that made the old > versions untennable for contemporary development or have solved a hard > problem that made things work poorly.

Oh, definitely. Node.js wouldn't be anywhere near as popular without V8 behind it. Also, without the strides Javascript has made in recent years. I was messing around with a MacOS 7.6 machine last night and Netscape 3 was throwing Javascript errors all over the place when it hit modern code.

I think another part of it is cultural. Since I brought up CSS preprocessors as my other example, a lot of the animosity toward them "back in the day" was driven by the web standards movement. We finally had sane standards that worked across the big browsers, and then some upstart was trying to introduce something proprietary and the community reacted. Now, we have little hiccups once in a while but things are pretty much standard across the board and that makes a stable platform for innovation.

</comment></comment></comment></comment></comment></comment><comment><USER34> When I joined my most recent company, one of the people on the team was a badass, grey bearded developer who used to work at Sun. He is basically a Tech Lead or Architect now, and is AWESOME. He has tons of experience and taught me quite a bit just by pairing with him. I'm glad he kept up the programming career!

<comment><USER35> This takes humility. Some people don't have enough to survive contact with a grizzled veteran without coming away bitter.

By the way, this is why many self-preserving large companies use humility as a filter for new hires. They want knowledge to pass down effortlessly from the veterans to the noobs (and others) without creating unnecessary internal battlegrounds.

</comment></comment><comment><USER36> Developing career is like starting up a business, you need to have a competitive advantage.

In early stage of your career, your competitive advantage is cheap and fresh. But at some point, that advantage goes away, and you need to find other advantages -- domain knowledge, industry reputation, connections, management skills, anything that can distinguish you from other developers.

Once you get that competitive advantage, you will get the desired respect and people will start to value your opinions. And hopefully, you will not find it boring anymore.

</comment><comment><USER37> Still loving it after 20+ years.

> I personally don't know a programmer who successfully survived the boredom, > disrespect and disregard that comes with age and experience.

I think to some extent, you get what you give.

</comment><comment><USER38> _In the end though we have to accept that programming is a repetitive activity._

No.

Would you also say that writing is a repetitive activity? I do think I saw you repeating a few letters in your post, after all.

Should we view living as a repetitive activity? All that breathing of air and pumping of blood can be so monotonous.

Rather than fretting that programming has become tedious, look up the stack to the limitless opportunities that applying your hard-earned skills now affords you. Build on what you know; don't wallow in it.

</comment><comment><USER39> The guy is depressed. Anybody can burn out on a job, at any age. He needs to get help, not rationalize how he's too old for this.

</comment><comment><USER40> If you don't get bored doing the same thing, you haven't mastered it. In all professions, one must level up to keep things interesting.

Unfortunately, for software developers (and mathematicians) leveling up starts to become difficult as the mind ages--and there's only so much computer science stuff out there before it all becomes repetitive. Fortunately this occurs at just about the time one begins to realize that they're in the middle of the pyramid, working primarily to enrich someone else, and thus follows consulting, entrepreneurship, or, if you don't care about enriching someone else, management.

</comment><comment><USER6> If my age becomes an issue for clueless employers, I will work only remotely, join the matrix, and _become my github account._

My face will not be old and haggard, but digital, expressive, cleanly coded, and handsomely tested.

</comment><comment><USER41> I'm over 40; I started late (after studying music for over a decade) and then spent some time in QA, so technically I've only been doing "pure" development for 6 years or so, and thus perhaps haven't been doing this long enough to face the burnout. But thus far, the more I do it the deeper my interest & passion. There's an explosion of interesting stuff to learn these days -- functional languages like clojure, scala, javascript, ruby, python, go, cloud, etc... -- and even if my day to day work is crufty old java, learning new things keeps me engaged. Even learning new java tricks is pretty fun. Github makes this so much easier. I feel pretty lucky. I believe that if you enjoy learning for its own sake, you'll remain engaged by this profession.

Now, eventually, I figure I'll hit barriers. I expect these to be mostly physical. How long can one take sitting and typing? I've had bouts of back pain and rsi, and these have been more demotivating than anything else. But even here, I think life is getting easier. More companies are coming around to the importance of decent ergonomics, sit/stand desk options, etc... Voice recognition is coming along nicely.[1] So I'm mostly optimistic.

[1] [http://pyvideo.org/video/1706/plover-thought-to-text- at-240-...](http://pyvideo.org/video/1706/plover-thought-to-text-at-240-wpm)

</comment><comment><USER42> I've been told by several of my mentors that there are precious few grey haired programmers (probably because of issues like the OP is pointing out) but seeing people like Jim Weirich (local Cincinnatian and inventor of Rake) who are still passionate about programming and going strong gives me hope that I won't burn out (I'm 34).

</comment><comment><AUTHOR> OP here. Sorry for joining late. Reading the comments on HN here was an uplifting experience! Thanks for all the feedback and encouragement! Can't reply to everyone but I will try to write a few follow up articles addressing the issue in further detail and depth. Thanks again!

</comment><comment><USER43> I wonder how much of the 'programming is a young person's profession' is due to relatively banal explanation like programming being a relatively young profession and other "demographic" reasons.

</comment><comment><USER44> Anyone else find that cartoon a bit odd - I tend to start the day a bit grumpy and generally find that my productivity (and mood) improves almost linearly throughout the day...

<comment><USER45> I was that way when I was younger. As I hit my thirties I found myself becoming a "morning person." Anecdotally, I find this is super common.

I actually enjoy early-morning coding (before the rest of the world wakes up) more than late-night coding now!

</comment></comment><comment><USER46> Started programming at 12, didn't stop until now and I like it more and more (getting close to 40).

The author seems to jump to generalizations. For example, from "I can't find the enthusiasm to program anymore" he goes on to "we try to discover new sources of inspiration". Who's this "we" he's talking about?

</comment><comment><USER47> As I try to explain to my kids - life is what you put into it.

When my work life gets boring, I do something about it, so I'm starting a saas. If you sit around and moan and groan, life's gonna groan right on back ;-).

</comment><comment><USER48> Started at the age of 10 and still enjoying it with 36, while trying to stay away from management tasks as much as I can.

Having fun to see youngster always jumping on the technology of the day every few years.

</comment><comment><USER49> In Europe you can be 49 years old and still doing what you love. How, because I bailed from the US 10 years ago!

</comment><comment><USER50> I'm 45, and started programming professionally only 15 years ago or so. Am I counted among the old ones? ;-)

</comment><comment><USER51> 25 years of programming and I am still loving it, especially building tools.

</comment><comment><USER52> Badly thought out and badly phrased.

</comment><comment><USER53> I'm young (upper 30s), but I've been programming since I was 10 and I still love it.

What I don't love is being forced to work on project after project by employers that don't have the slightest idea what they are doing.

At my current job, I've been stuck in the cycle of:

-boss will give me the specs -right before I finish, boss decides to change his mind (redesigns, functionality, etc) -There will then be pressure on me to get all of the new changes done in a specific time frame (often not even close to reality).

This cycle has repeated 5 or 6 times. I still haven't had one release of the project I was hired to complete. It has pushed me to leave and start my own company.</comment>


StartSSL domain validation vulnerability - <AUTHOR> http://oalmanna.blogspot.com/2016/03/startssl-domain-validation.html <comment><USER2> When prompting for "postmaster", "hostmaster" or "webmaster", the values in that form should be just those and StartSSL should then put the two together ($MASTER_EMAIL + "@" \+ $DOMAIN.) They shouldn't assume that the "sendToEmail" value wasn't tampered with or overridden. If the original poster didn't include his screenshots or his steps then I wouldn't believe such a stupid mistake, especially one made by a certificate authority.

Back before I found Gandi.net I came across StartSSL (I was looking for basic SSL certifications.) At the time StartSSL's website was horrible, and I mean ugly, it turned me away because it felt so unprofessional. I see now, even with a new flashy website, that they still remain unprofessional (maybe not in their looks, but obviously in their practices.)

<comment><USER3> For a while, I ran a small non-profit gaming site. This was well before Let's Encrypt, so we looked to StartSSL for a free certificate. They denied us.

Why?

Because we had links to a Paypal account set up to take donations. Even though PayPal had its own security, and we were only providing a link to it, that was enough for them to deny us the cert. They refused to understand that WE would be conducting no financial transactions using their service; or that PayPal was a separate entity.

It was maddening, and we ended up abandoning the whole idea of having SSL. Would that LE had existed.

<comment><USER4> Conversely, when I went for an SSL cert for my company, they called me (from Israel) on a phone number for our company taken from public sources, in order to verify we were who we were. Compare this to some other SSL providers, whose certification process is "can you give us $600?"

<comment><USER5> Was that an EV certificate? EV and DV certificates certify different things.

<comment><USER4> No, it wasn't an EV cert. It was whatever their level above the first level is (can't recall, it's been a while, but it wasn't for EV)

</comment></comment></comment></comment></comment><comment><USER6> > This method is rarely used, instead for the domain validation most > certificate authorities ask the domain owner to place a certain file in > their websites.

This statement strikes me as odd. Email-based validation is the most common validation method used by most CAs for DV certificates. The only exceptions that come to mind are WoSign and Let's Encrypt.

The vulnerability is pretty bad, though. Good catch.

<comment><USER7> I work for a hosting provider that acts as a reseller of certs and we use the DV file option the author speaks of. It's easy for us because we can automate the entire process for the customer.

Whenever I've bought a cert for myself I've used the same process. I never thought email verification seemed like a great idea.

<comment><USER6> It's certainly easier for automation. I think the security implications are mostly the same - you're vulnerable to DNS spoofing and BGP hijacking either way. With email validation, a misconfigured or breached email server is enough to get a certificate, while with http validation, it's your web server or web app that could be vulnerable.

<comment><USER8> And a vulnerability in your website permitting an attacker to create a file opens the possibility for an attacker to get a certificate for your site too, and without certificate transparency you'll possibly never even know it even happened...

</comment></comment></comment></comment><comment><USER9> A vulnerability of this level is inexcusable. StartSSL ought to be removed from all major browsers.

<comment><USER10> Right now, StartSSL needs to do a quick search on their database to see which certs had email sent to a domain other than the one for which the cert applies. All such certs should be revoked immediately, and the owners of the domains involved notified of the breach.

Also, did they check properly for TLD and subdomain issues? If I have "me.blogspot.com", can I get a cert for "blogspot.com"? (What's a TLD today? It's complicated. See "[https://publicsuffix.org/"](https://publicsuffix.org/"))

<comment><USER11> StartSSL only allows validation for top level domains. So you can't get a cert for me.blogspot.com unless you own blogspot.com.

<comment><USER12> I think you entirely missed his point.

What about blogspot.co.uk? Do you need to own that, or co.uk to get a cert?

What counts as a "top level domain" is, as Animats said, complicated.

<comment><USER11> Oh ok. I can't attest to how this is handled because I have never attempted to get a cert for a domain like this.

</comment></comment></comment></comment></comment><comment><USER13> Amongst it's repsonse, StartSSL should start logging every granted certificate to a Certificate Transparency log. From now on they need to provide the transparency so that site owners can verify there are no phony certificates being issued for their domains.

<comment><USER6> That seems appropriate. Google forced Symantec to do the same thing because of a number of misissued certificates[1].

[1]: [https://security.googleblog.com/2015/10/sustaining- digital-c...](https://security.googleblog.com/2015/10/sustaining-digital- certificate-security.html)

</comment></comment><comment><USER14> This seems to an incredibly basic error for a company trusted to issue SSL certificates.

How long has this vulnerability existed? Can we trust _any_ StartSSL certificates? Will they charge for revocation, as they did with Heartbleed?

<comment><USER6> If someone has fraudulently issued a certificate for a domain you own using this (or any other) vulnerability, you're not actually a client of theirs and I don't see how they could force you to pay for revocation. Issuing such a certificate would obviously be a violation of CA/B Baseline Requirements.

Then again, I'm not exactly sure how one would go about reporting such a thing. Browser vendors have done most of the blacklisting for cases like this in the past (either by blacklisting individual certificates, or removing the root certificate completely for massive breaches). I guess I'd try my luck on one of their mailing lists or bug trackers.

If you have a regular certificate from StartSSL, there are no security implications for you because of this. (As in: for you specifically. For the CA system as a whole, this is a "Set-Your-Hair-On-Fire-And-Run-Around-Screaming- Loudly"-scenario.)

</comment></comment><comment><USER15> If this is genuine then it is absolutely inexcusable - this isn't some complex attack, that is web 101 stuff.

<comment><USER16> I came on the website expecting some complex XSS attack and I just found a form validation exploit straight from the 90's, I can't believe it was not checked...

</comment></comment><comment><USER17> I do not have appropriate words for this. What a terrible nightmare. And even worse the second time they did this. I mean what kind of company is this? I am seriously shattered that they are so careless with so much responsibility. I never liked the trusted CA system on the web but always thought you would need to be at least some state actor or serious professional in order to be able to get hold of certificates from them without validation. They should all be required to get some real security audit on everything involved, and do it again whenever there is a change or some time passed. Without they should be dropped from the list of trusted CAs. I really do not get how this happened. It is like someone did this on purpose. I am sad now.

</comment><comment><USER18> Meanwhile, when I tried to use them for a client's domain after actually paying $$$ for business validation I was refused because the names on the WHOIS records didn't match our business name.

<comment><USER19> They did the same thing to me!

So, I corrected my WHOIS records... After which they complained that the legal disclaimer posted on the website served from the domain in question was not identical to the registered identity that they had on file for me.

So, I updated that legal disclaimer (since I have root on my own server), and afterward, they STILL refused to validate the domain on grounds that it may only be validated as a business -- a service which they tried to sell me.

15 minutes later, I was up and running with my first Let's Encrypt-issued cert.

Awful customer service at StartSSL.

</comment></comment><comment><USER20> This is basically a worst-case scenario. The entire public Certificate Authority trust model depends on the validation of ownership of domains that certificates are being issued for. If an attacker can get a trusted certificate for facebook.com, then they can silently man-in-the-middle connections and pretend to be Facebook.

</comment><comment><USER21> Now that Let's Encrypt is a thing, there's no reason to do business with these greedy losers.

That's not just an off the cuff insult either - I find very few charitable words to describe a company that charges $25 to rekey a certificate for reasons outside the user's control, i.e. heartbleed.

More to the point, in my arrogant opinion, now that a _good_ , free alternative exists, users in the know should pressure the browser makers to come down a lot harder on companies that let this kind of issue fly. There's no need to work through the CAB bureaucracy when, say, Google and Mozilla are probably a lot more amenable to dealing with bad (be that by ignorance or malice) actors by refusing to recognize their crappily-validated certificates.

<comment><USER22> > there's no reason to do business with these greedy losers

What makes them greedy? That they are charging for what they do? (Serious question I am curious why you label them "greedy" and further "losers").

<comment><USER23> [https://www.startssl.com/Support?v=43](https://www.startssl.com/Support?v=43)

They're the CA that wanted to charge $25 to revoke free certificates that were potentially compromised due to Heartbleed. Yes, it wasn't their fault, so they wouldn't be legally responsible for it, but they're acting in bad form by not offering those revocations for free for such a major issue.

<comment><USER24> Until LE, StartSSL was the cheapest option all around. Note that with their $59/year option you would get unlimited wildcard certs, amongst other things. I am not happy about this bug, and am glad I moved to LE a few weeks ago, but in the past StartSSL has saved me a ton of money, even though their website had been godawful at the time.

<comment><USER23> Sure, and all that may be true, but I was specifically responding to what makes them greedy. Recommending people revoke their certificate and then hitting them with a $25 fee when they try to do so is practically the definition of such. They knew it was a serious problem, they knew all certificates could be affected (and even called it out) but then they didn't care to waive their policy in this one case even with all that taken into account. A CA who actually cared about the integrity of the system as a whole would have made a one time exception for this serious bug.

</comment></comment></comment></comment></comment><comment><USER24> OK, so this seems like a terrible vulnerability. Does anyone know if (a) StartSSL has been notified and (b) what has been their response. This seems like such a severe vulnerability that publishing it on Blogspot seems too low key. Shouldn't there be a CVE about this?

<comment><USER6> It has been fixed according to the article:

> In 9 March, 2016 During my research I was able to replicate the attack and > issue valid certificates without verifying the ownership of the website > which I will explain later in my post, the vulnerability was reported and > fixed within hours.

<comment><USER25> This post needs to be higher up in the thread, and not people overreacting and demanding having them removed from browser's CA-stores etc.

<comment><USER26> It's absolutely not an overreaction if it really happened. However, no hard evidence has been presented yet. I'm seeing screenshots and a story that anyone could have cooked up.

</comment></comment></comment></comment><comment><USER26> Could the hotmail address have been allowed because it's listed on his domain name's WHOIS?

<comment><USER27> Maybe. StartSSL used to allow using E-Mail addresses from WHOIS records for domain validation and it's possible that this code was still in place on the backend.

</comment></comment><comment><USER28> check this: [https://www.startssl.com/NewsDetails?date=20160322](https://www.startssl.com/NewsDetails?date=20160322)

<comment><USER29> Yep, this was just a false alarm. Guy should update his blog to say he was mistaken.

</comment></comment><comment><USER30> Good to know StartSSL is just as shoddy as it's always looked. Good thing we have letsencrypt these days.

<comment><USER31> Yeah, I'm happy I moved all of my domains off them after they tried to nickel and dime me to death.

It's interesting to me that so many people strongly dislike StartSSL that they won't even use their product for free.

That really goes to show how bad their service is.

</comment></comment><comment><USER32> Arguably this vulnerability is serious enough to see StartSSL dropped from the trusted root store, or at least see browsers taking action to block DV certs from StartSSL issued before a certain date. It/they won't be, of course, since the whole system is a farce.

I'd lament again how we still need to push DANE, but I was doing that 2 days ago here on HN[0] and I'm tired of it.

Nevermind, maybe the next bug we see will be in one of the other DV methods, like tricking the validator to access a http uri of your choosing rather than '/.well-known/', for instance. Or authoritative DNS poisoning.

[0] [https://news.ycombinator.com/item?id=11321184](https://news.ycombinator.com/item?id=11321184)

<comment><USER8> It looks more like a confused report, as the email address used to verify the ownership was indeed listed as a legit contact in the whois database...

[https://www.startssl.com/NewsDetails?date=20160322](https://www.startssl.com/NewsDetails?date=20160322)

</comment></comment><comment><USER33> Too bad the author didn't issue certificates for, say, google.com, microsoft.com, and/or mozilla.org. That'd be a more likely way of getting those browser makers to put some restrictions or "sanctions" on them like Google recently did with Symantec.

<comment><USER34> It's my understanding that pinning limits the damage of this sort of attack on those "big" sites.

<comment><USER35> I think what jlgaddis was trying to say is that by getting certificates issued for the major browser vendors, you're much more likely to get them to pull this CA out of the trust store.

<comment><USER33> Yes, exactly. Thank you, I wasn't as clear as I could have been.

<comment><USER34> Frankly, I could have thought a bit more deeply before responding. Your meaning seems clear to me now.

</comment></comment></comment></comment></comment><comment><USER36> Interestingly, this blog author hasn't activated HTTPS for his own blog yet, which can be done with a single click on the Blogger settings page.

<comment><USER7> Why is that interesting?

<comment><USER5> Maybe irritating would be a better word. Or irritating that this is considered normal.

The laid out attack cannot be used to attack the blog, because the blog is already so insecure.

<comment><USER37> What would HTTPS gain you or the blogger?

I have literally no idea who oalmanna is, so a third-party saying oalmanna is oalmanna would be completely useless for me.

I suppose it would keep a third party from knowing I read this blog, but I can't find a reason to care about that.

<comment><USER8> Well with the shit some carriers pull, from injecting personally identifiable information in HTTP headers ([http://www.techrepublic.com/blog/it- security/why-are-website...](http://www.techrepublic.com/blog/it-security/why- are-websites-getting-your-mobile-phone-number/)) or code injection in the website content ([http://www.infoworld.com/article/2925839/net- neutrality/code...](http://www.infoworld.com/article/2925839/net- neutrality/code-injection-new-low-isps.html)), I sure benefit from an HTTPS connection everywhere...

</comment></comment></comment></comment></comment><comment><USER28> and this news:[https://www.startssl.com/NewsDetails?date=20160323](https://www.startssl.com/NewsDetails?date=20160323) StartCom log all issued SSL certificates to public CT log servers</comment>


I tried leaving Facebook – I couldn't - <AUTHOR> https://www.theverge.com/2018/4/28/17293056/facebook-deletefacebook-social-network-monopoly <comment><USER2> "Facebook had replaced much of the emotional labor of social networking that consumed previous generations."

But that's exactly the thing that makes Facebook worthless to me.

I have maybe half a dozen of _real_ friends, add a dozen of acquaintances to this list.

It's absolutely worth my time and I value those friendships deeply enough to invest time and energy into them.

I cannot - in seriousness - maintain "friendships" with dozens or hundreds of "friends" and I couldn't care less what my class mates from high school did last summer. I'm absolutely not interested in a machine, which maintains such non-friendships for me.

Being a baby boomer this may be a generational thing, but I just don't care for that shallowness that Facebook defines as friendship.

<comment><USER3> This. Facebook becomes what you let it. We're humans. We have the power to form and maintain friendships.

</comment></comment><comment><USER4> I left facebook around a month ago. It hasn't made a difference in my life. Although it was a non-trivial amount of work to purge it from all my apps and websites. App sales are the same - a few ppl commented that they were happy i'd removed fb. My social life is exactly the same as it was before - now I can easily just concern myself with what is happening in my tiny part of the world.

<comment><USER5> How do you do it though? My social bubble uses Facebook (FB groups, events and Messenger) exclusively.

<comment><USER6> It's going to be a combination of asking people to get in touch with you over another service and letting go of some people who aren't willing to do that. This would also mean getting fewer updates, but depending on you, your age and circumstances, it may not be a big deal not getting to know certain things. You could also ask a few trusted people who continue to stay in touch to pass on anything important from Facebook and its services.

I'd recommend Telegram because of its superior UX, though normal chats are not end-to-end encrypted. I wouldn't recommend Signal for anything other than voice calls (mainly because it purposely prevents backing up information, thus preventing moving conversations from one device to another). If you prefer a free and decentralized option, Matrix (matrix.org), with the Riot (riot.im) client on multiple platforms, is something to try.

</comment></comment></comment><comment><USER7> I put facebook and instagram at about the 5th screen away from my home screen. So if I want to load them I have to swipe past 5 other pages of apps. Went from checking them 4x a day to about 2x a week. Much better!

<comment><USER6> You should start using the search feature to open apps and see how easy or difficult it makes things for you. Though I do launch apps from the home screen, launching by search is something I use quite often so I don't have to track or remember which page an app is on.

I don't use the app for Facebook, since a browser gives a lot more control (on things like blocking ads, trackers, and still having messenger in the same tab). Sometimes I use mbasic.facebook.com from the browser for a messenger- integrated experience, but it's somewhat painful in certain ways.

</comment></comment><comment><USER3> I don't understand these kinds of articles. I left Facebook two years ago. My mobile phone battery life has improved.

</comment><comment><USER8> About 2 years ago I decided to "stay" on facebook on new terms: my interaction with it was reduced to checking messenger less than once a week (I have messenger lite installed and notifications turned off) and login into its mobile page around once a month to check for any _important_ @mentions or photos people may have posted of me. I also have facebook cookies blocked. Everyone on facebook who needs to contact me urgently or more directly knows of alternative ways to do so.

I do feel strongly that facebook as a tool has evolved to become more toxic than beneficial. I don't think being worked up against it will solve anything so I find that my ignoring it is way more useful in the long term and trying to leave and having to decide what to keep, who to notify, etc. From my perspective facebook can very well become slowly irrelevant and now one will care.

</comment><comment><USER9> The issue here is facebook has critical mass and another site needs to gain critical mass to unseat facebook. It's possible but difficult, especially as facebook buys out any other social media service with large numbers of users.

Facebook knows that a competitor could pivot to replace facebook, so they purchase the others.

<comment><USER10> The beauty of FB's dirty laundry finally making a difference (possibly, hopefully) is that the next big social network won't sell to them. It'd be bad publicity and there would be a mass exodus.

Furthermore, I think the next popular network would bill itself as being anti- FB.

<comment><USER11> > Furthermore, I think the next popular network would bill itself as being > anti-FB.

They can try to claim that, but any business that stores people's photos, personal profiles, posts, messages, etc. would have everything it needed to become just as bad for privacy as Facebook if they wanted to. They would need to convince people that they would not do bad things with the data. But even if we trusted them, they could change their minds at any time, or hackers could steal the data.

The only way to prevent such data from being stolen is to never collect it -- but a social network without that kind of data would not be very social.

<comment><USER10> The first part of your argument is true but it's missing a key reason why FB's data collection is so troubling — they run on advertisements and use all the user data collected to sell more of those ads.

A new social network doesn't have to be advertising-focused or based.

<comment><USER11> I think what really disturbed people was not the ads, which are pretty obvious, but rather the idea that Facebook shared user data with a company that influenced the outcome of an election.

</comment></comment></comment></comment></comment><comment><USER12> start by turning all notifications off... as a bonus, your battery life will extend dramatically...

<comment><USER13> I just removed the app altogether and created a link to the URL on my home screen. I really feel this is the best way to use FB for me. I don't have to worry about it tracking my location, notifications, or any other nonsense. I only ever used FB to share and view photos from family that doesn't live locally, and FB is still the best platform for that due to its network effect. Depending on your use of FB, I definitely recommend considering going app- less. It's the way the new web was supposed to be anyways.

The only nuisance is that FB constantly nags me to install the app. Well, it started nagging me to install the app. Then it gave up on that and suggested the "FB Lite" app. No thanks...

<comment><USER14> I switched to using SlimSocial. It forces me to launch an app, so I'm consciously deciding to go to Facebook, while avoiding the notifications and battery drain that plague the regular Facebook app. Thankfully, I don't get the nags.

[https://f-droid.org/packages/it.rignanese.leo.slimfacebook/](https://f-droid.org/packages/it.rignanese.leo.slimfacebook/)

</comment></comment></comment><comment><USER15> > Facebook is one step away from buying my kids their Christmas presents > because I'm too busy to choose them.

That's actually a sorta neat business idea: If all these data krakens know everything about my friends and family anyway, they could make gift suggestions. I'm absolutely horrible at choosing gifts, mostly because I despise getting gifts.

</comment><comment><USER16> [deleted]

<comment><USER11> What you suggest would be way too complicated for ordinary people to deal with. Heck, I'm a software engineer and I wouldn't even want to do it for myself.

Besides, I don't see how your solution would hurt Facebook any more than just using Facebook without clicking on the ads.

The value of Facebook is that it's easy to use and almost everyone you know has an account. Any competing solution needs to get both of those things right.

By the way, getting those things right at the scale of Facebook requires highly skilled people, and some of them are going to make $240k a year or more -- why are you citing the Facebook median salary like it's a bad thing?

<comment><USER17> > The value of Facebook is that it's easy to use and almost everyone you know > has an account. Any competing solution needs to get both of those things > right.

Email has those qualities. And doesn't need people making 6 figure salaries to run it.

<comment><USER18> Um...yes it does.

</comment></comment></comment></comment><comment><USER19> Why the altered headline? That makes no sense

<comment><USER20> Submitted title was "I tried leaving [social network]. I couldn't". Since the article's title is neither misleading nor linkbait, we've changed it back to the original, as the site guidelines ask.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)</comment></comment>


Amazon plans to ship your packages before you even buy them - <AUTHOR> http://www.theverge.com/2014/1/18/5320636/amazon-plans-to-ship-your-packages-before-you-even-buy-them

<comment><USER2> Is their data really that good? Won't the cost of mis-shipping be higher than the benefits of shipping faster?</comment>


Remote derailment of runaway train - <AUTHOR> https://thewest.com.au/business/bhps-runaway-train-wreckage-in-the-pilbara-cleared-but-questions-remain-after-derailment-ng-b881017238z <comment><AUTHOR> A view of what they had to stop. [https://www.youtube.com/watch?v=W667v-zBfNE](https://www.youtube.com/watch?v=W667v-zBfNE)</comment>


Neural Network library in JavaScript - <AUTHOR> https://github.com/harthur/brain

<comment><USER2> Great job!

Technically, this is a supervised learning NN library that implements the canonical backprop algorithm. Also looks like all networks are feed-forward and fully connected, with neurons activated using a sigmoid function (1 / [1+e^-ab]). Appears that cross-validation is used as well, but I haven't looked into how or which kind.

You probably want to add momentum or some other form of local optima escape/avoidance mechanism.

</comment><comment><USER3> This is awesome. I think more resources like this will help spread the ML field to those who otherwise wouldn't be exposed to it. We should really have a core set of tools/libs like pybrain and opencv in every language.

I'd also like to point out an interesting little set of slides by the same author: <http://harthur.github.com/txjs-slides/>

</comment><comment><USER4> harthur's Bayesian classifier module is also awesome: <https://github.com/harthur/classifier>. Using it to classify videos based on tags was the first time I'd made anything with ML.</comment>


Woman who lost downloading case says she can't pay - <AUTHOR> http://hosted.ap.org/dynamic/stories/U/US_SUPREME_COURT_MUSIC_DOWNLOADING

<comment><USER2> the link is down, needs either cookies or referrer</comment>


Design and Punish: A Review of Prison Architect - <AUTHOR> http://killscreendaily.com/articles/design-punish-review-prison-architect/ <comment><USER2> Seems like no one's read any kind of literary criticism. It's not that bad, and moreover, it's a pretty positive indicator that the medium is being taken more seriously.

You may disagree with how successful the endeavour was, but having video games place the player within a cruel system and force them to make alienated and morally ambiguous choices is an interesting and valid criticism of the way these systems play out in real life. _Papers Please_ is another pretty good example. The article does decent job at evaluating how effective _Prison Architect_ is as social commentary, in my opinion. It can hardly be accused of reaching too far if this commentary was one of the intentions of the devs themselves.

Commenters here would do well to reread pg's hierarchy of disagreement, and actually engage with the points that are made.

<comment><USER3> I didnt read this article yet -- but your comment reminds me of that old game "Dungeon Keeper" \-- where you build cruel dungeons and deploy minions into it for various amusements.

</comment></comment><comment><USER4> That was the most pretentious review I've ever read.

Someone needs to beat this guy over the head with a copy of The Elements of Style, or at the very least confiscate his thesaurus.

<comment><USER5> Games writing is currently a race to the bottom in terms of seeing who can render the most meandering, self-important quasi-review of game X. My personal theory is that the phenomenon of absurdly self-important critics accompanies the legitimization of any new art form; I can't think of any other reason for the explosion of facile garbage in games journalism.

<comment><USER6> Agreed, and this goes waaaaaay beyond just mere online review journalism too. Even textbooks for game engines are now cluttered to the brim with self- important lessons on "objective morality" and even "serving social justice" (e.g. Gibbon's Intro to Game Design for Unity). It's just amazing how, despite all the improvement in the medium, game-writing has actually become worse than it was in the days of just forum posters writing guides, faqs, and reviews on GameFAQs.

<comment><USER7> Yet there are still brilliant writers out there.

Although I am unsure of where all of this narrative comes from, it's so good it nearly brought a tear to my eye:

Nuclear Fruits [https://youtube.com/watch?v=15dxuAbTC0A&itct=CBQQpDAYBSITCJS...](https://youtube.com/watch?v=15dxuAbTC0A&itct=CBQQpDAYBSITCJSgy_T20MgCFckPDQodP5YMjDIGcmVsbWZ1SPyb5KT-1qGShQE%3D)

Origins of open worlds: [https://youtube.com/watch?v=EdV_2svrDVc&itct=CB0QpDAYAiITCK_...](https://youtube.com/watch?v=EdV_2svrDVc&itct=CB0QpDAYAiITCK_tu8H30MgCFcnPHQod96sN- DIGcmVsbWZ1SJ7b2-37i4Sl-AE%3D)

I highly recommend watching all his feature videos.

</comment></comment></comment></comment><comment><USER8> The "review" barely mentions the game. This is not a review, it's attention seeking.

<comment><USER9> I'd like to point out that there are lots of "reviews" that only tangentially mention the thing they're ostensibly reviewing, but are still very good and worthwhile pieces of writing (see some of Orwell's essays, for example).

The problem are:

a) this insists on pretending that it's still about the game (assigning a numeric rating, making the concluding paragraphs refer to the game)

b) the writing is terrible.

For some examples of this not-really-review genre done well, see [[http://orwell.ru/library/reviews/kipling/english/e_rkip](http://orwell.ru/library/reviews/kipling/english/e_rkip)] or [[http://orwell.ru/library/reviews/gandhi/english/e_gandhi](http://orwell.ru/library/reviews/gandhi/english/e_gandhi)]

</comment></comment><comment><USER10> Has anyone here played the game? Is it good?

<comment><USER11> I've been playing since mid alpha.

Yeah, it's pretty good! It's at least fun for a little while. It's an interesting series of puzzles to build an efficient system, and the flavor of the game is fantastic - every now and then you sit back and think a bit about prisons in general.

But for the most part, it goes for gonzo silliness. Which is a good thing! It's a game, and it's mostly pretty fun.

I'd recommend it. I think you'd probably play it about 15 or 20 hours and then wouldn't touch it for a while.</comment></comment>


Switched from Subversion to Git - <AUTHOR> http://concise-software.blogspot.com/2009/08/git-scales-enough-for-enterprise-java.html

<comment><USER2> I wish git was bit more user-friendly on Windows. With TortioseSVN, using subversion is so smooth and easy I almost forget it's there. I've got a bunch of Git tools installed in Windows, but it's all so horrible. The GUI tools are significantly worse than using Git bash at the command line.

I think, for Git, the GUI I'm looking for probably isn't possible. It's designed with the philosophy of small command line tools combined together -- that's not something you can paint over with pretty UI.

<comment><USER3> Have you tried TortoiseGit? <http://code.google.com/p/tortoisegit/>

<comment><USER4> How is that shaping up? Ready for production use? For people who don't know too much about version control?

</comment></comment></comment><comment><USER5> An amusing combination of titles:

 _In Search of Concise Software_

 _Git Breezily Handles our 500,000-line Enterprise Java Project_

<comment><USER6> I wonder what that 500,000 lines buys them.

<comment><USER7> 200,000 getters and setters.

<comment><USER8> I'm not convinced language snobbery is something to be encouraged personally :/ If it was lisp it'd be 200,000 lines of parenthesis, if it were python it'd be 200,000 of significant whitespace, perl? 200,000 of random punctuation characters etc etc.

It's not the language, it's what you do with it that counts. If someone _is_ writing countless getters and setters, in any language, they're clearly doing something terribly wrong.

my 2c.

<comment><USER7> But has anyone fixed this in Java yet, or does every large app still consist of thousands of nearly-identical methods?

Things like parentheses and whitespace don't affect the ongoing maintenance of your codebase; a bunch of code that your IDE typed for you does.

<comment><USER8> Using your IDE to type code for you is the problem. Not Java. Place the blame where it should be. If a programmer is foolish enough to use an IDE to generate code, and doesn't mind if it's near identical rubbish, then it's not the languages fault anymore.

<comment><USER7> So could you explain the "right way". I'm not a Java programmer, and googling did not reveal any way to generate accessors other than inserting code in your source file.

An explanation of how you do it would be very valuable, at least to me.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Does anyone have a real world example of a busy dev shop with a bunch of stretched coders that are accustomed to tortoise svn only based source control switching to git? the coders at this place range from brilliant to pretty good, but I don't think some of them would be capable of wrapping their heads around msysgit and they're thoroughly wedded to windows.

Tortoisegit viable? Looked ok from my brief experimentations, but I know that's different to actually doing real work with it...

<comment><USER10> Why do you want to switch to git? I say this as someone who uses perforce, subversion, git and mercurial on a regular basis. Version control is largely similar for the 90% of your work life, and that 10% can usually be solved by hand.

<comment><USER11> _Why do you want to switch to git?_ Agreed, I don't know either.

Any sort of branch/merge problems I encounter are mostly coders working on mutually incompatible versions of the base system. Not on a file level but rather on a protocol/format level

No mere source control system will be a hurdle of the same size as the hurdle of co-ordinating all the developers who broke each others preconditions.

\---

So a switch to git will be best for projects with extremely stable interfaces where the branch/merge _mechanism_ is the most time consuming part. Think: linux kernel, stable protocol services.

But where developers have to collaborate while modifying a shared framework _git_ makes little difference. Think: early stage GUI frontends, or server components which inter-depend on message formats which are evolving.

<comment><USER12> Git not being centralized helps a lot in the initial-development scenario. Two developers can pull changes from each other without polluting a centralized repository.

<comment><USER11> It looks like git / bzr / hg have better mechanisms than svn in the case you mention.

Those same mechanisms break just as badly as svn when you need to coordinate 10+ developers. The communication overhead of the developers dwarfs the way they sync files.

</comment></comment></comment></comment></comment><comment><USER13> Most "industry" developers can barely use Subversion. How are they supposed to handle Git?

<comment><USER14> by reading this book : <http://progit.org/book/>

<comment><USER15> If only those developers read books...

<comment><USER13> Precisely my problem... apathetic developers!</comment></comment></comment></comment>


Kandan, an Open Source Alternative to HipChat - <AUTHOR> https://github.com/kandanapp/kandan <comment><USER2> I recently installed Subway IRC on my server and loving it! <https://github.com/thedjpetersen/subway> If you look web-based IRC client. Its build on Node and Backbone.

</comment><comment><USER3> Even if a certain service has more features, I prefer to use the one based on open protocols, and in this case, IRC.

<comment><USER4> Kandan is completely Open Source and uses Faye as a messaging protocol which is also Open Source.

<comment><USER3> Yeah I realized I might consider it if it's OSS.

</comment></comment></comment><comment><USER5> Sweet mother of moses... if this is at all close to the stackexchange/serverfault <http://chat.stackexchange.com/rooms/127/the-comms- room> chat rooms, I'm all in! Seems like it at least, will have to give it a try.

<comment><USER6> As a SE mod (and Kandan dev member), it's similar. Definitely worth looking into (in my opinion). :)

</comment></comment><comment><USER7> Goes it have GitHub integration out of the box? That is the killer HipChat feature for me. I also like that HipChat will let me upload and link people to files.

<comment><USER8> There's a link for their Hubot integration in the README.

</comment></comment><comment><USER9> Does it speak jabber?

</comment><comment><USER10> What's the login for the Kandan demo?

<comment><USER11> I created demo1/testing if you don't want to bother signing up.

</comment></comment><comment><USER12> Balloons.io (<http://balloons.io/>) looks pretty similar, and it's open-source as well (<https://github.com/gravityonmars/Balloons.IO>).

</comment><comment><USER13> Looks awesome! I really love HipChat, but I'd love to be able to really customize it. The local chat room becomes a pretty big part of the company and deserves to have all manner of culture added to it (logo, sounds, etc).

</comment><comment><USER14> FWIW, there's a similar chat for ASP.NET/SignalR called Jabbr...does inline images, youtubes, etc <https://github.com/davidfowl/JabbR>

<comment><USER15> What an asshole of a name to give chat software, surely they'd heard of Jabber/XMPP?

<comment><USER16> It was written in ASP. We can't assume anything!

</comment></comment></comment><comment><USER17> We've been trying this out at my company, it's pretty full-featured already. Now if I could just get all my colleague's on board with the idea of a private company chat.

</comment><comment><USER18> Happy to see Kandan found its second wind! Thanks for all the work you're putting in :)

</comment><comment><USER19> Are there Mobile apps that connect to this? I use the campfire app all the time

<comment><USER6> Not yet!

</comment></comment><comment><USER20> Great work! This is awesome!</comment>


Anyone interested in selling their old IOS, Android, and Web applications? - <AUTHOR> On September 1st , Apple released that they would be purging old apps from the App Store.  According to data from Adjust, a business intelligence firm for app marketers, developers have abandoned 50 percent of all apps since May 2015.  What will you do with your old source from your past ventures?  I'm sure this code is just sitting in your code repository.<p>How about sell it?   I want to buy it from you and give your source a new purpose!   If you are interested, please contact me at email@example.com . <comment><USER2> Great question, but you should re-post this and prefix your title with "Ask HN" so that it can appear in the ask section of this site.

For posting guidelines see here [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

I hope your repost gets some traction because I'd like to know this as well :-)</comment>


Date labels on food packaging sow consumer confusion and waste - <AUTHOR> https://www.wsj.com/articles/easy-fix-to-cut-food-waste-cleaning-up-date-labels-11567157400?mod=rsswn <comment><USER2> In the old days, long before I was born, about 50% of the population was conscripted as "free" labor; staying home, cooking, cleaning, etc. That didn't take up all of the time, but that allocation of resources did leave a lot of time for doing things within a household.

Since that time nearly everyone works, and we have a literal war for attention (ads). At least in the school district where I had my education we also lacked any class about how to cook properly.

If as a society we want to make that choice I believe the logical conclusion is to have more community kitchens where workers (and automation where possible) make healthy, and also tasty (maybe not healthy) options for people to eat. We've outsourced that to fast food, generally, since that's also cheep "food". However the healthy, diversity, and quality are often lacking.

I live in the suburbs and I have to really, really, think. If I want something that isn't deep fried, isn't a burger, or a salad with 'BS' leafs (but is actually a salad with strong content and non-filler material): I struggle to think of even one place, let alone a selection that I could drive to within the local zone. Let alone anything I could hope to walk to in a reasonable duration of time.

Maybe if the automation revolution allows the average worker to have a 2-4 hour a day job (mostly supervising the automation and the paperwork) we can have an alternate future with time for rotating dinner parties and actual uses of the food.

<comment><USER3> I prefer to look at it like this: in the West, we used to have an effective cradle-to-grave UBI for females. In fact, caring for women and children in our culture was so important that we dedicated an adult male to basically every woman in the country, and her offspring. Super important. All of society was organized around this, and it's one of the greatest achievements of modern civilization.

Now we make women work for money, but the total amount paid across all workers is roughly the same. (Wages have been flat for 40 years, mostly because we have twice the "paid" workers—men AND women—but consumption is basically flat.)

It's regressive. Women have ALWAYS "worked" [0], but prior to the financialization of Western culture, that "work" was—as you pointed out—on activities that we can't put a price on, things like:

* building happy homes and families

* proper nutrition, which is extremely time consuming even today

* birthing and raising children (women had universal "time off" to have kids until we put those same women to work making widgets)

* helping out other families in the local community

* building and maintaining community institutions, schools, churches, etc.

* helping others in humane, non-financial ways where there isn't any money to be made

We've given up a lot of these things just to keep wages down for the Capitalists. At least the rising inequality over the last 40 years shows _someone_ benefited. Just not us, or our children, or our communities.

Decline is a choice.

[0] I hate that our culture only values things that can be expressed in terms of money. Calling what women do "work" (or as the OP calls it, uncompensated "labor") is demeaning to women. What women do day-to-day is vastly more important than whatever bullshit men have to (gladly) do to build and maintain civilization for their families.

<comment><USER4> It's disingenuous to call domestic servitude "caring for" or "UBI", by the same metric prison is UBI for prisoners.

If you want cooking, cleaning, and childcare so badly, why don't you volunteer to do it instead of telling women it's our place. I think I'll take my job over being a man's property.

<comment><USER5> I personally would love to be the property of most of the women I've dated in my life.

I help watch my nieces and nephews when needed already anyway, I'm very stubborn about keeping my living space organized and sanitized(in fact i cleaned my grandparent's entire house of mold(they are hoarders too so it involved tons of lifting/reoganizing)), and I've been into fitness/athletics my whole life, which entails learning to cook healthy meals.

If a women were to ask me to come do any of those things for her I would head right over enthusiastically and I don't expect anything in return either as long as she kept me company. This applies regardless of whether I'm romantically interested in her.

</comment></comment></comment></comment><comment><USER6> _In addition, 37% reported that they always or usually discard food when it is near the date stamped on the package, and 84% said they do so at least occasionally._

As someone who grew up in a not so wealthy family (but not "poor" by any standard), this behaviour is... perplexing. Are people regularly buying far more than they can consume? If that's the case, I don't think changing the date labels will do much. We almost never discarded food because of, and used the dates more as an indicator of when to consume it.

<comment><USER7> Part of it is even the small portions of ingredients are still too much if you're only cooking the required meal occasionally as a single. It would be great if grocery stores had the ability to only buy "2 cups of milk" or a "single egg" in a way that isn't a packaging waste nightmare.

<comment><USER8> _...a "single egg"..._

Regardless of the date on the package, eggs at least last a really long time. Go ahead and buy a dozen. If you eat those dozen this month, you'll probably be fine.

<comment><USER9> The float test is helpful here, if the egg floats then it's not a witch but you should dispose of it (or better yet, check it but be ready for the smell if it's off).

Delia Smith on how to tell a good egg.

[https://www.youtube.com/watch?v=E2OWXN80NZQ](https://www.youtube.com/watch?v=E2OWXN80NZQ)

Edit: Ironically (or sadly), I was a bit too quick to call for disposal of old eggs.

<comment><USER8> I wouldn't put a top-floater in an omelet, but if it doesn't smell I'd still bake with it. It's really a question of taste.

<comment><USER9> Good point.

</comment></comment></comment></comment></comment></comment><comment><USER10> "Best by" labels have no inherent accuracy. However, you know fairly certainly that for two instances X, Y of exactly the same product, if bestby(X) > bestby(Y), then X is the fresher one.

Furthermore, you know that the less fresh one is _at least_ |bestby(X) - bestby(Y)| days old.

If the difference in "best by" between two instances is three months, one of them is at least three months old already: it's three months plus the age of the newer one.

That's really the only accurate use of these labels: to leave the old stock on the shelf for someone who doesn't care. Once you bring it home they have little value.

<comment><USER11> In some stores the items nearing the best by date are slapped with a 20% discount sticker.

</comment></comment><comment><USER12> I feel like the uses of labels they are discussing might be served by considering a "dispose of after" or "safe until" date.

<comment><USER13> There are (in Sweden at least, I suppose everywhere else too) two types of dates: "best before" and "last day of use".

The "best before" kind of date is the most common one by far, and it's used on things that will be obviously bad to eat before they start becoming really bad for your health. Milk, for example, will smell and taste bad before it's really unhealthy. If it seems ok to eat, it probably is - regardless of the date printed on the box.

The other kind, "last day of use", is put on things that can become unhealthy without you noticing - most common use in Sweden is minced meat and raw chicken. This is the type of date you should actually follow without thinking too much about it.

A lot of people don't know there are two types of dates, and treat all dates like the second type.

<comment><USER14> One of the British supermarkets does the same thing (can't remember which).

</comment></comment></comment><comment><USER15> I have pretty good insurance by most standards, but a trip to the ER or emergency room for a serious case of food poisoning would be pretty hard to handle. Couple that with often having some important event coming up (project deadline, travel, social event, etc). So to that end, I throw out when in doubt. Yes, I feel particularly bad wasting food, but there are significant financial and social costs I have to pay for getting it wrong. And honestly knowing that I'm risking those things actually makes eating the food less enjoyable.

It's important to keep in mind that people are making similar rational decisions when deciding to sniff or toss.

<comment><USER16> Food pathogens don't produce smells or visual indicators as a rule. The sniff test is about food quality, not safety.

</comment></comment><comment><USER17> The title reads that changing the date labels is a way to fix the problem, yet the third paragraph outlines that "we estimate that 20% of household food waste is due to confusion over date labels". Cutting down on that 20% would of course be beneficial, but it's a long way away from fixing the problem as a whole.

<comment><USER18> Saying "this fixes a substantial part of the problem but not everything" is a surefire way to get nothing done.

Same in healthcare. Somebody makes a proposal and immediately people come out of the weeds claiming "But look at this thing! this is much worse" and in the end nothing ever changes.

<comment><USER19> Right, if there isn't a simple solution that can be explained in a headline a large number of people jump to "there is nothing (useful) that can be done".

</comment></comment></comment><comment><USER20> Big part of it is routine. I basically buy tonight's meal on way home. That leaves very little scope for anything going bad.

Meanwhile my parents have a fridge full of food and are constantly throwing stuff out

<comment><USER21> I'm guessing your parents are still saving money overall, even accounting for the stuff thrown away.

Having transitioned from the "buy supper and breakfast on my way home" to "week's worth of food in the fridge" myself, I see two components to this. One, buying just-in-time is easier when you're single, gets more complicated when you have a partner, and much more so when you have kids. Two, the "keeping fridge stocked" model affords going to a cheaper store less frequently, and buy in bulk, saving considerable amount of money on a monthly basis.

<comment><USER22> > I'm guessing your parents are still saving money overall, even accounting > for the stuff thrown away.

I'm the same as OP, for the most part my parents would be buying the same stuff at the same store. They'll also be buying at the price on their weekly shopping day and if that's on a weekend when a lot of people shop then stores aren't discounting, whereas I can take advantage of daily specials or late night discounts.

> Two, the "keeping fridge stocked" model affords going to a cheaper store > less frequently, and buy in bulk, saving considerable amount of money on a > monthly basis.

You can do both, most thrown away food is of the more perishable varieties, so you can buy that on an as needed basis and buy stuff like tinned food in bulk.

<comment><USER23> Even the perishables can be bought somewhat in bulk. My wife ends up chucking an appreciable amount of perishables so I have thought about the economics-- and her approach is generally the right one. Much of what gets chucked came from a store with good produce sales on Wednesday only. If she ends up chucking 20% of it but paid only 30% of what it would be at the store closer to home she's still way ahead.

</comment></comment></comment></comment><comment> sans-serif I'm not sure what threat model this supposed "Easy Fix" is intended to address. Struggling families already keep food past supposed expiration date. If manufacturers want people to throw away food, changing the way the label is worded won't fix that. And most people are discarding food because they don't plan and/or buy too many.

<comment><USER24> The goal is to encourage people _not_ to throw away perfectly safe food.

</comment></comment><comment><USER25> It would be cool if any food about to expire could be given away by your refrigerator. Maybe robots will one day handle that. Maybe even sniff the food to make sure it's still good.

Of course, when robots start cooking and restaurant quality meals on demand for the cost of the fresh ingredients, the need to store food will drop like a rock and this problem goes away.

</comment><comment><USER26> Date labels are a strange concept.

Different countries just like, don't have them. Particularly on stuff like fruit and vegetables.

I pretty much just eat things if they seem edible. If a piece of fruit is mouldy, I'll chop off the mould and eat the rest.

Maybe that's why I'm so bonkers. :P

<comment><USER21> Date labels on food let you _plan ahead_. For half of the stuff in my kitchen, I couldn't tell you off the top of my head whether it'll go bad in a month or in a year. Sure, once it goes bad, I might be able to spot it - but labels let me look at an unopened bag of $foodstuffs and decide whether I have to build a dinner around it this week, or whether it can wait another month.

<comment><USER6> I was taught to sort items by date, so you don't have to look through them all to determine which ones are the closest to expiry.

<comment><USER21> That's a neat trick. However, I've never seen anyone doing it around me. I wonder how one would make it work with fridge and storage space regularly filled to capacity?

My wife and I do something else instead. We know we can eat all foodstuffs before their printed expiry date, but we got tripped regularly by products with have short expiry time after being opened - in particular, through not remembering how long such a product has been sitting in the fridge. I eventually glued some magnets to a permanent marker and put it on the fridge, and now we write current date whenever opening a fridge-stored product. This made it much easier to avoid accidental food waste due to uncertainty around spoilage.

</comment></comment></comment></comment><comment><USER27> Why aren't irradiated foods more prevalent?

I NEVER buy strawberries because they are ALWAYS moldy straight from the store.

</comment><comment><USER28> Let's keep the wages stagnant for 40 years, and come up with new ways for the average American to do more things because they're so naughty, 40% of food goes to waste you naughty American.

What else should Americans do, use less water when showering, to fix 'water waste'?

Maybe the problem lies elsewhere...

To take it apart a little more - why is 40% of the food being thrown out a problem? What do we gain by cutting that down to 20%? Do we have a food shortage? Agriculture is 0.9% of America's GDP and less than 0.7% of the population is involved in farming and fishing combined. [0]

It's not at all clear there is any food 'waste' occurring and even if there is, it's not at all unclear where it sits on the list of priorities. I'd say somewhere near the bottom.

[0] [https://en.wikipedia.org/wiki/Economy_of_the_United_States](https://en.wikipedia.org/wiki/Economy_of_the_United_States)

<comment><USER29> Wages have been stagnating for 40 years because more and more women have been entering the workforce for 40 years.

Supply of workers has increased massively, while demand for the things being produced has obviously not increased in the same manner (because the women now in the workforce were already consumers).</comment></comment>