Equifax Breach Fallout: Your Salary History - <AUTHOR> https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/ <comment><USER2> > _The service is designed to provide automated employment and income > verification for prospective employers, and tens of thousands of companies > report employee salary data to it._

It sounds like companies can easily use this to collude against employee wages and benefits.

<comment><USER3> Yeah, that is pretty crazy. The ball is usually already firmly in the employer's court. This kind of information greatly diminishes the already most-diminished's bargaining power.

<comment><USER4> Past pay is not directly a significant issue. It's just a question of getting competing offers.

The real issue is some people suck at negotiation and past salaries will tell companies that.

<comment><USER5> Any suggestions on how to bypass the question of past/expected comp then?

<comment><USER6> In some cases, it is explicitly stated by the prospective employer that any refusal of requested information (or providing false information) will be met with a rejection letter.

I have been on interviews where this is part of a boiler plate release/waiver for a background check, prior to receiving an offer letter, and on the same form, you are made to list prior employers, and fill in the salary box for each.

And if you don't like it, good luck taking legal action, right? Whether something is legal or illegal, most people lack the resources to even entertain the idea of challenging legality.

The only path that seems to effectively buffer this practice is working with recruiting agencies, which do a better job of negotiating, but do still collect this information. And although recruiters might only be capable of telling you whether you have real leverage for your salary demands, whether the recruiter is being paid by you or the employer is a clue as to who they're working for.

Hint: if you aren't paying them out of pocket, recruiters aren't actually working for you, even if they seem really pleasant.

<comment><USER7> My offer letter says that I'm legally forbidden from disclosing the terms of my compensation. You should just fill in the salary boxes that you are under a legal obligation not to do so.

<comment><USER8> In California, you are legally allowed to share your salary. I would just not accept a job where they ask my salary, if I can create a big enough market where I can make that decision.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I hope all the hacked data gets open-sourced. Maybe then we'll have some serious reform. This is ridiculous. What is it going to take to get Congress to actually do something? In the meantime, my strategy is to keep my credit score bad.

<comment><USER10> Congress does plenty...

..to allow these corporations to continue to make money at our expense.

<comment><USER11> Indeed. Though I guess the plans are at least delayed for now, if not abandoned.

[https://www.nbcnews.com/business/consumer/republicans- congre...](https://www.nbcnews.com/business/consumer/republicans-congress- want-roll-back-regulations-credit-bureaus-n800471)

</comment></comment></comment><comment><USER12> It's offensive that I have to go jump through hoops, set security questions and a secret pin just so I can secure my own salary information.

Is it too much to dream that Equifax should be legally obligated to provide, at the bare minimum, a way to easily secure this sensitive information?

If I were a hiring manager or in HR this would be a goldmine for verifying candidates' salaries and work histories, and gaining the advantage in any salary negotiation.

<comment><USER13> 1\. I've only ever given my SSN to a company in the same packet of information that contained my signed offer letter, so we'd be far past negotiations at that point. If you're worried about them going back and verifying what you said you made, well, you shouldn't be lying about that anyway.

2\. I'd hope that people might hesitate a little bit before committing acts of identity fraud on an institutional scale.

<comment><USER12> 1 - It depends on the company. I've had some companies ask for my SSN when visiting for an on-site interview, and others that don't ask for it until I've signed an offer.

2 - Will it save the company more money than the potential cost of lawsuits? Is it provably fraud? I'd argue that there is value in knowing for certain that an applicant made $x amount of total compensation in salary, benefits and equity. Having a precise dollar amount could let you implement all sorts of ways to optimize the compensation packages you offer for different employees.

For instance you could check an applicants past three jobs and get the average compensation % increase between each. You could use this to get a well-modeled idea of the minimum you need to offer them based on past trends in order to hire them.

Is this illegal? It should be, but the job market didn't anticipate the Equifax breach. There may not be laws that specifically prohibit this.

</comment></comment></comment><comment><USER14> I didn't know this existed at all. I thought they just made phone calls to your previous employer and asked. Are we allowed to see what's in it? I mean normally, not just when there's a data breach (and it looks like they shut it all down right now).

Because when you get asked this on an interview, what's the "right" answer? There's base pay, bonuses, 401k match, all kinds of stuff. So the "right" answer is up in the cloud somewhere, I can't see it, but I'm being turned down for jobs when my answer doesn't match the mystery number?

<comment><USER15> Have you ever logged into Credit Karma? I wholehearty recommend it just to see how much information they are pulling, fully automatic up to seven days ago.

Its not only my salary month by month, but also all my bank accounts, all credit card account all with amount I owe, amounts and history I paid, everything! Full front-face info, straight from credit reporting bureaus! :|

<comment><USER11> Credit Karma only shows credit accounts (credit cards, phone and internet bills,etc.) It does not include bank accounts (savings or chequing) nor salary information. But I am in Canada, maybe things are different in the States.

<comment><USER16> They aren't, the post you're replying to is inaccurate.

</comment></comment></comment></comment><comment><USER17> > As part of our ongoing commitment to performance, reliability and security, > Equifax Workforce Solutions will be servicing The Work Number starting > Sunday, October 8, 2017. This will result in temporary service > interruptions; if you have received this notice please call our service > center at 866-222-5880 to complete your transaction. We apologize for any > inconvenience this may cause.

Convenient that Equifax is doing "maintenance" on this page after Krebs posted his article...

<comment><USER18> There's an alternate set here, still up and running.

[https://secure.w2.talx.com/popups/findemployer.aspx](https://secure.w2.talx.com/popups/findemployer.aspx)

[https://secure.w2.talx.com/PreAuthenticated/employerEntry.as...](https://secure.w2.talx.com/PreAuthenticated/employerEntry.ascx?ReturnUrl=%2ftwneeer%2fPreAuthenticated%2fEnterEmployerSearchCriteria.aspx)

<comment><USER19> Thanks, but despite the page loading this doesn't seem to be working. I found my employer and even after clicking the radio button for the result, it then tells me that code is not found, which makes no sense, obviously, unless they have disabled it without putting up the maintenance page.

<comment><USER20> Still works for me. Whenever I search for a company name ti returns a list of employers in this format:

XXXXX Company Name

I guess the first five digits is the code.

</comment></comment></comment></comment><comment><USER21> couple of thoughts:

1) If the value of the individual damages related to this breach are in excess of the market cap of the equifax company, all company stock should be seized and distributed equally among those affected by the breach.

2) In the future, if a company controls this amount of sensitive data, they should have mandatory breach insurance. This means that they are covered for a government mandated amount based on the legal liability if all their data was lost. This will mean that the insurers will do in-depth audits of the data security of the company, and they will be incentivized year-to-year to ensure their security practices are top notch. The present system incentivizes each CEO to have a head-in-the-sand approach to data security where a hack is considered a long-tail event unlikely to happen during the ceo's 3-5 year tenure and therefore is not really worth paying attention to. In addition, it would ensure that if the potential damage done if data is leaked far exceeds the value of the business storing the data, the insurance will be prohibitively expensive and the company will not be able to continue with this line of business - as it should be.

</comment><comment><USER22> Is it legal for employers to provide salary data on particular employees without permission?

<comment><USER23> Under FCRA, your employer or potential employer must get permission from you before performing any credit report (which includes a salary report).

>You must give your consent for reports to be provided to employers. A consumer reporting agency may not give out information about you to your employer, or a potential employer, without your written consent given to the employer. Written consent generally is not required in the trucking industry. For more information, go to www.ftc.gov/credit.

[https://www.consumer.ftc.gov/articles/pdf-0096-fair- credit-r...](https://www.consumer.ftc.gov/articles/pdf-0096-fair-credit- reporting-act.pdf)

<comment><USER24> Page 13-14 of the 20 page employment contract you skimmed.

<comment><USER25> And if you don't agree, you don't get hired.

</comment></comment></comment></comment><comment><USER26> Why are these people still in business?

<comment><USER27> "Still in business"? Hell, not only that, their stock continues to go up after bouncing off what appears to be the bottom. Which makes me torn, because despite wanting very much to see Equifax and those of their ilk go out of business, I have a bunch of call options I bought when it looked like low 90s was about as low as they were going to go. I still hold those options (though they're set to expire in about two weeks).

You see, once EFX bounced off its low, I thought I'd catch a "dead cat bounce" with some call options I'd hold for a week and make a few bucks. It's a proven strategy for me, find a company with a scandal, wait a week for it to blow over, make a quick and small profit when it bounces back up. Then unload, because it won't last. Worked for me with United Airlines as one example. But EFX just keeps going up...and up, and I have no idea why. They were always a horrible, if profitable, company. But the Equifax problem isn't even remotely close to being resolved, and yet at the rate it's going it'll be back to pre- scandal prices before long. (Note that I don't believe it will get back to those prices any time soon, but it's trending that way.)

So to answer your question: I don't have a good answer. The almighty market seems to think things aren't all that bad, despite the masses of unpopular sentiment. My best guess is that there are a lot of fingers in that pie (this article being but one example) that don't want to see their source of data disappear. Still can't figure out why that's driving the stock price up, though.

<comment><USER28> I call those BP oil spill trades. Starts with a surprise events that is seemingly catastrophic. If real consequences require special government action -- the consequences will be underwhelming and easily mitigable. If you believe there's no ethical consumption under capitalism, there's no problem profiting off this effect!

See: BP oil spill, HSBC money laundering scandal, Wells Fargo fraudulent account scandal, Equifax data leak, United Airlines beating up a passenger... I know I'm forgetting some.

I'm pretty sure you could beat the yearly S&P's performance in a single trade for any of those events.

Apple having to delay a new iphone release would have a more significant long term effect on that company's stock price than workers at foxxconn facilities killing themselves

<comment><USER27> _If you believe there 's no ethical consumption under capitalism, there's no problem profiting off this effect!_

Yeah, I don't know where I stand on it quite yet. I mean, I won't outright buy Exxon shares to hold long-term. Is it hypocritical to make a short-term trade using options? Yeah, probably. But it's not like that money goes straight into Equifax's pockets, it just adds a minuscule amount of liquidity to a market for abstractions of EFX. Meh, I've got bigger ethical fish to fry right now.

As aside, to add to your list: the private prison company whose stock went down last year when the Feds said they were going to curtail using private prisons. A few seconds of reading confirmed that it's states that make the most use of private prisons, not the Feds. Made bank on that one, can't say I feel good about it. But I also can't articulate exactly _why_ I shouldn't feel good about it other than, "private prisons, yucky!"

 _I 'm pretty sure you could beat the yearly S&P's performance in a single trade for any of those events._

Of the three that come to mind that I've personally traded recently, that is most certainly true (the in-the-money EFX calls I have are up about 300%). Problem is, such scandals need to happen more frequently in order to make a trading strategy out of it. About once or twice a year is as frequently as I see such opportunities come up. One could have made a year's SV salary on EFX calls with a $50K investment, but because it's options that $50K could very easily be worth $0 in just a month or two.

</comment></comment></comment></comment><comment><USER29> Anyone have any idea if Experian and Transunion have something similar?

<comment><USER30> There are lots of companies in this space. If the big ones don't, there is a smaller, creepier one or a subsidiary that does.

As an example, One firm managed to figure out the correct expected birthdate of our child. The only record of this child are the medical and prescription records of the near fatal miscarriage that my wife was hospitalized for at 9 weeks.

If they can get that, one or more somebodies is paying off your company's payroll processor for your salary data.

<comment><USER31> No birth certificate? Those are, iirc, public records.

<comment><USER30> The child was never born. The only records are "anonymous" by HIPPA standards data that the hospital or insurance co likely sells or shares with 3rd parties who can match a hospital admission to our mailing address.

<comment><USER31> I'm sorry, I didn't catch that the first time.

Yeah. Many levels of creepyness there.

</comment></comment></comment></comment></comment><comment><USER32> Ok, so I wasn't able to find any of my employers there, and after looking more at the site, isn't that service something similar to companies like ADP who take care of doing payroll that employer voluntarily signs up and provides the information?

Because mine initial impression was that this site uses credit information to disclose every person's salary.

In that case I guess the main issue here is just that the information is not well protected, especially after recent leak.

</comment><comment><USER33> It seems in China people use their cellphone to pay everything these days, credit/debit card are becoming old-fashion and meaningless there. Hope one day we can do it here.

For mortgage and car loans you do not need credit card either.

So we can just give up credit card totally. We do need a new way to build people's credit scores somehow though.

<comment><USER34> Aren't their cell phones just linked to credit cards?

<comment><USER35> No. Credit cards are fairly uncommon in China. Most people link an ATM card and load a balance into their WeChat account.

<comment><USER36> I'm not sure how this works in China, but credit reporting isn't exclusively about credit cards (but that is probably the most common component). It's about anything that would involve extending credit - mortgages, car loans, personal loans, paying for a cell phone monthly, etc...

So, just because credit cards aren't common in China, doesn't mean that there isn't some other equivalent tracking going on... (although, I don't know any specifics).

<comment><USER32> PP means that in China, and actually majority places, people don't purchase daily needs on credit.

Yes people still need credit, and typically a government branch keeps track this kind of information.

</comment></comment></comment></comment></comment><comment><USER37> > Sadly, this isn't anywhere near true because most employers who contribute > data to The Work Number — including Fortune 100 firms, government agencies > and universities — rely on horribly weak authentication for access to the > information.

Sounds like the employers were doing it wrong.

</comment><comment><USER38> In Norway, everyone's salary is published online by the government.

</comment><comment><USER39> More and more grateful my nutty "Sovereign Citizen" parents never got me a social security number

</comment><comment><USER40> I didn't consider this at all. Leave it to Krebs to elucidate :).</comment>


MySQL 5.5.12 for macports, stay bleeding edge. - <AUTHOR> https://github.com/zquestz/ports

<comment><USER2> or you know..

1\. install homebrew, 2\. type `homebrew edit mysql' 3\. change 5.5.10 to 5.5.12 4\. brew install mysql

[https://github.com/mxcl/homebrew/blob/master/Library/Formula...](https://github.com/mxcl/homebrew/blob/master/Library/Formula/mysql.rb)

<comment><AUTHOR> Yep and install all binaries as your active user... and have non-traditional cellar based installs...

<comment><USER2> the binaries don't install as the active user for me... also it's Mac OSX, so I hope you aren't installing on OSX for a production server environment. I use mine as a development environment only so I don't really care much what user it runs under locally.

Also being in Cellar doesn't effect much for me. easy to change prefix on things if they really complain.

<comment><AUTHOR> Wow, powerful assumptions. Of course I wouldn't use it in a server environment. I just prefer ports. Been using them on bsd for years, just what I like.</comment></comment></comment></comment>


Ask HN: Best resources for a web developer to dive into server admin? - <AUTHOR>

I'm a proficient PHP developer, but thus far have not dealt with anything that requires scalability or requiring to know the system--everything has been taken care of by managed hosting. Now I want to dive right in and learn everything from load balancing and web server administration to server security, scaling, performance, and troubleshooting everything when things stop working.
I know the basics of Linux (even my desktop is Ubuntu), and I've messed a lot with Apache config files, ufw firewall setup, etc, so I don't have to completely start from scratch. But I'm not sure where to go to when it comes to scaling my application (like with nginx or haproxy), performance, security. I'm looking for book recommendations or other resources that can give me the whole picture.
What I've found so far:
UNIX and Linux System Administration - seems popular on Amazon, but not sure if it'll cover everything I need as a web developer, such as scaling.
The Official Ubuntu Server Handbook (3rd Edition) - Claims to cover server setup, clustering, cloud, troubleshooting, etc, but I'm not sure if having it only Ubuntu-oriented is good.
All advice is appreciated! <comment><USER2> If what you're really after is designing a scalable website - which is very different from system admin stuff - I think the "Building Scalable Websites" book is a great place to start: [http://shop.oreilly.com/product/9780596102357.do](http://shop.oreilly.com/product/9780596102357.do)

Perhaps a bit dated (2006), but most of it would still be relevant.

<comment><AUTHOR> Would I need to know how to do a lot of administration tasks? For example, when getting an ec2 instance, I pretty much have to build the whole server myself. That means I need to know how to secure it properly from hacking, as well as set up clusters, all the software (apache, nginx, haproxy, etc) with the right configuration, etc.

Additionally, when something breaks in the middle of the night, I'm going to need to know how to troubleshoot it. What do you think?

</comment></comment><comment><USER3> go for Redhat certificate . they are best in it

<comment><AUTHOR> Do they provide only the certification, or training too?

</comment></comment><comment><USER4> You are right to ask here for direction, and you are right to be skeptical of single vendor approaches. My advice is definitely don't go for formal qualifications.

I would say do something yourself, but make it public enough that you are guilted in to continuing to the bitter end: start a blog! Write yourself a challenge that uses a different type of technology on unix (various classes of database, various web technologies, various server availability models, directory services, cluster filesystems, fault-tolerant storage systems, message queues, virtualization paradigms, load balancing systems, snapshots, network intrusion detection systems, firewalls, digital telephony, each of a few major formal kernel security policy models, diskless workstations, clusters, etc.) then go solve it using as many different Linux distributions (especially source-based or minimalist distributions that force you to understand software dependencies) or flavors of unix as you can find.

For each challenge, write about how you approached the problem, what tools you found, how you evaluated them across areas like security, functionality, resource efficiency, technical trajectory (community, maturity, adaptability, etc.) and why you chose a certain approach, how your solution solved the original challenge, and how it might be improved upon in future.

After five challenges, every second challenge must be to go back and modify one of your earlier systems to do something extra (the "how it might be improved upon" part), use less resources, scale better, function in Arabic, or similar. This is a more realistic means of gaining experience as maintenance is actually most of the life of a software project.

If you do a challenge per week, after 25 challenges which will be six months, spend another week or two writing about the common patterns in the problems you have been solving, what you feel is repetitive, how you feel this represents the state of the industry, and what might be coming next.

Bonus challenge: Linux from scratch.

Many people should then offer to hire you... that education will be technologically broader and also more current than most people in the industry. Remember that with experience comes ... experience, ie. understanding the tools is different to knowing how and when to apply them, what their strengths and weaknesses are. That's why you write about it on the way, to maintain some perspective and think at a higher level about the efficacy of the overall system you are putting in place.

<comment><AUTHOR> Thanks a lot for the advice, I may just do this!

Cheers!</comment></comment>


Ask HN: What are the most exciting things for hackers today? - <AUTHOR>

Question in title. Could be anything-- the meta-fact that hackers now have power that extends to various other domains, some specific programming paradigm, etc. <comment><USER2> The most exciting thing is that society at large thinks it is exciting. Let's see if that translates into more students choosing CS major.</comment>


Time for more European countries to facilitate entrepreneur visas - <AUTHOR> http://tech.eu/features/48/europe-entrepreur-startup-visas/

<comment><USER2> Of course, if you have an actual _business_ that does not require starting capital, you are out of luck.

<comment><USER3> On the contrary; I think those are already well taken care of (even in USA, with E-1/E-2, L-1/L-2 and probably a few others). If you have a successful business, you can move nearly anywhere.</comment></comment>


Why didn't anyone help this poor guy? - <AUTHOR>

So I was on my daily route this morning and saw a bruised blind man standing near a construction area. I ran to him as fast as I could and when I reached him, I noticed that he had a scrape of blood on his forehead and he looked very confused and nervous. I slowly held his hand and told him that I would take him to his destination. I was carrying about 25 helium balloons in my hands so it was a bit difficult but I managed.
It was a busy street and as we took a couple of steps I noticed a huge crowd of people standing at a bus stop looking at me with a sigh of relief. These people were waiting for their NYC bound bus which arrives every 10 minutes.
So my question is, why didn't any of them help this poor man? Would it have been so bad if they were late to work by 10 minutes? Why were they all waiting for 'superman' to arrive when anyone who can see and walk could have helped him?
-Samir <comment><USER2> Sorry to break it to you, but some are con artists and people have been burned too many times.

1) I helped a blind guy once. It was a ruse to try to get money out of me. He could have found his way easily.

2) For several months, there was this young guy who seemed to have a horribly twisted body begging for change daily. One day we saw him walking down the street perfectly normal. There was never anything wrong with him.

It's not lack of compassion at all. It's being sick of being taken for a sucker. The evil isn't in the people wary of helping. It's in those who faked the need for help.

EDITED to add: The above is not academic. I live in NYC, where these cons flourish.

<comment><USER3> Lets say i was one time incredibly stupid, it did cost me 50€ and since then i never trusted anyone on the street.

We have taxes for social care, that is what i pay for not being bothered on the street. If someone asks me to call the abulance or the police i do it, but don't believe anything else.

From Germany.

</comment></comment><comment><USER4> Bystander effect (<http://en.wikipedia.org/wiki/Bystander_effect)—since> no- one else is helping, you don't want to, and since there are all these other people here, maybe they should be the ones to help. Maybe one of them is better trained to help than you.

Inconvenience—trivial sure, but can easily be rationalised as "who wants to be late to work in this climate?"

And personally I'd be worried about offering to help a random, confused, nervous looking person with blood on them. I would like to think I would help, but it would worry me.

</comment><comment><USER5> Sometimes you are the person who has to help. What the others do is their business. Keep being you.

Some time ago I came across a dying man in the street and ended up doing CPR on him. There were also plenty of other people who could have helped.

[http://blog.jgc.org/2010/10/you-never-think-youll-have-to- do...](http://blog.jgc.org/2010/10/you-never-think-youll-have-to-do-cpr.html)

</comment><comment><USER6> Because somebody else should/could/would do it? There's actually a pretty small percent of us (I hope I would have your compassion) that will take action when part of a crowd, but many of those people would have helped if they were the only one there. Sad huh?

</comment><comment><USER7> In my last year of university I had a class on ethics and I learned the case of Kitty Genovese, a woman who was stabbed to death in New York. Many people watched but nobody helped.

This "phenomenon" is called "dilution of responsibility", that is, people don't do anything, because nobody else is doing it. I guess what you observed was exactly this.

Found a link describing the case here: <http://www.talsico.com/newsletters/newsletter6.htm>

</comment><comment><USER8> Because everybody else was also thinking _"Why isn't anyone helping this poor guy?"_.

The better question is of course "why aren't _I_ helping this guy". Of course you did ask that as well, but most people don't. It's not in their nature.

</comment><comment><USER9> Well done for stopping to help.

</comment><comment><USER10> In many cases, this is a matter of priority. Most people either aren't interested or don't want to subject themselves potentially dangerous.

Some people might be more inclined to question your insane abuse of helium balloons while we are in the midst of a helium crisis. Why didn't anyone mention that to you? Probably because in most cases, advice like that is discarded or met with argument. Most people would rather not say anything and perhaps shake their heads than to even bring it up.

You also admit that you had to get close to notice the scrape of blood. If nobody else got that close, he probably wouldn't have appeared to be in any danger and hence, likely did not need help.

There is (what I assume to be) a homeless man in the neighborhood I'm currently in who every day visits a reflective sheet-glass window and poses, as if he is checking out his figure or how he looks for a substantial portion of the day (e.g., more than an hour) while he smokes cigarettes.

Perhaps he needs _help_ in the vague sense, but he isn't in any imminent danger that I can tell, and as I'm just passing through, I am not in a position to help him in any permanent way, nor am I inclined to contribute financially to his nicotine habit.</comment>


What to ask a millionaire? - <AUTHOR>

Hi, I have a lunch coming next week with a millionaire (CTO of Fortune 500) .
It's a rare chance so I'm making a short list of questions that I'm going to ask him. Please let me know if I miss anything important. Your advice is really appreciated!
Also, I'll be glad to ask him any questions you may have, and post his answers here next week.
1/What are 3 skills you think the most important to your success?
2/ Is networking a must to be successful? If yes, How do you expand your networks? (go to conf, meetup, keep in touch with old friends...)
3/ If one advice you could tell your younger self, what would that be?
4/ Do you read often? How do you apply knowledge in books?
5/ Is being a millionaire what you originally aimed for or it's just a sweet side-effect? :)
6/ Which one is more important to your success? Technical skills or entrepreneurship? <comment><USER2> "Interested is interesting."

Don't treat this opportunity as in interview. Be genuinely interested in his life, his story, and his company. If you show interest, he'll open up. Ask the questions you have based on the current context of the conversation. Everyone has a story to tell, all you have to do is be inquisitive.

You may just end up with a friend and mentor.

</comment><comment><USER3> How will the answers to these questions help you? To be honest, if you ask all of these questions, I think it may feel like you're interviewing your lunchmate.

Instead, could you possibly turn this into a mentorship relationship? Maybe figure out what personal advice you might appreciate from them instead.</comment>


Uber used secret spyware to try to crush Australian startup GoCatch - <AUTHOR> https://www.abc.net.au/news/2019-03-18/uber-used-secret-spyware-to-try-and-crush-australian-start-up/10901120 <comment><USER2> I am absolutely confident that despite Uber being an ultra shady company, this news is even more nonsensical. The "surfcam" is more of a lead generation program for Uber and it even did this against Lyft. Infact Uber people would use the free credits of Lyft to take a ride and then market Uber.

Any driver worth his salt has all the car sharing apps installed and switches between them.

In this case it's pretty obvious the drivers saw no obvious advantage of being a gocatch driver and switched to Uber. Also here in Melbourne gocatch were just advertising as app for taxi service, not like ride sharing that Uber did.I never used them even if I had free credits from them.

Bad marketing, wrong targeting, crappy advertising but hey they got to blame someone else for their failure

<comment><USER3> What is Surfcam and where can I find out more about it?

<comment><USER4> You can start with the article that is discussed here.

</comment></comment></comment><comment><USER5> I'd bet good money that this was one engineer with Charles or Burb MITMing their phone to get details on the GoCatch API, then scraping it with a python script.

It's the cyber equivalent of walking into a business and writing down the names on the name tags.

Complaining about stuff like this gives Australian companies a bad name.</comment>


The Door Problem (2014) - <AUTHOR> http://www.lizengland.com/blog/2014/04/the-door-problem/ <comment><USER2> I think the biggest issue in video games is the disconnect between how people perceive developers and what they do. Many people complain about QA teams and how they "aren't doing their job". The real issue is that making video games requires so much testing that they can't keep up with meeting deadlines and goals. Considering that someone has to hand test nearly all situations that the only way you can really test a game is to release a beta quality game and let your users tell you whats wrong. Warframe is the best at trying to manage peoples expectations. The creative director went on periscope during a big release which made people understand what is happening. The head liveops (community manager) allows them to walk on water ([https://twitter.com/rebbford](https://twitter.com/rebbford)) due to her ability to manage the community. Warframe is the sole example of a game that treats its uses like adults.

<comment><USER3> I worked in QA on some AAA titles and I remember being told that the hours the team was putting in testing the game (nearly 300 people over several months of over time) would be matched by the players in the first 6 to 8 hours from the release. That and when the team is filling hundreds if not thousands of defects daily, how can the dev team keep up and "fix" everything?

<comment><USER4> Why are developers reinventing the wheel for each release (seemingly)?

The fix in my experience is to build a baseline between the low level framework and the UI, like a business layer in most web applications or the HAL in Windows.

I'm not a game developer though, so just my stab in the dark :-)

<comment><USER2> They do this though its called a video driver and a video game engine.

</comment></comment></comment></comment><comment><USER5> It's like with all software.

On one project I have a whole design team that tells me how the doors should look and behave.

On the next project nobody really cares, so I paint them black, lock all of them and wait till someone complains abut a few that they want to open. ;)

<comment><USER6> And this is a pretty good way of going about things. Details of the doors don't matter until they matter.

And if some participants have specific desires/needs/opinions about doors, you can worry about those while leaving other unmentioned details painted black.

<comment><USER5> Yes.

Often people need more than they initially think of, but if you wake desires on stuff they don't need you just waste time for nothing.

</comment></comment></comment><comment><USER6> This is a fantastic example, and it applies to just about everything in life.

That which we only use or see is simple. That which we build, is not. Until you've had a custom home built, for example, you may think a home is a pretty simple thing. Likewise, until you've built any non-trivial piece of software, you might think it simple.

I suppose it's a human optimization to conceptualize and minimize things in our mind. It allows us to have enough of an idea to get on with whatever is more important to us. The problem is when we forget that we are naturally oversimplifying everything in life (except that one or two things we're actually doing/building).

</comment><comment><AUTHOR> I liked this article because it relates to any form of development.

The next time a client says "that doesn't seem too hard, can you just add it to the app?", I'm sure you can think of a laundry list of things that need to happen to implement it.

<comment><USER4> It's just a button. This was the joke at my old job.

</comment></comment><comment><USER7> Another point that could be made is that all the questions in the first part are important and need to be answered, and all the answers in the second part are what the relevant people involved will actually _do_ , but if you add up all the answers in the second part, you haven't actually answered most of the questions in the first part.

And I'd say I've definitely played games where major systems were done that way; someone up on high said the system needed to exist, and then people charged off and did concept art, and sound effects, and made assets, and setup scripting hooks, without ever really fleshing out the details of what the system was meant to _do_. Come to that, I've worked on some non-game projects that did the same thing. :)

<comment><USER8> All of the questions in the top are the Game Designer's job.

</comment></comment><comment><USER9> And the inevitable, "It shouldn't be that hard to add a door, you can do that in 30 minutes, right?"

<comment><USER10> It's just one line of code.

</comment></comment><comment><USER11> There have been movie and television shows about how movies and television shows are made. The same about newspapers and magazines. People don't really have a clue how games are made and what it entails. When I say I work in video games, people usually say: Really, do you program them?

</comment><comment><USER12> Ahhhh... This article was so therapeutic.

</comment><comment><USER13> The localization bit made me crack up.

</comment><comment><USER14> _Monetization Designer: "We could charge the player $.99 to open the door now, or wait 24 hours for it to open automatically."_

Good lord. Please kill me. Is this what game design has come to?

<comment><USER15> In terms of "AAA" game design, yes. There are still a few indie developers out there who actually want to produce good games. But capitalism means they don't win - the people who get the most money do.

<comment><USER16> Doesn't capitalism mean they could win, but not in this century?</comment></comment></comment>


Robinhood: Millennials "loading up" on MoviePass stock - <AUTHOR> http://markets.businessinsider.com/news/stocks/moviepass-owner-helios-and-matheson-stock-price-millennials-buying-igoring-skeptics-2018-5-1024863463 <comment><AUTHOR> The status quo isn't working for theaters. Last year a 6% drop in admissions and worst summer in 20+ years. Theaters need something to drive demand, especially for off-peak times and non-blockbuster movies where they keep a higher percentage of the ticket price (and all the concession profit). If MoviePass continues to grow subscribers, it will be the biggest driver of demand, and will be able to negotiate discounts from theaters, greatly reducing its average per-ticket cost.

[http://money.cnn.com/2017/09/05/media/summer-box- office/inde...](http://money.cnn.com/2017/09/05/media/summer-box- office/index.html)

<comment><USER2> MoviePass tried to demonstrate its leverage by blocking AMC theaters and certain movies.

It didn't work. Instead, they just pissed of their customers and showed AMC that they had no ability to drive customers to AMC.

MoviePass should have built upon its success at driving viewers to _indie_ films to target smaller theater chains and movie studios. Instead, it went the VC way and try to artificially scale itself up by buying customers, and is now on the brink of collapse.

<comment><AUTHOR> The geniuses at AMC managed to lose over $480 million last year. They ran just a 2% operating margin ($101M operating profit from $5B+ revenue). They may in fact kill MoviePass by refusing to budge, but they would be shooting themselves in the foot doing so. Who else is generating demand for movie tickets at this scale?

According to their own earnings releases, AMC's USA per-screen attendance dropped from over 38,000 admissions per screen in 2016, to 29,808 in 2017. [http://investor.amctheatres.com/file/Index?KeyFile=392398945](http://investor.amctheatres.com/file/Index?KeyFile=392398945)

<comment><USER2> _The geniuses at AMC managed to lose over $480 million last year._

You need to learn to read investor reports...The "loss" was entirely driven by tax law changes that changed how they accounted for certain items on their books.

"Included in the net loss for the quarter was approximately $310.0 million of tax expense in our U.S. markets related to the impact of the change in the U.S. enacted federal income tax rate from 35% to 21% and the impact of a full valuation allowance on our deferred income tax assets."

 _They may in fact kill MoviePass by refusing to budge, but they would be shooting themselves in the foot doing so. Who else is generating demand for movie tickets at this scale?_

Not MoviePass. Last I checked, the movie studios spent a few hundred million dollars on promoting movies in the US alone.

There's no point in bringing in more MoviePass subscribers if they're losing money per ticket due to splitting the revenue 3 ways (i.e., adding MoviePass into the cut) if those viewers don't also buy enough concessions to make up for the lost revenue. So far, it appears they don't.

That being said, AMC has a subscription pass coming out (or is already out in some markets) which is like the original MoviePass: a sustainable price that brings in viewers _and_ incentivizes them to purchase concessions (and additional tickets).

<comment><AUTHOR> Passionate defense of AMC, a company whose stock price has tanked by more than 50% since Jan 1, 2017. ::eyeroll:: Operating income was still just 2% of revenue last year. 2018-Q1 was strong but if ticket sales continue their downward trend, will they even make an operating profit? They have more screens than ever to fill, while variety -- the number of films in wide release -- is also trending downwards.

The $310m of tax-related expenses in Q4 must be countered against the gain in the other 3 quarters. Annual "income tax provision" was only $154M for the year. Earnings before income tax were still -333 million. The Q4 "loss" is essentially the reduced ability to take future write-offs ("deferred income tax assets"), since the corporate tax rate was just slashed. Meaning, executive management failed to maximize the value of deferred taxes, when rates were higher.

You seem to believe no MoviePass subscribers are buying snacks. Surely there are abusers of the system, and subscribers' average spend may be lower than the general public's, but more butts in seats does result in more concession sales. Do you have evidence otherwise?

Let me know when AMC's subscription is out, and it has 2.5 million subscribers. Will it be as awesome as Cinemark's Movie Club? $8.99 for 1 whole movie ticket?

</comment></comment></comment></comment></comment><comment><USER3> Are these the same millennials that bought snapchat stock at IPO ?

<comment><AUTHOR> Could be the ones who bought bitcoins at $3, or $30, or $300.

<comment><USER4> Those mostly weren't millennials, they were gen X libertarians. The ones that held long enough to make some real money, anyways.

I know one millennial who mined a bunch of BTC when it first came out, and then sold all of it when it first hit $20.

I also know another millennial who bought a bunch of eth at the IPO, and has held through everything.</comment></comment></comment>


Classical music works of the 21st century - <AUTHOR> https://www.theguardian.com/music/2019/sep/12/best-classical-music-works-of-the-21st-century <comment><USER3> What is their criteria for selection?

Are they working from the idea of a published piece of music that could be performed by any symphony, quartet, choral group, etc? Or is about what instruments it is for?

I'm just not clear on what their definition of "classical" music is.

<comment><USER4> Your confusion is completely right. The genre classical has an almost insanely wide meaning.

It originally only meant music from the Classical Period of 1720 to 1820, then Romantic music after that, and thus everything you describe above ought to be termed contemporary music (and is usually called something like that as a sub- genre).

There is a marketing explanation which is often the easiest definition to use, which is that labels have to box music into genres to sell and so they do, and get to decide if music should be pitched as classical.

Beyond using vaguely reminiscent ensembles, forms and orchestration then I guess the focus on the composer is probably the next main thing.

It is not a consistent definition though, where film composer John Williams gets called classical because of the aesthetic and influences and orchestration but then show music is not counted because for some reason its use of song forms and aesthetic is just not right, despite using mostly classical music orchestration...

Although there are classical pieces that are quite like show music. Like "The Trout" by Schubert (which comes under Programme Music which is also frowned upon as low tier by many music snobs).

So I can only really conclude that it's essentially the domain of marketers, critics and snobs to determine which artfully composed music deserves to be acknowledged as "classical" in the modern day and I think essentially the definition is "something that somebody collating new classical music for the Guardian / anyone bold enough to claim they define it thinks deserves the title".

Classical music is in the eye of the beholder.

<comment><USER5> > _Your confusion is completely right. The genre classical has an almost > insanely wide meaning._

To pundits, not to the common man, for which it means "mostly artsy stuff done with acoustic instruments by conservatory trained composers and performed and their like".

Heck, for the common man even the distinction "classical", "romantic" etc doesn't mean anything, Bach and Mahler is all classical, and even for my brother and their folks (classically trained professional orchestra musicians), the term "classical" is thrown around for all this repertoire.

It's just anything with "serious" trained composers, and (mostly) real instruments by conservatory players. Jazz and experimental works, like Xenakis or Stockhausen are excluded from called "classical" though, where e.g. a Phillip Glass piece would be included (but in that case, there's the "minimalist" branding which prevails).

In any, case since the article talks about modern works (21st century or so), it has probably this meaning:

[https://en.wikipedia.org/wiki/Contemporary_classical_music](https://en.wikipedia.org/wiki/Contemporary_classical_music)

<comment><USER6> Xenakis and Stockhausen definitely count as contemporary classical.

It's actually about lineage. Contemporary classical sells itself on the basis that there's a direct academic - sometimes historical - link to Beethoven, who was the prototypical Genius Composer.

Which is why you usually get all the stock tropes - concert halls, serious audiences in seats listening very intently, serious clothes for the players, a serious conductor at the front, clapping at the end only, definitely no cheering or dancing - that also apply to traditional classical music concerts.

It's also about intellectual content. Pop doesn't usually try to justify itself intellectually. Contemporary classical does nothing but. Which is why it's a long series of "isms" of various kinds, all making more or less convincing claims about their own immense cultural importance.

You don't get points for writing interesting music, you get points for creating a new "ism" \- preferably an "important" one - and then writing music around it.

The committed audience is actually tiny - five figures globally, if that - <USER2> "important" is debatable.

Even so - the idea that contemporary classical is "important", with the implication that other music isn't, is probably the key to the genre.

<comment><USER7> Former classical music composer here. Your analysis is quite spot on. Some people in classical music scene even call it "serious music".

<comment><USER8> There are other distinctions, though. For instance, classical music, aside from some forms of minimalism, is very definitely not about loops and layers. Classical music is more about long form narrative and has a lot more in common with long form fiction, with development, surprises, and entirely new contexts. The way a classical work is cohesive within itself is very different than how a pop song or jazz or electronica is.

<comment><USER3> Funny enough a lot of film scores and more recently TV and video game soundtracks also follow that formula with specific motifs for different characters with variations depending on the scene.

It's particularly noticable where you have a long running series that allow for the motifs to mature over time.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> [https://open.spotify.com/playlist/23NEgb3NCEA7OtY7nZUHwR](https://open.spotify.com/playlist/23NEgb3NCEA7OtY7nZUHwR)

</comment><comment><USER10> This is a great list! For anyone who's interested in a few more recommendations:

* For my money, John Adams's best composition this century is El Niño ([https://www.youtube.com/watch?v=a2IUdBLVkOQ](https://www.youtube.com/watch?v=a2IUdBLVkOQ)), though Doctor Atomic is also amazing ([https://www.youtube.com/watch?v=AlUHKHLk_VU](https://www.youtube.com/watch?v=AlUHKHLk_VU)). The former is a nativity oratorio and the latter is an opera about Oppenheimer and the Manhatten Project. On the Transmigration of Souls (a 9/11 memorial piece) is also especially moving. ([https://www.youtube.com/watch?v=bwoasXzLdVY](https://www.youtube.com/watch?v=bwoasXzLdVY))

* Revelation, by Michael Harrison. This piece uses just intonation rather than the more common equal temperament. In just intonation, the notes are tuned so that the fifth is "pure" \--- i.e., the frequencies are in an exact 2:1 ratio. This causes the other intervals to sound slightly out of tune and gives the music a really otherworldly feel. [https://www.youtube.com/watch?v=D4oKzSRs3sA](https://www.youtube.com/watch?v=D4oKzSRs3sA) (Michael Harrison, incidentally was a student of La Monte Young who revived just intonation and composed a 5-hour piano piece called The Well Tuned Piano. [https://www.youtube.com/watch?v=sfWV4rNB6KE](https://www.youtube.com/watch?v=sfWV4rNB6KE))

* Sleep, by Eric Whitacre. Now a classic choral composition. (Cloudburst is also great, but was composed in 1995 at the age of 21!) [https://www.youtube.com/watch?v=Yw5gupbe9E0](https://www.youtube.com/watch?v=Yw5gupbe9E0)

* Orient & Occident by Arvo Pärt. Pärt has a lot of great works like Für Alina (which marked his departure from serialism), but most of them were composed in the 20th century, although he's still active! [https://www.youtube.com/watch?v=xGMaIfNdqH8](https://www.youtube.com/watch?v=xGMaIfNdqH8)

* "...similarities between diverse things", by Joby Talbot (2002). For piano trio and vibraphone. The title comes from a mathematician friend of Talbot's who died at the age of 20 and used that phrase to describe why he found mathematics beautiful. [https://www.youtube.com/watch?v=4tawlg0RN4I](https://www.youtube.com/watch?v=4tawlg0RN4I)

* The Veil of the Temple, by John Taverner. A magisterial work lasting 7 hours. [https://www.youtube.com/watch?v=62pRsgwSYjs&list=PLga2eRXhIy...](https://www.youtube.com/watch?v=62pRsgwSYjs&list=PLga2eRXhIyUgJmsqGzAaE19EPGz_C1kSn)

* Chanson Eloignee, by Morten Lauridsen. A lot of Lauridsen's more famous works were composed in the late 20th century, but he is still active. [https://www.youtube.com/watch?v=4Ajmn9m-C9Y](https://www.youtube.com/watch?v=4Ajmn9m-C9Y)

And there's a lot more that I'm missing. A couple of other favorites of mine that missed the 21st century by a few years:

* Concerto for Harpsichord and Strings by Michael Nyman (1994) [https://www.youtube.com/watch?v=Svf9yuouXww](https://www.youtube.com/watch?v=Svf9yuouXww)

* Danzón No. 2 by Arturo Marquez (1994). This piece is great fun and helped to bring Gustav Dudamel to fame after he conducted it with the Venezuelan Youth Orchestra on their world tour in 2007. (Dudamel is now the conductor of the LA Philharmonic.) [https://www.youtube.com/watch?v=ZXeWiixwEz4](https://www.youtube.com/watch?v=ZXeWiixwEz4)

* 24 Preludes for Piano by Lera Auerbach [https://www.youtube.com/watch?v=G9u5wc2CkL8](https://www.youtube.com/watch?v=G9u5wc2CkL8)

Lots of great music out there!

<comment><USER11> I'm enjoying Michael Harrison's Revelation very much so far; thanks for the tip-off. By the way, the fifths in just intonation are a 3:2 ratio, not 2:1.

<comment><USER10> Oh shoot, good catch! Yeah, 2:1 is just an octave, of course.

</comment></comment></comment><comment><USER12> Very surprised not to see Nico Muhly on this list. There are many of his short pieces on youtube. I highly recommend "It Goes Without Saying", "Motion" and "Drones In Large Cycles".

Another interesting musician is the Ukranian pianist Lubomyr Melnyk. The live video of him in Hamburg is wonderfully shot.

<comment><USER13> Also from near Hamburg (now Berlin) is pianist/organist Nils Frahm, who featured in Hamburg several times, and also at the proms.

</comment></comment><comment><USER14> Without having read the article, as so often is the custom in comment sections, I am UNABLE to prevent myself from recommending the series of documentaries "Leaving home". Specially the first one. They're all on youtube.

"Home" here stands for the familiarity of classical/romantic music ("19th century" but including post-1900 stuff like Rachmaninoff and so on) but also more literally the tonic root of the harmonic system. Episode 1 is very closely about the road to serialism throughout Wagner, Debussy, etc. up until Schönberg's pre-serial and serial works. Then there are episodes about rhythm and folk influences and so on that widen the scope from just serialism.

If you have a piano or keyboard at home I also recommend trying some of these tone rows, verifying when they're "true" tone rows, etc. I sometimes try to improvise with common chord progressions with my left hand and tone rows that start (or end) related to the tonal progression to feel how they forcefully disconnect from attempts to think tonally.

Of course serialism isn't the definition of modern art music, but it's a mind expander.

</comment><comment><USER15> I'm pleased to see Heiner Goebbels listed, I know him from his excellent collaboration with Alfred Harth on _Frankfurt-Peking_ (1984), which is a jazzy sound collage album. I didn't know he also made classical music.

</comment><comment><USER16> seems like noise to me. How can it be classical if it's not even pleasing to ears?

<comment><USER17> I thought it was pretty but gratuitously sad. Got fed up and didn't finish the list.

Artists and philosophers both, I think, sometimes mistake sadness for import.</comment></comment>


Official Google Blog: "This site may harm your computer" on every search result?? - <AUTHOR> http://googleblog.blogspot.com/2009/01/this-site-may-harm-your-computer-on.html <comment><USER2> _Unfortunately (and here's the human error), the URL of '/' was mistakenly checked in as a value to the file and '/' expands to all URLs._

Wow, one character. That was one expensive character.

<comment><USER2> Incidentally, I'm glad to know that I can now tell my clients that I have a _Google-class_ QA procedure: I make my changes directly on the live site, without testing them, and I promise not to blow up the home page for more than an hour!

Six sigma, baby!

Seriously, though: We've all made similar mistakes before (though, after the first few times, we usually try to catch them on the dev server or the staging server). The trick for Google will be to ensure that this one is not made again.

<comment><USER3> I'm not sure it's practical to test this on a dev server with each update. All they really need to do is make sure "/" or sites ending with "google.com" and maybe some other white listed sites are never included in the file.

<comment><USER2> _I'm not sure it's practical to test this on a dev server with each update._

I tell myself that all the time. And then I pause, and sigh, and load up the dev site anyway, just to make sure the home page has not exploded. Because _sometimes it has_. Typos happen. Brain farts happen.

Obviously I wouldn't necessarily expect Google to test a dev server by hand every time they change some code. That procedure is for little people like me. [1] For something as important as Google I'd expect there to be a procedure whereby each new change gets pushed to a small group of boxes, which then run a few really simple automated acceptance tests ("If I do a search for a random term, do I get back a page with links that can _actually be followed_?") before the thing gets pushed live fifteen minutes later.

Apparently I expect too much. Perhaps I'm overengineering this. Maybe it's okay if, a couple of times a decade, we just cripple half the Internet for 30 minutes and give 5% of the world's computer users a virus scare.

\---

[1] At least until I get lazier (in the Larry Wall sense of the word) and write some more scripts.

</comment></comment></comment></comment><comment><USER3> This could be a PR nightmare for Google. On top of the Epic Google Fail, they could not even come up with an accurate blog post: [http://blog.stopbadware.org/2009/01/31/google-glitch- causes-...](http://blog.stopbadware.org/2009/01/31/google-glitch-causes- confusion).

It will be interesting to see the stories that come up when the regular news cycle begins again.

<comment><USER4> Interestingly, the StopBadware blog is now down - I can't get a response from it. I guess they got GoogleDotted.

<comment><USER3> Well StopBadware got screwed twice then. First, their site was overloaded because every Google user who attempted to view a search result url was taken to the interstitial page, which links to their site...bad news. Their site is still down as of this comment: <http://stopbadware.org>

Now I suspect their blog is down because Google linked to their blog.

The blog post basically pointed out some inaccuracies in the original version of the Google blog post.

</comment></comment></comment><comment><USER5> This is a risk you run when you have _continuous_ deployments. Luckily, incremental roll out, sufficient unit testing, and other safeguards mitigate the problem, but sometimes things are still going to slip through. I'd bet that significantly man more problems have occurred, but this is simply the first big, obvious one worth talking about.

This goes back to what I was preaching earlier about Microsoft and Google's varied approaches to testing. If this sort of bug got burned on to a disk and shipped to a million customers, it wouldn't have been a 40-minute problem... Sadly, Microsoft's testing culture bleeds into its ailing web culture and is becoming less effective in the modern auto-update world. See: Google grows impatient, so they patch Chrome with a workaround for Hotmail. Meanwhile, the Hotmail team is waiting for the next scheduled release. Lucky for Google, Chrome is mostly useless without an active internet connection useful for pushing updates.

</comment><comment><USER6> Someone should make the case for a separate test / dev environment to the big G :)

Seriously though, I wonder how many programmers / site builders are going to use this as an excuse for their own goofs....

"Look, if google can be down for half an hour due to one slash, you really shouldn't be angry with me for [insert some terrible mistake here]."

</comment><comment><USER7> Isn't StopBadware Niels Provos' Google 20% project?

</comment><comment><USER8> I wonder if that cost him his job.

<comment> a-priori I sure hope Google is more forgiving than that... in the grand scheme of things this is a very minor screw-up.

<comment><USER9> As a former Google employee, I can assure you that there have been far bigger screw ups than that... and it's just part of the learning experience. The bigger the screw up, the more money you've invested in training them :) (i.e. When I was there, one man single handedly instantly brought down 10,000 machines in a hard reboot... fortunately because of the way Google replicates and distributes things, the world was none the wiser. It really gave me great respect and trust in their infrastructure and no he wasn't fired.)

</comment></comment></comment><comment><USER10> Wow. Someone broke the Google by slashing on it.</comment>


What's next for Apple: iTora, iBible and iKoran? - <AUTHOR>

Would it be surprising, if Apple takes the path towards spirituality (remember, Steve Jobs once led a life of an ascetic) and starts offering the sacred books in its own digitized version? I am pretty sure that it would definitely have its mark of an "angelic" touch with a wonderful font design, not to mention a human voice option to render the recitation to take the believers to the greatest emotional heights. You would never know, given Apple's marketing savvy, they could bundle this with the iCoffin package, too. <comment><USER2> There are quite a few bible apps out there already. Most popular one is just called Bible I believe, it's free. There's a couple of very high quality ones as well.

Know less about the other 2 options, but I imagine there's different options there as well.

On the other hand, there were loads of musical instrument apps, and then Apple came with Garageband, which is far superior. Keep an eye on Apple's career page, as soon as they start hiring bible scholars you know what's going to happen.</comment>


Cap'n Proto 0.4: Time-traveling RPC - <AUTHOR> http://kentonv.github.io/capnproto/news/2013-12-12-capnproto-0.4-time-travel.html

<comment><USER2> My gut reaction was "ewwww", but upon reflection, this does seem like a great idea. I disagree with the claim that it "solves" the RPC problem (you may be making it _less expensive_ to make a network request, but you still can't pretend a network call is a function call; one of the big problems with such pretending isn't the latency but things like "total network failure" that are poorly represented by the function call abstraction), but it does go a long way towards mitigating it. The ability to create much more orthogonal and composable RPC interactions is a lesson that many such protocols could stand to learn.

<comment><AUTHOR> Oops, you're right, I should have said "helps solve" rather than "solves".

Yes, total network failure is still an issue. Typically, applications need to solve this by catching a network exception somewhere high up the stack and then starting over with a fresh connection.

There's certainly an argument to be made for using a different abstraction, e.g. those provided by ZeroMQ, that can handle fault tolerance more transparently. But, it all depends on your use case. A lot of things just don't fit into stateless models -- particularly real-time collaborative types of things. (ZeroMQ pairs nicely with Cap'n Proto serialization, BTW, if that's the route you prefer.)

</comment></comment><comment><USER3> Awesome, a C++ implementation of the Future monad. Personally I would prefer .flatMap to .then, as in Scala. That would also allow for a companion function .map that transforms the result of a Future using a function that does not return a promise.

ie: (in Scala, my C++-fu is weak)

        getTweetsFor("domenic") // returns a future
           .map(parseTweetsForUrls)
           .map(_.head)
           .flatMap(expandUrlUsingTwitterApi)
           .flatMap(httpGet)

<comment><AUTHOR> Heh, yeah, I only realized yesterday, I think, that promises are monads.

then() will actually accept functions returning regular values, too. A big difference between then() and map() is that then() accepts an optional second parameter for exception handling. In any case, I used "then" because that's what Javascript promises use.

<comment><USER4> JavaScript promises are wrong and broken. See the huge spec of the Promises/A+ vs. the few lines of specification for a correct one.

<comment><AUTHOR> Are they broken in a way that I have copied? I don't actually know too much about the details, I just copied the `then()` call.

<comment><USER5> I haven't looked at your implementation, so I'm basing this on the statement "then() will actually accept functions returning regular values, too" in your grandparent comment. Because of this you don't have a true Monad (as in your Promise implementation doesn't satisfy the third monad law).

One easy way to think of Monads is that they are like black holes - you are free to put something into it but can't ever pull it back out. Instead, all you are allowed to do is chain them together (with bind). So to transform the value inside a monad, you must write a function that takes that value and returns the transformed value wrapped in the same type of monad (Promise in this case). The monadic machinery in 'bind' will take care of pushing the result from one Promise into the transform function.

<comment><AUTHOR> What dwrensha said, although I'd describe it like this: Allowing then() to take a function which returns a bare value rather than a promise is just syntax sugar. You can always wrap a bare value in a promise by creating an immediate (already-fulfilled) promise. Giving then() such a function -- that wraps its result in a promise -- is equivalent in behavior to giving then() a function that just returns a bare value, except that the latter is somewhat more efficient in implementation.

</comment></comment></comment></comment></comment></comment><comment><USER6> I don't understand how this is different from the standard RPC model.

A typical RPC in a C++/Java/C# language looks something like this:

      var client = EchoClient::Connect("corba://example.com:9000");

      var request = new EchoRequest();
      request.set_message("hello world!")

      var options = new RpcOptions();
      options.set_timeout_milliseconds(5000);

      Future<EchoResponse> futureResponse = client.Echo(request, options);
      EchoResponse response = futureResponse.Wait();

According to the article this is going "back in time", but that's completely silly -- the response is being returned at the point of the Wait() call, which blocks until the server has finished RPC processing.

And of course, languages with proper thread support (e.g. Haskell) don't need to bother with futures at all, because it's easy to spawn a new thread for each request instead of blocking some central main thread.

And it's fairly easy to provide syntactic sugar over this to provide closure- based control flow

<comment><AUTHOR> Where does that code come from? That's not Cap'n Proto.

Sorry, but did you read the docs?

<comment><USER6> That's the kind of code that would be used in a typical RPC system written in the last ~20 years. You have some sort of client stub, a request object, and a response handle that has operations for waiting until the server has generated the response. The actual marshaling implementation could be ASN.1 or JSON or Thrift or whatever the local programmers want.

I want to know how the Cap'n'proto design discussed in the post is significantly different from this standard RPC model.

<comment><USER7> If you're executing a 2nd procedure call that uses the output of the first (or 3rd, 4th 5th etc) then it requires 1 call. A traditional RPC system would either need a combined method (which is suboptimal from a "clean design" perspective) or you'd get the response of the 1st back, and then just pass it back to the server for the 2nd call.

<comment><USER6> So the major improvement described here is a hint to the server that it should pass the response from one RPC directly into the request of another, rather than returning anything to the client?

That seems like it'd only be useful in very specific circumstances; you'd need RPC methods with the same type for request and response, and it only works if you're using the same backend for each call (e.g. you can't have load balancing of separate calls).

<comment><AUTHOR> If you read the documentation, I give an extended argument for why this is useful: it enables more object-oriented protocol design.

[http://kentonv.github.io/capnproto/rpc.html](http://kentonv.github.io/capnproto/rpc.html)

Also, it is _not_ the case that the new RPC's input type has to match the old one's output. You can take just one object embedded in the old response and use it in the new request.

Please do look at the examples.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> It seems my post has been severely penalized by HN. Went from #2 to #30 all at once, then dropped from the front page.

Anyone know what I did wrong?

<comment><USER6> You submitted a post about programming to PoliticsNews. Please try again when you have an outrageous story about government abuse.

<comment><AUTHOR> I think I figured it out. Someone with moderator rights must have read the summary, not read the documentation in detail, and decided that I had only implemented regular old promises/futures and was calling this "time travel". They probably missed the point of promise pipelining -- which is something that no mainstream RPC system implements to my knowledge, only research systems like CapTP. So they demoted it for making what they assumed to be a ridiculous claim about a mundane piece of software.

Sigh.

</comment></comment></comment><comment><USER8> Is anyone using Cap'n Proto in production? What has your experience been?

<comment><AUTHOR> Canonical is using it in Ubuntu Unity:

[http://packages.ubuntu.com/source/trusty/unity-scopes- api](http://packages.ubuntu.com/source/trusty/unity-scopes-api)

There is also the OSX text editor, TextMate, which uses Cap'n Proto for some kind of cache file.

Sadly, most users don't actually tell me about their experiences, but given the number of people asking questions and filing bugs, I suspect there are many more.

The biggest thing holding people back is lack of MSVC support.

</comment></comment><comment><USER9> SMB and NFSv4 have support for something similar in their protocols. Nice to see it generalized. The file protocol versions only chain RPCs on success. You can't operate directly on the result.</comment>