Knuth's 'Earthshaking Announcement' due tomorrow - <AUTHOR> http://www-cs-faculty.stanford.edu/~uno/news.html#lectures

<comment><USER2> Using new features of TeX π, Knuth has inserted interrobangs along critical fault lines, and he intends to offset the entire West Coast, widening rivers and reflowing the Pacific; the Bay Area will be left flushed and right ragged, creating many widows and orphans. The only way to stem this bold, unjustified plot is to transfer a well-padded figure of $175,921,860,444.16 immediately to the Bank of San Serriffe.

<comment><USER3> Land: It's the only thing they're not making more of.

<comment><USER4> the lesson here is: Don't make jokes on the internet unless you've thoroughly researched the 'facts' of your 'joke'.

<comment><USER5> You have no idea how many jokes I've abandoned after realizing that they're scientifically inaccurate.

</comment></comment></comment></comment><comment><USER6> Unfortunately, it appears to be just a lecture called "Earthshaking Announcement". The previous one was called "All Questions Answered" and I'm sure he left some questions unanswered.

</comment><comment><USER7> I really think this is going to be one of the most overblown things ever. I seriously doubt it's actually going to be interesting at all. Really. He's being sarcastic with the title of a lecture. Calm down fanboys.

<comment><USER8> Nothing will ever trump 'it' aka the segway.

<comment><USER9> or Transmeta or Danger inc. if you were around in 2000.

<comment><USER10> or Geraldo Rivera opening Al Capone's vault live on television. Anyone here remember that?

<comment><USER11> Or Geraldo Rivera giving up the positions of the army unit he was embedded in.

</comment></comment></comment></comment></comment><comment><USER12> I had it on my list to post a reminder of this today as well-- looks like you beat me to it.

I'm curious to see other's guesses here. My personal hunch is that he is going to declare TeX complete, and move the version number to Pi (as he had planned to do upon his death.)

<comment><USER13> Don't you mean tau/2?

<comment><USER14> Maybe he's declaring the project finished early so as to avoid the upcoming pi/tau bloodshed :-)

<comment><USER15> I gather you say that pi/tau jokingly.

<comment><USER16> You're tau/pi funny

<comment><USER17> Well... My old cd burner was a tau/pi. Does that count?

ObOntopic: it most lilkely is him declaring version pi.

<comment><USER13> Huh?

<comment><USER17> A tau/pi = atapi Just a bad joke.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> He's announcing that he's retiring. He had some health issues in 2006 so I really hope it's not related to that. Of course his consciousness will be uploaded to a positronic brain so he'll be around for a while yet.

<comment><USER19> If he was actually retiring, he's not the kind of guy to call that an "Earthshaking announcement."

Incidentally, I went to his last Stanford lecture, the lecture hall with maybe ~400 seats was totally full, and there were exactly 3 women in the audience.

</comment></comment><comment><USER20> Back when it was first announced, everybody made jokes about the new TeX policy and every document made using TeX will have to be reviewed before publishing :)

</comment><comment><USER21> He's quitting Stanford to work for Facebook|Google|Twitter.

<comment><USER22> How will this be earth-shattering?

Not trying to be a dick, just wondering if you have a point if you're not kidding.

<comment><USER23> Dude, it's _Knuth_.

OTOH, maybe Twitter will continue their overengineering by porting everything to MMIX.

<comment><USER24> TeX <-> JSON <-> JavaScript translator?

</comment></comment></comment></comment><comment><USER25> TeX 4.0 will have Ribbons.

</comment><comment><USER26> Tomorrow @ 5:30 PM PDT, to be more precise. <http://tug.org/tug2010/program.html> Given how many people on HN are interested in this, I'm curious to see how fast, and in what manner, the announcement gets posted here. Perhaps someone tweets it directly from the conference and the tweet gets posted here. I'm hoping for a post here by 6:00 PM.

<comment><USER23> We could just crash it, it's in Union Square (SF). :)

</comment></comment><comment><USER27>
        \blink{}

<comment><USER28> \marquee{ }

</comment></comment><comment><USER20> Maybe the numbering of TeX will now go up to 6 and something...

<comment><USER29> Yes, he is changing the numbering from pi to tau.

</comment></comment><comment><USER30> He converted to OpenOffice.

</comment><comment><USER22> Does p = np or not?

That's what I hope we'll find out tomorrow. Too hopeful?

<comment><USER31> A tad too hopeful.

<comment><USER22> One can still dream!

</comment></comment></comment><comment><USER32> Will TeX somehow tie into eBooks?

<comment><USER33> Would put money on it being along these lines.

</comment></comment><comment><USER34> Any theories on what Knuth will announce?

<comment><USER35> Premature optimization is actually cool.

<comment><USER36> People stress out about random number generators too much.

</comment></comment></comment><comment><USER37> I've seen a bunch of companies/ people using this strategy lately. Making it appear like they're going to make a revolutionary statement that is going to change the world.

An "idea implemented." Unfortunately is rarely turns out to be something concrete - it's usually an idea with a significant buy in... But an idea that's a step in the right direction... A call to action...

Examples:

1) Cisco announced a really fast router that was going to "change the Internet forever." ([http://tech.fortune.cnn.com/2010/03/09/what-cisco-lacks- in-s...](http://tech.fortune.cnn.com/2010/03/09/what-cisco-lacks-in-sex- appeal-it-makes-up-for-with-speed/))

2) Bloombox (<http://bloomenergy.com>)

Of course, as others have pointed out maybe he's just playing the fool.

<comment><USER12> Come on. You're really comparing a throwaway line in the "upcoming events" section of Knuth's blog to a Cisco press release?

<comment><USER37> I actually just thought it was an interesting discussion point for strategies like this; I also pointed out that he might be playing the fool.

Did not mean to garner offense.

<comment><USER12> No offense taken, but the point is, there's no "like these." You're comparing two very different things. Knuth's comment was aimed at piqueing the interest of the tiny fraction of people who might want to come see him at a TeX celebration-- which has absolutely nothing to do with hyperbole in marketing press releases.

</comment></comment></comment></comment><comment><USER38> 47 minutes past the scheduled 5:30 pm, pacific announcement time. Earth still stable.

</comment><comment><USER39> I'm pretty sure the announcement will be release dates of Volumes 4a, 4b, and 4c of "The Art of Computer Programming."

<comment><USER12> Not likely. The release date for 4A, sure-- that's scheduled for later this year. 4B and 4C aren't even written, much less available in pre-fascicle form.

Besides, this is an announcement at a TeX conference; it's going to be TeX- related.

<comment><USER39> Thanks for the update, I was under the impression that each of the fascicles were a dot volume, instead of chapters within 4A.

</comment></comment></comment><comment><USER40> Maybe he's created an earthquake algorithm?

</comment><comment><USER41> Well, if He's not the one demostrating P = NP or P != NP, some other will have to take the token. That's life. Anyway, Knuth is a great hacker, having my respect and admiration.

</comment><comment><USER42> Do we know how long this has been up?

If it was something as significant as P{=,!=}NP, I really doubt he would have been able to keep this hidden for any length of time.

<comment><USER24> For a month or so. It was announced on HN before. Hit up searchyc.com if you are curious how long ago.

</comment></comment><comment><USER43> The Art of Computer Programming will not get finished.

</comment><comment><USER44> This thread has too many one-line jokes like reddit.

</comment><comment><USER45> TeX will be able to render moment tensor solutions, with a package called Beachball.

</comment><comment><USER46> I think he will retire. That is the last speaking engagement in the page.

</comment><comment><USER47> Maybe he will unleash the missing volumes of TAoCP

</comment><comment><USER48> What's the purpose of this besides having us speculate? Just have a post tomorrow with whatever Knuth announced and it's enough to have a good discussion.

</comment><comment><USER49> This better be good

<comment><USER50> In the same spirit as his objections to the old style delta (<http://www-cs- faculty.stanford.edu/~knuth/cm.html>) he'll be making comments regarding whether we should be writing with $\phi$ or $\varphi$

</comment></comment><comment><USER51> title should say "Knuth's..." not "Kuth's..."

<comment><AUTHOR> sorry for the typo. that's a hard to control habit of mine, because in german it's ok to write 'Knuths'. fixed it.

</comment></comment><comment><USER52> He will be introducing the $99 holographic PC.</comment>


Google banishes China's main digital certificate authority CNNIC - <AUTHOR> http://www.zdnet.com/article/google-banishes-chinas-main-digital-certificate-authority-cnnic/

<comment><AUTHOR> Google says a future update in Chrome will remove trust for all certificates from China's main root certificate authority.</comment>


How to Win Friends and Influence People Summarized - <AUTHOR> http://www.westegg.com/unmaintained/carnegie/win-friends.html <comment><USER2> If you do want to read "How to Win Friends and Influence People", try to get an older version of it. It has been rewritten over and over by Carnegie's successors, with more "relevant" but less interesting anecdotes. The original is filled with fun anecdotes about turn-of-the-century robber barons. Good stuff.

</comment><comment><USER3> The only thing I am not sure about in this book is the whole "a person's name is the sweetest sound" thing. It is hard to use this piece of advice correctly, and more often than not comes across as " I just read Carnegie's book the other night". When I hear my name being used just for the sake of throwing it in a sentence, I make a mental check of whether I am being manipulated, and this is pretty much the only effect.

<comment><USER4> I wish _The Gulag Archipelago_ were search-able online somewhere. There is a chapter where Solzhenitsyn is describing the attitude of the various ethnic groups who occupy the same hell-hole prison that he is in. A prison where many were confronted with the choice between licking others plates and starving to death.

I can't remember if it was Croatians or whom, but he described a particular group as being the nicest, most generous bunch of men, despite the fact they were dying of hunger. He mentions that this one person would always address him by his full name (including the patronymic) with the intent to show respect and endearment.

I think this usage of a person's name embodies what Carnegie was trying to get across.

[edit]

If you have children, try addressing them by their full name. It's the closest thing to their actual personage that came come from your mouth, and it's a pleasure to take the extra time to utter it because you love them so much.

I think the key is not to try to figure out where to sprinkle someone's name into a sentence, but to figure out how to like them enough to want to use their name.

[/edit]

<comment><USER5> I thought having your parent enumerate out your middle name(s) was the classic sign that you're in deep shit…

<comment><USER6> Not in Russia, where first/patronymic is a proper formal address. Just good manners. Very good manners under the circumstances.

I think this anecdote was in his short story, 'One Day in the Life of Ivan Denisovich' if I'm not mistaken? And I think the plate lickers were the first to die.

<comment><USER3> Yes, but when it's a parent talking to a little kid, the formal address can mean one of two things:

a) they are being funny, in the "look at you being all grown up" sort of way;

b) the kid's in trouble.

Funny how some things are international that way :)

</comment></comment></comment></comment></comment><comment><USER7> I used to be a big fan of this book, but every time I tried applying the principles, I only did it in the 1-2 "insipired" weeks, right after reading or re-reading the book. Then, as time passed, I gradually shifted into my old habits.

I used to blame my weak willpower for a while for that - but now I think the problem could be with the book itself. I feel the problem is that this book focuses too much on the 'outside', the presentation layer, instead of the 'inside'. It's how to _act_ like you're a successful, popular person with lots of friends, even if you're far from it on the inside.

Of course, many have noted that acting "as if" will eventually turn you into that person, I think that's true only if you actively focus on that goal. The book does not. It only occasionally pays lip service to "inner character" (ten pages about smiling a lot... and in the end "oh by the way, you actually have to be nice for this to work").

Having said that, I still think it's a very good book for many geeks who have no idea about social norms at all, to provide as sort of tutorial on this topic.

<comment><USER8> Sounds like you had a similar experience to mine. The book has powerful concepts but is dangerous for the soul.

</comment></comment><comment><USER9> The title of this book always put me off - but I eventually picked it up and I'm glad I did. It is not a book about how to be a jerk. The content is excellent, despite the cheesy/manipulative sounding title. Available in audiobook too.

</comment><comment><USER10> Much of the advice in this book can be explained by people wanting to feel important. Doing anything that makes people feel less important (criticizing, arguing, saying "you're wrong") doesn't help your situation. Doing anything that makes people feel more important (give sincere appreciation, remember a person's name, let others talk about themselves) likely will help your situation.

I still recommend reading this book. You'll get a lot more out of it than you will from summaries, because the book contains real-life examples that clarify what each principle means and how it can be applied. If you're put off by the title, remember that it was written in 1936. "Influence people," sounds very manipulative today, but in the book it simply means "to be an influential person." I think that's an important distinction to make, because the latter is more relationship-oriented than the former.

</comment><comment><USER11> Good summary, though reading the actual book may make it easier to internalize those principles. I figure that's similar to the 10,000-hour rule for becoming an expert in a field: the more time you spend internalizing something, the more likely you'll actually _use_ what you just read.

<comment><USER12> That's true, but summaries like these are very useful in two cases:

1) People who've already read the book (like me). Keeping big books around is a waste of space, but a list like this can bring the content of the book flooding back.

2) People who aren't going to buy the book or think it sounds lame, but who could be convinced by getting a taste of what it offers.

I'd certainly advise reading the book, but I think there's still a ton of value in summaries like this.

</comment></comment><comment><USER13> I find it depressing that the best way to get on someone's good side is a combination of gratuitous flattery and ignoring their faults. Have you ever noticed how much of our language is devoted to simply not offending people?

<comment><USER14> If you read the book, it specifically tells you to not resort to gratuitous flattery and instead give genuine, meaningful, and honest praise. The book also suggests you to point out people's faults in a more indirect and encouraging manner, so as to incite a desire to improve rather than a doubt of one's abilities.

</comment></comment><comment><USER15> I've always wanted to build a site that does a tl;dr of advice books, since it always feels like a few simple things plus a boatload of stories and blah blah etc.

<comment><USER16> If you want a piece of <http://www.squeezedbooks.com> , you're welcome to it. I'd love to hear your ideas about making it better.

Phillip Greenspun puts it rather nicely on a review of "Crossing the Chasm": "This book illustrates a fault in the publishing industry. If you have a 50-page idea it is too long for a magazine. But it is too short for a book. So if you wanted to get it distributed before the Web came along, you had to drop in words until you reached 200 pages."

</comment></comment><comment><USER17> The book is a classic, its advice looks sensible, but I always found the title dreadfully cynical.

Having a friend is something else than knowing someone you can influence. It seems to me that finding real friends is much harder than applying this sensible, but limited advice.

<comment><USER18> As someone above hinted at, I think the title is more a product of the times. When the book was written, "influence people" probably meant more like what "be influential" or "be a trusted source" means today.

</comment></comment><comment><USER19> Think of...

\- a few real people you like, and would like to know better

\- the most convincing people you know

\- the best leader you ever followed

How do those people fare alongside Carnegie's recipes for success? In my case, I'd say "not too well".

</comment><comment><USER20> I read Dale Carnegie's book 4-5 times over because I enjoyed reading it.

It really backfired on me one time, though. I was staying in a hostel and some guy was angry at me (it's not important why). I decided to go for the "take the blame, and agree that it's your fault to disarm your opponent who expected a fight". The angry guy really felt like I was patronizing and I didn't give a shit about him, which just made him more angry. Oops.

I was convinced that my Carnegie verbal kung fu was better than that. I made note and next time I'll argue briefly before conceding and moving on.

I also agree with someone in this thread who said that it's annoying when you suspect that these techniques are being used on you. I have a friend who reads those kinds of books and I regularly wonder if he is being genuine when he asks my opinion about something.

</comment><comment><USER21> I think these ideas are probably true in every era and culture, blackswan, being based on universal truths about human nature. Applying them mechanically I am sure you will agree is a terrific idea. Don't you?

Thanks for the post blackswan. Each of your posts is better than the last. Even the ones I didn't understand why you posted, blackswan, not being of such a high caliber as yourself. I have modded you up blackswan. Keep up the fine work, blackswan.

Now I must be off to my Toastmasters meeting.

</comment><comment><USER22> I recommend to read the book. Without reading it is hard to understand the principles behind it. Book shows practical examples throughout and explains how other person feels when each principle is applied.

</comment><comment><USER23> I'm not a big fan of HTWFAIP. It's basically "don't be a jerk". A lot of geeks are good at that already, and could actually afford to be a bit more of a jerk.

<comment><USER24> This is the problem, most people don't even know if they are being a jerk or not. I thought I had good social skills until I read HTWFAIP. It made me realize how socially inept I was. Turns out the main message in most social intelligence books is the emphasis of empathy; it is actually a hard skill to learn and one that's usually underestimated by the majority of people especially geeks.

<comment><USER25> Steve Blank had an interesting post about this: <http://steveblank.com/2010/02/08/emulating-empathy/>

</comment></comment></comment><comment><USER26> I just listened to the audiobook and jotted down very similar notes on my whiteboard. Thanks for sharing!

</comment><comment><USER27> There's only one way to make people like you, actually, or am I misreading that sentence? ;)

</comment><comment><USER28> _Don't criticize, condemn or complain._ Certainly don't condemn, that's just being a dick.

Be careful about criticising, will that really and I mean really help?

Complain? Trying to stay positive is good for your mental health. Never complaining, not so much. Completely hiding your feelings is bad for one of the most important things in life: Making a true and honest connection with other people.

 _Give honest and sincere appreciation._ Or to put in a more general way, seek honesty and communication.

 _Arouse in the other person an eager want._ Aha! This must be the secret to influencing, but.. uhm... how do you do that exactly?

 _Become genuinely interested in other people._ Sure, again seek genuinely human connections, that's a good thing.

 _Smile._ :)

 _Remember that a person's name is to that person the sweetest and most important sound in any language._ Not for me, you can call me anything as long as you're good to me. A great old guy completely screwed up my name once, to the point of calling me a completely different name. By the time I realized he was NOT talking to someone else, it was in front of company and I didn't want to embarrass the old man. He kept calling a name which was 100% not my name, but he was a great guy! I like that guy a lot. So yeah, what ever. It's not about the name, it's about showing you care about someone, the name's just a small part of that.

 _Be a good listener. Encourage others to talk about themselves._ In other words, interrupting people is rude, and talking too much is also kind of a dick move.

 _Talk in terms of the other person's interests._ Communicating with others is honestly hard, it really is. One "trick" you can use is try and frame things in a way the other person can understand, use metaphors invoking things they like etc. As you communicate with someone the understanding between you and them will grow and you can communicate more with less effort.

 _Make the other person feel important - and do it sincerely._ Oh I bet that's another secret, and how do you exactly and sincerely make people feel important? All I can guess is listening and communicating without treating them a like an inferior.

 _The only way to get the best of an argument is to avoid it._ Sure don't be that guy that looooves arguments. Unless you're having dinner with Brits, arguments are just damn good fun, it's bad if you can't hold your own! And some, in fact often the most important arguments can NOT be avoided. In fact, a pathological avoidance of arguments will in the long term NOT make you popular. The above rule can be put more simply as: "Don't be a dick."

 _Show respect for the other person's opinions. Never say, "You're wrong"_ Don't be a dick.

 _If you are wrong, admit it quickly and emphatically._ Be honest, communicate, don't be afraid of failure or embarrassment.

 _Begin in a friendly way._ Don't be a dick.

 _Get the other person saying "yes, yes" immediately._ And how do you do that exactly? Do you open with: Is the sun bright or what?

 _Let the other person do a great deal of the talking._ Don't be a dick.

 _Let the other person feel that the idea is his or hers._ Or maybe you should seek agreement, and try and make them see things your way and tell them how their way of thinking inspired yours, and don't be a manipulative sociopath.

 _Try honestly to see things from the other person's point of view._ Don't be a dick. Be honest, communicate... I feel like I'm repeating myself.

 _Be sympathetic with the other person's ideas and desires._ I am repeating myself.

 _Appeal to the nobler motives._ Yes appeal to things which are good and legal, not damaging and/or illegal things.

 _Dramatize your ideas._ Communicating with other is really hard. You can't just dump a succinct thought in your head and expect everyone else to get it.

 _Throw down a challenge._ Or offer something that's fun. Just don't bring people down and don't be a dick.

 _Begin with praise and honest appreciation._ Positivity, honest communication, etc.

 _Call attention to people's mistakes indirectly._ Don't be a dick, but do be honest and sincere. Don't be an obtuse prick, people do appreciate honest communication.

 _Talk about your own mistakes before criticizing the other person._ Don't be a dick.

 _Ask questions instead of giving direct orders._ Use the Socratic method of teaching. If you can that is. That shit ain't easy!

 _Let the other person save face._ Don't be a dick, and try not to embarrass people.

 _Praise the slightest improvement and praise every improvement. Be "hearty in your approbation and lavish in your praise._ You might not want to "make it rain" with cash, but verbal recognition cost you nothing so the ROI is like infinite.

 _Give the other person a fine reputation to live up to._ Yes, when most people think you don't think much of them, they'll meet your expectations.

 _Use encouragement._ Didn't we just talk about that? _Make the fault seem easy to correct._ Don't be a dick, be honest but positive and don't embarrass people.

 _Make the other person happy about doing the thing you suggest._ The best you can do is invest a lot of effort into honest communication and making the other person feel respected and that you think of them highly. And then try to tell them why what you suggest is important to you and try to communicate your ideas as best as you can, dramatically, with things they are interested in, etc.

And if that's not enough, you're screwed. But maybe they'll still do it. Just don't be a dick or a sociopath.

Now recently I by accident (pointless small talk before a meeting) found out my manager and I share a common interest. We've been talking about it often because we enjoy talking about it.

And recently I also mentioned I wished one of the projects I'm on had him as a manager, but I was also happy he was happy not be part of that cluster fuck.

Yet I've never red "How to Win Friends and Influence People" and I haven't seen this website before today.

All I try to do is:

1\. Not be a dick.

2\. Be honest.

3\. Be positive.

3\. Avoid fear, embarrassment, false pride, etc.

</comment><comment><USER8> This book is filled with great anecdotes and effective strategies. I've used a lot of them, however there are some downsides.

1) By constantly making people feel good about themselves, you create a sense of entitlement and pride which can be very difficult to work with when you need them to stand down. There is a reason they tear you down before they build you up in boot camp.

2) People who religiously practice this style of communication can seem annoying and manipulative, even if they are successful and popular. When I've followed the advice in this book completely, I've ended up feeling more popular but also more alone.

I've found a sprinkled dose reality check can be a good thing for all involved, particularly those you care most about.

<comment><USER12> _I've ended up feeling more popular but also more alone._

Anecdotally, it seems to me that, on average, the most successful members of our society are lonelier than the average - celebrities go on about it a lot.

Luckily, people are motivated by different things. Many people are glad to be financially poor but well loved in their communities. Others prefer the alternative. None of this is good or bad unless it feels so to you. Was becoming more popular but distanced good to you? If not, I can certainly see why you might want to tone down the charm :-)

<comment><USER8> I'm much happier with real mutually respectful relationships - the kind you can't establish by acting like a politician. I find every time I play these flattery games with long term relationships, it keeps things rolling, but leaves a deep division.

This book is great for people who want to establish a network or run for office. It also provides food for thought in more personal relationships, but it's dangerous to act this way to real friends.

</comment></comment></comment><comment><USER29> "Lie, Cheat, Steal, and listen to heavy metal music."

or was that something else?</comment>


Ask HN: Are BBC and CNN intentionally squashing AAS bombshell? - <AUTHOR>

Just to be clear I am in favor of reducing CO2. I am not in favor of selective reporting. Am I missing something? This is the American Astronomical Society making the announcement, not some fringe right-wing group. I am sympathetic to many of CNN and BBC's positions but they have lost all credibility in their silence. I can't watch Fox (too political) but I can't stay with BBC after this so its Christian Science Monitor I guess. <comment><USER2> Some context would be useful. What announcement? The AAS website doesn't seem to be highlighting any announcements, and CSMonitor hasn't got any news up on this "bombshell" either?

<comment><AUTHOR> [http://www.csmonitor.com/Science/2011/0614/A-sun-with-no- sun...](http://www.csmonitor.com/Science/2011/0614/A-sun-with-no-sun-spots- What-that-could-mean-for-Earth-and-its-climate)

[http://www.boulder.swri.edu/~deforest/SPD-sunspot- release/SP...](http://www.boulder.swri.edu/~deforest/SPD-sunspot- release/SPD_solar_cycle_release.txt)

<comment><USER2> Thank you for those links. My take on it is that they're not intentionally squashing anything, it's just that predictions (especially on a topic as stuffy as astrophysics) aren't as news-worthy as actual events?</comment></comment></comment>


Phantompy - Headless WebKit engine for Python, like phantomjs - <AUTHOR> https://github.com/niwibe/phantompy

<comment><USER2> I wonder if Phantompy is truly headless so it works on servers without GUI libraries and without xvfb.

QtWebKit needs access to some GUI features out of the box, but phantomjs includes platform abstraction code that avoids the dependency on an X server. That's the feature that made me migrate my own C++ crawler code to phantomjs.

<comment><USER3> Actually, you don't even need xvfb these days (and I have no idea why anyone is telling people that they do). You could use something like xserver-xorg- video-dummy. Of course, as you have pointed out, PhantomJS doesn't require an X server (as opposed to these other projects, wtf) so that it is "really really truly headless".

</comment></comment><comment><USER4> OT I know, I cant help but feel a little smug when I see cool projects like this and they use cmake, and not autotools.

Thank you cmake, you've made working in the C ecosystem fun again.

<comment><USER5> CMake is pretty horrifically inefficient at compiling WebKit. The makefiles it generates fork to call CMake (to do things like printf in color) far more than they fork to call the compiler. The ninja generator is better, but it has various issues with long command lines on WebKit currently (trunk CMake fixes some of these, but then it doesn't make some directories in the output directory).

Also, the CMakeLists syntax is pretty nasty IMO, but it feels like gyp, cmake and autotools are in some kind of syntax ugliness competition... (Maybe because nobody ever wants to work on a build system, so they'll just do this one little hack which inevitably grows tentacles).

</comment></comment><comment><USER6> Is there anything wrong with the python bindings to phantom? I used phantomjs (it's great)a few years ago and I thought there were some python bindings to the original phantom C++ library - could be wrong though.

<comment><USER7> There _were_ a set of Python bindings for phantom.js named PyPhantomjs, and it was included in actual phantom releases, but the maintainer moved away from the project, no-one stepped forward and it was ultimately removed from the project (<https://github.com/ariya/phantomjs/issues/10344>).

So this project is really useful.

<comment><USER3> > no-one stepped forward and it was ultimately removed from the project

Here's the source code, if you are interested:

<https://github.com/kanzure/pyphantomjs>

</comment></comment></comment><comment><USER8> Nice. There's also <https://github.com/jeanphix/Ghost.py> which I remember using a couple of months ago.

<comment><USER9> Ghost.py seems promising but is painful to work with. Installing the dependencies took about an hour (compiling PyQt itself took about 25 minutes). When we did finally get it working, PyQt would crash after the third or fourth scrape and would take between 15 to 30 seconds per scrape. Where we used it: [https://github.com/createch/PriceChecker.py/blob/master/pych...](https://github.com/createch/PriceChecker.py/blob/master/pychecker/scraper.py).

My advice to anybody looking to do headless webkit in Python: Don't use Ghost. Try out PhantomPy and try using the Selenium webdriver for Phantom.

We switched over the Selenium webdriver for PhantomJS and found it to be much more stable and fast. See this SO answer by another Ghost.py user who gave up: <http://stackoverflow.com/a/15699761/854025>. Where we used the Selenium driver: [https://github.com/createch/PriceChecker.py/blob/phantom/pyc...](https://github.com/createch/PriceChecker.py/blob/phantom/pychecker/scraper2.py).

<comment><USER10> Just to give another perspective: I'm not sure on which OS you had those issues, but I'm successfully using Ghost.py on Ubuntu and OS/X. On OS/X it was harder to install PyQT and sometimes there were weird issues, but on Ubuntu it all went smooth.

By now I've ran it on thousands of different websites with little issues. It's true that I'm "recycling" the processes after ~10 sites, but that's mainly because of memory leaks.

EDIT: and to clarify on Ubuntu installing either PyQT or PySide (Ghost.py now supports both) was as easy as apt-get install...

<comment><USER9> I tried (but failed to) get it to run at all on OS X. We were able to get it to run on Ubuntu, but thats where it crashed after every three to four scrapes.

<comment><USER10> When was it?

<comment><USER9> About three weeks ago.

</comment></comment></comment></comment></comment></comment><comment><USER11> There are so many half-baked headless browser projects, many building in some way on PyQT. I've made heavy use of Spynner and Ghost. Spynner especially. It always seemed to offer _exactly_ what I needed but the inconsistent docs and endlessly-deep stack always seemed to leave successful implementation just beyond my grasp.

Now, as an OSS maintainer myself, I sympathize. But I'd love it if this or another one of these projects started breaking away from the pack and could build some critical mass. I'm all for democratization but in this case I'd gladly trade 10 mostly working projects for a single solution ran by an iron- fisted BDFL if it meant decent docs and a mostly stable API.

</comment><comment><USER12> I've been working on a project like this that's nearing completion (it works, and the api is mostly complete). It differs from this in that it uses any normal browser to fulfill requests (via extensions).

The idea is to have a pythonic API to any browser that has reasonable support for extensions; i.e. a cross-browser scripting.

<comment><USER13> What does it offer over Selenium Webdriver? Yeah, the API is not terribly pythonic, but it's battle tested and stable, works across almost all browsers and there's always wrappers like Splinter (<http://splinter.cobrateam.info/>) if you prefer a more pythonic interface.

</comment></comment><comment><USER14> For those of us on the outside, what's the typical use cases of a headless browser engine? Testing?

<comment><USER15> We use it to generate images from a website. We do a product with HTML5/CSS3 and webfonts, layout it all then "screenshooting it" to make a final image with the proportions we want. It's cool because its server side and we can generate endless images based on what the user want.

Addendum: If you want to use webfonts, specially from Google, you need to recompile Phantom to support WOFF.

<comment><USER16> Can you capture PDF that way, or is it only png?

<comment><USER15> To do PDF, you better install HTML->PDF command line tool than that. What this do is simply load a webkit browser and we just perform an screen of that.

<comment><USER16> Printing works differently in different engines, so I want the designer to use her HTML / chrome skills to design templates, and then render the PDF with users data using the same engine. Command line HTML to PDF tool will work too, but it will require the designer to relearn engine quirks.

</comment></comment></comment></comment></comment><comment><USER17> OT - I've been looking for a headless WebKit for Go (Golang) I've searched all over with no luck. If anyone wants to become famous, please make one :)

</comment><comment><USER18> Does this actually offer full DOM access?

I see a 'cssselect' in tests.py, but I wonder how much of the DOM Api is actually supported?

<comment><USER19> Take a look at lib/webelement.hpp -- there's not too much yet, notably absent is a way to iterate children. But you can evaluate Javascript.

</comment></comment><comment><USER20> Cool you can take screenshots with it, see the test_capture_page example.

</comment><comment><USER21> Will this render Flash content?

</comment><comment><USER22> Looks phantastic</comment>


Startups and the Art of Motorcycle Maintenance - <AUTHOR> http://adgrok.com/startups-and-the-art-of-motorcycle-maintenance <comment><USER2> Another biker here.

It's true that as a motorcycle rider you're completely invisible: not just that you should imagine yourself invisible -- you really are. Nobody in a car has the faintest clue that there can be non-car vehicles on the road, probably next to them when they change lanes, etc. If you think they can see you, you're dead.

BUT I like it that way: it's cool to be invisible, and it's also safer. Car drivers don't understand bikes: when they see you they have all sort of weird reactions -- like kindly going to the side to give you more room, forgetting that there might be _another_ bike on the _other_ side that they are cutting off!

My favorite car drivers are the ones that don't care about me, stay in the middle of their lane at constant speed -- in general, those who are predictable.

And that's probably where the analogy with the startup world breaks: a startup really needs to be noticed to move forward -- although maybe not by everyone; it's better if competitors don't notice you before it's too late.

So cars are competitors; but who are the customers?

<comment><USER3> > _[...] it's also safer. Car drivers don't understand bikes: when they see > you they have all sort of weird reactions [...]_

I don't understand how people reacting unpredictably could be safer. If your choices are (1) drive a car and other drivers behave as you would expect or when they don't at least you are in a similar vehicle with seat belts and some shock absorption, or (2) drive a motorcycle, and other drivers either don't see you and drive into your space without warning or else freak out, and in a collision you are likely to be horribly maimed or die, I must say that (1) sounds dramatically safer to me.

<comment><USER2> Driving a car is probably safer than driving a bike.

But, being on a motorcycle, it's safer to stay invisible (and drive accordingly) than to be "visible" and incur weird reactions from car drivers.

</comment></comment></comment><comment><USER4> Cool writeup :)

I would also add that you need to be intimately familiar with your bike (startup) if you're going to succeed.

Every bike you ride is different, the clutch, the steering, braking distance, all of that varies and knowing exactly how to operate it can mean life or death.

When I first started riding I ended up rear tire skidding through a few red lights because I didn't have much experience stopping my bike from high speed. It was absolutely terrifying ;)

</comment><comment><USER5> I'm impressed, a non-rider hit almost all of the basic bullet points for safety on a bike. You have to _beat_ that into new riders most times.

<comment><AUTHOR> Thanks. I am a non-rider, but know enough riders and have read enough biker blogs to know a thing or two.

Of course, this is the guy who got on a motorbike with a bicycle helmet because it's all he had. I should learn the basics instead of high-level theory maybe...

<comment><USER6> Especially when you're a passenger and you can't influence all those things. Wearing the right gear is all you can do.

</comment></comment></comment><comment><USER7> Motorcycle owner / Startup founder here. Love riding and love my work. Having jumped out of planes, skied the Swiss alps and rocked out at Burning Man, there is still nothing quite like gunning my Ninja on the i5 at night with all 5 lanes to myself. Similarly, nothing compares to the rush and energy you get from running your own startup.

</comment><comment><USER8> Was anyone else hoping this would be about Quality?

<comment><USER9> There's a great essay in there trying to get out. Someone needs to write about the romantic vs. classical perspectives on startups.

</comment></comment><comment><USER10> It's helpful to hear the perspectives of others occasionally, if not often, to help to determine changes to our own work and lives.</comment>


Why big companies fail to keep talent - <AUTHOR> http://www.forbes.com/sites/ericjackson/2011/12/14/top-ten-reasons-why-large-companies-fail-to-keep-their-best-talent/ <comment><USER3> VladRussian, if you're reading this, you've been hellbanned. You just commented on this story an hour ago, so I figure maybe you'll pop back in here and see my message.

You probably don't know me, but you are someone whose name I recognize, and whose comments I've enjoyed over the past 2 or so years. Very sorry to see this happen to you, and for no apparent reason that I can tell. Maybe you'll get reinstated, or maybe you'll leave for greener pastures -- but either way thanks for trying to make this place a little better.

<comment><USER4> thanks for letting me know, and i appreciate your kind words. When HN pages started to load slow - "slowban" - i guess it was a "big T" for "time to go" :) for me which i didn't recognize.

> for no apparent reason

When i downvoted several PG supporters and upvoted several opponents - <USER2> and the likes - in the yesterday's "Trolls" thread it seems it was the last drop :)

<comment><USER5> Actually you got autobanned for including a link to a site that spammers had been promoting in comments.

<http://news.ycombinator.com/item?id=3350300>

Someone just sent me an email pointing out your account had been banned, presumably by mistake, and I just unbanned it. Sorry about that.

<comment><USER4> Thank you. Sorry for the ban reasons guesswork in GP.

</comment></comment></comment></comment><comment><USER6> Another biggie is a failure to pay market rates for existing employees.

If you stay at a company, they will give you some fixed pay increase, perhaps tied to your annual review. After a few years, your pay could get seriously out of whack with the market.

Many companies have a policy of only fixing such problems after the employee gets an external offer. Of course, by the time the employee gets the external offer, they are pissed at their current employer about being underpaid, so they leave.

tl;dr; pay your employees market rates, or plan for turnover of employees experienced in your own practices.

<comment><USER7> Oh boy that's a biggie here. Last year the raise given for "exceeds" was around 1% - 3%. For comparison, inflation is running at about 5% in the UK, so effectively if you work as hard as you can, you still get a pay cut.

Currently, I'm interviewing new hires who will be roughly a paygrade below me. They will start with a 10% higher salary than my current.

Needless to say, I'm not a happy bunny. Sadly, there aren't that many software companies here, so I can't easily move jobs.

</comment></comment><comment><USER8> A pretty decent list. In addition I'd add that company's often find it hard to detect when they've changed in a way that drives away top talent. A company can make a few boneheaded changes in a single year that has already caused all of their top talent to irrevocably make the decision to leave. But it may take months or years for them to follow through on that. And it may take years for the impact of losing top talent to be felt. In the meantime the company could still continue growing and even increasing its profits. It's only when the company finds that it can no longer execute on new projects nearly as effectively as it once did that it feels the impact of that lost talent.

</comment><comment><USER9> So here's a question I have been battling with for weeks. Some of these things are definitely things that are wrong with the system, but how reasonable are some of these other points? Like wanting to work on interesting projects, wanting to work with smart people, etc. Is it selfish to want a lot of these things? I quit my job a few weeks ago because of some of these reasons, and I can't help but think that maybe sometimes you have to just live with some stuff.

I guess what I'm asking is where is the line between being that guy who's always fighting management and being a yes-man? And are all of these things really actionable issues?

<comment><USER10> One thing that has happened with me is, as I progress, my expectations about what is reasonable have changed.

I used to get really unhappy about being asked to just "get a quick fix" out the door. At my next job, I wasn't nearly as internally angsty about this, given that there is a tradeoff between what the business needs ("this bug needs to be fixed now so that merchandise can arrive by Christmas") and core engineering.

I often wonder, then, if my previous position would have been less stressful to me had I a different expectation about the tradeoff between engineering-vs- business needs. To me, working with smart people was something I wouldn't compromise on. But doing non-interesting bugfixes? Less of an issue than it was previously.

</comment></comment><comment><USER11> Let's not pretend this only happens in "big" companies. Any company who's headcount grows to more than five tends to make the same mistakes _especially_ if they're run by inexperienced start-up entrepreneurs.

</comment><comment><USER12> I don't really agree with any of these things. I'll go over them point by point and then add my reasons.

First is the issue of bureaucracy. This doesn't matter to me; it's hard to get individuals to do things, and it's hard to get big corporations to do things. If you want something done, do it yourself. Remember, the same bureaucracy that won't upgrade your Linux kernel is the same one that would be in charge of punishing you for doing it yourself. So don't fear the consequences of actions; if something feels right, just do it. (The one procedure that we can get our sysadmins to do here is to reboot a machine. So we have a "firewall rules" script, writable by developers, that is run from rc.local. If we really need some package installed, we do it from that script and then request a reboot. Against "change control policy"? Probably. Do I care? No.)

Next is having good projects. I suppose this matters for some people, but at the end of the day, I find pretty much everything programming-related interesting. If someone wants me to manually edit a billion records, or something, that's simply not going to happen, so nobody asks. You can't be afraid to push back if someone wants you to do something that you'll hate doing. Nobody wants you to hate your job, after all.

Performance reviews are always stupid. I've never seen the point of them. The people doing the reviews don't know how to program and don't take input from programmers, so the review boil down to random guessing. Which is fine, because a good review gets you no raise, and a bad review gets you no raise. It's just a big waste of time. (I get "meets expectations" every year, because they can only give out one "exceeds expectations". I mostly find it hilarious because I'm consistently in the top of the list of edits to our company-wide source repository. If being the top 10 in a 75,000 person organization is "meeting expectations", the expectations are a little high, I'd say. But that's OK, because management doesn't even know what edits or source control is.)

Strategic priorities are amusing. A bunch of people that know nothing about business or software will make lists of important-sounding things. The reason you are considered "top talent" is because you know this is bullshit. Ignore the todo list and work on what you think is important. (Same goes for the next point, being told how to do your job. If your management can't do the job, how can they check that you are doing it their way? They can't. So do things right.)

"Top talent likes top talent." That I can agree with. I know people can't be fired from big companies, but I wish they could be indefinitely suspended with pay. ("We'll pay you to STOP CHECKING IN CODE.") Then the three people with a clue wouldn't have to waste their time reverting the mistakes of the people trying hard for a good performance review.

The next three things boil down to how management works at big companies. If you are a really amazing programmer, they're not going to make you a manager. That's because they need programmers, not managers. So managers end up being blown-up programmers with enough people skills to get promoted. That means they make decisions with people skills rather than with programming skills. In order to get buy in, you have to "play the game", that is: don't treat it like your glibc mailing list, treat it like you're trying to get someone to date you. Be nice, say how your idea will unify teams, etc. People that can't understand details don't want them. Play to their people skills side, and everything will work our for the best. "I heard about this project and implemented it over the weekend" also works.

Anyway, I think the biggest problem is work environment and pay. I can get a 50% raise if I quit and go somewhere else. I can get a 2.5% raise and 20% bonus if I stay. The economics tell me to leave. You can't beat the economy. Same goes for work environment. I don't really believe that a top 5 corporation can't afford a 30" monitor for me. Stop lying and buy me the shit I need to get my job done. (The reason they don't want to buy people expensive equipment is because most people don't do any work. If those people see the three good programmers with bigger monitors, they'll want them too, just to feel good about their dick size. This goes back to the problem of not being able to do performance reviews properly.)

<comment><USER13> I'm guessing that you haven't worked at a place where it can take months to get a single line change implemented in production. This kills creators with the huge lag time between fix and implementation. I won't even go into meeting abuse.

<comment><USER12> Yeah, you've got to get those rules changed. It seems to be popular around here to call everything an "emergency fix".

(But the rules are changing. Right now, I only have to click one button to deploy to production, and it requires no manager sign-off. We hired a new CTO and that was the result :)

<comment><USER14> Obviously your employer sucks at bureaucracy. My employer has a "project and quality management system" (PQMS). Basically we have a group that sits around and thinks up more useless things that we could be documenting. Some documentation that they wanted last week is not good enough this week.

We have "phase reviews" before anything is released, no matter how minor. A "phase review" is essentially a long meeting with a dozen or more people (including one or more people from development) where the PQMS people bicker about the wording of something but no one cares that the thing does not work well. Then half a dozen people have to sign the documentation.

At the end of each sprint (we do something that we call Agile but is actually its antithesis) developers have to sign off on their peer reviews, which have been printed out. QA people have to create several documents (this seems to be QA's main function) and sign them and then everything is signed by multiple managers who know very little about what went on. We also have daily "stand- up" meetings that all development and QA people must attend. These meetings usually last 15-30 minutes but can last an hour or more. Before each sprint we have a "design review" meeting where people who know nothing about software development try to create user stories in our ticket system while everyone watches. A few days later we have a retrospective meeting and then we do sprint planning where we watch the same people who created the user stories try to enter sub-tasks for developers. Most of these meetings must be documented and of course people must sign the documents.

There is also a large repository of documents which supposedly describe every process that we use. These documents are of course inaccurate and rarely useful. A few of them are updated each week and everyone is required to read the updates.

No one, other than top executives who do not care, has any real power to dispute any new policies that PQMS creates. I should also mention that the people in the PQMS group have no understanding of software development.

<comment><USER15> Your company surely makes a ton of money. Otherwise it would burn to the ground in mere weeks. The story you're telling sounds terribly expensive.

<comment><USER12> BofA has all these dumb processes, and as a result, the stock market values the company at less than the total of its assets. CEOs do not make the connection between stupid policies and utter financial failure. "More policies," they say, until one day, the company is gone.

</comment></comment></comment></comment></comment></comment><comment><USER16> I boil the reasons why down to two primary issues:

1\. Failure to offer competitive pay. 2\. Failure to provide a great work environment

<comment><USER17> True, but those are further reducible to: failure to understand the nature of employees.

Companies that look at their employees as "resources" (read: commodities) will not see the value in competitive pay, a good work environment, or anything else on the article's list. It all stems from a fundamental misunderstanding of the role of talent in an organization.

Something tech companies have grokked for awhile, which a lot of other industries really haven't, is that human resources is a _strategic_ discipline when it's done correctly. Good HR strategy recognizes that employees/talent are the lifeblood of the company, and that the loss of great ones is as potentially catastrophic as the loss of millions of dollars. When an employee who's capable of generating millions of dollars' worth of innovation, technology, productivity, insight, and opportunity to a firm leaves the firm, the total opportunity cost of his or her departure is precisely those millions of dollars.

More employers should endeavor to understand that equation.

</comment></comment><comment><USER18> "However, [big company bureaucracy is] usually a reason that masks the real reason. No one likes rules that make no sense. But, when top talent is complaining along these lines, it's usually a sign that they didn't feel as if they had a say in these rules."

Well, no, not really. This strikes me as patronizing, as if they're saying, "those silly employees _say_ they mean X, but they _really_ mean Y." Well, no, I mean X. When I say I don't like bureaucracy, it's not because I can't get along with rules I didn't have a hand in. I can deal with other people's rules. Big companies have certain disadvantages in communication and coordination, and things like rules and processes and standards can help. I totally get that.

But what I keep seeing is that nobody's looking at what the rules are trying to accomplish and trying to make it easier to follow them. You want every change to be accompanied by a requirement or bug reference? Great--not a bad idea; make it dead simple to do. I remember filling out _paper forms_ for code review documentation as recently as a few years ago. That's just silly. Code reviews aren't bad, but paper forms?

There's hundreds of little friction points that add up, though. The ubiquitous second/large monitor. Stock machines with slow, small drives and RAM. More and more network resources moved offsite, accessed via a slowish WAN. Limits on email storage, and auto-deletion. Limitations on what software you can install. It goes on and on, down to the breakroom amenities, office supplies, and so on.

Every little (needless) obstacle between me and the work getting done just pushes me closer to the door. Any difficult work is going to have obstacles, sure. But why make more?

</comment><comment><USER19> One additional challenge for large companies is the dilution of all actions due to the multiple layers. Many companies including Yahoo/GE have initiatives at the highest level that are aimed at correcting the issues highlighted, but the vision and the message gets completely diluted by the time the first line managers act on it. This dilution has to be stopped first for successful implementation of any retention initiatives.

</comment><comment><USER20> Perhaps big companies are around long enough for people (talented or not) to grow older until their priorities have changed enough to no longer fit within the company.

Unless you're in quite a large amount of control of a company's direction, it's likely after enough time (if you're talented) you'll want to move on to working on something that is outside the scope of that company's focus.

</comment><comment><USER4> the longer talent stays in (kept in) the less of a talent it becomes. Been there myself and when interviewing people who've been long term with a big company, it is very noticeable how one sided their experience and thinking is. Changing jobs once in at least a couple of years keeps your mind open and up- to-date for the current technological developments.

Following the Adams logic of the opportunity costs, all these "stupid boss, performance review, process" reasons are there to help you to not get comfortable, to help you by providing a motivational nudge to make a move.

</comment><comment><USER21> i don't think they're failing anything. most big companies don't need or want superstar. those big companies who do, don't have these problems.

"bigco isn't willing to pay for [superstars] -- they are executing an established business model quite effectively without superstars, and it makes sense to continue to do that while its economically feasible."[0]

[0] [http://www.dustingetz.com/the-unnecessity-of-superstar- middl...](http://www.dustingetz.com/the-unnecessity-of-superstar-middle- management-in-bigcos)

</comment><comment><USER22> My biggest thing when working at AOL was no upward mobility. If I wanted to manage developers, literally 70-80% of my time would be sucked into the ether with meetings and product reviews. There is so much management overhead there that it's a nightmare to actually get anything done. Once you manage even just one person, you're going to have no time left to do what you actually like (and are probably good at): programming.

So why not go to a smaller company where people listen to your ideas _and_ you're able to do what you love and make a difference? I think the thing people want the most is to know that they're making a difference. This is nearly impossible at a large company.

</comment><comment><USER23> I think that top developers may be like explorers - once the frontier is settled, its time to explore further afield. It's not that the settlers aren't nice, it's just not exploring.

</comment><comment><USER24> Do big companies really fail to keep talent? Yes, talented people leave. And in particular, attention-seeking, talented people leave. But I've also met lots of very talented engineers within large companies that have been there 5-10 years or more. And I've been at startups where the talent was running out the door like the place was on fire.

The article fails to support the theory that big companies are any worse at retaining top talent than companies in general. Not surprisingly, people who are highly talented tend to be in more demand, they tend to get more offers, and they tend to have more mobility between jobs. When they want to move (for whatever reason - personal, boredom, etc) - they can.

There are a number of good tech companies that recognize this and make sure that if a valued employee is leaving, they leave on good terms and it's made clear they can come back later if they want to. That makes a lot more sense than trying to figure out how to prevent talented people from ever leaving.

</comment><comment><USER25> I think the author is making assertions based on dubious assumptions:

       Whether it's a high-profile tech company like
       Yahoo!, or a more established conglomerate like
       GE or Home Depot, large companies have a hard time
       keeping their best and brightest in house. Recently,
       GigaOM discussed the troubles at Yahoo! with a flat stock
       price, vested options for some of their best people, and
       the apparent free flow of VC dollars luring away some of
       their best people to do the start-up thing again.

Firstly, these companies are in trouble. It doesn't matter whether it is a big company or small. Financial troubles tend to lead to cuts in headcount.

Places such as DuPont have a lot of long term scientists. They offer the best unprecedented freedom as well as a lot of facilities and support. In startups, a worker has to wear many hats, and not all wish to do that.

</comment><comment><USER26> Good list -- I think it hits the essentials.

Most of these issues can be traced to a single cause, which is that as companies grow, there's a growing 'diffusion of responsibility' effect that takes place in terms of people's responsibilities towards one-another. Bosses and managers are clustered and have an ever-changing set of direct reports, ergo they see the responsibility of engaging and keeping talented people as a 'company' problem and not their problem. Similarly, talented people see the company as an uncaring monolith, and not a set of individuals that can help them get to where they want to be.

In the end, there is no 'company', there are only the individuals that compose that company. Their decisions make things happen. The less agency you give those individuals (or perceive those individuals to have), the harder it's going to be to keep the most talented around.

</comment><comment><USER27> Overall, the article generally reeks of employees that are too lazy/complacent/comfortable to pull out the big guns and aim for what they want in a big company. Obviously if you've had your big guns out for months/years and you still feel ungratified, then yeah, probably time for a change.

There are my initial reactions to all the points.

1) Bureaucracy getting you down? Tear down/bypass useless red tape.

2) Can't find an interesting project? I'm sure there are hundreds of interesting teams nation/worldwide you haven't met yet.

3) Poor annual performance reviews? Learn the system and work it, even if you have to play kiss up every now and then to important people. It's your money in your bank, after all.

4) No discussion around career development? No lead is going to turn you away if you go into his or her office and ask for it.

5) Feeling jerked around? Stand your ground and don't be a yes-man (or woman).

6) No one holding you accountable? Call for your own brainstorming sessions and peer reviews.

7) Can't find smart people? See note above about finding an interesting project.

8) Don't understand your company's vision? Either take ownership and try to influence it if it's that important to you, or keep your head down and keep doing awesome work.

9) Encountering closed-minded imbeciles? See note above about getting jerked around.

10) Don't like your boss? See note above about finding an interesting project.

The reason why I generally dislike working at my big company (wonder if they'll see this!) simply boils down to a lack of challenge. Not intending to come off as arrogant, but if I can dedicate 20% of my brainpower and consistently get rave reviews from everyone around me, something is seriously wrong with the picture. So I generally wait until the last minute, code sprint, say "check please," and go home and do something more interesting with my life.

<comment><USER28> _The reason why I generally dislike working at my big company (wonder if they'll see this!) simply boils down to a lack of challenge_ To me this encapsulates the problem we're talking about. The fact that you're coasting and not challenged is exactly the problem. You sound smart and energetic, but the system has still got you down by failing to enable you to find challenges that would benefit the company. Fighting an entrenched bureaucratic culture is a lot harder than you might think (I've spent plenty of time recently doing this!).

</comment></comment><comment><USER29> This can be summed up with the words 'middle managers'.

Middle managers are like giant herbivores who multiply like crazy. You need to cull them once in a while or they will eat the whole place.

</comment><comment><USER30> The interesting thing here is: why do big companies don't need to keep their talents? Does bureaucracy compensate for lack of talent? And vice versa? Does this also mean that you can innovate without talent?

<comment><USER21> big companies exist to execute a well known business model. they invest in lobbyists to keep the business climate stable so they continue to execute their business model. it usually makes more sense to outsource innovation -- e.g., invest in and acquire startups.

</comment></comment><comment><USER31> Why nobody mentioned 'Netflix culture' - That seems to ideal to me.

<http://www.slideshare.net/reed2001/culture-1798664>

</comment><comment><USER32> offtopic: does forbes page look to you like this <http://i.imgur.com/8ZF4S.png>? soemething is wrong...

</comment><comment><USER33> Most of the reasons are good, but how can anyone keep a straight face while they present changing strategic priorities as a big-company problem? Don't startups do 90-degree "pivots" of the entire darn company just as often? The ten startups I've been in all got jerked around far more than the two big companies, and I get the impression this is even more true in today's startup culture.

<comment><USER34> I think the issue around this is in big companies you rarely see the reasons for the shift in priorities. At least this has been true in my experience. When priorities shifted in my last job all we got in explanation was some buzzwords and a 'trust me'. At my current startup job, when priorities change I get all the information that lead to the decision, and can also participate in making the decision.

</comment></comment><comment><USER35> I actual wish I could send this link to my Boss.. Spot on!!!

</comment><comment><USER36> As someone who just left a big company for a startup I think 8/10 of these things apply to me. I'm half-tempted to email this to my old boss.

</comment><comment><USER37> Wow, this list is pretty spot on, can't really think of anything else to add to it.</comment>


How would you do a web platform for niche content? - <AUTHOR>

Considering that the internet contains mostly mainstream contents websites, how to implement a platform that concentrate niche sites, where the user can follow only what he's REALLY interested?<p>Do you know any current website that already has something similar? <comment><USER2> Reddit?</comment>


Can You Use FreeBSD for a Developer Machine in 2020? - <AUTHOR> https://hackernoon.com/can-you-use-freebsd-for-a-developer-machine-in-2020-fc653bk5 <comment><USER2> I'm slightly confused by the claim this article makes about performance. It says:

> Generally, FreeBSD performs better than Linux - Don't expect exponential > differences, but many tests have shown that FreeBSD performs better than > Linux

In that same line, it links to [https://www.phoronix.com/scan.php?page=article&item=3990x-fr...](https://www.phoronix.com/scan.php?page=article&item=3990x-freebsd- bsd&num=2) which says:

> Lastly is a look at the geometric mean for all of the benchmarks conducted > for this FreeBSD vs. Linux scaling comparison on the AMD Ryzen Threadripper > 3990X. In the end, both CentOS Stream and Ubuntu 20.04 (development) > delivered similar performance and were basically tied for first.… At 16 > cores, RHEL8-based CentOS was about 17% faster than FreeBSD 12.1 while at > 128 threads the lead expanded to 28% based upon the geometric mean or 21% > when comparing the GCC9 results on FreeBSD 12.1.

<comment><USER3> There was a period of time where FreeBSD performed much better under load (particularly under a high network load). Unfortunately as a side effect you get a lot of people quoting "FreeBSD performs better than Linux" without context or under what scenarios.

<comment><USER4> There were many different periods where FreeBSD performed better than Linux under some loads. The same is true in the other direction. Generally speaking, "X performs better than Y" is meaningless without specifying the workload.

</comment></comment></comment><comment> non-entity > for C, C++ and Python developers FreeBSD is probably your best possible > choice because of the number of tools and packages available.

Is there any source for this? I cant think of anything that any BSD would offer for C / C++ / Python that I couldn't get on another platform?

Also, perhaps I just haven't paid attention, but I feel like in the last year at least, I've seen a ton of articles or anecdotes about people trying some BSD for the first time (usually FreeBSD or OpenBSD) and having some epiphany.

<comment><USER4> DTrace, for one.</comment></comment>


Dump truck ferry carrying up to 100 each day - <AUTHOR> https://www.stuff.co.nz/national/111852077/dump-truck-ferry-carries-up-to-100-each-day-across-bridgeless-waiho-river <comment><USER2> The old man in me says that seems wildly dangerous and I bet insurance would deny any claim.

The kid in me is giggling with excitement.</comment>


One month in Kuala Lumpur as a remote developer - <AUTHOR> https://smakosh.com/one-month-in-kuala-lumpur-as-a-remote-developer <comment><USER2> How was actually working there remotely? I've worked remotely from an Asian country and I was somewhat disappointed by the internet speed and reliability of the connection.</comment>


Government Investigations Have Frozen Google's Manual Search Results - <AUTHOR> http://launch.is/blog/l021-breaking-government-investigations-have-frozen-googles.html

<comment><USER2> Although all companies go through litigation, this is starting to feel more and more like the same process Microsoft went through with IE - core business, varied legal action at state, federal, and international level, and business practices that can be painted as suspect, with lots of small business owners that can be put into the press as victims. Add into that a press-worth corporate tagline of "Do no evil", and this will, over time, get a fair amount of attention.

Could this be the Achilles heel for Google? The Microsoft lawsuit was a huge drain of both cash, brand, an intellectual capital from the company. It will be interesting to see if this series of litigation has a similar effect.

<comment><USER3> Good point about drain of intellectual capital -- legal issues could well be a turn-off for new talent, too. Do engineers still see Google as a cool place to work? Microsoft lost the cool factor ages ago.

</comment></comment><comment><USER4> This could get ugly...who knows. So much time may go by and we will forget about it, like Panda, and a new story will pop up then we will reference back to this... the line will never be linear.

</comment><comment><USER5> This just seems like a article written to be confusing and take quotes out of context, even matt cutts head of google web spam said this whole article is false.

</comment><comment><USER6> I wonder how this is going to play out?

And can the govvies even understand what they're doing, tech wise?</comment>


Ron Paul: Let the dollar prove itself - <AUTHOR> http://www.cnn.com/2009/OPINION/10/30/ron.paul.fed/index.html?iref=mpstoryview

<comment><USER2> "Thus, the more the dollar is debased, the more capital gains taxes must be paid on holdings of gold and other precious metals. For individuals who may wish to use gold and silver in everyday transactions, this can quickly become a complicated and costly burden."

Ron Paul,

Thanks for not being able to write a single essay without sounding like a complete fucking lunatic with no grip on reality.

Sincerely, Liberals

<comment><USER3> Huh? What he says makes perfect sense.</comment></comment>


Ask HN: What is something someone said that really changed your way of thinking? - <AUTHOR> <comment><USER2> Don't remember who said this but here it is anyway. We always seem to put great thinking and efforts into time management. We schedule a bunch of things and try to track them to completion. However, what I have come to realize that it always is not a time management problem but a PRIORITY management one. If you consider a task more important than others, you'd find the time to do it. If you consider a person more important than others, you'd do what's required to keep that person happy.

</comment><comment><USER3> About 10 years ago while researching market trading ideas, I stumbled across a 1960's transcript of testimony to a congressional hearing by a long time NYSE market maker. While the tone of the entire testimony was mind blowing in its honesty about the actual market making processes, especially given the era, a single quote really changed the way I think. The quote from the trader was simple enough; the price is used as a worm. But coupled with the entirety of the testimony regarding stock and flow management it changed my world view especially the fractal nature of the price action and the fact that left unchecked I am basically biologically programmed to respond to price movement. I was literally walking around for weeks mumbling that the price is a worm. I have been unable to find the transcripts again. I compare these old time market makers to today's supposed liquidity providers and can't help but think, those old timers were heros compared to todays laser riding quant jockeys.

</comment><comment><USER4> Look into Firas Zahabi:

[https://www.youtube.com/watch?v=aowunaGcly8&list=PLDOLullo_N...](https://www.youtube.com/watch?v=aowunaGcly8&list=PLDOLullo_N4mA0CPKaR- niU67RULDbvfO)

[https://www.youtube.com/watch?v=T7H-WsRVQzY](https://www.youtube.com/watch?v=T7H-WsRVQzY)

</comment><comment><USER5> Read in a book: "If you spoke to your friends like you speak to yourself, would anyone ever want to be your friend?" ("Living with a heart wide open"). The line instantly changed my self-talk from negative and dystopian to compassionate and constructive i.e. things like scolding myself when I missed a freeway exit while driving. Turns out my case is not uncommon - most people call themselves stupid 8-10 times a day.

</comment><comment><USER6> A Henry Miller quote: "Maybe all one can do is hope to end up with the right regrets" \- I find that very therapeutic.

</comment><comment><USER7> I was told, "You are not responsible for the happiness of others". It sounds like a selfish thing unless you are the type of person who feels responsible for the happiness of others. It changed my perspective and has made me happier by freeing me from the crushing responsibility I was putting upon myself.

</comment><comment><USER8> Slowing down to simply observe my thoughts instead of "owning" them right away and acting on them.

Some people practice this by meditation. I too, meditate sometimes, but I just try to be mindful in general.</comment>


Up to date list of departures & closures at Sun - <AUTHOR> http://en.wikipedia.org/wiki/Sun_acquisition_by_Oracle#Impact

<comment><USER2> <http://www.infoq.com/news/2010/01/sunset>

discusses: glassfish, netBeans, etc

<comment><USER3> It will be really sad to see netbeans go. In combination with jvi it is a slick development environment - the only one thats ever tempted me from vim and emacs. I'm sure the people that have developed plugins for netbeans will be gutted if Oracle don't set it free as an open source project.

<comment><USER4> Yeah it is sad because Netbeans was just starting to gain momentum. Allot of people that I have known for years, and where Eclipse and IDEA users where beginning to convert over because as of 6.5 Netbeans had put all the pieces together. I have not used Eclipse in a couple of years now, I really hope they have good REST service generation tools, with NB I am able to generate my services off of my JPA annotation classes this was nice and fast.</comment></comment></comment>


RateMySite: Mailing list for niche programming and startups - <AUTHOR> http://jon.io/

<comment><USER2> I wish there was a sample newsletter to view. How is content curated? Also missing a privacy policy and T&C even though the MailChimp reference helps somewhat.

<comment><AUTHOR> Good feedback! Fixing right now :D

</comment></comment><comment><USER3> Nice idea, but a sample of what you would be signing up for would be useful. Good Luck!

<comment><AUTHOR> thx, I'll update the site and I'll include a sample of the newsletter.</comment></comment>


List.js » Paging & Plugins - <AUTHOR> http://jonnystromberg.com/listjs-0-2-0-plugins-paging/

<comment><USER2> Love list.js. We've used it for a couple of internal things and users have always been impressed with the searching - it kind of feels like something that should have always been built into long tabular lists.

</comment><comment><USER3> Sweet! For a real world usage, check out <http://html5please.us/>

</comment><comment><USER4> I've been using List.js lately, submitted a few bug fixes on Github for it as well. Great plugin and an awesome lightweight alternative to DataTables. Shaved a nice ~80k of the payload of CRUD app I'm working on right now.

</comment><comment><USER5> I still wish you exposed a DOM fragment as an option instead of HTML strings.

<comment><USER6> I'd like that too. Would like to be able to sort on something stuck in a data attribute. <https://github.com/javve/list/issues/35>

I might take a crack at a patch if no one else does.

<comment><AUTHOR> With the new plugins-functionality you could create your own special sorter that uses data attributes too. Then you would call it with listObj.yourSortersName(something).

And you can still use the regular sort function which since this version is a included in the helper object :)

<comment><USER6> Actually I realized I can already do this even without plugin functionality. The Item object passed to the sorter has access to the element <http://screencast.com/t/Z5uVYNtH8>

<comment><AUTHOR> Ahh, smart! And good move with the screencast :)

</comment></comment></comment></comment></comment><comment><USER7> Awesome! The only thing missing now is support for fuzzy search

<comment><AUTHOR> With plugins you can build your own fuzzy search! :) ...but I know that is a feature many want, so maybe I will build a plugin if no one get before me.</comment></comment>


Panera Bread did nothing about its customer data vulnerability for eight months - <AUTHOR> https://medium.com/@djhoulihan/no-panera-bread-doesnt-take-security-seriously-bf078027f815 <comment><USER2> I had posted it on the other link as well (1), but since it is relevant to this discussion, reposting it here:

Commenting only on the speed of response (or the glacial interpretation of it in Panera's case): For companies operating in European Union, the General Data Protection Regulation (GDPR) (2) mandates that such breaches need to be disclosed under 72 hours. The implementation deadline for GDPR is by end of May 2018 (~7 weeks to go).

Underarmor, a US-based sports apparel manufacturer, who operates in EU as well, recently had a breach that affected 150-million users, and went public within 3 days of discovering the breach (3).

I believe UnderArmor's case is the norm we can expect going forward.

(1)[https://news.ycombinator.com/item?id=16739753](https://news.ycombinator.com/item?id=16739753)

(2)[https://en.wikipedia.org/wiki/General_Data_Protection_Regula...](https://en.wikipedia.org/wiki/General_Data_Protection_Regulation)

(3)[http://www.bbc.com/news/technology-43592470](http://www.bbc.com/news/technology-43592470)

</comment><comment><USER3> As someone who receives vague security emails from folks who say we have a 'vulnerability' and ask if we have a 'rewards program for bugs' and try to ask 'how much money I will be paid for the bug', Dylan's first email is very legitimate and specific. It comes from a non-generic domain (ie, not a "email@example.com" email), with an identity that could easily be verified.

In fact, as someone who would work on the API facing side of things, even that report would be enough to discover the areas to dig around and find the vulnerabilit(y|ies). There must be an API or HTTP or some other endpoint that takes in a user id, rewards card, zip code, phone number or something similar and returns data for an arbitrary user(s). Let's audit all our endpoints and see where the vulnerability might be.

I've also reported similar vulnerabilities before, and I have received a whole range of responses.

<comment><USER4> The reply to Dylan's first email is very bizarre. Is it just me or is asking for a PGP key neither suspicious nor uncommon? It sounds like the least scammy request possible. What scammer would want to go through the trouble of PGP encrypting communication?

<comment><USER5> It makes perfect sense to me - he doesn't know what a PGP key is and just read the word key.

</comment></comment></comment><comment><USER6> "No, Panera Bread Doesn't Take Security Seriously"

I didn't expect this to be an actual description of a security event, but just a rhetorical observation: of course Panera Bread doesn't take security seriously. There's no "security" in the name of their company. They are not in the security business. I think they do actually take bread seriously. And store location, and customer service, and stuff like that, because that's the kind of business they are.

Because of PCI you can expect they probably do handle your credit card (except apparently the last 4) reasonably well. Because of other regulations you can expect they take food safety seriously. They take basic business operations seriously because there's a bunch of professional business-runners, and they know they really have to.

<comment><USER7> > I think they do actually take bread seriously.

No they don't. They admit on record using same additives as Subway mostly a rubber-type chemicals invented by BASF that make bread more elastic, won't go dry this quick and has longer shell-life. Basically when you eat their bread some ingredients are the same of the tires your car was put on!

Further good read how horrible quality their food is:

[https://www.thealternativedaily.com/panera-bread- additives/](https://www.thealternativedaily.com/panera-bread-additives/)

<comment><USER8> You can't be serious about that link. It is a quack website that claims that wheat and sugar are harmful additives! It also uses the number of ingredients as a good metric of the healthiness of food.

</comment></comment></comment><comment><USER9> Forget complicated questions about corporate policy, the costs of verifying security, the limited negative impact that companies seemingly face when problems like this happen. Those questions are definitely interesting, but they're hard questions and I'm not in the mood for hard thinking right this second.

What blows my mind here is the actions of a single person. The Security Director got an email about a dead simple vulnerability in his company's website/api. All he had to do was paste a single link into a browser to verify that there was a big big problem. And he did nothing?

I simply can't understand that.

What was this guy doing every day? Did he have any sense of professional self respect at all? Did he think it would just....go away? It's so confusing.

Do you think he....didn't know how to decrypt the PGP encrypted description? And that he was too embarrassed to say so? In a weird way that's my most charitable explanation.

<comment><USER10> Did you notice the part about his previous job as the director of security for Equifax? He is obviously clueless about technology and security.

<comment><USER9> While I am sure that there are clueless people that have worked on the security team at Equifax, I'm willing to bet that there have been good people too. It's hard to sort out the good from the bad and what problems are individual and what were systemic.

<comment><USER11> Putting a person, who majored in music theory, into the Information Security Officer position at a company of Equifax's size, shows how much they actually regard your information as something important.

I actually dislike bringing this up, because I respect the people the have gone through music education; while it doesn't pay in terms of salary, it's certainly something they are passionate about and love dearly. But just as they would not hire me to direct an orchestra, I would not hire them to secure critical Financial systems. This isn't to say there is a fault with them, it's just to say that we all have our strengths in certain areas.

<comment><USER12> This is clearly wrong. Do you know who Mudge is? Check out the wikipedia page for him at [https://en.wikipedia.org/wiki/Peiter_Zatko](https://en.wikipedia.org/wiki/Peiter_Zatko) and note his degree.

<comment><USER10> Aren't we talking about Mike Gustavison? Does Peiter Zatko work at Equifax or Panera?

<comment><USER12> We are apparently talking about _who majored in music theory_ and my point is that is totally irrelevant.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> First screen from the post [1]

 _[...] will never respond to a request like the one you sent [...]_

Dylan has not asked for a bounty or it wasn't a sales pitch! This Mike guy could not even understand basic underlying tone of the message, not to mention some technical issues the problem relates to. I hope Mr. Mike Gustavison is NOT with the company anymore, or at least is off the public-facing keyboards!

[1] [https://cdn- images-1.medium.com/max/2000/1*oJEZOkK6qtq2RreBN...](https://cdn- images-1.medium.com/max/2000/1*oJEZOkK6qtq2RreBNgBQqQ.png)

EDIT: okay update from Kerbs twitter -- Mr. Mike used to work at.. Equifax :)

 _Oh look,the guy my source initially notified at @panerabread EIGHT MONTHS AGO -- their dir. of info security - was senior dir. of security operations at Equifax until 2013. Shocker._

Maybe he should open his own security company... with all of his experience.

<comment><USER13> It's not hard to guess what's behind Gustavison's knee-jerk accusation of extortion. With his '1337 security skillz, he will have been getting actual extortion demands -- and probably paying them -- for a long time. Probably more than one a day.

</comment></comment><comment><USER14> Even with the other Panera-related threads that made the front page, this is a good read because I was wondering how exactly (and how thoroughly) the researcher attempted to contact Panera -- seems he went above and beyond just trying a few emails to the customer support line. Panera definitely had plenty of warning here.

</comment><comment><USER15> Going three years uninterrupted free credit monitoring now. I'm so glad my run will get extended courtesy of Panera.

<comment><USER16> There's nothing in this leak that can be used to damage your credit.

<comment><USER17> That depends on what the ratings were.

</comment></comment></comment><comment><USER11> For _this_ particular bug, I would have reported in anonymously in private and given them 48 hours before I went public. Vulnerabilities are one thing: you don't want to rush a patch and create more problems when you started with, and it's safe to assume you don't know everything about the systems involved. But direct data leakage is an entirely different matter.

</comment><comment><USER18> No shit. Name any company that does. Until there are serious consequences for leaks like this, no company will take security seriously. There is no incentive. Jail some executives and take their earnings and I guarantee this will change. Short of that, or some other serious punishment, this isn't really even news anymore. Self-regulating industry is a joke.

<comment><AUTHOR> > No shit. Name any company that does.

Paragon Initiative Enterprises.

</comment></comment><comment><USER19> the only way security will ever be taken seriously us if there are fines for leaking data. $1000 per user per incident. Nothing will ever happen otherwise. There is zero incentive.

<comment><USER20> Great, now you've incentivized coverup of breaches.

<comment><USER21> Whistleblowers should be (maybe are?) given a cut of any fines that their disclosure results in.

<comment><USER22> If we're talking $1000 per impacted user as suggested by GP, then I'm wondering just how small a fraction of the 37 billion dollar fine it would take for me to swallow my morals and "accidentally" cause or approve changes which cause a vulnerability like this, so I can then blow the whistle and collect my check. As a security engineer, I doubt my net worth will ever reach even 0.05% of that.

<comment><USER21> Whistleblowers should be compensated for uncovering intentional negligence and violation of laws, not accidents. There should be a pattern of bad behavior that the whistleblower couldn't create herself.

</comment></comment></comment></comment></comment><comment><USER23> Video about how Panera's number one priority is protecting your data: [https://www.akamai.com/us/en/our-customers/customer- stories-...](https://www.akamai.com/us/en/our-customers/customer-stories- panera-bread.jsp#7155)

Archives: [https://web.archive.org/web/20180403215610/https://www.akama...](https://web.archive.org/web/20180403215610/https://www.akamai.com/us/en/our- customers/customer-stories-panera-bread.jsp)

[https://archive.org/details/panera-security- video](https://archive.org/details/panera-security-video)

</comment><comment><USER7> Okay I tried to mimic the URLs in post to see if my own data is there. Whole Panera website is down. Is it just me or everyone else? :)

If everyone - wonder if this is "effect of hackers news" :)

EDIT: down for everyone: [http://www.isitdownrightnow.com/panerabread.com.html](http://www.isitdownrightnow.com/panerabread.com.html)

I guess the DO eventually take security seriously :)))

</comment><comment><USER5> How far up the chain is Sr Director of Security at Equifax? That sounds 2 or 3 rungs from CEO? Or is it just corporate speak?

</comment><comment><USER11> Credit card numbers are sort of like symmetric keys... anyone that knows your credit card number can also authorize transactions. Why can't we have ECDSA instead?

<comment><USER17> No, they also need CVV2 and expiration date. (That said, a 3 digit number is easy to crack. The date is just 1 bit on top.) In more modern setups, there are things like MasterCard Secure or Visa 3D Secure which require direct authorisation with a token. (One time key, token hardware, phone secure element token.) The tokens are much more secure than PKI without a password.

And then there are decent banks that will put suspicious and/or big transactions on hold for phone authorization. And you cannot change auth data easily without knowing the account password and potentially again authorizing changes with a token. (Remember to disallow changing data over the phone. Most banks require extra work to enable phone account management anyway.)

And in any case you can dispute the suspicious transaction and probably get notifications about these.

</comment></comment><comment><USER24> How is this a dupe?

<comment><USER25> This article [https://news.ycombinator.com/item?id=16739753](https://news.ycombinator.com/item?id=16739753) (which is linked from the top comment above) was posted 10 hours ago, is currently in position 11 with over 250 votes and 73 comments, and includes much of the same information, including screenshots.

</comment></comment><comment><USER26> Atleast their bread is better then their security...

</comment><comment><USER27> I would have thought that companies would have woken up by now to the idea that security is important and worth the cost...

<comment><USER28> Being charitable, I think the more likely explanation is that CTOs/CFOs do not understand how easily these things can happen, and how much data can be exposed by a "small" mistake.

One line of code can expose 30,000,000 records. That's hard to get your head around if you are not a programmer.

<comment><USER29> From the description, this wasn't one line of code, this was a major design oversight. Either nobody is security conscious on the dev team handling their mobile/web services, or it's just one guy with no code review on major components, or people who complained were tuned out, ignored, placed in low priority, or some other totally irresponsible managerial action.

You have to have a lot of bad process in place for something like this to get in.

</comment></comment></comment><comment><USER30> "Hey @panerabread : before making half-baked statements..."

<comment><USER31> The @ symbol reminded me... not sure if it's still true, but about a year ago you could create a password that contained an @ symbol but you couldn't login with it in their mobile app.

Also, sometimes when I give them my phone number for my loyalty card it works, and sometimes it doesn't... an alarming number of times it doesn't work, all of which makes me think they have some questionable IT practices going on. I should have seen this coming.

</comment></comment><comment><USER32> But they do take bread seriously, and their name isn't Panera security.

</comment><comment><USER33> I don't really like these kinds of articles. It's like "Hey, look, publicly shame this non-technology company that probably never gets bug reports for not jumping to immediately fix my bug report!"

Seems (just a little) like bullying. I'm sure I could do the same to lots of auto shops around my city that have really basic websites and then publicly shame them for not investing enough in security even though security is the biggest money sink ever that never gets fully solved.

<comment><USER34> Cannot disagree with this more. There was far more than due diligence demonstrated here.

<comment><USER35> You must be kidding. From all appearances they did absolutely nothing except take their entire API down after 8 months.

<comment><USER34> You misunderstand. Due diligence on the part of those _reporting_ the vulnerability.</comment></comment></comment></comment>


Hoping to Lead Great Lakes Lampreys to Demise by the Nose - <AUTHOR> http://www.nytimes.com/2016/02/09/science/hoping-to-lead-great-lakes-lampreys-to-demise-by-the-nose.html <comment><USER2> Hopefully 3kPZS and the other pheromones don't affect native fish species on their stream migrations. Has this been tested yet?

</comment><comment><USER3> Treating infested water with lamprey pheremones - sounds like the beginning of a horror movie.

<comment><USER4> well the video included shows a bit of a scare [https://www.youtube.com/watch?v=ylImuwPWLBo](https://www.youtube.com/watch?v=ylImuwPWLBo)

<comment><USER3> That was just precious.

<comment><USER4> That should be the video shown in front of the political committee to get the funding to use the pheromones.

<comment><USER3> I hope they remember to put signs up at the swimming spots where they dump the lamprey attractant.

<comment><USER4> Failure to do so would result in the video that gets shown on 60 Minutes. Those videos tend to negatively affect funding and career advancement.</comment></comment></comment></comment></comment></comment>


Hacker News demographics (by Quantcast) - <AUTHOR> http://www.quantcast.com/news.ycombinator.com#demographics

<comment><USER2> WTF are those demographics trying to tell me? I can't for the life of me figure out what the No Kids/Has Kids metric means.

No Kids 0-17 Has Kids 0-17

No Kids 0-2 Has Kids 0-2

What?</comment>


The Absolute Worst Way to Read Typed Array Data With JavaScriptCore - <AUTHOR> http://phoboslab.org/log/2015/11/the-absolute-worst-way-to-read-typed-array-data-with-javascriptcore <comment><AUTHOR> In related news, Ejecta 2.0 is now out too, an open source project which lets you bring JavaScript applications to Apple TV as well as iOS.

[http://impactjs.com/blog/2015/12/ejecta-2-0](http://impactjs.com/blog/2015/12/ejecta-2-0)</comment>


Ask HN: Twitter down again ? - <AUTHOR>

HN breaks the story before TC! http://www.hyperspin.com/en/quicktest.php?action=result&qtid=292510&r=4751 <comment><USER2> The DDoS attack against Twitter continues...

[http://groups.google.com/group/twitter-api- announce/browse_t...](http://groups.google.com/group/twitter-api- announce/browse_thread/thread/64300754706cf5e2)

</comment><comment><AUTHOR> [http://www.hyperspin.com/en/quicktest.php?action=result&...](http://www.hyperspin.com/en/quicktest.php?action=result&qtid=292510&r=4751)

<comment><USER3> Yes, and I couldn't even tweet about it!

<comment><AUTHOR> hmmmm maybe a queuetweet service ? while twitter is down you can continue to communicate over a queue.</comment></comment></comment>