Berkshire Hathaway 2014 Annual Report [pdf] - <AUTHOR> http://berkshirehathaway.com/2014ar/2014ar.pdf <comment><USER2> Interesting:

 _Shortly after we purchased Gen Re, it was beset by problems that caused some commentators --- and me as well, briefly --- to believe I 'd made a huge mistake. That day is now long gone. General Re is now a gem._

And, regarding Clayton Homes (their mobile-home manufacturer which also offers mortages both to Clayton homeowners and owners of other manufactured homes):

 _Many of our buyers how low incomes and mediocre FICO scores.. our blue- collar borrowers have often proved to be much better credit risks than their higher-income brethren._

This is interesting as it is apparently true, by the numbers, and also a slap at investment bankers.

I also love that the person who manages the annual shareholder meetings, "Woodstock for Capitalists", is a 30 year old that was hired 6 years ago.

Also, does anyone have color on went wrong with Tesco? Buffett writes that he lost faith in the management team, which seems like an unusually direct condemnation given all the other way he had to explain their exit from that position.

<comment><USER3> > This is interesting as it is apparently true, by the numbers, and also a > slap at investment bankers.

Usually the "higher-income brethren" are not succumbing to the ethical and moralistic brainwashing regarding defaults, and bankruptcies. For them "bankruptcy" != "I am a lazy, bad, and irresponsible person" it is just a risk calculation in an excel spreadsheet.

<comment><USER4> > succumbing to the ethical and moralistic brainwashing

Ugh. "brainwashing"? A bankruptcy for a low- or middle income earner would be much more disruptive than it would be to a high-income earner. Your opinion (or how I am reading it) is elitist at the very least.

<comment><USER3> > A bankruptcy for a low- or middle income earner would be much more > disruptive than it would be to a high-income earner

It would be. But I am saying even if even they wouldn't, the higher income earner will have less moral and ethical qualms about walking away.

In other words they would do the math and seeing that their million dollar home is under water, they would throw the keys at the bank and walk away.

While perhaps someone raised and believing in hard work, paying your debts, being fair and responsible, would actually feel like they are letting the bank down or they are violating some core ethical principles, and might lose sleep over it.

<comment><USER4> That makes sense. But "succumbing to the ethical and moralistic brainwashing" makes it sound like you think it's ethically and morally justified to walk away from a loan.

<comment><USER5> I imagine that he/she is looking at it from the perspective of the high-income person. In that case, defaulting is no more evil than losing money in the stock market or having one's business perform badly this quarter. Sure, the financial impact may be painful, but all parties involved should have been aware of the risks of making the loan.

</comment></comment></comment></comment></comment></comment><comment><USER6> Need a definition for ambition?

 _With the acquisition of Van Tuyl, Berkshire now owns 9 1⁄2 companies that would be listed on the Fortune 500 were they independent (Heinz is the 1⁄2). That leaves 490 1⁄2 fish in the sea. Our lines are out._

There you go.

<comment><USER7> It has all of the trappings of a successful slogan: definitional, pithy, & ambitious-sounding enough to make everyone ignore the bad math.

Berkshire itself is on that list, so surely there are only 489.5 to go. :)

<comment><USER8> A company that contains all companies that do not contain themselves?

</comment></comment></comment><comment><USER9> I thought it was interesting that Berkshire intentionally hasn't harmonized its systems across subsidiaries. It reminded me of one of Taleb's ideas on robustness from his book Antifragile, where he argues that a system of individually managed municipalities would be more robust than an economy with a single central government because system failure would tend to only affect isolated parts of the overall population at any single point in time.

<comment><USER2> That goes hand-in-hand with how simple Berkshire's home-office system is, right? It seems like, by design, BH itself does as little as possible. It runs out of a small office suite with something like 30 people. That system _can 't_ be harmonized across companies like Geico and Gen Re, even before you realize that those companies run alongside a furniture store and a jeweler.

</comment></comment><comment><USER10> Classic Warren Buffett: _The unconventional, but inescapable, conclusion to be drawn from the past fifty years is that it has been far safer to invest in a diversified collection of American businesses than to invest in securities – Treasuries, for example – whose values have been tied to American currency. That was also true in the preceding half-century, a period including the Great Depression and two world wars. Investors should heed this history. To one degree or another it is almost certain to be repeated during the next century._

Buffett buys boring, but practical businesses. Also, because Berkshire Hathaway owns insurance companies, their "float" can be invested. It has to be invested in low-risk investments, which is just fine with Buffett. Berkshire Hathaway has such a delightfully boring portfolio.

<comment><USER2> Is "boring" the right word? BH owns a huge chunk of DIRECTV, the whole BNSF railroad (can you _imagine_ how complex that business is to run?), and NetJets.

I think there's a difference between "businesses Warren and Charlie feel like they can get their heads around" and "boring businesses". Also: I don't understand why they bought DIRECTV.

<comment><USER11> I don't think Warren purchased DTV. It's likely purchased by one of his prodigies.

<comment><USER12> DIRECTV was indeed a purchase by Ted Weschler and Todd Combs, as Buffett wrote in the 2012 Annual Report (p. 15). They operate pretty much autonomously.

</comment></comment></comment></comment><comment><USER13> I thought it was notable that Buffet referred people to Airbnb for lodgings in the Omaha area for the shareholder meeting. Not a guy particularly noted for being on top of trends (note: I am a huge WEB fan in numerous ways, though).

edit: see page 22

<comment><USER9> Haha yes his love of a good bargain overcame his self-professed technophobia in that case!

I'd guess he's just being modest with his frequent professions of technophobia though. I'd guess he knows a lot about technology businesses, but just figures that it's impossible to see their futures clearly enough for them to meet his standards.

He did forewarn disappointment with the 1999 tech boom, so he can at least spot extreme misvaluation in trendy businesses: [http://archive.fortune.com/magazines/fortune/fortune_archive...](http://archive.fortune.com/magazines/fortune/fortune_archive/1999/11/22/269071/index.htm) (if anyone wants to ctrl+f to the start of the relevant section, it begins with 'I thought it would be instructive')

</comment></comment><comment><USER14> Of the 15 largest stock investments, IBM is the only one that has lost value (page 15). Simultaneously, it looks like the largest cost based investment (next to BAC, which is unlisted in the table). Yet, he does not seem to address that position in any of his writing. I wonder what he thinks of the company.

<comment><USER11> He thinks it's good.

[http://www.gurufocus.com/StockBuy.php?GuruName=Warren+Buffet...](http://www.gurufocus.com/StockBuy.php?GuruName=Warren+Buffett)

You can see he's added more to his position as of Dec 31st.

the big IBM drop happened in October.

</comment></comment><comment><USER15> I used to read Berkshire's annual reports - good to see HN discussing them.

If you liked the annual report, take a look at the "Owner's Manual" as well - it is worth a read: [http://berkshirehathaway.com/ownman.pdf](http://berkshirehathaway.com/ownman.pdf)

</comment><comment><USER16> >BNSF is, by far, Berkshire's most important non-insurance subsidiary and, to improve its performance, we will spend $6 billion on plant and equipment in 2015.

That's an incredible amount of capex.

</comment><comment><USER17> Their site reminds me of the nineties [http://www.berkshirehathaway.com/](http://www.berkshirehathaway.com/)

What is with the Geico ad at the bottom?

<comment><USER18> I actually show this website to clients sometimes to demonstrate that just getting a functional website online is more important than mastering and zeroing in on a perfect logo, perfect color scheme, perfect layout, etc. If you waste all of your time worrying about things that people have extensively varied opinions on (anything with artwork, colors, layout, etc.) you are wasting your time when you could be selling, learning your market, and getting to know your potential customers with a basic yet fully functional website.

<comment><USER19> I see the Berkshire Hathaway website as being perfectly aimed at the kind of person who goes looking for the Berkshire Hathaway website. It looks frugal and old fashioned, which is exactly the image BH wants to project to their investors.

Contrast to the websites for their consumer brands like Geico.

</comment></comment></comment><comment><USER20> Here's a good post that highlights some of the takeaways from the annual report: [http://25iq.com/2015/02/28/a-dozen-things-taught-by- warren-b...](http://25iq.com/2015/02/28/a-dozen-things-taught-by-warren- buffett-in-his-50th-anniversary-letter-that-will-benefit-ordinary-investors/)

</comment><comment><AUTHOR> Gets good at page 26, the chairman discusses how Berkshire Hathaway got started, though really the whole thing is fascinating. I wonder at what point YC will begin to compete with Berkshire Hathaway.

<comment><USER2> I don't see how they're on comparable trajectories.

Berkshire wins by using a formula that relies on them owning whole businesses with sustainable, predictable returns, ensuring that they're extremely well managed, and backstopping them with a gigantic pile of cash that they can use to roll up other smaller bolt-on companies with.

YC works almost exclusively with unproven, highly speculative new firms, with unproven management teams (many of whom will, after joining YC, hire their first employee ever), owns so little equity in each firm that they don't even get a board vote, and by design avoids further capitalizing companies they bet on.

That doesn't make YC bad; the model seems to work extremely well. It just seems like a very different model.

 _edit: HN- >YC. Embarrassing._

<comment><AUTHOR> Of course, I don't think it's a direct analogy. But it seems that partly what makes YC successful is also what makes BH successful.

BH also has an extra 50 years on YC, so of course the models don't match up. And I'm not Sam, so I can't speak to whether not YC's ownership or investment models will change over the next 50 years (and yes, I think there's a good chance YC will be around in 50 years). YC is focused on testing and validating its thesis across other industries, but the thesis started in one area. Very much the same with BH.

In other words, if BH's only value is that they can successfully help grow a candy company, an insurance company, and a train shipping company, and YC is able to help grow a fusion company, a hotel industry company, and a home cleaning company, then they are both doing something right. It seems they are both heavily driven by focused principles.

Another great point is that YC and BH don't have traditional competition. See pg 31 starting

"Berkshire has one further advantage that has become increasingly important over the years: We are now the home of choice for the owners and managers of many outstanding businesses."

<comment><USER21> > Of course, I don't think it's a direct analogy. But it seems that partly > what makes YC successful is also what makes BH successful.

In what way? Yes, they both invest in companies, and the investments represent people trying to figure out how to make money and beat their competitors. But there are a lot of differences in the details (Buffet has a source of stable income that people trust him to reinvest; Y Combinator makes money sporadically when other investors decide to buy their companies). They're about as similar -- to me -- as football and bowling. Sure, both sports have balls, but there are a few relevant differences.

<comment><USER21> I feel like I should add [http://www.econ.yale.edu/~af227/pdf/Buffett%27s%20Alpha%20-%...](http://www.econ.yale.edu/~af227/pdf/Buffett%27s%20Alpha%20-%20Frazzini,%20Kabiller%20and%20Pedersen.pdf) (alpha is supposed to measure how much better a manager does compared to the market, [http://en.wikipedia.org/wiki/Alpha_%28investment%29](http://en.wikipedia.org/wiki/Alpha_%28investment%29) ).

Compared to ordinary investors, Buffet's alpha is consistently high. He looks like a genius. But if you change the definition of alpha based on his strategy, his alpha ends up being much lower. Personally, I don't think that diminished Buffet in any way: he came up with the strategy, after all; but it does show that his investments work because he's doing something different than the competition.

And, again, Y Combinator is also doing something different than the competition (or at least, different from what the competition was doing when YC launched), but it's also doing something wildly different from Berkshire Hathaway. BH invests in a small number of mature companies, YC invests in many small and risky companies. I would be interested to see what kind of personalized alpha YC manages to get (and, even, what kind of generic alpha they have). I don't know if they publish their investment numbers, so I don't know if it would be possible to calculate.

</comment></comment></comment></comment></comment><comment><USER22> _Over the last 50 years (that is, since present management took over), per- share book value has grown from $19 to $146,186, a rate of 19.4% compounded annually._

Insanity.

</comment><comment><USER23> 1,826,163% growth in stock price is quite a performance...

</comment><comment><USER24> A measly 1,826,163% since 1964. SELL.

<comment><USER21> If I'm doing the math right, that's only about 16% annualized ( [http://en.wikipedia.org/wiki/Rate_of_return#Geometric_averag...](http://en.wikipedia.org/wiki/Rate_of_return#Geometric_average_rate_of_return) ). Which, for the record, is much better than I've ever done. But Buffet is being a little sneaky there: it's really a good example of compound interest over long time periods.

<comment><USER25> It's not sneaky. This is the way returns are calculated in the industry. 1.09 * 1.09 * 1.09 would be 3 years of 9% returns compounded. In the same way if the total return over 3 years is 50% you take the cube root of 1.5 to figure out what return each year would give you the same. In this 50% over 3 years example it would be around 14.5% a year.

<comment><USER21> I've certainly seen journalists give out such a simplistic number, usually phrased as "$1 invested when the company went public would be worth $XXX today." And when the numbers are presented in a _chart_ , it shows basically the same thing (often labeled the "growth of $1" or "growth of $100"). But when the numbers show up in a table, they are annualized. That allows you to compare the different cells in the table ( [http://blog.greaterthanzero.com/post/57991351347/measuring-i...](http://blog.greaterthanzero.com/post/57991351347/measuring- investment-performance) ).</comment></comment></comment></comment>


A Brief History of Bad Santa - <AUTHOR> http://www.laphamsquarterly.org/roundtable/brief-history-bad-santa <comment><USER2> I think they need to fix some of their links. The one about the National Bank of Cisco robbery goes to localhost, which obviously makes it unusable.

That said, it's an interesting read. Didn't know so many crooks used Santa's image for this sort of stuff...</comment>


Rails 3.2.0.rc2 has been released - <AUTHOR> http://weblog.rubyonrails.org/2012/1/4/rails-3-2-0-rc2-has-been-released <comment><USER2> Interesting comment on the article:

Jay Feldblum on 04 Jan 22:30: Heroku currently injects configuration code into vendor/plugins to configure your application for the Heroku platform. Other deployment systems do the same. For example, Heroku injects a plugin to disable x_sendfile, and another plugin to set Rails.logger to log to $stdout.

If vendor/plugins is to be phased out, how should Heroku and other deployment systems inject configuration code? An initializer?

<comment><USER3> These systems run "bundle install" on the server anyway - simply make it a full-blown gem and patch it into the Gemfile.</comment></comment>


Stop reading this blog and learn something - <AUTHOR> http://avdi.org/devblog/2011/12/29/stop-reading-this-blog-and-learn-something/ <comment><USER2> I recall having a similar epiphany about the value of books when you need to learn something new.

There's a tendency to believe that all information is equally valuable. Therefore, an hour spent reading about, say CoffeeScript in blogs is equivalent to an hour spent reading a CoffeeScript book, only the blogs are free, immediate, and more entertaining.

The last bit is the key. They reason that blog posts are more entertaining is the reason to read the book. They are all sizzle, with optional steak. A book has _structure_ , as Avdi notes, and part of that structure is balance between crazy-fascinating things and fundamentals that are not that fascinating at first but necessary for deep learning.

In cliche terms, books contain information that is important but not urgent. Thanks to the social mechanics of blogs and social news sites and retweeting, the blog posts the filter through the firehose are all urgency. Some also contain important topics, but none contain the important but not urgent stuff that is necessary for a complete education. Any blog post or essay with important but not urgent information falls into people's "read this later" bucket and never gets the upvotes to make the front page of Hacker News or anything else.

So, you will learn things in an hour on the web, and in an hour reading a book, but if your primary goal is a thorough education in something that is new to you, an hour in a good book will serve you better than an hour reading blog posts.

p.s. Alas, my own books at <http://leanpub.com/u/raganwald> are simply collections of blog posts massaged into book format, and as such they are entertaining but do not provide the kind of structure and "important but not urgent" information Avdi and I are extolling here. For example, my essays about Combinators and Ruby might make you interested in Combinators enough to read a real book about them, but the book won't actually teach you introductory combinatory logic.

<comment><USER3> Agreed. Books are also the result of much more time and effort spent thinking about, planning, and evolving the content, structure, presentation. A book- length collection of blog posts just won't have the attention to detail and completeness that most books do.

I also believe books improve one's ability to concentrate, which directly benefits a programmer's ability to get into and stay in flow. Whereas blog posts are, to paraphrase Fight Club, 'single serving' bits of information, reading a book requires (and improves) mental commitment and the ability to shut out distractions and delay gratification for longer durations.

I got myself a Kindle for Christmas, and one of the biggest benefits of this little device is that it eliminates distractions like email and makes it much easier to shut out the world and concentrate on reading long, relatively difficult technical papers and books (vs reading them on my computer as I had been doing previously). Amazon really knows what they're doing when it comes to books and reading.

<comment><USER4> How do you find the support for pdfs?

<comment><USER3> Servicable, sometimes only given that I have 20/20 vision (PDFs with particularly small text), but plenty of room for improvement.

The biggest problem is that Kindle can't reflow PDF text the way it does with mobi formats (which I believe is true anywhere you read PDF, not just kindle), so you can't seamlessly resize the text. You can zoom the PDF document to enlarge the text, but page turning functionality doesn't work until you zoom back out since a zoomed document will reinterpret page turn actions as horizontal scrolling actions (on Kindle Touch at least, not sure about the others with specific hardware buttons for page turning).

There is a literal _ton_ of info on converting PDF to mobi at the Kindle subreddit, but no perfect conversion techniques yet:

[http://www.reddit.com/r/kindle/search?q=pdf&restrict_sr=...](http://www.reddit.com/r/kindle/search?q=pdf&restrict_sr=on)

Some suggestions:

1\. Use Briss (<http://sourceforge.net/projects/briss/>) to trim the margins of the pdf, then read it in Landscape mode. This naturally enlarges the text without breaking page turning.

2\. Use any of the converters listed in the Reddit/r/kindle sidebar, whether downloadable software or web-based (Readability, Instapaper, SendToReader, etc).

3\. Use Calibre to convert PDF to mobi (results are mixed, and graphs and images aren't handled so well).

4\. Email your PDF to email@example.com with "convert" in the subject to have the PDF converted to mobi by Amazon and then delivered to your kindle. Similar results as 4.

All of them except #1 result in mangled formatting to some degree or other, especially PDFs (or PDFs created from websites) with special math or code formatting. Like I said, servicable, you can read it and get the info, but not the brilliant reading experience it is with native .mobi files.

<comment><USER4> Thanks. Makes me wonder if there's a startup in there somewhere, for converting pdf to mobi or even a device optimized for reading pdfs.

I respect pdfs for their Postscript origins but man do I hate getting a pdf link, hate waiting for them to load, hate reading them on my computer. And yet much of what I want to read is locked inside them.

<comment><USER3> That thought occurred to me too. There are a bunch already working on it and are all listed in the sidebar of the kindle subreddit. But I imagine whoever perfects it is looking at a quick buyout from one of them, or maybe even Amazon. It's definitely a real pain point for an otherwise brilliant product.

</comment></comment></comment></comment></comment></comment><comment><USER5> I don't know why he pushed you should learn "the popular one" so hard, unless he meant that ironically. There's no way to choose the most popular language from PHP, Ruby, and Python.

I do agree on books vs. blogs though. When I started learning Python as my first real language this summer the best source I ended up learning from was LPTHW[1] (I used the free online edition). I think a book like that is a good tool for learning a _language_ , because it makes sure you hit on every important feature/concept in that language. However, I later bought a physical book for $30 about Django that didn't do anything except hold my hand and walk me through what could be a 20 minute Django tutorial on YouTube. Maybe it was just a bad book, but when it comes to learning a framework/stack, I think the documentation provided if you choose one of these so-called popular options will be plenty, and from there it's tinkering and screwing up that gets you there.

[1] <http://learnpythonthehardway.org/>

<comment><USER6> As I was reading his post, I was thinking that the perfect example of the sort of technology his methodology would apply to right now is the recent explosion of Javascript MVC frameworks: Backbone, Spine, Ember, etc. Using his approach, Backbone would be the obvious choice to start off with.

<comment><USER7> ...I also used that as an example below the main example :-) And I have come to the same conclusion as you re: Backbone.

</comment></comment></comment><comment><USER8> Author accurately describes the cycle I go through in trying to keep up with technology changes. If I want to make an iPhone app well first let me pick up a book on design so I can make it visually pleasing. ohh wow this psychology stuff is interesting I think Ill read some of that. man wasnt I supposed to be programming? better pick up a book on how to get stuff done." I think the author is on to something when he suggests immediately applying what you are learning to a real world project. I can read a book on HTML and think I know what is going on until I close the book and try it out. Same with Chemistry or this or that. The best way to learn a new skill is to apply it immediately.

</comment><comment><USER9> Simple:

Phase I: Print this out, have it framed (with non-gloss glass) and hang it on the wall where you can easily see while you code.

Phase II: A day will come when, while reading this, you will chuckle to yourself and mutter, "I, too, was like that". Then remove it from the wall and pass it on to another noob.

I'm still in Phase I, but have become conscious of this, which is an indication that I may be moving, albeit very slowly, to the second phase.

<comment><USER10> The first step is to admit you have a problem, hallelujah my friend!!

</comment></comment><comment><USER11> This was me a year ago: _I've read all of their design rationales, and despite the fact that I've never written an app in Ruts, I totally agree with their critiques._

</comment><comment><USER12> When it comes to programming books, I tend to prefer paper-based books versus e-books.

With paper-based book it's easier for me to flip back and forth through the book to quickly reference something. Also, reading code snippets is a whole lot easier since you don't have to worry about screen size messing up the code readability and formatting.

<comment><USER13> Not to mention hi-light, scribble in the margins, fold corners, add postit notes.. I like to get to know a book like an old friend.

When I first came to Japan a little j-e/e-j pocket dictionary did wonders for learning vocab. I may just pick up a new one...

</comment></comment><comment><USER14> >Now use what you've learned in a project. For the love of pete do not use it on a project you get paid for, unless you have an explicit understanding with your employer that you are using something you've never used before, and will probably get it totally wrong and have to rip it up and start again in six months. Otherwise, use it on a personal project. A small personal project.

Whoops.

To be fair, with my current project there was an expectation that this was a going to be a month long "use and dump it" project.

Well, I just got hired for the rest of the year to expand my horrible, horrible mistakes. It was my first django project and I didn't realize you have to explicitly define relationships in the model on related fields in order to do joins. Now there's too much data and legacy code to go back, and I'm stuck pulling up related fields in other tables one by one... kill me now.

</comment><comment><USER15> Here's my manifesto for learning:

        1)Be inspired to build something.
        2)Pick a tool you think might work.
        3)Build it.
        4a) Success? Go to 1.
        4b) Failure? Go to 1.

</comment><comment><USER16> Any time I want to learn something new, I always try to start with a book... SEO, JavaScript, Ruby, Version Control, etc. Being forced to follow a linear learning path works well for me. Even thought many of these concepts are evolving rapidly, books get me the core understanding I need to then venture out online for more current, even cutting edge material.

For me, there's nothing better than cracking open the pages of a book on a new topic.

Edit: Crappy grammar.

</comment><comment><USER10> i feel offended, Were you spying on me?

</comment><comment><USER17> I just had to go through this and was forced to learn these tips myself recently. Before I discovered HN I was a PHP guy. I knew it. Used it. Was comfortable with it. Then I came lurking around here and found out that I wasn't cool because I didn't know Ruby and therefore Rails. Then I found out that I wasn't cool because I was using Apache instead of Nginx or nodejs. So I read about all that stuff for most of this year, played with getting Ruby to spit out arrays in reverse and organize them in different ways, got a VPS and installed Nginx and then at the end realized that all I got from it was an Nginx server serving up a static unfinished website in HTML and the knowledge of how to play with arrays in Ruby (and just in irb, not even in a web page!).

The moral of the story is that reading is useless without action. It's easy to fall into analysis paralysis even if you're decently experienced.

I've come to almost despise the hipsters (and that word is so apt for describing them) who are too cool to do things the standard, time tested way. It's one thing to go bleeding edge for the sake of experimentation and furthering your knowledge and skill but when you're off using some esoteric language or framework or whatever just to be different or cool then that's really... Well... Lame for lack of a better word. Like wearing some ridiculous outfit "to be different" and claiming its just fashion that the rest of us are too uncool to get.

I eventually did get out of that unproductive cycle by the way. I am learning Rails but I've put more of my energies into actually producing things that work using uncool but very useful languages, practices, and frameworks. Sometimes the cool kids are wrong. It's more important to get something produced and working well than it is to use some hip technology because the cool kids claim its better. Ive found that a lot of these claims of some tech stack being better either all boil down to some very narrow use case or give you some benefit that's really negligible in the grand scheme of things. Take it with a grain of salt. Read a bit but don't get hung up on the hype. Make something.

<comment><USER18> > I've come to almost despise the hipsters

Can you give me a concrete example of one of these hipsters? I'd like to know because I work at a company where we use rails and related tech exclusively, so we'd probably fit right into this camp.

> who are too cool to do things the standard, time tested way. It's one thing > to go bleeding edge for the sake of experimentation and furthering your > knowledge and skill but when you're off using some esoteric language or > framework or whatever just to be different or cool then that's really... > Well... Lame for lack of a better word.

If you're happy with PHP, use PHP. If you don't like PHP and want to learn something else, then learn something else. But no one builds or uses anything just "to be different", they use it because it helps them produce working code quicker.

> Like wearing some ridiculous outfit "to be different" and claiming its just > fashion that the rest of us are too uncool to get.

The hipsters that you refer to don't think you're too uncool to get it. In fact they don't think anything about you at all. They're too busy making things.

<comment><USER19> I don't think Bill was targeting all Ruby users with his response. If anything, RoR is the poster child for what he describes as a "standard and time-tested" technology. As long as you're actually building something with your stack -- whatever it may be -- you probably don't fall into the "hipster" camp.

<comment><USER17> Right. Thank you. I wasn't targeting any language really. I just happened to remember some instances of Ruby hipsters who laughed at people using anything else and used it as an example. The language or whatever technology doesn't really matter, you can swap out Ruby for anything (literally anything), because the hipsters exist in every camp. Some languages are more well known for their hipsters but I wasn't trying to single out any one group so I'm sorry if I offended anyone.</comment></comment></comment></comment>


Ask HN: What is the biggest challenge you face as a developer? - <AUTHOR> <comment><USER2> Not being permitted to do my job.

Yes, I'd love to help you, if only you'd let me. Won't you let me?

But you won't, because you can't seem to control yourself--it's like a compulsion to self-sabotage. (Similar to what happens to creative works in the entertainment industries. Too many cooks...)

And it isn't the CEO, who is typically a practical business guy, enjoyable to speak and deal with. He's never the problem (and it's best to deal with him directly when possible, no matter your role). Instead it's the VPs and CTOs and others in lead or similar roles, who are inherently political creatures. Witness there the worst sort of decisions in everything from hiring to "culture" to technical and business strategies.

Personified, the typical company is a capricious and self-defeating entity.

What was the question again? Oh yes, here's me trying to write an app, up against all that...

</comment><comment><USER3> Dealing with other people's perceptions. When I start a new job, everyone sizes me up and forms impressions about my skill or 'level' or whatever. What impressions? How do they form them? Do they actually have anything to do with me? Typically, at first everyone assumes I'm an idiot. Then, after I've tackled something hard that impresses people, they upgrade to "not a total idiot, but probably green/ignorant". Then slowly over time, as I solve a large variety of problems with decent, well-performing, and not-so-buggy code, they upgrade me to "pretty smart, actually!" Eventually I'm the senior guy. Now, begin a new job and start at the beginning again. Even with 20 years experience and a long list of successful shipped products, I still start every new job with the presumption, "probably an idiot."

<comment><USER2> Yes, there's an incredible lack of self-awareness and understanding out there, with regard to others.

</comment></comment><comment><USER4> The "software is a team sport" mentality.

At the start of a project, people saying "this needs a team", even if you can already see a clear path to getting the thing working.

In the middle, "stakeholders" who want to set schedules and define how things are done without adding value.

Once something's working, others presenting it as incomplete or untrustworthy purely because it's the work of a lone developer and doesn't tick some process boxes (and completely regardless of demonstrated capability/stability/etc.)

(This isn't to say collaboration isn't the right answer some of the time. But in my experience when it works out, it's usually arises pretty organically and often has clear boundaries rather than "working on a shared backlog").

</comment><comment><USER5> 1\. Not being able to cover all corner cases. Didn't implement auth on Mongo, some evil bot deleted the database. Forgot to set the timeout on HTTP client, ending up with resource leak (goroutine) and downtime. Integrating a lot of services, often I miss so obvious thing which results in service going down.

2\. People with expertise in some key areas not willing to help with your seemingly easy questions.

<comment><USER6> You had your database open to the internet and a bot deleted it? Did you get any emails from someone trying to sell your deleted database back to you?

<comment><USER5> Yes, I received bitcoin request. I asked them to confirm their bitcoin address to which they never responded! So, i figured, it's not worth paying.

</comment></comment></comment><comment><USER7> Figuring out how to show and talk about what I'm working on with my friends and family. Other mediums such as ceramics and painting are much more accessible to a general audience. It would be nice to have a way of showcasing software in a similar way.

</comment><comment><USER8> Every project I've been on goes through periods of crunchtime, at which point process goes out the window and it all becomes word of mouth. The team chat app becomes a firehose of information and if I look away for a minute, I miss something important and end up working on something that someone else is already working on. Developers become an extension of the team lead who effectively becomes the sole thinker and commander of his little army of code monkeys. It's like being a unit in Command & Conquer. And all because of an arbitrary deadline to build a demo for internal stakeholders, which sets up the project for ultimate failure.

</comment><comment><USER9> Marketing. I think for most that's number one.

</comment><comment><USER10> The variance in productivity.

1\. How do I estimate how long something takes?

2\. How do I deal with the fact that some developers are an order of magnitude more productive than other devs? For some reason it's not acceptable to pay some devs 10x more, unlike sports stars.

3\. When it's normal for an individual to do huge things, it becomes their expected of them. And so people often work a little slower than they can.

4\. When you're not getting paid accordingly to your output, is it fair to work as fast as you can?

</comment><comment><USER11> Trying not to sell myself short to potential employers.

It's a far more challenging problem to solve than anything I've encountered at any job.

</comment><comment><USER12> The hardest challenge as developers IMO is understanding and selecting the best technology that suits the current era, your use case / goal, and your current situation.

Most people that I know made technology stack's decision making based on hype.

</comment><comment><USER13> FOMO on the latest and greatest framework and the feeling of being left out. But deep down I know it's a distracrion; albeit a mentally taxing one.</comment>


It's Time to Say Goodbye - <AUTHOR> http://us2.campaign-archive1.com/?u=7fac71dd0dfba815e14fe7cef&id=341c11a519&e=8d09175c77

<comment><USER2> They seem to have removed their crunchbase profile already. Pretty sure they used to have one. The amount of shut downs lately seems slightly higher than usual, feels like we are entering a slight shedding phase.

<comment><USER3> I noticed that too because I was trying to figure out who bought them (Sales Force) on Crunchbase. Entrepreneurs aren't building sustainable ideas. I think this tightly correlates to the series A crunch.

<comment><USER2> Yeah I can't wait to see the shit show in the seed stage field if this happens [http://www.forbes.com/sites/chancebarnett/2013/10/23/sec- job...](http://www.forbes.com/sites/chancebarnett/2013/10/23/sec-jobs-act- title-iii-investment-being-democratized-moving-online/)

<comment><USER3> Honestly, I think one of the key things of finding a great investor is not just the money but the business mentorship. With crowd-funding, all you get is money which is cool, but what most start-ups need is money + people in power in their corner to promote their product, set up meetings with corporations who would otherwise never listen to the startup founders, and a way to open doors to new relationships.

</comment></comment></comment></comment><comment><USER3> I'm glad I stuck with Asana.

<comment><USER4> Until they decide to shut down? Anything that's a saas can be the next one to close. This is why I'm sticking with opensource tools that you can self host.

<comment><USER3> What are you using for task management that is open source?

</comment></comment></comment><comment><USER5> Well, there's life after death. If you're looking for a similar do.com alternative, you can take a look at: [http://bit.ly/HlxzHY](http://bit.ly/HlxzHY)

</comment><comment><USER6> Can anyone recommend any other alternatives? The reasons we chose do.com over Asana and Flow were the simplicity of the interface, great mobile app, free, and CRM support. Totally bummed.

</comment><comment><USER7> Clicking "Update Subscription Preferences" at the bottom of the email shows the address of who it was sent to. Might not want that everywhere.

</comment><comment><USER8> I find it odd that they would announce a shutdown _today_ , yet they do not have a tool to migrate data for another 2 weeks.

</comment><comment><USER9> SFDC is in the enterprise software business, full stop. Their SMB offering is SFDC. Was this an aqucihire?

</comment><comment><USER10> Do.com -- Get more done, have more fun. (and a picture of old folk) O_o This just wrong!

<comment><USER11> Watch the video. Seriously, it's hilarious in an incredibly macabre way.

</comment></comment><comment><USER12> Upvote for awesome title

<comment><AUTHOR> Lol thanks, but it got moderated somehow</comment></comment>


TheReq - Real-time coding interviews - <AUTHOR> http://thereq.com/

<comment><USER2> Site is totally broken on Mobile Safari.

<comment><USER3> Likewise for chrome on android</comment></comment>


Google: 350,000 Android devices activated every day - <AUTHOR> http://androidandme.com/2011/04/news/google-350000-android-devices-activated-every-day-3-billions-apps-installed-so-far/

<comment><USER2> This article raises a lot more questions for me than it answers. How does this compare to iPhones? How about iPhones + iPad combined? How many of the Android devices are phones vs tabletes or other misc devices?

<comment><USER3> Apparently 270K iOS devices per day as of Oct 2010 and 366K iOS devices per day as of Jan 2011.

[http://www.gadgetvenue.com/366k-ios-devices-activated- day-01...](http://www.gadgetvenue.com/366k-ios-devices-activated- day-01192758/) [http://news.yahoo.com/s/pcworld/20110415/tc_pcworld/googlebr...](http://news.yahoo.com/s/pcworld/20110415/tc_pcworld/googlebragsaboutandroidmarketstats_1)

Other reports say the 350k number for Android is handsets only.

</comment></comment><comment><USER4> As an aside, does anyone know how to generate visualizations like the one in the article? Any tools folks use to do these?</comment>


Facebook ends 'Places' feature - <AUTHOR> http://technolog.msnbc.msn.com/_news/2011/08/25/7472945-facebook-kills-places-check-in-feature?gt1=43001

<comment><USER2> They're just changing it so location information becomes integrated into all the other types of posts rather than being it's own thing.

Makes sense, the old way felt like they were trying to graft foursquare onto facebook.

</comment><comment><USER3> It takes guts to end an ailing feature. Even with the feature struggling, it probably had more monthly active users than what success at a startup looks like to most of us.

On the scale of facebook, it was clear that they weren't getting the traction that foursquare has. It always felt like a me-too feature. I doubt that this is the last location play that facebook will make. Im looking forward to what's next.

</comment><comment><USER4> I don't think most people got it. They'd tag themselves as at "Home", "In bed", "At Paul's house :)", etc.

</comment><comment><USER5> Ah that sucks for the business downtown I saw had a big, new check in with Facebook Places sign made. It was well done too. Ha.</comment>


London's 'amoral' tech elite is driving inequality - <AUTHOR> http://www.wired.co.uk/news/archive/2014-07/24/tech-city-morality <comment><USER2> Nothing but rhetorical questions and bullshit as far as the eye can see.</comment>


Did Bing Just Leapfrog Yahoo Search? - <AUTHOR> http://www.techcrunch.com/2009/06/05/did-bing-just-leapfrog-yahoo-search/?awesm=tcrn.ch_3Cj&utm_campaign=techcrunch&utm_content=techcrunch-autopost&utm_medium=tcrn.ch-twitter&utm_source=twitter.com <comment><USER2> I think TechCrunch has discovered their preferred linkbait title format.

[http://www.google.com/search?hl=en&lr=&client=safari...](http://www.google.com/search?hl=en&lr=&client=safari&rls=en- us&q=allintitle%3Adid+just+site%3Atechcrunch.com&btnG=Search&aq=f&oq=&aqi=)

Come back in a month once the press frenzy has died down and we'll see.

<comment><USER3> Or, if you prefer:

<http://www.bing.com/search?q=site%3Atechcrunch.com+did+just>

<comment><USER4> For some reason I just feel icky using Microsoft products when there's a fine/better alternative.

<comment><USER5> It is all in your head, my friend :). Bing is actually pretty good.

<comment><USER2> I'd love for Google to have some serious competition... just not from _Microsoft_. I feel like Microsoft has had their turn.

I just want some unknown startup to come out of nowhere and take a bite out of Google.

<comment><USER6> Well, a startup _is_ doing this. Powerset is supposedly behind Bing.

Do you honestly think an unknown startup can take a bite out of Google and not get acquired in the process?

</comment></comment></comment></comment></comment></comment><comment><USER7> 1) Microsoft had two horses in the race, MSN and Live, both redirecting to Bing now.

2) Microsoft owns the largest botnet in the world; forcing a browser update and setting the home page to a Bing query is a good way to improve your ranking ;-)

3) I trust "statcounter" as much as I trust Compete, Alexa, and the other user-side traffic analysis and statistics services taken individually. Let's get data from a bunch of them and let's average them out, etc.

<comment><USER8> Windows 7 + Bing + Project Natal.... Microsoft is certainly garnering good vibes these days.

<comment><USER9> The force IE6 Bing homepage redirect (even for google users) gave off distinctly unpleasant vibes.

</comment></comment></comment><comment><USER10> I work for Microsoft. Before bing 80% of internal search engine traffic was to google. The reason MS employees used google instead of live search was pretty much the same across the company - live search sucks.

However, MS employees finally have a decent search engine made by Microsoft. Bing is good. There are 100,000 employees that likely just switched from whatever they were using before to Bing. That might affect the stats a bit. Plus, those employees will tell their friends and families.

</comment><comment><USER11> Does it have to dethrone Google to be a success? I don't think so. If they can take away 5 points in marketshare from from Google that is a huge success and will draw in a lot more money for Microsoft. If they take five points from Google, they are also likely to take away 5 points from yahoo and that is a huge gain. I think Bing is a good search engine, nothing revolutionary, but every product doesn't need to be revolutionary to be successful.

<comment><USER12> Also keep in mind Bing is a start. It's a change to the brand name timed with some fairly significant technical refreshes and some obvious ideological changes about search.

There is a lot more to the space of "search" as we move forward into the next decade, much of which Google, Yahoo and Microsoft haven't even tried to move forwards on. Hopefully the kind of technology and infrastructure related to search will start to be re-purposed for other uses.

</comment></comment><comment><USER13> Bing recently garnered lots of press with its release. That lead to lots of people looking at it and a sharp jump in viewers. It'll fade.

<comment><USER14> I de-Googled my browser at work for the sake of trying out Bing and so far I've only needed to use Google once.

Overall I'm very happy with everything except a few search annoyances. Bing Image search vs. Google Images is no comparison, the Wikipedia "enhanced view" is simple but great, Live maps > Google Maps with the birds-eye view, so pretty much all my regular usage has been slightly improved by Bing.

That's a win and I'll probably stick with it for now. Right now I'm using Google just for comparison sake to see if Bing is "on track" with searches.

I think a lot of people are to the point where they are willing to give "Google competitors" a test drive, and most of them fail instantly (Cuil, etc.). Bing hasn't done that, so we're all pretty surprised.

<comment><USER15> I'm doing the same. For search results, Bing works. I prefer Google's prominent ranking of Wikipedia, but I've been able to find what I need on Bing in all but one case.

However, before this week, I was completely unaware of how frequently I use Google for non-search queries. Things like "-40 F in C" or searching for "Place X to Place Y" and clicking on "Maps" to get directions. Bing doesn't even come close to matching my expectations / muscle memory in those cases.

</comment></comment></comment><comment><USER16> Bing is nice. I don't think it is such an evolutionary leap as to dethrone Google, but I could see it keeping Google from becoming complacent.

MS seems to have subdued their biggest dragon: the results are much more relevant. In fact, all three have gotten really good in that regard.

That was what always killed me about MS' search offerings: nice bells and whistles, but it was so poor at its basic function.

</comment><comment><USER17> Comparing results on the scientific domain I'm working on, my conclusion is that google result is still far more pertinent. For some unknown reason the result obtained from bing are strongly biased toward very specific institution.

Bing is not going to replace google any time soon and throwing millions in marketing campaigns won't turn it into a more useful and efficient search engine.

But there is room for improvement though, and more"competition" and valid alternatives would be beneficial for everybody. We are totally dependent on the answer returned by google who can the strongly bias the data we "find" on the web.

</comment><comment><USER18> One of my favorite parts of Bing is the "Popular Now" items at the bottom. Very cool to add that "real time" feature, reminds me of the twitter "trending topics".

</comment><comment><USER19> Microsoft should have released Bing separately, only slowly leaking out that Microsoft was actually behind bing.

</comment><comment><USER3> I forgot Yahoo _had_ a search engine, so this doesn't impress me much.

</comment><comment><USER20> In short, no.

One swallow and summer and all that.</comment>


Non-alphanumeric Backdoors - <AUTHOR> http://blog.sucuri.net/2013/09/ask-sucuri-non-alphanumeric-backdoors.html

<comment><USER2> So my grep patterns list should now look like this?

@$_[]=@!+_ apache_child_terminate assert base64_decode bzopen chgrp chmod chown copy create_function curl_exec curl_multi_exec edoced_46esab eval exec exif_imagetype exif_read_data exif_thumbnail extract fclose file file_exists file_get_contents file_put_contents fileatime filectime filegroup fileinode filemtime fileowner fileperms filesize filetype fopen fsockopen ftp_get ftp_nb_get ftp_nb_put ftp_put get_meta_tags getimagesize glob gzfile gzopen hash_file hash_hmac_file hash_update_file highlight_file image2wbmp imagecreatefromgif imagecreatefromjpeg imagecreatefrompng imagecreatefromwbmp imagecreatefromxbm imagecreatefromxpm imagegd imagegd2 imagegif imagejpeg imagepng imagewbmp imagexbm ini_set iptcembed is_dir is_executable is_file is_link is_readable is_uploaded_file is_writable is_writeable lchgrp lchown link linkinfo lstat mail md5_file mkdir move_uploaded_file parse_ini_file parse_str passthru pathinfo pcntl_exec pfsockopen php_strip_whitespace phpinfo popen posix_kill posix_mkfifo posix_setpgid posix_setsid posix_setuid preg_replace proc_close proc_nice proc_open proc_terminate putenv python_eval read_exif_data readfile readgzfile readlink realpath rename rmdir sha1_file shell_exec show_source stat str_replace symlink system tcpflood tempnam tmpfile touch udpflood unlink

<comment><USER3> Actually, you don't even need grep, just find:

      find . -name "*.php" -exec printf "PHP found, you're probably owned: " \; -print -quit

Sorry, I know that "PHP is insecure" jokes are overdone, but that enormous blacklist that you have to find vulnerabilities seemed like it could be simplified a bit.

<comment><USER4> Can we please leave stupidities like this off of HN?

PHP is a programming language - it would be a pretty useless programming language that can't do anything.

Go read that list - they are all useful functions. You would be hard pressed to make a usable language without them.

</comment></comment></comment><comment><USER5> An encoder (obfuscator?) to create similar code (alphabet: "()[]{}+!") in JavaScript: [http://patriciopalladino.com/files/hieroglyphy/](http://patriciopalladino.com/files/hieroglyphy/)

<comment><USER6> For even more fun, JavaScript can use unicode characters as variable names, provided the first is alphanumeric. I'll let you use your imagination with that one.

<comment><USER7> The first char has to be a _letter_, $, or _. Letter can be one of the letter classes for any language.

ಠ_ಠ is a valid javascript identifier.

[http://stackoverflow.com/a/9337047/35338](http://stackoverflow.com/a/9337047/35338)

</comment></comment></comment><comment><USER8> What are the most effective and sneaky backdoor mechanisms you know? I'll be forced to implement a one myself so it better be good.

<comment><USER9> Backdooring Chips by Altering Silicon Doping [http://sharps.org/wp- content/uploads/BECKER-CHES.pdf](http://sharps.org/wp-content/uploads/BECKER- CHES.pdf)

</comment></comment><comment> vezzy-fnord Although a pretty good feat, I thought the Joomla! backdoor in the GPL was sneakier and more interesting.

These characters should trigger an alarm if caught by eye in a source file.</comment>


How I destroyed my startup - <AUTHOR> http://maxkle.in/how-i-destroyed-my-startup-by-moving-it-to-china/

<comment><USER2> For reference: Why I'm giving up on Europe and moving my startup to China <http://maxkle.in/giving-up-on-europe/> and HN discussion - <http://news.ycombinator.com/item?id=1547964>

Unfortunately, the story focuses only on the girl. I would have liked to read about the actual experiences of doing business in China. He just glosses over the fact that their programmer was fired. Also, is his co-founder Chinese? I think that would have been relevant to mention.

</comment><comment><USER3> I think the post should have been titled 'How I destroyed my startup by competing for the only girl in the office with my cofounder'.

Small offices are no places for dramas. A bit different in large organisations where you are in different departments/buildings. Still a very tight rope to walk though.

<comment><USER4> The co-founder already had a girlfriend, so I think it was only his fault.

</comment></comment><comment><USER5> > "I told him that if he did not go my way, I'd stop doing the programming > work. He said if I did not go his way, he'd stop the staff from working."

This quote struck me because it's a surefire sign that a project is probably going to fail. Every time I've seen people holding a project hostage by threatening to withhold their skills, those projects have either ended in failure, or even when successful, the people on the projects had very low morale.

In my experience, it's very important to create a culture where people do _not_ use unique skills to hold a company hostage. For instance, a designer should be willing to implement a design that is (to her) sub-optimal from a design perspective, e.g. when A/B tests indicate that this design generates more money.

<comment><USER6> I agree, but in this case I'd say the problem seems to be 50/50 cofounders with no clear hierarchy for decision making. I've been burned by this too many times not to insist on a clear discussion up front on who has "last call" on product issues. Of course something like the quoted interaction is a symptom of a dysfunctional relationship and probably has very little to do with the actual issue at hand.

</comment></comment><comment><USER7> What is the role of China in this article other than in the title?

<comment><USER8> Nothing. But it catches attentions.

</comment></comment><comment><USER9> You guys fired people based on daily figures? Must be excellent for morale

<comment><USER10> Do daily fluctuations even matter, especially at startups?

I'm pretty sure even big companies have bad months. It's not a reason to start firing people left and right.

</comment></comment><comment><USER8> One sentence summary/advice: don't hire a pretty girl.

[edit]: hey why the downvote? go read the story and you'll see why.

<comment><USER11> Reminds me of the naval idea that it's bad luck to have a woman on board.

</comment></comment><comment><USER12> Are you writing a synopsis of what happened or a romance novel? So far it seems there are multiple thoughts, and the part about the pretty girl is pretty tangential.

</comment><comment><USER13> So he was ok with firing the programmer but didn't want to fire the cute girl who couldn't quite do her job of writing ad copy? Cofounder fail.

</comment><comment><USER14> tl;dr?

<comment><USER15> Having read the whole thing, I... honestly don't know. Is this fiction, or a true story told in a fictionalized style? What computer business are they in that they go from profitable to unprofitable in three or four days and this is a call to fire the entire company in two days? World's shortest runway or what?

<comment><USER16> Apparently you are not familiar with maxklein.

<comment><USER15> I really am not. Could you give me at least a hint in what sense you meant that?

<comment><USER16> That's exactly how he writes. "Is this fiction, or fact? Or stylized, fictional-sounding fact?"

</comment></comment></comment></comment></comment><comment><USER17> One of the most poorly written articles I've seen on here.</comment>


3.5B-year-old microbe fossils get another look - <AUTHOR> https://arstechnica.com/science/2018/01/hotly-debated-3-5-billion-year-old-microbe-fossils-get-another-look/ <comment><USER2> If you are into this kind of thing I highly recommend 'The Vital Question: Why Is Life The Way It Is' by Nick Lane "In The Vital Question, Nick Lane radically reframes evolutionary history, putting forward a cogent solution to conundrums that have troubled scientists for decades."

</comment><comment><USER3> I imagine this happens a lot more as there are advanced ways to preserve these, until better technology presents itself that tests for more than we have previously.</comment>


Show HN: I made an app that helps you search through your audio library - <AUTHOR> https://victorribeiro.com/look4sound/ <comment><AUTHOR> Hi everyone, recently GDC released 50+ GB[1] of free sound effects. As I'm doing some game development and need to find some sounds, I made this simple tool that let's you search for sound and preview them in a single page.

click load, select all your audio files, then just search.

when you click on a result it will create a preview of that sound, click again and it will go away.

hope you like it.

[1] - [https://sonniss.com/gameaudiogdc2020/](https://sonniss.com/gameaudiogdc2020/)

<comment><USER2> Looks sweet, thanks for sharing.

Have you considered setting up a torrent?

<comment><AUTHOR> thanks. They provide the torrent themselves.

<comment><USER2> Whoops, didn't scroll down far enough. Sorry about that.

</comment></comment></comment></comment><comment><AUTHOR> Here's a link showing how to use it: [https://www.youtube.com/watch?v=Hr828Yfhrqc](https://www.youtube.com/watch?v=Hr828Yfhrqc)</comment>


"Voice cues for the unfortunate souls that gave us 1-star reviews." - <AUTHOR> http://itunes.apple.com/us/app/stuck-on-earth/id478313722?mt=8&ign-mpt=uo%3D4

<comment><AUTHOR> Here's the whole text, as an app developer I definitely can relate:

About .01% of users got stuck on the first screen where it says Enter Your Name. They apparently got stuck and not understand that you were supposed to Enter Your Name. We have now added voice cues to help out these unfortunate souls that gave us 1-star reviews.</comment>


Why I'm Checking Out from Airbnb - <AUTHOR> https://wordpress.com/post/bionwi.wordpress.com/276 <comment><USER2> > You-are-supposed-to-reward-returning-cash-cows…erm customers. Period

That's not how the world works. Can't tell if this is a joke or not. Either way, this article is not written well.

</comment><comment><USER3> How can I read this article without creating a wordpress account?

<comment><AUTHOR> Sorry - bad link. It should be [https://bionwi.wordpress.com/2019/09/13/why- im-checking-out-...](https://bionwi.wordpress.com/2019/09/13/why-im-checking- out-from-airbnb/)</comment></comment>


Johnson and Johnson knew for decades that asbestos lurked in its Baby Powder - <AUTHOR> https://www.reuters.com/investigates/special-report/johnsonandjohnson-cancer/ <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=18684384](https://news.ycombinator.com/item?id=18684384)

<comment><USER3> I would like to highlight this comment and HN policy on reposts: [https://news.ycombinator.com/newsfaq.html](https://news.ycombinator.com/newsfaq.html)

Particularly, this article received significant attention just in the last few days and should be removed as a duplicate.

</comment></comment><comment><USER4> We shouldn't be surprised that this sort of thing happens from time to time.

What are the incentives?

If you're an exec in charge of some product, you want to sell the product. You don't want to be pulling it, you'll never get promoted like that. And you know more about how to move product than about asbestos testing results, that's for sure.

And chances are nothing will be discovered. And if it is discovered it will take a long time and you'll be long gone. And if it turns out to be really bad, you don't personally pay. The company pays.

Not saying I have an answer. I'm sure there's quite a few people within a company that would know about the findings, and they all have reasons to either keep things going, or you could call it a psychological bias towards diminishing the severity in their own minds.

<comment><USER5> > you want to sell the product

but if it has a carcinogen in it? do you really still want to? i fail to understand how humans can behave like this.

<comment><USER6> "It is difficult to get a man to understand something, when his salary depends upon his not understanding it!" - Upton Sinclair

This quote gets brought out a lot, for good reason, but I think people don't quite grasp its meaning. It's often understood as meaning that people will play dumb in order to resist you. But it goes deeper than that. A person will literally have a difficult time understanding something if that understanding will put their livelihood on the line.

I would wager that essentially everybody involved in this process had a twisted understanding of the problem that left them convinced that what they were doing was harmless.

<comment><USER7> When one personally doesn't know the victims it is easy to rationalize.

</comment></comment></comment></comment><comment><USER8> Everybody knew? Talc deposits often occur near asbestos deposits. There's a govt standard for 'cosmetic' talc that addresses asbestos content, that's been around since 1973.

<comment><USER9> Did you read the entire article? The FDA was guided by J&J to set the standard at 10x higher than their original proposal, and to reduce testing to an inexpensive test that only detects the least common type of asbestos. Basically, the article contends, the standard that "everybody knew" about is meaningless and was not much more than positive press for J&J.

<comment><USER8> ...and is the health issue of talcum powder real? Is that standard wrong? Is it's risk above the environmental noise level of cancer-causing substances?

Anything else is not much more than ragging on J&J.

</comment></comment></comment><comment><USER10> When I read about something like that, I'd like to hear more than "traces of". I'd like to see concentrations and levels of concentrations from which it is considered toxic. Products can even have traces of radioactive material while being harmless.

<comment><USER9> Did you read the article? They explain that "traces of" was actually as high as 3% in some samples. The bulk of the article explains the tests performed over time including the results of concentration. Not sure what your complaint is, they even link to the original test result documents.

<comment><USER11> 3% of other (minerals?) than talk. Not 3% asbestos to make that clear.

<comment><USER10> And even then, without a dangerous threshold level, the number is meaningless.

<comment><USER12> How about none? Is it advertised or listed as containing asbestos in the ingredient list? Do you want to use it on your baby?

<comment><USER10> "None" doesn't exist in nature. Every product is always contaminated by all sort of chemicals. It's always a matter of concentration. The water with which you prepare you baby milk likely contains cyanide, lead or arsenic. Just not in high enough dose to matter.

</comment></comment></comment></comment></comment></comment><comment><USER13> If people started tossing J&J baby powder at J&J executives would that be assault with a deadly weapon?

<comment><USER14> One exposure might not be sufficient to create a deadly cancer.

</comment></comment><comment><USER15> The legal discovery process is an interesting one here - we are seeing documents almost 50 years old here, paper records of what, prima facie is damning behaviour.

But who keeps records for fifty years any more? My BigCo Employers delete my mails after a quarter usually. The idea of my emails being dragged up in 20 years is crazy

Edit: I meant to say that new practises like deleting emails are likely to ensure that crimes like this but happening today may well not get discovered, or at least prosecuted.

Good audit trails are vital for justice - and by deleting them are we just encouraging fake news - a lack of trust in what did happen? I have a suspicion that deleting ones organisational memory is likely to be more destructive

<comment><USER16> Emails are one thing, but product QC results and related communications might well be retained for decades. Not just for liability reasons, but because trends in process behaviour and performance can be observed and acted upon, and correlated with changes to suppliers, machinery, workers' shift patterns, and other factors. This can affect the bottom line.

</comment></comment><comment><USER14> Leaded gas. Asbestos insulation. Cigarettes. Fossil fuels. High schools would do well to put on All My Sons every 3 years [https://en.wikipedia.org/wiki/All_My_Sons](https://en.wikipedia.org/wiki/All_My_Sons)

"All My Sons is based upon a true story... how in 1941–43 the Wright Aeronautical Corporation based in Ohio had conspired with army inspection officers to approve defective aircraft engines destined for military use"

</comment><comment><USER17> If it can be proven beyond a reasonable doubt that people died because of this, and that execs knew the results and danger and ignored them, why shouldn't the state(s) charge them personally with murder /manslaughter ? In the end someone, a living, breathing human being, made the final decision to ju$t keep going.

Let them explain it to the jury. Asbestos was found in powder and people died because of it (assuming both can be proven--a judge will have to convinced first and then it goes to trial.)

Money is one part of the equation, you can be jailed for life for murder and asked to pay $15million for killing that person.

</comment><comment><USER18> Wonder if they sell the same product in Europe. I don't think we have a similar exception as the USA to allowing putting asbestos in cosmetics.

</comment><comment><USER19> It is worrisome that current, and future "leaders" are discussing the ethics and other nuanced nitpickings.. as if this were a debate class. There should be one - correct - answer.

</comment><comment><USER20> The whole purpose of making a corporation is to mitigate risk in the first place. That's literally why they came into being. Secondly, it is to concentrate financial power to pursue a joint mission, usually profit. So with these two design forces, there's a structural incentive in the short term for these things to happen. A decades-long awareness of unethical dealings is another side effect of this design: externalizing costs onto society at large.

</comment><comment><USER21> When companies like Marriott and JJ are doing things like this, people incur great losses and there is little to no repurcussion to the companies.

Meanwhile, some guy in the street will go to prison for selling some weed.

All those who did this at JJ honestly deserves a life sentence at a minimum given abestos exposure leads to mesothelioma.

This is some diabolical stuff - something out of a movie, akin to for example contaminating the water supply in Batman.

So evil.

<comment><AUTHOR> Big corps who can do anything to capture market share and have some sort leverage over the Government cannot be trusted.

I guess people just forget about all ethics when huge debt / investment / incentive is involved. Leverage over media and governments along with an army of lawyers and bean counters just makes this whole thing possible.

Meanwhile globalisation has arguably made it more difficult for SMEs to market / sell products in industries within which big corps have huge interests.

<comment><USER22> This is a big reason why I'm for regulation when it comes to health, and environment. Somehow conservative Americans are believed that the 'invisible hand of the market' will solve all problems. But companies will always be in it to make money if they feel they can get away with cutting corners.

Would we rather err on cutting a few percent here and there from company profits due to overhead and inefficiency of regulation? Or err on harming people and the planet?

<comment><USER23> We saw how the 'invisible hand of the market' played out in the housing collapse of 2008. Even the clown known as Alan Greenspan admitted that his ideology was shaken.

</comment></comment></comment></comment><comment><USER24> I have a question which I don't believe is answered: these people who knew, where they using the powder on their own babies? Because they could be due to mental minimization of the risks associated with the use of their own products.

If they are, and they could be, then humans are more pro-ignorance than I ever thought.

</comment><comment><USER25> Honestly, reading that entire thing was exhausting. How obvious does it have to be before we change as a people.

</comment><comment><USER26> I am speculating about motives here, but it seems to me that this sort of behavior is an example of an all-too-common form of the 'banality of evil', Hannah Arendt's observation / thesis that the holocaust was enabled and implemented by a large cadre of rather ordinary people who were 'just doing their jobs'. In this case, there was no nucleus of genocidal, powerful and violently coercive psychopaths driving the process; it may have been almost self-organizing out of people 'just doing their jobs' in response to the initial mistake of shipping a tainted product, and either not thinking of the ethical issues, or actively suppressing them (some of both, I imagine), all helped along by a dose of self-interest.

This is not intended to be in any way an excuse for what happened here; if anything, it is a cautionary tale, as any of us might, one day, be faced with a choice between just doing our job and doing the right thing.

</comment><comment><USER27> Double posting. It was just on HN yesterday.

<comment><AUTHOR> I missed it yesterday and didn't search for it before submitting so that's my bad.

But if it's getting upvotes, I guess it's because other people missed it as well.

</comment></comment><comment><USER28> Makes these stories more relevant.

[https://www.nytimes.com/2017/10/23/business/johnson-talc- can...](https://www.nytimes.com/2017/10/23/business/johnson-talc-cancer.html)

Almost as if the "free market" doesn't regulate itself and generate ethical results...

<comment><USER29> You realize that the FDA (regulator) was award of these results and still didn't pull it off the market?

<comment><USER30> Yes, because the so-called "regulators" are in the hands of the companies which _they are supposed to supervise_. It's a complete perversion.

<comment><USER29> As someone who has worked with the FDA I find this laughable. The FDA has very few qualms about bringing the full force of the US govt down on a company.

Maybe, just maybe, the situation is a little more complex than you realize?</comment></comment></comment></comment>


Are you user friendly? (old) - <AUTHOR> http://www.over-yonder.net/~fullermd/rants/userfriendly/1 <comment><USER2> All that and it basically concludes Windows is terrible?

Really? All that just to bash Microsoft?

And X Windows being any part of a conversation about user friendly-ness is ridiculous.</comment>


Improve your REPLs with rlwrap - <AUTHOR> http://ithaca.arpinum.org/2013/01/20/rlwrap.html <comment><USER2> This program is exactly what we usually recommend for people who aren't using SML/NJ inside of an Emacs inferior window (which is far and away the most common usage mode for experienced SML/NJ programmers - all ten of us <grin>).

I personally apologize for my laziness. Two or three different times I've started in on making something similar to the haskeline package in GHC to provide readline-style support to make life easier for students, but have never quite finished it up. Unfortunately, "just linking" readline/libedit isn't a very friendly solution given the way that the interpreter is currently architected, as it's written on top of the ML basis library primitives for reading/writing individual characters from the input stream.

<comment><AUTHOR> Thanks for mentioning Emacs: You made me realize _why_ this hadn't come up in the course notes or material for the Coursera class I'm doing[1]: they explicitly recomment using SML inside Emacs. Unfortunately, I'm a relatively long-time Vim user, and I'm just not comfortable editing in Emacs. So I came to this round-about solution.

[1]: <https://class.coursera.org/proglang-2012-001/class/index>

</comment></comment><comment><USER3> I've been using rlwrap for years with Oracle's sqlplus command line client on Linux.

Because it uses readline, it can benefit from settings in ~/.inputrc, along with all of your other readline-based applications for a more uniform experience.

For example, I'm a vi(m) user, so I put this in my .inputrc:

        set editing-mode vi

That's just the tip of the iceberg.

These days, I tend to use the dbext vim extension for Oracle queries, allowing me to develop and save them in one file per project. But when I need to fire off something quick on the command line, it's nice to have rlwrap available.

<comment><USER4> The command line SQL client is one place Postgres blows away Oracle. I'd pay real money for psql on Oracle.

<comment><USER5> You would have to, wouldn't you? It's Oracle...

<comment><USER4> Not at all. There are several free open source alternatives to sqlplus like Yasql and sqlpython but none of them are as good as psql.

</comment></comment></comment></comment><comment><USER6> This is great, exactly what I needed for the new Coursera class about Programming Languages: <https://class.coursera.org/proglang-2012-001/class/index>

(They start of with ML and a very simple REPL)

<comment><AUTHOR> I'm taking the same course. I was frustrated with the SML REPL, learned about _rlwrap_ and wrote this up. Glad it helps. (I just posted the tip to the course's forums as well. Thanks for reminding me.)

<comment><USER7> Thanks for your contribution! What do you think of the course so far? I had too much fun doing the first homework.

<comment><AUTHOR> ML itself is interesting, and I think the material for the class is good. I enjoyed the first round of homework - not too easy, but not really too hard either. The tough thing for me will be seeing whether can I maintain the extra work for the full 10 weeks.

</comment></comment></comment></comment><comment><USER8> OS X users, I advise using

        brew install rlwrap

instead of downloading the tarball in the link. You may feel tempted to download a tarball and compile readline. But I experienced the problem mentioned in rlwrap-0.37/BUGS:

        49-On recent OS X sytems, libreadline is not the real thing, but a
        50-non-GNU replacement. If the linker complains about missing
        51:symbols, install GNU readline and try again.

This may then lead you to attempt compiling and installing GNU readline, which will ultimately lead you to try to solve more problems you're having in compiling readline. You might find this fun. But if you just want to get things over with, there is an easier way. Homebrew[1] to the rescue:

        brew install rlwrap

Perhaps this is just obvious to others. Would've saved me a few minutes to hear this, though.

[1]: <http://mxcl.github.com/homebrew/>

<comment><AUTHOR> I definitely think a package manager is better than manual installation. That's why I said this:

> Simply install rlwrap via your operating system's package manager (or > manually)

But I'll add an update that mentions the bug on OSX. Thanks for the feedback.

<comment><USER8> Ah, you're right. Sorry for implying you didn't mention this. I overlooked that--just went to the rlwrap page and got caught up in what I was doing.

<comment><AUTHOR> No worries at all. Any feedback is good - and I added a clarification to make it's clearer now.

</comment></comment></comment></comment><comment><USER9> For the rlwrap gurus in the thread, is there a way to use rlwrap to better deal with multiline expressions in the repl?

For example, when using a clojure repl and entering a multiline expression, I might err on one line and want to go back and correct that line before evaluating the expression. Unfortunately, the only option I have right now is to terminate that expression by entering in a bunch of closing parens and then trying to enter in the entire multiline expression again. It'd be great if multiline expressions could be modifiable and if you could up arrow to load a previous multiline expression.

<comment><USER10> You might try starting rlwrap with the `-m' option (--multi-line) which by default escapes " \ " into newlines. By itself this isn't all that useful but this enables editing the line in your $EDITOR via `ctrl-^'. When you do this the editor will display the escape sequences as literal newlines, so that means you can do multi-line editing with up to recall a previous expression and `ctrl-^' to edit it.

If you're to the point where you are editing lots of multiline expressions you may want to consider using an editor that has a function that will send the contents of a buffer or the current expression to a running interpreter. Emacs is an obvious choice for this, but there are lots of plugins to other editors/IDEs that do the same.

</comment></comment><comment><USER11> I just want to say that rlwrap is awesome.

Such a _simple_ idea, yet so effective.

</comment><comment><USER12> rlwrap seems cool at first blush, but you quickly realize that for anything nontrivial (e.g. context-aware autocomplete) you need to use readline directly

<comment><USER13> This isn't about adding readline support to your own programs (although it's a reasonable stop-gap solution there), this is about adding basic readline support to _other people's_ programs without a massive investment.

</comment></comment><comment><USER14> I knew about rlwrap, but hadn't bothered to learn anything in depth. Thanks, keywords are a great feature that I wouldn't have known without this.

</comment><comment><USER15> For people who like ruby but think irb sucks, there's pry (<http://pryrepl.org/>), but it's still missing some features.

<comment><USER16> which features is pry missing?

</comment></comment><comment><USER7> This is a godsend, thank you! I've been having a tough time using `sml` and `gprolog`, but this fixed every single issue I found. Thumbs up.

</comment><comment><USER17> ocaml has an awful default interpreter repl, so most people use it with emacs. Alternatively, my default rlwrap is this:

rlwrap -p"0;31" ocaml -init _init.ml

the -init allows me to preload, set directories aso.

As a remark on the side. A lot of people complain about a lot of things without even bothering to improve the quality of their working environment.

</comment><comment><USER18> News at 11'</comment>


The Rise of the Nerd - <AUTHOR> http://www.slideshare.net/Group8A/nerd-deck-final

<comment><USER2> I hate this rise of the "nerd" all it dose is forcing you to be a certain stereotype in order to be seen as someone to hire by startups.</comment>


Verve Painter, a fluid dynamics based paint application - <AUTHOR> http://lesterbanks.com/2014/03/verve-painter-fluid-dynamics-paint/

<comment><AUTHOR> Amazing that the binary for this is only 288kb</comment>


Freshplum has hard problems - <AUTHOR>

Freshplum has hard problems. It's plain md5. Cracked in less than 5 seconds with 16crack.
Edit. See the front page of HN to understand. They posted this: Freshplum has d64a84456adc959f56de6af685d0dadd 8d8a1b73876ca678cc3afa372e5199de
For some reason comments are closed. So I posted the solution here. <comment><USER2> Even easier:

[http://lmgtfy.com/?q=d64a84456adc959f56de6af685d0dadd+-fresh...](http://lmgtfy.com/?q=d64a84456adc959f56de6af685d0dadd+-freshplum)

and

[http://lmgtfy.com/?q=8d8a1b73876ca678cc3afa372e5199de+-fresh...](http://lmgtfy.com/?q=8d8a1b73876ca678cc3afa372e5199de+-freshplum)

<comment><AUTHOR> Yes, but less fun than cracking it yourself with software you wrote.

<comment><USER3> Yes, but I guess they're rather looking for people who value the goal and not the path.

<comment><AUTHOR> They'll find plenty of those.

</comment></comment></comment></comment><comment><USER4> They don't want you to post the solution. If you're interested in the job, it shows that you have a basic level of competence in figuring things out. There's another teaser on the job page they link to.

<comment><AUTHOR> So is this a paid spot on HN? Can't reply to or upvote/downvote their posting? Yet it's on the front page.

Edit: They should do better than md5 if they want smart people to solve hard problems.

<comment><USER5> I'm constantly surprised by this response to these sorts of questions. My understanding is that it's simply an initial filter - this isn't the hard stuff. My own experience is that there are many people who can't solve this sort of thing, and yet think they're great. This sort of question is just going to cull the obvious non-starters as an initial phase of the triage. The teaser on the jobs application page is similar. It's only after passing those - and showing that you care enough to try - that the interesting bit starts.

Sadly, by posting this submission you've simply negated the whole point, and now they'll have to think of something else.

And with regards paid spots, again, my understanding is that job posts by YC companies can't be replied to and simply drop linearly down the front page. They are treated as a special case, but equally, have to adhere to specific guidelines.</comment></comment></comment>


Cognitive function decreases in over-40s working more than 25 hours per week [pdf] - <AUTHOR> https://www.melbourneinstitute.com/downloads/working_paper_series/wp2016n07.pdf <comment> T-A This begs the question: what about under-40s working more than 25 hours per week?</comment>


Is ATARIBOX Going to Make It? - <AUTHOR> https://www.ultragamerz.com/is-ataribox-going-to-make-it/ <comment><USER2> I would hope it could tap into the Atari 800 / 5200 / 7800 era of games.</comment>


Hey Docker, Get Off My Lawn - <AUTHOR> http://michaeldehaan.net/post/131057132717/hey-docker-get-off-my-lawn <comment><USER2> Containers != microservices.

Yes they can be used for this, but they are usefull for a lot more things, we use docker intensively CI in Jenkins for documented, project-specific build environments. I replaced dozens of build VM's that were idle 95% of the time with 1 beefed up VM running docker. I use a lot less resources a lot more efficiently.

Yes it is hyped, but that doesn't mean it's useless. Docker or containerisation, just as any other tech, is just another tool in the box. It's up to the users to decide how to use it - or not to use it. Stop bitching about it, and just don't use it if you don't see any advantages in your use- cases. For me, it was mostly a positive experience.

<comment><USER3> > we use docker intensively CI in Jenkins for documented, project-specific > build environments

This. Doing apt-get install on Travis builds to spin up _my_ required tools on every build was slow and a PITA. I started using GitLab CI with the Docker executor[0], that's reduced to `docker pull myimage` which is often times cached locally. Build time when from up to 10s of minutes -> seconds.

I built a Docker image for building Android AOSP projects[1]. Few people use Docker for build environments where it's immensely valuable. I don't want to develop my low level Android platform code on Ubuntu 14.04, I'd rather throw the build over the wall to a pre-vetted build image that _always_ works.

Sure I could roll my own special Jenkins slave to do this, but why not leverage Docker? Perhaps it'd be too easy to use the _same_ Docker image on my development laptop.

I do agree with the author in some respects that some people don't fully understand when containers are valuable and instead containerize all the things!

[0] [http://doc.gitlab.com/ci/docker/using_docker_images.html](http://doc.gitlab.com/ci/docker/using_docker_images.html)

[1] [https://hub.docker.com/r/kylemanna/aosp/](https://hub.docker.com/r/kylemanna/aosp/)

</comment></comment><comment><USER3> > Creator of Ansible and Cobbler

For context on author's perspective. Perhaps the post is related to [http://www.ansible.com/blog/red-hat](http://www.ansible.com/blog/red-hat)

</comment><comment><USER4> yeah, nice one. Thanks for writing down pretty much my own thoughts a lot more eloquently than I ever could.</comment>


Ask HN: What are the best options for cloud IDEs? - <AUTHOR> <comment><USER2> A couple of weeks ago, researching options for remote pair programming I signed up to Cloud9... and I was quite (positively) surprised! They give you a full VM/container so you can play with a proper Terminal..

I only disliked one thing.. I couldn't install yeoman for scaffolding some apps.. I don't know why! I'll need more research...

<comment><USER3> Cloud9 also supports remote ssh workspaces which is very useful. The default workspace runs inside a container where you have root. They give you a public https route mapped to the container.

</comment></comment><comment><USER4> My personal favorite: Cloud9 (c9.io). Includes many built-in functionalities and they have a responsive support team.

</comment><comment><AUTHOR> One of the ones I recall seeing (and can't remember) allowed you to use your own Digital Ocean/AWS instance instead of using theirs. I've also seen an old post on reddit suggesting a DIY instance of Codebox ([https://github.com/CodeboxIDE/codebox](https://github.com/CodeboxIDE/codebox)) but it no longer appears to be updated.

The others I've heard of are Koding ([https://koding.com/features/solo#get- started](https://koding.com/features/solo#get-started)), Codio ([https://codio.com](https://codio.com)), and Runnable ([https://runnable.io/](https://runnable.io/), doesn't appear to be an IDE).

</comment><comment><USER5> I like Nitrous (nitrous.io/) - they have just reintroduced a free plan.

I use it to code C++. It's nowhere near the levels of VS2015, obviously, but it allows me to have a free dev box in the cloud.

</comment><comment><USER6> I would suggest checking out Codenvy ([http://codenvy.com](http://codenvy.com)) they recently released a new On- Prem version built on Eclipse Che ([http://www.eclipse.org/che](http://www.eclipse.org/che)). Che has made some big steps forward recently, if you haven't looked into it lately I would strongly suggest taking some time to check it out.

</comment><comment><USER7> I'd been using Cloud 9 c9.io. It's really good since it gives you a terminal and repl shell to play with.

The only issue is that c9 seems more suited for web development.

</comment><comment><USER8> One that was not mentioned is Codeanywhere [https://codeanywhere.com](https://codeanywhere.com)

<comment><USER9> As the founder of Codeanywhere, I thank you for the link :)

</comment></comment><comment><USER10> Loving Cloud9 (c9.io) We've been using it for over a year now as our primary team development tool and couldn't be happier.

</comment><comment><USER11> Codio has been my favorite. Very great for web development. I used it for a couple years to program from chrome books! However, their business model has shifted to a more education focus, so I can't say if they'll continue to focus as much on badass web development ide.

</comment><comment><USER12> You can have a look at Eclipse Che, I tested it not so long ago and it was pretty good.

</comment><comment><USER13> I like ShiftEdit ([https://shiftedit.net/](https://shiftedit.net/)).

</comment><comment><USER14> codenvy.com was neat but I ended up going back to net beans and Visual studio</comment>


Show HN: TealJoy - <AUTHOR> http://www.tealjoy.com/

<comment><USER2> There's a ton of meme/funny websites out there (like 9gag). Why bother making another?</comment>


Ask HN: Storing Credentials Securely - <AUTHOR> I know that storing plain-text passwords in your database is a no-no; for login credentials, the typical solution is to store a hashed password (preferably with some entropy or salt).  But what about sites that store your credentials for other services or sites?  I'm thinking about things like Mint (www.mint.com).  Since hashing is a one-way function, they can't hash my credentials.  So are they encrypting it, and hopefully somehow keeping their encryption algorithm/data safe?  Is it even possible for the encryption algorithm to be REALLY safe?  What's the best practice for doing this sort of thing?<p>I'd really like to hear your thoughts, since I'm a little nervous about giving people my banking credentials, but also because it seems like this sort of thing is going on more and more with aggregator-type services (things like Friendfeed). <comment><USER2> I am not sure how mint does it, but several ways to store highly secure data is since you asked for it

      * Boxes have no direct internet connection
      * Spread the Ciphertext, Decryption Keys, and Algorithm
        across multiple yet different machines (each with unique
        distributions/operation systems and data storage
        solution).
      * Instead of a global salt, use a separate salt per each
        user (login name / account creation time)
      * Generate the encryption/decryption keys for storing the
        credentials using a newhash(login+password) and use it
        only when the user logs in (this hash is never stored,
        it's hashed, generate the encryption/decryption keys,
        decrypt the data, use the data, and destroyed). So this
        key only awailable for a short period of time when the
        user logs in.
      * Use something strong to encrypt like PGP as the base
        and roll-your-own obscure one on top of it (which is a
        non-standard algorithm)

There will always be holes and weaknesses, it's just making it really really hard, never impossible.

<comment><AUTHOR> Yeah, "security by obscurity" seems like the only way to do it really. It's sort of like DRM; a DVD is encrypted, but your DVD player needs to know how to decrypt it, and since you have both items, the information for HOW to decrypt is in there somewhere, so you just need to figure it out...

</comment></comment><comment><USER3> Mint actually doesn't store your credentials. Rather, as I understand it [1], you essentially delegate to them certain read-only privileges for your accounts. Then, they use their own highly-authenticated channels to the financial providers to request only what they've been authorized to see.

They don't retain your own credentials; they've even said they don't retain exact knowledge of who you are -- just how to get your transaction stream and attach it to your Mint reports.

Apparently, they leverage the preexisting service for doing this established by Yodlee, a company that dates back to the first net boom and initially had a multi-account dashboard that _did_ login for you, but evolved to a service for doing this in a more secure way.

[1] my understanding based on the link timf provided in this prior thread -- <http://news.ycombinator.com/item?id=412715> \-- and other research around that time

</comment><comment><USER4> Use OAuth. <http://oauth.net/>

That's what I'm using on FragTweet.com. To be clear, the service has to let you use it, but its still better than storing passwords. You get an authorization token from the target service that lets you authenticate as that user for certain actions which you can then store. At any time the user can deactivate the token through the service's control panel. Very slick, although not quite finished.

</comment><comment><USER5> I have no experience of mint, but I used to use egg.com which accesses other bank accounts. That does it by installing an application on your computer that stores the passwords locally. I wouldn't trust anything else and even then there's still a certain amount of trust there that they're not lying to you about how it works.

As for another site storing your passwords, I'd at least hope they'd store it encrypted, but trusting someone else is a matter of, um, trust. Who knows, it could be in a text file called passwords on the root.</comment>


$100 apps, bibles, big-budget RPGs: The strange nature of Nigerian app market - <AUTHOR> http://www.bgr.com/2012/08/15/nigeria-mobile-app-market-analysis/ <comment><USER2> Must be a slow news day for BGR. Not only is this article pointless, but the writer was also too lazy to do any basic research. It is true that the Nigerian App store slants towards religious apps (and sex apps).It is also true that there is very little activity on that store. I had an app in the top 100 overall for many weeks on sales of fewer than 30 total copies

</comment><comment><USER3> "Popular Nigerian apps are expensive. Very expensive. The two best-selling bible apps among the top five apps on August 10th were each $10"

Very expensive 10$

Choose one please.

I don't know about those particular apps, but an era where any piece of software over 1.99$ is considered expensive is a very sad one.

<comment><USER4> Your sarcasm is uncalled-for. Nigeria is not the United States. If normal people are making the equivalent of about $100/mo, and most apps are around $1-$2, then a $10 app should probably be killing snakes for them.

What's probably going on here is that people aren't aware of how to get the Bible on their phone for free, and are still paying a lot less than it takes to get a hard copy.</comment></comment>