CircleCI trusts 8 analytics companies with your source code and API tokens - <AUTHOR> https://kev.inburke.com/kevin/circleci-is-hopelessly-insecure/ <comment><USER2> Rob Zuber, CTO of CircleCI here. We take security very seriously and are taking a deep look at the issues Kevin raised.

We'll save additional commenting until we have gathered more information. In the meantime, our security policy and steps for reporting issues are here: [https://circleci.com/security/](https://circleci.com/security/) and we'd like to ask the community to please use our outlined methods for reporting potential security issues so we can keep CircleCI as safe as possible for everyone.

<comment><USER3> OP here. Thanks for responding promptly. To be clear, letting third party JS run in a trusted environment like a dashboard is an industry wide problem. If we assume CircleCI is the _only_ bad actor we're kind of missing the point of the exercise.

CircleCI is a notable example, due to the fact it hosts source code and secrets for so many different companies and loads so many third party scripts in its dashboard context. But they're not unique in this regard. I hope everyone reading this is reconsidering the scripts that have access to their dashboard and pushing for changes at their company.

If CircleCI was immediately vulnerable to injection via the scripts above I would have used the private disclosure route and I encourage others to as well. But I don't know that there is a "vulnerability" here so much as a discussion that we need to have about what and how much third party code we let run in a trusted context. I wrote a little more in the thread below, [https://news.ycombinator.com/item?id=15442988](https://news.ycombinator.com/item?id=15442988).

<comment><USER4> IMHO you should have followed the standard practice of telling them first, then posting the story afterward. Blindsiding them wasn't nice, even if (hopefully) this makes them and others think more about what they risk with external JS, rather than just "oh shit circle...". Just my 5c.

p.s I'm curious why you thought this route was better?

<comment><USER5> I hear this attitude a lot and it always rubs me the wrong way.

It's a corporation... Why should he care about it's _feelings_? What does he owe CircleCI? Are they paying him? What claim do they have to his time to jump through their hoops / process?

I'm positive in this case that they weren't intentionally messing with people's security, but shouldn't we and their customers be able to judge that ourselves instead of getting it swept under the carpet via private channels?

I do believe it's good practice to "not be a douche", especially at a personal level, but I wouldn't even come close to categorizing this as douche behaviour.

* Note: this comment is not actually directed at CircleCI, just the attitude that we all somehow owe it to companies to tell them about their goofs privately.

<comment><USER6> It's rarely about the company and much more about those affected by a potential issue. This issue's a little different as it's the potential for a vulnerability more than an actual vulnerability.

A typical case for responsible disclosure is something like a bug in Apache or Nginx that's serious and if a security issue is found that they're given time to address it. So when they make an announcement its:

1\. Here is the issue

and

2\. Here is the fix

Instead of just spreading and publicizing a vulnerability.

<comment><USER5> I'm mostly with you when there's potential damage to their customers, especially when those customers are individuals (like a database of social profiles being compromised), which was not the case here. However I think saying it's "rarely" about the company is a bit naive.

There's been some really high profile breaches where the extent of the impact to the customer has taken an unacceptably long time to be made public... which results in increased fallout damage.

A company's natural inclination is going to be to minimize losses (generalizing of course), and that often means dragging their feet, or dealing with it privately and never notifying their customers.

We should recognize these incentives and be a bit more aggressive about holding their feet to the fire, instead of criticizing the researcher who discovers the security flaw. Unless of course his / her behaviour is blatantly malicious.

It anecdotally feels a bit lopsided in favour of the corporations at the moment. Especially when someone like in this post, who clearly didn't endanger any customers, gets criticized...

</comment></comment></comment></comment></comment></comment><comment><USER7> At GitLab we separated the infrastructure between about.gitlab.com (our marketing site, lots of third party javascript) and gitlab.com (our application, zero third party javascript). We recently deprecated the Piwik instance we ran in house for gitlab.com because it slowed the page load time. Please let me know if there is anything we can do better, these things are complex.

<comment><USER8> _> Please let me know if there is anything we can do better_

You can not opportunistically spam nearly every thread where GitLab might be tangentially related.

I don't use GitLab largely because of the way you post on HN, though the software seems reasonably well-written. It's very frustrating.

<comment><USER9> You refuse to use an awesome product because the CEO of a startup is actively engaging with a community that may (or may not) use it, accepting feedback and discussing the product with people?

Ok....

<comment><USER10> This isn't engagement, it is quite clearly advertising.

<comment><USER9> Sure, he's advertising how Gitlab, a related product in the same space, handles this and the steps they took to prevent this problem from happening.

It's informative, not "gitlab doesn't suffer from this, here's a 10% off coupon [https://gitlab.com!!"](https://gitlab.com!!").

<comment><USER10> You're right, his post does contribute to a discussion on how to avoid this situation (which is what I'd like the thread to be about). I think it is based on a history of seeing GitLab's marketing team or CEO in any comment section tangentially related to their product that has put a bad taste in my mouth. I usually know before clicking into a comment thread whether or not they will be pushing their platform inside.

<comment><USER11> In general, I would tend to agree with you. In this case, though, the original article was about CircleCI specifically but mentioned this being an issue across the entire industry. GitLab is a part of that industry and they have lots of users on HN so, in this case, the comment is relevant (IMO).

More generally, however, you're right although I have just come to accept that this is how things are on HN. Choose pretty much any "Show HN" thread or any thread about some cool new app/product/service and in the thread you'll find a few "shameless plug" comments that would be considered spam in any other forum: "Hey, we also make an app that does $foo, sign up for our beta at example.com and check us out!".

(One of the worst "offenders" is Userify. Pick any thread that relates tangentially to user authentication and chances are good you'll find a comment from them that manages to work their name/URL into the conversation somehow.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Google's policies are a big part of this problem. Ad code and tracking code ought to be in an iframe, where the code can't snoop on the surrounding page context. Google insists that _their_ ad code must not be in an iframe. That gives the lesser players an opening to insist that they, too, should't be constrained.

A few big site operators should push back against Google on this. The New York Times and CBS, for example. They use Google Publisher Tags, but no Google ads, so they don't really need Google on their pages.

<comment><USER13> Most ad code does run in iframes and the industry standard is to use "friendly iframes" which offer security but also access to the parent window. And even if you use iframes, something has to create that iframe initially and publisher devs are not going to do that manually, which is why there are top level script tags. All tag managers and adservers today default to using iframes for 3rd party tags.

<comment><USER12> Google AdSense FAQ:

 _Q: Is it violating program policy if I place ads on iframe webpages in my software?_

 _A: Yes, it does violate our policies. Firstly, you're not allowed to place ads in a frame within another page. Exceptions to our policies are permitted only with authorization from Google for the valid use of iframes._ [1]

[1] [https://support.google.com/adsense/answer/3394713?hl=en](https://support.google.com/adsense/answer/3394713?hl=en)

<comment><USER13> That's different. Yes, their policy is that you cannot have a page of your site that you load in an iframe, then put ads into that child page. This is to prevent fraud and viewability issues like loading 100 invisible child pages in the background to rip off ad networks.

None of that has to do with how ads from their network are actually rendered when you use their tags. Adsense/DFP tags do use iframes for almost everything unless explicitly set to load directly on page, usually for legacy code or rich-media. The relevant help article is here: [https://support.google.com/dfp_premium/answer/183282](https://support.google.com/dfp_premium/answer/183282)

 _"...SafeFrame is supported in DFP and enabled by default when using Google Publisher Tags. Reservations serve into SafeFrames by default, but you can disable this setting...and use friendly iframes instead, if needed.... Some creatives, such as expandable ads or creatives that access your page's DOM elements, might not render correctly in SafeFrames or other cross-domain iframes. We recommend updating these creatives to make them SafeFrame- compatible, in order to retain SafeFrame's security benefits. If this is absolutely not an option, there are a few things you can do to allow reservation ads of this type to render properly..."_

<comment><USER14> To add to this, there's also a slow transition towards safe frames [1] that allows for better protection than friendly frames by restricting all page- iframe communication to a specific API.

[1] [https://www.iab.com/guidelines/safeframe/](https://www.iab.com/guidelines/safeframe/)

</comment></comment></comment></comment></comment><comment><USER15> > Send an email any time an API access token is created. Add a setting to > allow org-wide disabling of API token creation.

I wish more apps supported this.

Also on my list is a " _Don 't ever let me disable 2FA_" setting. I'm more worried about malicoius resets than I am about ever losing my 2FA device _and_ backup codes.

> Add an option to delete old logs. If you have ever dumped env vars to the > log file, an attacker can export these.

I surprised that secrets make it into the logs at all. I would have expected them to filter anything that's in an env secret from the log output. Pretty sure Travis does this.

> Enable subresource integrity, or serve JS from each of these companies from > the CircleCI domain.

That's not much of an option for this type of thing as the third parties would then have a PITA time dealing with upgrades (so they wouldn't support it). Using <script src="hxxps://tracker.example.com/path/to/script.js"></script> (rather than a fixed version) allows for live upgrades as they're in control of the resource that is loaded.

And you can't load the script from your domain as at the end of the day it's got to get instructions and upload data to the third party. At best you'd be loading a shim that does the same thing as the script tag.

<comment><USER16> > "Don't ever let me disable 2FA" setting.

I like this idea. I'd only want to use this though if my Google 2FA backup codes are backed up via Authy or a similar app.

I don't trust codes I've printed out and have always lost.

<comment><USER17> I tend to just stick all my 2FA backup codes into "secure notes" in LastPass.

<comment><USER18> That sort of defeats the purpose of 2FA though. Now if your LastPass database is compromised, they have access to your 2FA codes as well.

<comment><USER17> True. I think it's a bit of a security compromise for convenience. Having backup codes stuck in a folder somewhere at home is only useful if I need to regain access to one of my accounts while I'm at home.

</comment></comment></comment></comment></comment><comment><USER19> I feel calling all 8 of these companies "analytics" is a little unfair.

Pusher is a SaaS product for websockets and push notifications. I think it's reasonable that a company like CircleCI might outsource this instead of maintaining the infrastructure for it in-house.

Launch Darkly is a feature flagging service. While I feel the value is much less than Pusher (and I'd be inclined to just build an in-house solution), I think it's still a relatively reasonable tool to use to create a better user experience.

Intercom when used for customer communication is also something that I feel I'd want as a user, although this could perhaps only be loaded when requested by the user.

<comment><USER20> I feel like narrowing down what any of those companies _could_ do to what they are doing today irresponsible. And analytics is one of the could-do's that many third party tools do offer or add on later to increase monetization or perceived value to customers.

The important point is that there are now 8 attack surfaces instead of 1. Whether they're analytics or pad-string doesn't really matter.

<comment><USER19> I agree there are now 8 attack surfaces, but to call all 8 "analytics" I does not think does justice to the reasons why CircleCI may have chosen to use some of them.

</comment></comment></comment><comment><USER21> Thinking about mitigation here... It appears that some of the included scripts have crossorigin="anonymous" script tags. Wouldn't this prevent authenticated access to to the circleCI domain, aka preventing the creation of api tokens or access to the API using the logged in browser context for any script loaded off the circleci domain?

Also, not that they do so, but would Access-Control-Allow-Origin set to something other than * prevent 3rd party requests to the API for scripts loaded from 3rd party domains.

Also curious if anyone has written a JS library that patches XMLHttpRequest.prototype to audit exfiltration of data in the DOM.

<comment><USER22> usually blockers like ghostly and ublock/adblock are doing that, but modifying xhr in runtime is interesting idea!

</comment></comment><comment><USER23> I use CircleCI because it allows 1 free private repo. Personally though I do not like Circle too much, it has a lot of cool features but the UI loads so slowly because they have so much stuff going on. They use the UI skeletons technique to make the load time appear to be faster but it is still very apparent how slow the load time is.

I have hit numerous bugs with their website as well where stuff doesn't load, builds kick off into infinity, when I transferred a repo everything broke, ack!

Furthermore, I am frustrated with their pricing, they go from free to $50/mo for the next upgrade tier, that seems like a crazy jump to me. I would gladly pay $10/mo or so for another container or 2x parallelization. The issue is being a single developer I rarely would save any time and the $50/mo is just too steep.

Finally, when I tried to build a justification case for my manager to pay the $50/mo, I wanted to use data from their CircleCI Insights which shows how long your builds are queued on average and some other important data points. But you cannot access these insights from a free account. Seems like that info should be available and prominent to help people understand the cost-savings they might receive by upgrading. I emailed support and asked for a one-time data point for that statistic to build the case as I was considering upgrading and they said sorry, nothing we can do for you. Is their goal to make money and have happy customers? If so they aren't doing a great job of it.

Overall a lot of frustrations with the platform and this just adds more fuel to the fire.

<comment><USER24> Serious question: why CircleCI over, say, Jenkins or custom_build_script.sh running on a VPS that costs much less, and that you control?

<comment><USER25> Drone is a self-hosted alternative, although you still have to do some configuration:

[https://github.com/drone/drone](https://github.com/drone/drone)

We went from Drone -> CircleCI -> Jenkins in the last two years. Jenkins feel opaque and hard to reason about, periodically dies for no _good_ reason and the UI is atrocious.

Drone itself was fine, as a minimal feature set. I think the docs are offline now, but it's fairly straightforward.

<comment><USER26> > periodically dies for no _good_ reason

You must be doing something wrong then. I run a Jenkins cluster with hundreds of automated pipeline build/deploy jobs and the master node never dies. (It's also the only node up and running 24/7) You should be offloading your work to build agents.

<comment><USER25> I'm certain there is a reason, we scaled up and hired an infra team that owns it so it's out of my domain now.

I was merely a poor steward in the early days out of necessity. My era of tinkering ended once we moved to CircleCI.

</comment></comment></comment></comment></comment><comment><USER27> Loading third party JS is increasingly common for a lot of sites, and I tend to raise it when doing security reviews, for this reason, you're trusting the security of those 3rd parties.

There are some defenses that can be put in place. The first one is kind of awkward in many cases which is to host the JS on your own domain. There's still the risk of course that it will go off and get additional code from the 3rd party source to execute, but that can be reviewed for.

The other option is to use sub-resource integrity ([https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)) to ensure that only scripts you've reviewed are used.

Of course you need then to make sure you're notified before the 3rd party makes changes that would break the signature.

<comment><USER28> _Loading third party JS is increasingly common for a lot of sites, and I tend to raise it when doing security reviews_

What kind of pushback do you get and how do you handle it?

<comment><USER27> To be honest I'm a external security assessor/pentester and I've not had much pushback from clients on this. That said I don't always get visibility of whether they implement our recommendations or not :)

To me, it's not really a debatable point that loading JS from a source you don't control implies trust in that source and therefore a risk that if they are compromised it affects your site.

Whether that risk is ok for a business depends on a number of factors like :-

\- How trustworthy are the sources they're loading from? \- What reviews have they completed on the security of those sources? \- Do they have contracts in place with those sources that cover the requirement for security?

</comment></comment></comment><comment><USER29> I noticed that Galaxy - Meteor Development Group's hosting solution for Meteor apps does similar. I checked the console and saw multiple analytics, even some that seem to monitor your visual usage/screenshots etc, which would seemingly capture screens that have portions of environment variables / settings etc. So basically potentially a lower level marketing employee who has an infected laptop and is reviewing UX patterns etc could expose sensitive data on their MacBook Air that could potentially be infected. They might not expose that data. But I had the same thoughts as this article points out.

</comment><comment><USER30> I'm trying to understand why "CircleCI browser context has full access to the CircleCI API, which is hosted on the same domain".

Doesn't API have seperate authentication credentials (API key/tokens) than the web UI (i.e. cookies)? I understand these loaded 3rd party scripts can scrape what's rendered on the UI, but making calls to the API??? I wonder how that's possible in CircleCI case.

<comment><USER31> That's the first thing that triggered me as well.

The only thing that 3rd party JS will have access to is everything on the page.

Now, the things on the page are sensitive (the secrets from the env variables are dumped in the UI).

Secrets in the secrets page are not exposed at any time, even when you go to edit. Only in the build screen, it's exposed to the output.

Those 3rd party libs DO NOT have access to your source code at any time. The only time they will have access to your code is if they gain SSH access to the machines that are running the build. And that's not trivial.

Even if your public key is exposed, they don't have access to checkout github with that.

So yeah, it's 3rd party libs in a "private" context but not more than that IMHO.

<comment><USER32> From searching for discussions around CircleCI API and cookies it seems like at least some API endpoints might accept session cookies for authentication.

I guess we'll have to wait for a CircleCI statement to address this in detail (or someone testing it).

</comment></comment></comment><comment><USER33> Wouldn't similar vulnerability be present in most SAAS platforms? All of them include tons of analytics scripts on their website. If you are a logged in user, your session presumably includes a token (encrypted cookie?) to use the SAAS API.

Therefor in theory other scripts loaded on the page could grab the token and make authenticated API calls as well? Although I guess this is mitigated by verifying script integrity when loading scripts from CDN (e.g. integrity attribute of script tag)?

<comment><USER3> There are a few approaches, but yes, one thing I hope to do by publishing this is to draw attention to the problem of third party Javacript scripts running in a privileged environment and not on e.g the marketing page.

</comment></comment><comment><USER34> > Why don't you include a POC? I have one that demonstrates this attack, but I > don't want to show script kiddies how. If you can't figure out how to > construct it by reading the above description and the network traffic, you > don't deserve to know how.

I feel this is a bad way to approach it and a bad attitude in general. Showing people how this can be exploited (after responsible disclosure) is a great opportunity to spread awareness of potentially their own issues in the same space and create points of discussion. If a user feels compelled to do so, they can seek out the info. But to show disdain to the reader for their lack of knowledge comes off as unprofessional in spirit.

<comment><USER3> I disagree, and we'll just have to leave it at that. Anyone who knows how to construct an AJAX request and look at the Network tab can figure this out.

<comment><USER35> While I understand the point you made in that last sentence, the very last part of it sounded needlessly loaded _even though I can easily figure such things out_. Replacing "you don't deserve to know how" by, say, "you're not the target audience" or anything to that effect goes a long way to not detracting from getting your _real_ point across.

BTW this last easily misunderstood sentence sits just above your "I'm available for hire" link, which is not exactly painting you in a bright light for recruitment.

<comment><USER36> I agree. There was no need to insult your audience, and it is a career- limiting move in the long run. The Internet has a long memory.

<comment><USER3> My career's doing just fine, thanks.

</comment></comment></comment></comment></comment><comment><USER37> As someone who has been a web developer since the 90's, this topic brings me back to ~2005 when Google Analytics launched. I thought it was absolutely insane that people would just stick someone else's JavaScript in their pages (and especially on e-commerce sites!).

Today it's perfectly normal. I don't have exact numbers but at least 50% of all sites pull in third party code. It really is bizarre to me that this became the norm.

</comment><comment><USER38> To me, this seems like a vulnerability report. The following line is what really made it stand out for me as being a vulnerability report:

>Why don't you include a POC? I have one that demonstrates this attack, but I don't want to show script kiddies how.

That leads me to this question: Did the author reach out to CircleCI to report this issue, before publishing their blog post?

<comment><USER3> No, I didn't. If one of the JavaScript sources was immediately compromisable, I would have.

<comment><USER39> Why post a big public dig? If there's a problem, make the world a better place by helping to solve it maybe? Just having a bad day?

<comment><USER3> 1) they know exactly what they are doing; 2) arbitrary 3rd party JS running in privileged contexts (dashboards) is a wider problem I would like to draw attention to; 3) It's not immediately exploitable; 4) It takes five seconds to understand what the problem is; 5) I did not want to wait 90 days to be told "we are not going to fix this;" 6) my history of reporting problems (not security related) to the company in question is that they are not very responsive to fixing them.

<comment><USER39> Umm, either its a problem and worth reporting responsibly, or not a problem and so not worth a hit piece on your blog?

<comment><USER40> It's only worth reporting "responsibly" if waiting might prevent users from being hurt. The way that concept has been manipulated into implying that the companies are owed an early warning is crap. The author doesn't owe CircleCI anything.

<comment><USER3> Precisely

</comment></comment></comment></comment></comment></comment></comment><comment><USER41> No one has mentioned this, but I'm really curious about the script from Quora. Why is Circle CI loading JS from Quora?

Or is that a browser extension that the OP forgot about?

<comment><USER3> I don't run browser extensions

</comment></comment><comment><USER42> I think these kind of issues will become more and more important, both from a security standpoint, and from a privacy standpoint as well. GPDR might apply to api access from 3rd party tools (not just analytics btw) - it'll be up to them to prove they don't, and I'm curious to see how it'll be regulated.

I've tried to explore the privacy aspects here [1] (like many, we completely separated libraries for the public site and libraries for the apps)

I think we need a framework when thinking about which companies to pick when adding 3rd party features to our products - and probably a system to trust such 3rd party with their data processing.

I'd be interested to know how companies make these decisions today...

[1] [https://blog.getkumbu.com/posts/building-a-privacy- respectfu...](https://blog.getkumbu.com/posts/building-a-privacy-respectful- startup)

</comment><comment><USER43> The web is a disaster. Why do people insist on adding this bullshit to their pages?

<comment><USER33> Marketing and sales people usually ask to have tons of third party scripts loaded everywhere and devs don't have power to turn them down. They need analytics for their work. It's a bad idea from security standpoint for sure.

<comment><USER44> Yeah, management and marketing need web analytics. If you don't want 3rd party scripts you'd have to, what, roll your own analytics software? There is some open source analytics tools you could self host, but they're garbage compared to google/adobe/etc.

<comment><USER45> > Yeah, management and marketing ...

should get off their duff and analyze their own internal server logs.

<comment><USER13> Server logs dont have much useful information, especially for SaaS interfaces. You need to have the events from the actual UI tracked, which requires a lot more work and is the reason why these analytics tools are used.

</comment></comment></comment></comment></comment><comment><USER46> If npm or even a single popular npm package is compromised, almost every website will be compromised.

</comment><comment><USER47> Does anyone know if Travis CI does something like this.

<comment><USER48> pretty sure they also use pusher

</comment></comment><comment><USER49> Also, Github and Bitbucket should allow much more granular ACLs such as single repo, single repo shallow clone only. Ideally they would also support some form of steganographic tagging of repo contents as well, in case of a breach.

</comment><comment><USER50> At my last company we had a similar issue with third party scripts on credit application forms. Analytics is critical for ecommerce sites but it's way too easy to accidentally log sensitive data across dozens of third party services.

<comment><USER25> There are self-hosted analytics (like Piwik) that you could self-host for sensitive data to solve this generally. I'd like to think that conversion of credit applications isn't something a marketer is trying to gamify though, that's probably wishful thinking.

<comment><USER50> >I'd like to think that conversion of credit applications isn't something a marketer is trying to gamify though

If it's in the overall sales conversion funnel it will be optimized. Credit application flow was scrutinized just as much as adding to cart and checking out.

</comment></comment></comment><comment><USER51> uMatrix.

<comment><USER52> That treats the symptom, not the problem.

<comment><USER53> uMatrix is defense in depth. They could solve the problem today, and tomorrow a new CircleCI programmer/marketer/CEO would decide that, in fact, they do care more about analytics than about user's secrecy, and revert this change.

By installing uMatrix and not approving these things, you are (a) reducing the probability that a mistake, misaligned incentives, etc, would harm you, and (b) get a notification that there's something you wish to block.

uMatrix IS part of the real solution. The other part is avoiding providers whose security standards are not up to yours.

<comment><USER54> Its a real solution, for YOU personally. I use and love umatrix (whitelisting ALL js/content by hand on all domains).

We need to consider the good of the many, and client side solutions like umatrix are not a solution for the many.</comment></comment></comment></comment>


How Google Buzz for mobile will change your life - <AUTHOR> http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2010/02/12/urnidgns852573C400693880002576C8007B7D43.DTL

<comment><USER2> When I am out and about the last thing I want to do is post crap on my phone. Maybe I'm just old, but it seems rude to divert my attention from the people I am hanging out with in order to check/post on buzz.

<comment><USER3> Twitter & FB have incontrovertibly shown that millions of people want to "post crap on [their] phone[s]" when they're out.

</comment></comment><comment><USER4> I think the location feature + mobile experience is what makes buzz stand out. Since buzz came out, everyday i am on my way to work (public transport) i check whats happening in my city. People commenting on the indian restaurant they are eating, others asking questions regarding the city and getting answers in a few minutes or posting pictures. Forget the gmail integration, it's the mobile experience that is great (on android atleast with integration in the native google maps application). I only use gmail to check for comments on posts i made on my mobile.

It is far more interesting to see whats going on in your city and communicate with locals then what twitter offers.

<comment><AUTHOR> Bingo. When you get enough people using it, it's going to be amazing to be out after work with your friends wondering "what's happening that's fun?" and just look up fun things going on in the nearest half mile radius.

</comment></comment><comment><USER5> What struck me with this article was the requirement to "pull" the data. Take the waterfall example (someone buzzes about a cool waterfall they find). That is great, but for it to be useful to others they have to be hiking in the area, be a buzz user, AND have Buzz open. I think many of these location apps are missing the discovery piece and need someway to push content. If you are hiking and your phone vibrated and told you about the waterfall it would be much more useful.

</comment><comment><USER6> I was using mobile maps with the buzz layer to get an idea of which parts of town had the most smart phone + social tech adoption. Pretty interesting. (The freeways are always popular...)

</comment><comment><USER7> Facebook can have these features too, but they don't seem to go for them.

</comment><comment><USER8> Maybe right after a lot of bad press about sharing a woman's info with her abusive ex-husband is not the best time to be touting a "Near me now" feature "baked right into the mobile version of Buzz". Why don't they just call it "Stalk me now"?

<comment><USER9> Nonsense. I use Google Buzz on an Iphone. It asks permission to use your location when you are writing a new buzz, shows the location info that will be attached clearly, which you can opt out of easily (click the X). Also, there is a big public/private button at the bottom of the screen. If you select 'private' you can select exactly the people who will view the buzz.

</comment></comment><comment><USER10> > The more people use a network, the more valuable it becomes; the more > valuable it becomes, the more people use it

the more useless it becomes.</comment>


Jason Calacanis's Open Angel Forum is accepting applications.  - <AUTHOR> http://openangelforum.com/

<comment><USER2> _A large number of service providers, including lawyers, accountants, real estate agents and consultants, have asked to attend the event. While I personally love my lawyer and accountant, we can't allow every service provider in the world into the event or it will be 90% service providers. In order to resolve this issue, I've come up with a revolutionary concept: charge the service providers to attend the event. In fact, that is the business model of the Open Angel Forum: free for startups, free for angel investors and very expensive for service providers._

Makes sense to me.

<comment><USER3> The good news is that by charging a substantial fee, we are eliminating a lot of the annoying, cheap and low-rent service providers. Those type of folks are already complaining to me about the fee--which is exactly what I want.

Any decent lawyer or accountant of note will look at the fee and say "$1,500 is a lot for dinner, but if I attending eight of these over two years and get one client it pays for itself." That is to say, the right providers will take a long-term approach to this.

We've got a sick group of angels already lined up for the 14th, and you don't have to be a startup from Los Angeles to apply to present. You can be a startup from anywhere around the world (although closer to California is obviously better since most angels like to invest within a one hour flight of the startup).

The angels coming will have 200-300 angel investments between them I think... really exciting, super qualified and intimate. I'm trying to get 100% of the companies that present funded.

<comment><USER4> Yup, my comment focused more on events as a whole and service providers attending.

You roll with a top notch crowd and put on events to match. If I were a service provider, I would pay the fee to be at the table.

</comment></comment></comment><comment><USER5> The intention behind this kind of event is awesome. Focus on getting the founders and the funders to talk (whilst allowing serious service-providers to come and catalyse the reactions between these two parties) and you're bound to create some awesome companies.

<comment><USER3> Thanks pal. Really hope we see a lot of y-combinator folks sign up to pitch! Note: you don't have to be based in LA or California to present... we'll take a great idea from anywhere in the world.

</comment></comment><comment><USER6> very exciting news; and definitely a great list of angels involved in the event. In light of all the market pressure and negative effects on the VC industry, an opportunity like this for startups is priceless, literally. Great stuff. We will definitely be applying.</comment>


Some AI Koans [Lisp jokes from the old MIT AI Lab] - <AUTHOR> http://www.catb.org/~esr/jargon/html/koans.html

<comment><AUTHOR> A couple more here: <http://www.serve.com/cmtan/buddhism/Lighter/aikoans.html>

Sussman told me that the story about him and Minsky actually happened. Except the punchline is "It has preconceptions, you just don't know what they are."</comment>


Y.A.G.I.S: Yet another Google Interview story (With a twist) - <AUTHOR> http://startupinsights.blogspot.com/2008/06/yagis-yet-another-google-interview.html

<comment><USER2> I agree that's not much of a twist, but the "looking for developers fluent in Arabic" is a bit of a surprise. Googleplex Dubai?

<comment><USER3> Why is it a surprise? With oil heading to $200 per barrel, buttloads of money are accumulating in the Middle East.

</comment></comment><comment><USER4> What twist?

<comment><USER5> the fact that the interview ends with _"Thanks a lot, we'll contact you in 6-12 months"_ instead if a rejection/hire

<comment><USER4> That's a pretty crappy twist. In my opinion anyway, I was expecting something at least moderately interesting, something that might have made it worth reading the article.

</comment></comment></comment><comment><AUTHOR> The outcome of the interview is a little vague! Its not a solid yes or no.

<comment><USER4> Forgive me if I don't share your excitement at this fact. However, owing to the fact that I am not you, this has very little relevance and is not at all interesting to me.

Good luck with it though, hope you get the job.</comment></comment>


Fast function to parse strings into double (binary64) floating-point values - <AUTHOR> https://github.com/lemire/fast_double_parser <comment><USER2> It has about 15 KB of data: 10KB in power_of_ten_components and 5KB in mantissa_128. [1] That's ~23% of the per-core L1 data cache on (eg) the recently announced APU chip. [2, 3] So before getting too excited about the microbenchmark numbers, I'd be careful to ensure the additional cache pressure doesn't slow down my program as a whole.

edit: also, ~2.5KB of that is due to padding in power_of_ten_components. I wonder if it'd be better to split the uint64_t field into two uint32_ts to avoid this.

[1] [https://github.com/lemire/fast_double_parser/blob/master/inc...](https://github.com/lemire/fast_double_parser/blob/master/include/fast_double_parser.h) [2] [https://news.ycombinator.com/item?id=22440894](https://news.ycombinator.com/item?id=22440894) [3] [https://en.wikichip.org/wiki/amd/ryzen_embedded/r1606g](https://en.wikichip.org/wiki/amd/ryzen_embedded/r1606g)

<comment><USER3> Also, I know it's not always possible, but if your application is spending so much time parsing strings into numbers that this could make a difference, seriously consider whether the source of those strings could be changed to not emit strings, because unless it's something like user input, chances are they may already be doubles which can be used as-is.

<comment><USER4> HN is collectively schizophrenic on this topic. On the one hand, the comments say that nobody really needs anything fancier than JSON. On the other hand, other comments say that if JSON parsing shows up in your profiles, you should switch off JSON!

<comment><USER3> HN (and a lot of other places, really) has a large population of web or otherwise "web-heritage" developers, as well as those whose ventures into computing started beside/before the web. I suspect the JSON promotion comes mostly from the former group, while the latter, of which I am a member, laments it roughly as much as we did the "XML craze" of the late 90s and early 2000s.

<comment><USER5> Indeed, hand rolled fixed point network marshaling, preferably with delta encoding for time series alike data (or data that oscillates) is couple of orders of magnitude faster and but also significantly "smaller" than a double- string-double, counterpart. Getting ~1 byte per data point of time series is quite achievable.

<comment><USER6> How do you encode floating point delta into one byte?

<comment><USER4> You can't, that's why they said fixed point. Time series data should probably never use floats, for the exact reason that delta-encoding is not effective.

<comment><USER2> "Can't" is too strong a word. Depending on what your numbers represent, I'd think you could do one or more of:

* have a shorter exponent and/or mantissa to make each number shorter and the overall series more repetitive. (maybe even skip the mantissa if you only care about order of magnitude! call it the opposite of fixed-point, or just storing the logarithm of the value, whatever terminology works for you...)

* skip the sign bit for a non-negative series (e.g., deltas of a non-decreasing series),

* use a variable-width bitstream encoding like exp-Golomb to represent the exponent and/or mantissa,

* use run-length encoding if it's repetitive (after delta-encoding),

* etc.

One byte per value (or less!) is surely possible in some cases. But I've never done it myself and agree fixed-point sounds much more pleasant. One of my projects represents deltas of durations in units of 90,000ths of a second, varint-encoded. I much prefer that to dealing with float seconds.

<comment><USER4> There's also the XOR compression scheme described by Facebook:

[https://www.vldb.org/pvldb/vol8/p1816-teller.pdf](https://www.vldb.org/pvldb/vol8/p1816-teller.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> > That is, given the string "1.0e10", it should return a 64-bit floating-point > value equal to 10.

Err, surely it should be equal to 10,000,000,000. Or more probably, they meant to write "1.0e1".

<comment><USER8> Oh, you don't use base 10,000,000,000 yet?

</comment></comment><comment><USER9> More context at Daniel Lemire's blog post at [https://lemire.me/blog/2020/03/10/fast-float-parsing-in- prac...](https://lemire.me/blog/2020/03/10/fast-float-parsing-in-practice/) . It's about twice as fast as abseil or from_chars and nearly 10x faster than strtod.

</comment><comment><USER10> I was expecting this to include fancy bit twiddling and simd assembly for parsing 8 decimal digits at once...

But the reality is the core of the algorithm is still a while loop that looks at each digit one at a time and multiplies by 10 each time ...

</comment><comment><USER11> Shouldn't std::from_chars be included in the benchmarks?

<comment><USER12> Yeah, looking forward to it. Especially with latest version of MSVC, based on this post from the author: [https://www.reddit.com/r/cpp/comments/92bkxp/how_to_efficien...](https://www.reddit.com/r/cpp/comments/92bkxp/how_to_efficiently_convert_a_string_to_an_int_in_c/e35b3r1/)

</comment></comment><comment><USER13> Is there a site out there that collects the absolute fastest ways of doing common low-level operations like this? For something as common as converting strings of digits to IEEE 754 floats/doubles, you would think we would already have the absolute fastest sequence of assembly instructions to do this. It's disconcerting thinking that the functions in the standard c/c++ library may not even be close to optimal.

Very cool btw

<comment><USER4> I can't think of a single thing in the C or C++ standard library that is state of the art. Often they are actually quite terrible. Some of them just can't be fixed because of ABI compatibility issues. That's why, just as an example, C++'s std::unordered_map is an embarrassment compared to all recent hash tables.

<comment><USER13> That's so true and honestly it kind of gives me a pit in my stomach just thinking about all the C++ programs in particular that use STL and end up being so much slower than they could be. Hopefully Rust and Zig won't end up making this kind of mistake

<comment><USER14> The most egregious offenders here IMO are C++'s map and unordered_map. The spec constrains the possible implementations, and it's hard to implement them as anything better than a red-black tree or a badly-unoptimized hash table, respectively. And really the unordered one should be the default with the nice short name.

It looks like Rust is doing well on this. HashMap (the one everybody uses) is essentially a clone of Google's heavily-optimized C++ hash table:

[https://abseil.io/blog/20180927-swisstables](https://abseil.io/blog/20180927-swisstables)

... and if you need the collection to be sorted, their BTreeMap has much lower overhead than the C++ std::map, plus a big prominent note in its documentation saying that HashMap is usually the one you want.

I'm impressed. (Haven't looked at Zig yet.)

<comment><USER15> > anything better than a red-black tree

Is there an equivalent data structure that has better worst-case time complexity than red-black tree?

<comment><USER16> There are plenty of algorithms that are also O(logn) that are much faster in practice, because of how caches work.

<comment><USER15> Could you name some please? I'm genuinely interested in learning of data structures with this property.

<comment><USER16> The simplest one is a B tree. It's like a self-balancing binary tree, except that you put more than two children in each node.

Same big-O, but faster by a big linear multiplier.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Great hack, but in a broader sense this is silly. If parsing/pretty-printing floats from/to ASCII strings is a bottleneck you should be using hexfloats, as supported in the latest C/C++ standards and elsewhere. As a bonus, they will reliably evaluate to the same floating point number, eliminating an extra source of ambiguity and possible overhead.

<comment><USER18> It can be a big chunk of the cost of parsing JSON.

<comment><USER19> stop using json is the message

<comment><USER20> I dream about day when all cryptoexchanges get this message. Not today :-(

</comment></comment></comment></comment><comment><USER21> What's a scenario where you have a huge flow of floating point data as text? Assuming it's usually json, but in which case does that happen and you need to work around it (parse faster) rather than fix the underlying problem of having a huge stream of numbers as _text_?

<comment><USER20> If you could control both ends, yes. But sometimes you need to consume data produced by entities which you could not control. Examples? Crypto currency exchanges, for example. All of them use ugly, often terrible, JSON-based protocols, and some of them have non-trivial amount of trading to see JSON parsers as hot spots.

</comment></comment><comment><USER22> Would having a mode that restricts the types of numbers it accepts (in my particular case: no scientific notation) speed it up significantly?

</comment><comment><USER23> bad. you should not do that at all.

<comment><USER24> If you're writing a parser for any language which is expected to deal with floating point numbers, being able to parse those numbers is generally necessary.</comment></comment>


Ask YC: What's the best virtual hosting for a development stage startup? - <AUTHOR>

I'm currently using WebFaction to host my Pylons based web app, which is under development and really not that close to be ready for public use.
I've had some issues with WebFaction. Mostly it's just that every once in a while I want to be root, though I have other gripes as well. The reason I stick with it is that it's cheap.
What I'd love is a virtual hosting platform, but I'm not sure when ones offer the best bang for your buck. We don't have any money yet, so Amazon EC2 doesn't make sense right now (it's not very cheap until you get some traffic). I've looked at Joyent, but I haven't heard whether they're any good or not.
So, what does the YC community recommend when it comes to cheap, development stage virtual hosting? <comment><USER2> I highly recommend Slicehost. I've been amazed with their responsiveness, availability and competence.

<http://slicehost.com>

<comment><AUTHOR> Those guys do look pretty good, and cheap.

I'd sign up right away, but we are using facebook for our social aspects, so we probably qualify for Joyent's free accelerator (for a year). That's a pretty tempting offer, even if I have to learn Solaris.

<comment><USER3> We've used SliceHost for over a year now. We tried one of the free Joyent Accelerators a couple of months back but whole experience for us wasn't as good as with SliceHost. Their kind of hosting is worth paying for.

</comment></comment></comment><comment><USER4> Joyent is solid. We've worked with them for several years (we build the control panel they use), and they're among the smartest in the business, technically speaking. I think the price is quite nice on their Accelerators, particularly those for Facebook apps (which are free for a year). $45/mo for root-equivalent access and 512MB of memory is a very nice price. Their shared hosting accounts are in the middle of the low-to-high price continuum, but their support is very well-regarded, and they actually know how to host framework-based apps (Rails and PHP has been their focus, but I believe they accommodate Python frameworks, as well).

Another customer of ours, GridZones, also offers Solaris Zones accounts similar to Joyent's Accelerators, for a few bucks cheaper.

We've got a dedicated box with the Planet and one with Layered Tech, and both have been reliable and cheap--the Planet I've used for about five years, and Layered Tech only this year. Both seem to have competent support and reliable networks.

</comment><comment><USER5> I can't directly answer your question I have only used shared hosting, dedicated servers, and EC2.

However, I would say that EC2 is actually not that expensive compared to the others. I've been using it for my latest project and really like it. The cost is only about $75 a month and it behaves just like my dedicated servers (but it has more RAM!). That's coffee money.

Also, you will eventually leave the "development stage" and finding a place where you can easily (and without great expense) move to a larger VH will save you money in the long run, too.

<comment><AUTHOR> $75/Month is way more than the $20/month slicehost is offering. They do offer a lot more memory, but for the time being, I just can't justify $75/month.

</comment></comment><comment><USER6> I don't use a virtual host, but I can highly recommend webfaction especially for Python based applications.

<comment><AUTHOR> WebFaction is nice for shared hosting, but the 60MB limit on RAM and the lack of root access is fairly irritating sometimes.

600GB of bandwidth is nice though, way better than the paltry 100GB slicehost offers with their minimum package.

</comment></comment><comment><USER7> I use Joyent, and I'm happy with them. Fast connection, great support, sufficient documentation. But, it's somewhat more expensive than other options if you just look at the technical specs.

</comment><comment><USER8> another vote for slicehost.

it's run by developers in response to their own frustrations with other hosting companies. full root access to the VM, flexible pricing/options, super-reliable.

we've been using them for about 3 months for staging and some back-end admin tasks, and so far it's been brilliant.

</comment><comment><USER9> I've been using Linode for a couple years. They're reasonably priced and I've never had any issues with them.

</comment><comment><USER10> Serveraxis, another Xen host, for me.

</comment><comment><USER11> Slicehost!

</comment><comment><USER12> Look into a VPS. I currently use vpslink.com, but there are many to choose from.</comment>


F-16 pilot was ready to give her life on September 11 - <AUTHOR> http://www.c-spanvideo.org/program/Penne

<comment><USER2> " _People sleep peaceably in their beds at night only because rough men stand ready to do violence on their behalf._ "

And women in these times.</comment>


The Hackathon Experience Is a Hack - <AUTHOR> http://www.tomordonez.com/blog/2013/08/25/the-hackathon-experience-is-a-hack/

<comment><USER2> The Hackathon in question is apparently BattleHack Miami, hosted by PayPal:

[http://miamiherald.typepad.com/the-starting- gate/2013/08/bat...](http://miamiherald.typepad.com/the-starting- gate/2013/08/battlehack-miami-and-the-winners-are.html)

The winner in question was YellowPepper, who at the very least share their name with a startup also involved in mobile banking ([http://www.yellowpepper.com/#/homeId/homeCB/page/home.html](http://www.yellowpepper.com/#/homeId/homeCB/page/home.html)) and have issued a press release from Miami ([http://www.prnewswire.com/news- releases/yellowpepper-and-fun...](http://www.prnewswire.com/news- releases/yellowpepper-and-fundamo-partner-to-bring-greater-access-to-mobile- money-services-in-latin-america-84463442.html)).

(I'm not involved, I just saw this through Tom's Twitter.)

<comment><USER3> I was at the BattleHack in Berlin. The event itself was absolutely fantastic. It was definitely the best organized hackathon I've ever been part of.

Still, the final results felt similarly weird. The winner was a (non- technical) dude who had been pitching his startup for months already and found himself an amazingly talented developer at the hackathon. They made use of most of the sponsor APIs and added PayPal as a payment option for the already existing service. To me it felt like the guy was just going to random hackathons so he could get work done on his website for free. Even though the developer seemed to be exceptionally good, it seemed like he was just being taken advantage of by a guy who couldn't get his startup to have more traction.

There were definitely much more impressive hacks out there. (Mine honestly wasn't one of them, so it's not just jealousy talking). In addition, the theme of the hackathon was 'solving local problems'. Now if not having a platform to get product X in city Y is a local problem, it might fit. For me though, the interpretation was more 'making the world a better place' and not 'building a purely profit-oriented application to sell stuff using PayPal'.

I think they simply chose the most monetizable product that was in the competition. Made the whole event, which, I repeat, was about the best organized and executed hackathon I've ever seen, suddenly feel cheap.

<comment><AUTHOR> I agree that the BattleHack is a very well organized event. It even had massage chairs, tons of food, drinks. I have organized some events but never at this level. At the end all of that means nothing when there is not a fair game. I might as well go to a hackathon where I have to pay for my own lunch and there is a real chance of winning.

<comment><USER4> Hell yeah, nothing says hardcore hacking like massage chairs.

</comment></comment></comment></comment><comment><USER5> I've seen this before. I was involved in one where the winning team had been working for months beforehand (their website was registered > 6mo before the event), had prepared presentation materials far before the event including design mockups, and presented with nothing more than a pre-cooked video that was looked manipulated to show "working" code. None of us knew for sure, but it looked like they had just built static HTML pages and transitioned between them.

For those of us who had built working products, it felt more than a bit cheap. We saw some great code and very little of it was recognized.

I believe the issue is one of expectations and marketing for these events. They are pitched as "hackathons" and try very hard to attract engineers, as you simply can't have the event without coders. Therefore, engineers reasonably expect an event where the best code wins. After all, it's called a "hackathon", not a "meet & greet with investors" or even a "startup weekend". In the end, it just felt like the judges were putting themselves into the mindset of investors, and in that case, obviously the team that has prepared for months beforehand will win. But to the coders, we felt cheated, and that they had completely missed the point.

<comment><USER6> So, did anyone complain at the event? Or even after the event? How did the judges and organisers respond to the complaints?

<comment><USER5> There wasn't much that could be done. According to the rules, all's fair so long as the code wasn't written until the hackathon itself, which is pretty much impossible to prove or disprove anyway. You can prepare as long as you want. There is a section about a "code review" but I doubt that was really done; IIRC we didn't even submit our code, we just did a demo & video.

The strongest complaint we could make was that it was strongly against the spirit of a hackathon, which is a difficult argument to win.

<comment><USER6> The strongest complaint you can make is presumably "I wouldn't have come if I knew a team like this could enter and even win, and I won't come to your next one, and I will be sure to let others know that I won't come and why". Saying it publicly with all the other entrants around lets others join in if this is something that is widely regarded as unpopular and lets the organisers know that there is some serious resentment. Not complaining at all is certainly one way to make sure nothing will be done.

I mean, nobody here can even say "wow, I won't go to their next one!" because you haven't even named them.

<comment><USER5> You're right, and I wish we had. Instead we were just sort of stunned by the underwhelming ending and the crowd filtered out very quickly (there was no "drinkathon", we were all too tired). It was Angelhack - I suppose, by the name, we should have known that investability comes first, hacking second.

Our team was tired out after all-night coding and really didn't possess the mental finesse at the time to walk the fine line between arguing "the results don't fit the spirit of the event" and "we are sore losers".

<comment><USER7> Is it not normal to have a team made before the hackathon? We're registered for a few hackathons and a lot of them ask us to join a team ahead of time or join one when we get there but they do ask that teams put down their idea. The rule we adhered to was no prior coding or design work before the hackathon so build everything there but feel free to discuss the idea we want to go in with.

<comment><USER8> Yeah, forming teams is pretty normal - I think ssafejava is talking about something well in excess of simply forming a team and talking about ideas.

I was at Angelhack NYC last time it was held, and was disappointed in that way also. The winner, and indeed a _lot_ of contestants, had code or designs that were impossible to generate in a 48 period.

There was a "code review" clause in the rules, but I did not see it ever enforced. Some of the high-ranking (the ones that made it into the final round of judging anyways) projects had clearly pre-cooked designs and mockups (this wasn't against Angelhack's rules), and obviously little to no working code. Many presentations were slide decks. Disappointingly few showed the core idea working.

I've always thought that the spirit of a hackathon was to get together with some crazy smart people and see what useful and worthwhile things you can bang out in a limited time. Precooking 95% of your project beforehand seems rather against the spirit of this.

Personally I've resolved to stop going to corporate-sponsored hackathons, or hackathons where investors are waiting at the sidelines. There's a tremendous misalignment of incentives and it encourages a rather ruthless atmosphere. It's no longer about good clean fun and all about attracting investor attention.

Question: anyone in NYC know about low-key hackathons where it actually fits the spirit of a hackathon?

<comment><USER9> Hey Potato, that's sad you don't want to go to hacks anymore. Code reviews are either done in private before we announce the winner or within 7 days after the event.

The slide deck thing is a persistent problem and one we're not happy with. I think that kills it for everyone and its disappointing when judges are impressed by them. To change this, starting this Fall we'll be the first hackathon to disallow power point presentations and require teams to demo if they'd like to win.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> It seems there is a lot of "startup weekend" events masquerading as Hackathons. A Hackathon shouldn't be about business, or funding; no one should be leaving that room with investors interested in funding their 24 hour hackathon idea. It's for fun, collaboration and learning. When one of the judges took to stage at Hacked.io in London and banned business pitches, there was a small cheer.

</comment><comment><USER9> Hi,

I'm the founder of AngelHack, we organize large hackathons around the world and I can tell you this article doesn't hold true for us (though I can't speak for other events). We operate independently of companies and choose winners based on hour things-- Completeness, Impactfulness, Technical difficulty, and viability. We had some issues in our early days with pre-done code, so now all winning teams are subject to code reviews after winning (and in the case where the review shows previous work has been done, we contact the second place winner and invite them to our finals event instead. We do this discretely as to not shame the initial winner who sometimes may not have understood the rules). I'd say this happens 5% of the time, so this is very much the exception and not the rule.

I started AngelHack so that people could have a shot of getting exposure for their ideas and support in taking them to the next level. We welcome everyone to our events, startups who want a good environment to team build and work on new things to indie-devs looking for an outlet from their typically work week. Normally, great coders win and great ideas come out of it. Our mission from there to provide support and mentorship, so top teams have a fighting chance at turning their hack into a startup. Many companies raise funding after they win our events and we're proud of that. They literally start at our events and now they are in YC, TechStars, AngelPad, and you name it. That's cool. With 35 cities happening concurrently, sometimes the quality of what judges pick can vary, where even I myself have had WTF moments on who won, but the majority of our judges pick solid winners and if I see something was really awesome, I'll still invite that team into our finals, regardless of what the judges choose.

My take on corporate hackathons -- most award winners based on who has spent the most time digging into the API and asking good questions to the company -- these would be teams who helped them improve their product and teams that they'd like to believe will finish their product so they can showcase it on their app-store// dev-site. Again, I can't speak for everyone, but that's the trend I see.

And for Startup Weekend, they don't throw hackathons. They do a business plan event, where they don't really care what comes in or comes out. It's about uniting the community and doing customer development on ideas. They judge based on who they feel has improved and who makes the the crowd happy. It's not really a competition.

All this said, I'm curious what people think hackathons should be judged on. Imagine you were giving away $10,000 -- how would you decide? Would you do it on what's cool, based solely on the tech, based on what could make revenue, based on the teams passion for what they are doing? Solve that, and AngelHack would gladly integrate it in with our events worldwide. Again, currently we judge based on Completeness, Impactfulness, Technical difficulty, and viability.

</comment><comment><USER11> The term hack and its derivatives are trite. People use them because they perk ears. In Dallas, I've attended events where first place won with a 'business plan' consisting of buzzword-laden management-speak and a clever whiteboard diagram. This is a product of the community; the culture here is business- oriented.

A solution is to set expectations on having a good time and socializing, or not to attend. Instead, you may more satisfaction from working on real projects that survive the weekend. At a hackathon, or any event in general, you serve the host's purpose. Their game, their rules.

<comment><USER12> The culture in Dallas is _very sadly_ business oriented :/

</comment></comment><comment><USER13> I went to my first hackathon a few weeks ago and it was very skeevy with all the idea people floating around looking for folks to build their idea for free while they watch.

Hackathons would be fun if it was all about everyone building what ever and having a good time instead a lot of them seem building a business focused.

</comment><comment><USER14> "Or startup weekends"

Having been to a couple startup weekends, I feel like this behavior would be pretty atypical?

I am aware of how Zaarly was started - Ashton Kutcher was a 'surprise' judge, happened to be a good friend of a co-founder, and subsequent investor. Both founders were Startup Weekend board members. It seemed like a staged event for a company launch.

[http://startupweekend.org/2011/03/09/from-zero-to-1mil- in-3-...](http://startupweekend.org/2011/03/09/from-zero-to-1mil-in-3-weeks- zaarly-goes-warp-speed/)

Aside from that, have there been others?

<comment><USER15> Sorry, but if you are going to a SW to try and win, you are missing the point of SW. I appreciate that for some winning and losing might be the point, but it's been impressed upon me by everyone involved with SW that I've met that if you look at winning as the goal, you're going to have a bad time.

Hackathons and Startup Weekends are all about meeting new people, trying new things, and possibly making new friends. It's about trying to accomplish something and sharing it. At SW, it's about getting help in moving that idea forward, in qualifying the idea.

If you treat it like a win/lose scenario, you are going to lose regardless of the outcome.

<comment><USER16> If winning is not the point, then why is a win state defined?

<comment><USER17> Same reason you give trophies to Little League participants - to provide context for the competition. To add something fun that hopefully underscores what is effectively a networking/show-off event.

</comment></comment></comment></comment><comment><USER18> Off-topic: The blog title is a perfect example to demonstrate why to never use line-height in the place of margin.

<comment><AUTHOR> thanks for the feedback. I didn't have time to put effort on design but more on content. I will fix it when I have the chance. Thanks

</comment></comment><comment><USER19> One of the judges at Startup Weekend crapped on every team. The weekend had been a lot of fun, but that ruined it for me. Other judges at least had constructive criticism. I have to admit this pulled the steam out of my sails and I'm not all that interested in the startup scene anymore. I felt slightly cheated at another event where the winners had obviously been 'playing the circuit' with their startup, but I still came away from it pretty positive.

</comment><comment><USER20> I'm active in our area's Startup Weekend community, and we try to stamp out the pre-fab work ahead of time. We've never had a funded project come through before, but I know we wouldn't allow it.

I'm also the organizer of a local civic hackathon, where we have one caveat: Feel free to continue work on the project you started at our last hackathon. I'm curious how many will, or how many will start from scratch.

<comment><USER21> Hackathons are events where ideas are born and are quickly laid to rest. I'm glad there's some encouragement to work on existing projects, especially on projects that have a civic focus.

<comment><USER20> It's a shame too. We get all sorts of sponsors and spend a lot of time promoting an event that supposedly benefits the community, but did we really accomplish anything if we just let it drop? Maybe the idea wasn't the most greatest in the world, but now that you've had a few months to think about what you could have done better... pivot.

</comment></comment></comment><comment><USER22> I just wanted to sound a note of caution not to tar all Hackathons with the same brush. "Hackathons" is a lose word which can mean many different things to many different people.

A lot of the time I see Hackathons criticised, I read the argument and the person has set up one definition of a Hackathon then demolished it - a Straw Man, basically. And often it's deserved - there is _some_ really shit behavior at _some_ hackathons and it's right that it is called out. This post fits that mould pretty perfectly.

But there are also some really great Hackathons. Try and find the style of Hackathon you like, go and have fun!

<comment><AUTHOR> I agree and emphasize on "some" hackathons. I went to hackathons where the winner is well-deserved and there is code of honor. Fair game on judging. It makes me feel that the most over-produced over-sponsored over the top hackathons are the ones that have suspicious behavior.

<comment><USER22> I'm glad to hear you agree, but to be honest when I read you article I didn't pick up the emphasis's on "some" at all. You seemed pretty harsh on all Hackathons.

</comment></comment></comment><comment><AUTHOR> Hackathons are a lot of fun if your goal is not only about winning. You meet a lot of people. Sometimes future employees/founders/CTOs or sometimes friends. You learn a lot if you really put yourself to the challenge and pair program with others. I usually go to hackathons to have fun. Most of the times I cannot stay all day so I go to meet people and make friends. I even help other teams brainstorming, refine their idea, testing. But when you see suspicious crap it is unmotivated for everybody. Besides having fun all teams have a goal of winning. When they realize nobody had a chance, it is disheartening.

</comment><comment><USER23> I would suggest, for anybody considering attending a hackathon to not let this totally discourage you.

Not all hackathons are equal. My first was at Launch Fest 2013. It was a great experience and I think the judging was as fair as could be expected. There were a lot of talented people who honestly hacked awesome projects together in such a short time. You can see the 5 finalist starting at 23:30 in [http://youtu.be/HPSnsxN4lEs](http://youtu.be/HPSnsxN4lEs)

Also, consider [http://openhack.github.io](http://openhack.github.io)

</comment><comment><USER24> Well duh, didn't you get the memo: the Hackathon is a marketing hack to attract talented developers who will then work on your startup projects for free! Amazing. May the best marketer win!

</comment><comment><USER25> "Instead you spend your technical efforts going to meetups and helping others."

Do this indeed. One of the best ways to get better and encounter interesting people is to go to meet ups, user groups and "fun" hack events. You will encounter peers, newbies, gurus, recruiters, investors and all sorts of interesting people with ideas, needs and possibly money.

</comment><comment><USER26> I've been to these hackathons. They are a hack. It's more of investors looking for investment ideas than engineers hacking codes and building products. One event a team won by doing a Powerpoint presentation because the judges (all investors) thought the idea could monetize the most, while the losing teams had built more complete and more impressive prototypes.

</comment><comment><USER27> I worked at quite a few hackathon's at my previous job. Judging always had some ulterior motive.

We'd see people walk into 48 hr hackathons at the very end and pitch their pre-built app they always took around. They could walk off with a macbook pro no problem...not bad for a few hours of work.

It's sad, but most of them seem to run this way.

<comment><AUTHOR> No problem if the walk off with a new macbook. Yes problem if the walk off with a chance to win $100K at a national event with investors.

</comment></comment><comment><USER28> Where and how did that happen? What was the name of the startup? Who organized the event?

</comment><comment><USER29> Happened to me at two Microsoft events in Boston for Windows 8 and another one for Windows Phone 8.

</comment><comment><USER30> hackers shouldn't go to a hackathons .. they should go to _hack club_.

the first rule of hack club is, you do not spea ...oh crap.

<comment><USER31> If it's your first time at hack club, you have to hack.

<comment><USER30> only two hackers in pair programming

</comment></comment></comment><comment><USER32> don't go to hackathons if you just want to win

<comment><USER33> That's not the point. I'm sure OP would've been fine loosing, as long as it was in fair competition.

<comment><USER34> The darkest cynic in me says, competing fairly is for losers. Literally, not figuratively.</comment></comment></comment>


Response to false statements on surveillance made by Martin Steiger - <AUTHOR> https://protonmail.com/blog/martin-steiger-false-statements/ <comment><USER2> Martin Steiger also responded. Addendum 2 in his blog article [1]:

Tonight, on 29 May 2019, ProtonMail responded to this article with a blog post entitled "Response to false statements on surveillance made by Martin Steiger". (This article was published on 23 May 2019 and not "earlier today" as claimed by ProtonMail.)

ProtonMail claims that this article is "factually incorrect" and states first and foremost that it does not voluntarily offer assistance for real-time surveillance. Apart from that, ProtonMail does not respond to the many points raised in this article.

ProtonMail essentially refers to my addendum, where I point out that the public prosecutor in question contacted me, saying he had been misquoted. ProtonMail of course "forgets" to quote my full addendum and shows an incomplete screenshot of my addendum. ProtonMail quotes only the part with the public prosecutor's claim and not my explanation why I am confident that the public prosecutor was not misquoted. ProtonMail also claims that the addendum is "hidden at the bottom of Mr. Steiger's article", although it is linked right at the beginning of this article.

In a direct email to me, ProtonMail's legal department confirmed that real- time monitoring could be carried out. The legal counsel of ProtonMail now argues that ProtonMail is after all a provider of derived communication services and that having to tolerate surveillance carried out by the Swiss Federal Post and Telecommunications Surveillance Service (PTSS) according to Art. 27 para. 1 SPTA is equal to an obligation for real-time surveillance. In addition, ProtonMail threatens to take legal action for defamation pursuant to art. 174 of the Swiss Criminal Code.

As mentioned above, the SPTA provides neither for providers of derived communications services without more extensive surveillance obligations nor for telecommunications service providers with reduced surveillance obligations an obligation for real-time surveillance. As also mentioned above, ProtonMail used to claim to be a telecommunications service provider with reduced surveillance obligations. In either case, there is no obligation for real-time surveillance, i.e., any real-time surveillance is performed voluntarily by ProtonMail.

ProtonMail once again argues contradictorily and inconsistently. Every user of ProtonMail must still decide for himself whether the email service is trustworthy.

[1] [https://steigerlegal.ch/2019/05/23/protonmail-real-time- surv...](https://steigerlegal.ch/2019/05/23/protonmail-real-time- surveillance/)

</comment><comment><USER3> It's absolutely necessary in today's outrage fueled world to get your statement out as quickly as possible. The longer it takes to get a response out, the more the outraged masses dig in, and the less likely the truth will stand in peoples minds after the dust settles.

<comment><USER4> "A lie is half way round the world before the truth gets its boots on"

</comment></comment><comment><USER5> The conversation we had yesterday on this topic was not very productive. One thing I'd like to see is a clarification about what surveillance actually means to a user. Does it mean:

\- Providing IP address details?

\- Providing message contents?

\- The police compelling you to provide your password?

\- Anything else I'm missing?

It would be nice to avoid equivocating "surveillance" and stick to a common definition so we can argue the merits of each potential practice.

<comment><USER6> They have done several things including:

\- enabled IP logging against a specific user account

\- disabled an account and rendered assistance

\- comply with the data request, to the extent that it is possible, given our cryptography.

The unknowns are what assistance they render and what extent is possible for them to comply with data requests. They have complied with requests without court orders in cases when they believed a court order was inevitable. They have also delayed reporting incidents at the request of authorities in order to not endanger victims.

[https://protonmail.com/blog/transparency- report/](https://protonmail.com/blog/transparency-report/)

</comment></comment><comment><USER7> I'm not going to get into the meat of the drama here but I do want to say, and I hope the protonmail team is reading, the value of protonmail for me isn't even in protecting me from state actors and whatever they're proud about for being in Switzerland etc.

The value of their service to me is primarily:

\- they aren't mining my communication for ad revenue or the enabling of any convenience features which indirectly leads to ad revenue

\- should someone (perhaps not nation state) gain access to their storage, that attacker can't see the plaintext of my past mail. Perhaps this doesn't stop them from monitoring incoming/outgoing unencrypted mail, but at least my life history is secure.

I guess they're trying to get this across with their marketing/branding but it always felt a little more over the top to me than the more practical feelings I have about it if that makes sense.

I know some people will say "go with google because their security team is the best" and maybe that's true but my threat model here is googles business model, not nation states. Would it bother me if I found out Protonmail was colluding with nation states etc, yeah, maybe enough to switch providers should one of similar quality exist. Now to read into this kerfluffle...

edited for formatting

edit post read (quote from Steigers second addendum regarding protonmail response):

> ProtonMail once again argues contradictorily and inconsistently. Every user > of ProtonMail must still decide for himself whether the email service is > trustworthy.

The decision I'm making, and this shouldn't be surprising given my initial comment above, is that I will continue to be a happy paying user. I agree the advertising is kind of misleading, but I always had the pessimist view that the service might give away more than their marketing/branding tries to let on, whether voluntarily/knowingly or not.

I am a little disappointed that protonmail didn't respond more directly to some accusations, I guess they might not want to if they're suing for defamation (according to Steiger?). Am also a little disappointed that both in their response and in their HN comment they said he "hid" something on the bottom which was clearly linked. Though I think he could have done a better job of highlighting the content of that addendum where it was relevant in the article, I wouldn't call it hiding given the link.

I would be happy to see the marketing/branding take a shift towards my more practical viewpoint of it and maybe this incident will encourage that. I have friends/family creeped out by google/yahoo but when they go to the home page for protonmail they tell me (in different words) that the branding is too tin foil hat. The value is there for them otherwise but hard to get past that.

Anyway back to work...

<comment><USER8> _" my threat model here is googles business model, not nation states"_

Same here, for this Proton Mail user. I am, of course, attracted to the idea of keeping my mail private from nation states, but Google (and most other providers) is a bigger thing in my (personal) threat model.

<comment><USER7> Agreed and I'm not the type to be like "well I've got nothing to hide" but the reality is email is a requirement for modern life and I'm guessing nation states can intercept my plaintext mail in places besides the servers of my mail provider so...

</comment></comment></comment><comment><USER9> They have metadata (ips, ports, date, time, bytes, etc.) and can be compelled to release it. This can be (and is) used to correlate activities and make accusations, obtain warrants, etc.

Metadata is very powerful and is captured on every network. It's a byproduct of the requirements of the network and its protocols. How many bytes were sent? To where from where? How long was the session? etc. They may not know what the data contained, but they'll know everything else down to the second.

<comment><USER6> > can be compelled to release it

Yes, but the point that they are contending is whether they _voluntarily_ provide this data.

</comment></comment><comment><USER10> Can someone answer simple question regarding privacy value.

What exactly protonmail has/can disclose by law obligation? Only encrypted message? "Envelope" meta data? Something else?

I think this is important to understand this to assess their service before calling alarm bells that it's useless or storing criminal correspodence there. I couldn't grasp it clearly from the message.

<comment><USER11> As I understand they can provide real-time ip address information about the suspect account.

<comment><USER12> Why was this comment dead? From this article ([https://steigerlegal.ch/2019/05/23/protonmail-real-time- surv...](https://steigerlegal.ch/2019/05/23/protonmail-real-time- surveillance/)) it appears to be true:

>In its transparency report, ProtonMail explicitly mentions the possibility of real-time surveillance ("ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities"). ProtonMail even mentions a current case of real-time surveillance:

>"In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings."

</comment></comment></comment><comment><USER13> The original blog post from Steiger did seem suspect to me when I read it earlier today when this story broke. What's still unclear is what the motive would be to make up or exaggerate such a story.

</comment><comment><USER14> And what about the statement in their own transparency report that corroborates it, which is a major part of Steiger's case? This response is pure bluster and indicates Steiger is right.

<comment><USER6> Which statement in their transparency report corroborates it?

<comment><USER14> See the original discussion and also original blog post, to which Proton is signally failing to respond.

</comment></comment></comment><comment><USER15> For more context, see [https://news.ycombinator.com/item?id=20044336](https://news.ycombinator.com/item?id=20044336) and its parent.

</comment><comment><USER16> Your snail mail's "metadata" is inspected and saved. Your snail mail can be intercepted. The snail mail system is a public good if ever there was one, and managing it is done with the whole in mind.

If the s-mail system were used to deliver viruses daily, and in large volumes, I wonder what the reaction would be? Would we say, "Those individuals have every right to utilize the s-mail system to deliver deadly viruses as they like. It is the receiver's responsibility to not open those packages." How many people that disproved of e-mail "surveillance" also disapproved of s-mail surveillance during post 9-11 anthrax attacks? I wonder.

</comment><comment><USER17> This is a rather poor refutation of the claims made. I hope they can do better or I forsee a mass exedous. Who is a good alternative?</comment>


How I Made Sleep a Priority — And Got More Productive - <AUTHOR> http://www.good.is/post/how-i-made-sleep-a-priority-and-got-more-productive/

<comment><USER2> Waking up very early is actually really nice because everyone is still sleeping and you can get stuff done without distractions. I especially like the fact that you can't even hear the hustle-and-bustle of car engines outside, which gives a feeling of serenity that boosts productivity - at least mine.</comment>


Gilbert U-238 Atomic Energy Lab Toy (1950-1951) - <AUTHOR> https://www.orau.org/PTP/collection/atomictoys/GilbertU238Lab.htm <comment><USER2> The '50s were a different time. When I was in third grade, I think it was 1959, I got to go to Mrs. Spencer's Workshop for part of each day. This was a special class where we could make up our own projects and do them.

I wanted to make a printed circuit board for a science fair project, and I wanted to etch it myself. I didn't have a source for a phenolic board with a copper layer, but I figured I could at least demonstrate the concept by masking both sides of a copper sheet with electrical tape as a resist.

So I asked Mrs. Spencer if she could get me a sheet of copper, some electrical tape, and a tank of nitric acid. And she did!

I masked the copper with the tape and dunked it in the nitric acid, and watched it dissolve the copper. Then rinsed off the copper, peeled off the tape, and glued the copper strips to a cutting board to make the circuit. (I figured the cutting board would satisfy the "board" part of "printed circuit board".)

This was the best third grade project ever!

</comment><comment><USER3> When I was kid you could buy pharao's serpents over the counter at joke shops in the UK.

This is a mercury compound that gives off mercury vapour when lit: "If the reaction is performed inside a container, a gray film of mercury coating on its inner surface can be observed"

The instructions told you to be in a well-ventilated place. Oh yeah. Helpful.

<[https://en.wikipedia.org/wiki/Mercury%28II%29_thiocyanate#Ph...](https://en.wikipedia.org/wiki/Mercury%28II%29_thiocyanate#Pharaoh%27s_serpent>)

Really good video, well worth watching if you've never seen this before <[https://www.youtube.com/watch?v=vQdK7gaZS0k>](https://www.youtube.com/watch?v=vQdK7gaZS0k>)

<comment><USER3> Replying to myself, the Pharao's Serpent isn't about gassing kids with metallic mercury vapour, that's just a bonus, but the peculiar growths it produces. It looks like a mashup of CGI and '70s stop-motion making a cheap Dr. Who monster. It's well worth seeing if you've not before.

</comment></comment><comment><USER4> I wish these toys were available today. This one is not particularly dangerous (U-238 is barely radioactive), yet very educational and entertaining.

I try to perform some chemical and biological experiments with my daughter, however, it is much more interesting when you can do such things without adult supervision; and e.g. home CRISPR kits, while available, require precision and many difficult steps to achieve the results (there are no guarantees).

<comment><USER5> _I wish these toys were available today._

Maybe if they were, fewer people would be afraid of science. And atomic energy.

When we were kids one of my cousins was signed up for some kind of science experiment of the month club. The first kit came with a microscope and all kinds of instruments. Then each month a box would arrive full of slides and rocks and all kinds of things with instructions for performing five or six different experiments.

Even as an adult, if such a thing existed I would subscribe to it today.

<comment><USER6> [https://www.thimble.io/courses/](https://www.thimble.io/courses/)

<comment><USER5> That seems like a good choice for some. It's sad, though, that for Thimble, and so many others, that "science"=electronics, when there is so much more to explore.

</comment></comment></comment></comment><comment><USER7> I had a 1970 version of the Gilbert chemistry set. It was pretty good, not quite as cool as the Kosmos one. I still have a few remnants of it.

It was just before the end of chemistry sets.

</comment><comment><USER8> has anybody tried to reorder materials for thier kit ?

[https://www.orau.org/PTP/collection/atomictoys/GilbertAtomic...](https://www.orau.org/PTP/collection/atomictoys/GilbertAtomicOrderForm.jpg) [IMAGE]

</comment><comment><USER9> video from Atlas Obscura about the toy [https://www.youtube.com/watch?v=zeyoJGqKbOQ](https://www.youtube.com/watch?v=zeyoJGqKbOQ)

</comment><comment><USER10> wouldn't the Zn-65 sample (gamma rays) in the kit be hazardous ?

[https://ehs.princeton.edu/laboratory-research/radiation- safe...](https://ehs.princeton.edu/laboratory-research/radiation- safety/radioactive-materials/radioisotope-fact-sheets/zinc-65)

<comment><USER11> To be fair, most products and practices in the 1950's would be considered wildly dangerous by today's standards. Hell, we were still using leaded gasoline (gasoline with tetraethyllead additive) up until the 90's. Think about how dangerous lead poisoning is and now imagine that we used to add it to gasoline and every gas powered motor was spewing vaporized lead. Good times.

<comment><USER12> They still use that fuel in airports: avgas

<comment><USER13> I had no idea. FAA confirms: [https://www.faa.gov/news/fact_sheets/news_story.cfm?newsId=1...](https://www.faa.gov/news/fact_sheets/news_story.cfm?newsId=14754)

<comment><USER14> Yeah it's a problem because there is no money in light aviation and a lot of liabilities. And leaded aviation gas appears as a liability, especially to refineries.

There are increasing attempts to produce diesel aircraft engines. Complicated by there not being any money in light aviation.

</comment></comment></comment></comment></comment><comment><USER15> I have long been enamoured with the idea of building a series of educational science toy sets were in some way better than those I remember growing up. Seems like a nice pastime.

</comment><comment><USER16> Po-210 is an incredibly powerful alpha emitter, and because of that it's one of the most toxic of all isotopes. LD50 is one microgram.

The fact that someone was selling it in a kit for kids is terrifying.

<comment><USER17> ~~Note that the article mentions Pb-210 not Po-210, ie. lead not polonium. Pb-210 was known as Radiolead.~~ (edit: it actually contains both)

Po-210 is deadly when ingested but not very dangerous when outside the body. It also has a very short half life, so you need it fresh out of a reactor if you are to poison a defected spy or a dissident with it.

<comment><USER18> If anyone else found this comment about poisoning defected spies oddly familiar, you might also be thinking of the poisoning of Alexander Litvinenko[0], indeed using Po-210.

[0]: [https://en.m.wikipedia.org/wiki/Poisoning_of_Alexander_Litvi...](https://en.m.wikipedia.org/wiki/Poisoning_of_Alexander_Litvinenko)</comment></comment></comment>


Hoarding critical knowledge is a way to stay employed - <AUTHOR> https://qatalog.com/blog/post/got-knowledge <comment><USER2> I remember working in a dev team where only one person knew where all the keys for all services were stored

If he was hit by a bus, we were f*ed

<comment><USER3> I had a team where we always talked about our bus factor - how many of us it would take to be hit by a bus to royally screw the team. We also got nervous when too many of us shared an elevator together, hah.

In all seriousness though, knowledge silo'ing can be a nasty problem</comment></comment>