Google to Slow Hiring for Rest of 2020 - <AUTHOR> https://www.bloomberg.com/news/articles/2020-04-15/google-to-slow-hiring-for-rest-of-2020-ceo-pichai-tells-staff <comment><USER2> So years ago this came up with Eric Schmidt, who was CEO of Google through the GFC. After 2007, Google had selective layoffs (probably not in engineering) and slowed hiring. They also paused construction projects in Mountain View and probably elsewhere.

Eric said when asked about it that it was a mistake. He said that if Google was healthy there was no need to have a kneejerk reaction to the slowdown. And this caused significant growing pains later.

Is the situation the same now? I'm not so sure. I think this economic shock is potentially far more serious and could last much longer. But also, I don't think Google really knows what Google is anymore. We're long passed the mission statement of making the world's information accessible and useful. And certainly my impression from working there (now >3 years ago) was that even then there were a ton of teams and orgs that didn't really have a reason to exist.

Have people sitting around and they will find things that "need" doing. I saw many a project that was simply rewriting something where I at least had questions as to the real need for that. The bureaucracy is expanding to meet the needs of the expanding bureaucracy as they say.

And there was (and I imagine still is) too many layers of middle management. The ideal is (IMHO) CEO -> SVP (PA level) -> VP -> Eng Director -> Manager (of managers) -> Manager (of ICs) -> IC. That's 7 levels. I don't know what Google's mean org depth is in engineering but my guess is it's closer to 11, maybe even 12.

In fact this would be a good metric:

Management overhead = Mean org depth / log(# of employees)

where

Mean org depth = Mean of how many layers each IC has above them

<comment><USER3> On the topic of not having enough work to do, here's a couple questions to any Google employees:

1\. As someone generally frustrated with the quality of the search results I get on Google, is improving search quality seen as any kind of priority within the company?

To be fair I can't think of any other search engine that returns better results. But I feel like Google's gotten very complacent with their search, which is not surprising given the fact that it's practically a monopoly.

2\. Is there any initiative to rewrite gmail on the web? The damn thing takes like 30 seconds to load. For a company pioneering progressive web apps and web performance, it boggles my mind that they've put no effort into improving gmail's atrocious load times over the last decade.

<comment><USER4> The cynical view about search quality is that the metric being optimized for is not how satisfied people are with the results, but the amount of ads and therefore revenue earned. Search results only need to be good enough to get you to come back and not worse than the competition.

I wish Google had a subscription option (with actual support) that eliminated all ads across their products. Imagine Amazon's customer obsession with Google tech... I'm sure it would do well for the 4 years they would support it.

<comment><USER5> Google Contributor was their ad-free subscription option.

It was always a curious product, never really seemed to have management buy- in, and was pretty much a one-man product, which a 'subscription to get rid of ads across the whole web' shouldn't have been.

</comment></comment></comment></comment><comment><USER6> Before everyone starts painting bleak picture, reminder: Facebook's Sandberg announced last week or so that they are going to do accelerated hiring spree this year, opening massive 10,000 more positions! Google as well as Facebook both depend on ads so I'm wondering why one is tightening the belt and other is moving full speed on expansion.

<comment><USER7> > Sandberg announced last week or so that they are going to do accelerated > hiring spree

That was a message to the stock market. In reality I haven't heard from a Facebook recruiter in a month now.

<comment><USER8> Not sure why RivieraKid was getting downvoted - there's no "just a message to the stock market". Lying in this context would be illegal, and would open FB up to shareholders suing the company IMO.

<comment><USER9> I'm not a securities lawyer, but I would assume that there is little deterrence for "sending a message to the stock market" with statements about hopes, plans, or predictions for the future. As long as there's nothing definitively false as of the moment you say it...

[https://en.wikipedia.org/wiki/Forward- looking_statement](https://en.wikipedia.org/wiki/Forward-looking_statement)

</comment></comment></comment></comment><comment><USER10> I wonder if so many layoffs, freezes etc. happening at the moment are directly due to the crisis or something that was long overdue and can now be done without much negative PR.

<comment><USER11> Google depends on advertisers to make money, and the writing is on the wall for these advertisers.

<comment><USER12> Call me dumb, but are people not sitting around consuming advertising 10x nowadays? There's never been a better time to get someone's attention.

<comment> grey-area 1\. Demand has fallen off a cliff globally - this is far worse for companies than most realise, this has never happened before

2\. All companies are facing a cash crunch, gov loans are slow to arrive and they have fixed costs like rent

3\. Companies need to conserve cash, turning off ads is a click of a button, and given no demand, it's an obvious choice

This is going to be bad for google and Facebook if it lasts any significant amount of time.

<comment><USER13> On the other hand, Amazon is going gangbusters. I wonder if covid-19 will ironically prompt a longer term re-alignment away from virtual interaction in favour of real-world connections, as people realize how much they miss real things during lockdown.

<comment> grey-area I imagine Amazon will do well in some areas (consumers) initially, but overall will see a drop in demand as the crisis really bites - businesses have stopped ordering, and consumers will stop ordering soon to save money. It will be interesting to see how this plays out but I think US markets are far too optimistic at present, and this is going to have a very large impact economically, because it won't be over as soon as say Trump hopes, and premature attempts to reopen will be disastrous.

Strangely enough I think the disease and its impacts will have far less impact on our behaviour than the economic impact of mass layoffs and shuttering the world economy for months. I don't think we've ever seen a drop in consumption of this magnitude and the road back to normality will be slow.

</comment></comment></comment></comment></comment></comment><comment><USER14> I've been stuck in the final SVP approval part of their hiring process for a week. At this point I think I'm just going to keep my current job. Too bad — seemed like a good time to get equity at a good "strike" price

<comment><USER15> Google has a notoriously slow hiring process. For new grads and internships, the time between initial coding assessment to final hiring confirmation is often several months.

<comment><USER6> One has to think why the concept of employment is still considered like marriage that require such an extensive ultra-deep multi-level deliberations. Let's say you were local, why it shouldn't be possible to give someone on-the spot offer after half-day of interviews as well as let them go with, say 2 weeks of standard severance if things don't work out?

<comment><USER16> At a large technology company with its own software stack it takes several months before a new hire isn't a net-negative to the team they join. And it will be months after that before they reach full productivity. A bad hire is an extremely expensive mistake.

<comment><USER6> A bad hires are expensive mistake if you can't get rid of them until some artificial annual event. While I understand onboarding complexities, my experience is that the teams/companies which hasn't create good automated process so new hire can commit their first change within 2-days are big red flag (this was insisted upon by Zuck extensively at Facebook scale). I would also argue that culture of hire/replace team members in agile manner would help enforce this process more naturally and vice versa.

<comment><USER17> Being able to make a change, and being able to make a change without handholding are two different things.

> hire/replace team members in agile manner would help enforce this process > more naturally and vice versa

Places where this happens are normally considered very high stress and competitive.

</comment></comment></comment></comment></comment></comment><comment><USER18> It's briefly mentioned in the article, but Google actually shed jobs during the financial crisis. _Facebook_ is the company that ramped up hiring newly available talent.

<comment><USER19> Through layoffs or attrition though?

<comment><USER20> Attrition

</comment></comment></comment><comment><USER21> Makes sense if they can't onboard the talent, and can't manage a 100% distributed workforce.

Nevertheless, seems like a great time to acquire talent on the cheap, so long as you can effectively use it.

<comment><USER22> Anecdotally, I've been told they require you to come onsite to get onboarded and receive Google hardware and their offices are locked up. Some recent hires are not able to work and now being paid to do nothing.

<comment><AUTHOR> They are mailing out the required hardware and doing remote onboarding for the time being. But hardware shipments are getting delayed leading to some new hires being paid to do nothing for a week or two.

</comment></comment></comment><comment><USER23> I recently posted a Ask HN asking about the effect of how drop in ads money would affect Google/FB and someone did a quick and dirty analysis for their runway: [https://news.ycombinator.com/item?id=22884042](https://news.ycombinator.com/item?id=22884042)

</comment><comment><USER24> A lot of companies are cutting back big time on advertising spend and that's Google's sacred cow of revenue so this isn't a surprise.

<comment><USER25> I work in digital advertising. Spend* is up. Companies are diverting their traditional advertising budgets into digital. I'd be surprised if Google is unable to capitalize on this.

edit: I want to clarify it's strictly ad spend/booking. It's companies committing budgets. They know they will want to run ads and will run more ads. The ads haven't actually run yet, so ad payouts will tank.

<comment><USER26> That is _totally_ not true across the board. I know for a fact that at one point the big online travel sites (booking.com, expedia.com) were some of the largest buyers of adwords among any companies. Can guarantee that is not happening now.

I would guess spend is up only among companies that still have robust revenue. Tons of sectors have essentially been frozen for the time being.

<comment><USER25> Ah, yeah, can confirm the travel segment cratered into the ground. I can see adwords being an unpopular product overall at the moment. It's just an awful format for rebranding/storytelling/marketing.

<comment><USER27> This is super interesting. I never thought of search ads from the lens of storytelling, only from the lens of click through. Interesting that a lot of SEO-built brands have no way to even reach customers to repair brand now, since search volume is so down.

<comment><USER28> I suspect this is one of the reasons advertising on Instagram is going gangbusters. The combo of better targeting + a format that naturally lends itself to storytelling makes for a much more compelling advertising platform.

</comment></comment></comment></comment></comment></comment><comment><USER29> Maybe the travel, restaurant etc industries have stopped paying for clicks so Google gets less cash? My work cut down on PPC by a lot and we spent a lot of money on it.

<comment><USER30> So what? They have enough money to last trough years of economic depression. Long term plans might be as important as short term plans, or more important.

They don't send a good signal to investors.

Micromanaging makes sense when you are in deep trouble - see LA Times. Is Google in trouble? I believe not. Yet they send the message they are in trouble.

<comment><USER31> As this crisis has illustrated, early inaction can get you into later trouble.

</comment></comment></comment><comment><USER32> One thing is that people just aren't leaving their jobs in general. Most hiring rates take into account natural attrition, but if your attrition is close to zero, then you just have to scale back your hiring to even hit the rates had planned before the crises.

</comment><comment><USER33> I guess I'm lucky I got my approval just today. My recruiter did mention things are slowing down drastically.

<comment><USER34> Congratulations! It's a great place to work with amazing people. Source: got hired not that long ago.

</comment></comment><comment><USER35> It will be interesting to track the frequency of Google walkouts while the economy has tanked, hiring has slowed to a crawl, and layoffs could be in the future.

</comment><comment><USER36> I think... there will still be work. I think it means they will be going heavier on contractors, so they have more 'cushion' to preserve FTE when things unexpectedly go south. At this point, companies simply don't know how the rest of the year will pan out.

<comment><USER37> I feel so much optimism in your "the rest of the year".

<comment><USER38> I have been asking my friends to speculate how us pandemic survivors will be different from other people in the future? How we will be characterized in novels? How would Sherlock Holmes distinguish us from the privileged ones who by luck of birth were not involved in the pandemic? Dr. Watson would say, after Holmes spotted the survivor, "If you worked from home for two years, you'd behave that way too."

I always pose this a little more colorfully, but the part that gets the response is the two years.

</comment></comment></comment><comment><USER39> Seems like some layoffs too, [https://twitter.com/whyhiannabelle/status/122810842950535168...](https://twitter.com/whyhiannabelle/status/1228108429505351680?s=21)

<comment><USER40> In the cloud business, based on the tweet

<comment><USER39> Yes. If you search at Bind, seems like some in marketing too.

</comment></comment></comment><comment><USER41> Ooof. I've been studying for months for my upcoming virtual onsite interview at Google. I wonder what this means for my interview. I was also recently laid off.

<comment><USER42> I was also preparing for an interview and received a call from my recruiter that the position has cancelled.

</comment></comment><comment><USER43> I've also seen slow hiring and hiring freezes used by orgs to reduce head count by letting natural attrition take over. IMHO it is better than layoffs.

</comment><comment><USER44> [https://archive.md/SIXk8](https://archive.md/SIXk8)

</comment><comment><USER45> Damn, will be interning this summer. I guess conversion to FT will be even more unlikely now

</comment><comment><USER46> As a counter point there was an article the Wall Street Journal two days ago that large tech companies(Apple, FB and Amazon) are all looking to hire:

[https://www.wsj.com/articles/looking-for-a-job-big-tech- is-s...](https://www.wsj.com/articles/looking-for-a-job-big-tech-is-still- hiring-11586712423)

Sorry about the paywall, I couldn't get outline.com to render it.

<comment><USER47> The tech sector as many other industries is always recruiting cheaper workers anywhere in the world to make more profits distributed in priority to the leaders.

Nothing new in a capitalist world...

</comment></comment><comment><USER48> I just chickened out of Google interview last month. I dont know how I feel now.

</comment><comment><USER49> People on Blind are posting that it's more than just slowing.

<comment><USER50> It can't be more than a simple slow. This crisis decimated their revenues while increasing their huge subsidized operational costs like bandwidth.

Take for instance YouTube. Just imagine the cost to operate the site increasing exponentially overnight (because of all the quarantined people) while their ad business goes down. You're in the worst possible situation for a business with a model that is heavily dependent on that particular ad revenue.

That's like a supermarket having three times more foot traffic but people only buying gum.

<comment><USER51> The threat to YouTube has also never been higher.

The spike in usage means that YT needs content creators to make more, but also earn less money. A forward-thinking startup could capitalize on this by paying content creators more to migrate to their own service, and work to get the attention of those eyeballs which are bored of YT content.

</comment></comment></comment><comment><USER52> Fingers crossed for the end of surveillance capitalism.

</comment><comment><USER53> This is just getting started. Everything is so interconnected. Each chunk of the economy that falls away will have a cascade effect that takes weeks or months to knock the next piece out. Once everyone finally heads back to work it will take years to regrow everything to the point it was.

</comment><comment><USER47> How many jobs will go to India?

<comment><USER54> As third party observer, why this gets downvoted?

I'm genuinely asking.

<comment><USER55> Probably because it is perceived to be a fairly uninformed question. It's sort of like talking about the USPS potential insolvency and someone asking how many postmen will be replaced with gig economy workers. As far as I'm aware, major leading American tech companies have never really exported jobs to India, it has been almost entirely companies that need mediocre quality work contracting out to companies that fill those contracts with workers from India or elsewhere. Without carefully developing an office, culture, and employee pipelines over 3-5+ years you carry extremely large risk outsourcing important work.

<comment><USER47> Is it a joke?

In many industries it's not uncommon to subcontract a service by a subcontractor which himself subcontract the same service to another subcontractor (usually cheaper).

In the end it is only a question of money!

Actually top american tech companies don't have to go directly to India to get cheaper workers but instead they call american subcontractor to get cheaper workers anywhere in the world. Even more with restricted green cards thanks to Donald TRUMP. :-)

<comment><USER28> i don't know why you were downvoted -- you're exactly right.

<comment><USER51> It was right 10-15 years ago, but less so now. There's been a huge pushback on off-shore development in the past decade for a variety of reasons, mainly poor results, issues with time zone differences, and the negligible cost savings. Most of the big consulting firms we associate with off-shore contracting (like TATA) are supplying mostly on-shore (engineering) consultants to domestic companies (but maintaining services like help desk offshore).

Middle management got tired of having daily meetings at midnight or 6 AM, and it got too expensive to bring people over who were fine with doing so. The India job market got pretty tight around '14 or so, to the point where engineers were leaving jobs every 4-6 months for greener pastures. And even though the consulting companies are supposed to be in charge of KT, so that transitions don't impact the clients, the rate of change was just too high to maintain good quality.

</comment></comment></comment></comment></comment></comment><comment><USER56> If even Google, which is pretty much the pinnacle of Silicon Valley tech, is slowing down, imagine what the Chinese tech scene must be like.

<comment><USER23> Comparing Chinese tech companies with Google here feels like comparing apples and oranges and also "Chinese tech companies" is too big a entity to be compared with a single company. But scenes at Yahoo/Reddit/Baidu and other smaller ads-driven companies aren't pretty

</comment></comment><comment><USER47> Open source foundations will go to bankruptcy without subsidies from Google and others.

Are you ready for the dot com bubble 2.0? :-D

<comment><USER57> Death of open source? Don't get me excited

<comment><USER47> Death of unfair competition from communist organizations living on private money from anticompetitive tech giants.

Open source have to die to give back value to the software industry.

</comment></comment></comment><comment><USER58> This is the outcome of crazy hiring, more than you can actually make use of in the past few years.

</comment><comment><USER59> With the number of people who go through Google's interview process, this might actually change the industry to think more carefully about the interview process. If Google isn't making whiteboard interviews the norm, who will keep it going?</comment>


Can You Learn to Draw Realistic Portraits in One Month? - <AUTHOR> https://www.scotthyoung.com/blog/2016/08/26/ultralearn-portrait-drawing <comment><USER2> Very interesting!</comment>


Swype (Re)Opens Its Beta - <AUTHOR> http://www.readwriteweb.com/archives/one_of_the_killer_apps_for_android_swype_opens_its.php

<comment><USER2> I've found Swype to be very easy to use so far. It's far easier to get used to then a bold re-imagined keyboard like 8pen. Still, it doesn't beat a physical keyboard. Text input isn't autocorrected like iOS, either, which makes such a difference. It is a big plus that your finger doesn't get tired from tapping.

I am fascinated by 8pen, though. Look it up if you haven't seen it before. I'll have to check out the other one they mentioned.

<comment><USER3> As long as we are talking about creative Android keyboards, I'll pimp my own weekend project - Scrybe. It's a keyboard that uses Google Scribe to make completion suggestions.

<http://www.appidio.com/apps/scrybe/>

</comment></comment><comment><USER4> I used Swype for a while half a year ago, but I found SwiftKey to be far quicker at issuing updates, where Swype had some pretty huge usability fails that remained unfixed for ages. It's an amazing keyboard, but SwiftKey won the race for me.</comment>


Top Gawker editors resign after outrage over Conde Nast exec story - <AUTHOR> http://www.washingtonpost.com/blogs/style-blog/wp/2015/07/20/top-gawker-editors-resign-after-outrage-over-conde-nast-exec-story/ <comment><USER2> I'm with Nick Denton on this one. Just because you _can_ publish a story doesn't mean you _should_ publish a story. Not every website should aspire to be TMZ.</comment>


Network Engineer looking for a new direction - <AUTHOR> Hello world!
I've been a network engineer for a relatively short 4 years but jobs for this position seem to be dwindling fast.
Currently unemployed and looking to skill up in a new direction. 5 years from now I could see myself working remotely, with a startup or small to midsize business. It would be great if the direction I take could be complimented by my networking knowledge.
In my previous job I worked with Full-Proxies (F5 BigIP) and really enjoyed being more involved with security and application delivery.
Any gurus out there have suggestions for me? I should mention I have very little coding experience and generally don't enjoy coding.
Cheers! Philip <comment><USER2> Over the long term, not enjoying coding may become a detriment. Networking is moving more and more towards automation, and all that entails.

Depending upon which world you live, Cisco has their automation, Juniper theirs, and open source has things like Ansible, NAPALM, SaltStack/Proxy,...

Thinking logically and being able to write intent based rules is going to be important.

Do some research on SDN, SDWAN, NFV, ....

Lookup NetFlow as a management tool.

Security, networking, application delivery are all becoming inter-twined and Software Driven.

Adapt or Die.</comment>


NSA contractor hired Snowden despite concerns about resume discrepancies - <AUTHOR> http://www.reuters.com/article/2013/06/21/us-usa-security-snowden-idUSBRE95K01J20130621

<comment><AUTHOR> Oh no, he exaggerated on his resume... Totally misses the point.</comment>


How does the Twitter iPhone App animate the current tab bar indicator? - <AUTHOR> http://idevrecipes.com/2010/12/17/twitter-app-tab-bar-animation/

<comment><USER2> There has been much debate about making customizations like these that stray from the UI guidelines. I actually like subtle customizations like these, but some more orthodox folks feel that it's a crime.

In any case, it's nice to see someone reverse engineering some of them, as I've always wondered how a few of them worked.</comment>


New Severity Level, "Critical" - <AUTHOR> https://www.openssl.org/blog/blog/2015/09/28/critical-security-level/ <comment><USER2> I hate the generic sounding levels anyway, they explain nothing. I'd much prefer to see business relevant levels.

Those vulnerability still can fit into nice categories like 'remote code execution' 'denial of service' 'local code execution' 'remote information leak' 'loacal information leak' and those could also directly communicate what the bug is all about without 500 words explanation for each single level.

<comment> glass- With those categorisations a maybe-probably-theoretical-phase-of-the-mooon vulnerability such as CVE-2010-1633 gets put into the same category ("remote information leak") as Heartbleed. This is why severity levels exist.

<comment><USER3> But it seems to me the difference you are pointing to is in _probability of the adverse possibility being realized_ rather than _severity of the impact if the adverse possibility is realized_. In risk management, these are usually rated on separate axes.

<comment><USER4> That probability assessment is pretty dangerous to rely on. Lots of vulnerabilities look extremely improbable, until the exploit tool starts to circulate. This is an age-old problem in software security: when you try to score things in a risk management rubric, you wind up hair-on-fire over simple vulnerabilities that managers can understand, and wind up not fixing sophisticated vulnerabilities that will be commonplace among attackers soon.

It's also important to remember that there's a window in which this stuff gets fixed, probably just weeks long, anchored to the announcement of the vulnerability. Once that window passes, any update you're going to see about exploitability is basically going to announce "everyone is now owned". That's a failure of vulnerability scoring!

<comment><USER3> I don't disagree with the idea that probability has a lower value in this type of software security risk assessment than some others; my point was that probability is a different thing than severity, so that it is not necessarily an error that issues with a different probability of being exploited but similar consequences get the same severity rating.

Your point, however, is well made.

</comment></comment></comment></comment></comment><comment><USER5> Can I just say, while I have no specific issue with adding critical or traffic light systems in general:

> The headsup doesn't contain any details of the issues being fixed apart from > the maximum severity level and a date a few days in the future.

Maybe it would be advantageous to include a short summary of the issue (DoS, local security, remote security (exploitable), remote security (unexploitable), etc)? The "bad guys" still wouldn't know where to look, and it isn't like people aren't actively working to find exploits in OpenSSL daily. But this gives the "good guys" information which you yourselves say they need to evaluate the risks to them.

<comment><USER4> It's often hard to determine whether a vulnerability is merely a denial of service vector, which is one reason the descriptions are kept abstract.

<comment><USER5> If that were true then this new critical moniker doesn't make sense. The whole justification for them adding it is that they have (past tenths) made that determination.

<comment><USER4> I don't understand your rebuttal. The "Critical" designation confirms that a vulnerability is known to have applications beyond DOS in real-world configurations. "High" does not; it includes memory corruption vulnerabilities that are _believed_ to be capable only of crashing a process, but not _known_ to be so limited.

<comment><USER5> You said they cannot put broad notes onto their release because they may not know enough. I am saying that the new critical term has been coined because they claim they do know enough to classify it.

If they cannot make these determinations then the whole high/critical distinction is impossible. They've made a determination in order to categorise them.

<comment><USER4> Still not following. "Critical" is the term they plan to use when they _do_ know enough to say that there are immediately available better-than-DOS exploit vectors.

</comment></comment></comment></comment></comment></comment><comment><USER6> Firefox throws an error related to security when connecting. How ironic.

[http://i.imgur.com/WGBQ8U9.png](http://i.imgur.com/WGBQ8U9.png)

<comment><USER7> works fine for me.

<comment><USER8> Future versions of Firefox are going to be much more strict about security and SSL configuration, and some of those changes are already in the nightly/beta/developer-edition builds.

I already know there are some sites I can't use from the developer edition due to things like outdated/insecure cipher suites, but which continue to work in the released version and in other browsers.

<comment><USER9> Works for me on Fx 41.0, but I had just noticed Mozilla had removed all the useful information from the popup that appears on clicking the padlock icon. The _only_ text here is pointless "secure connection" (even for EV certificates!). Firefox UI team must've gone insane.

</comment></comment></comment></comment><comment><USER10> Fast forwards twelve months and we'll have "Ridiculously Critical" and after that "Ludicrously Critical" and then eventually Plaid.

<comment><USER11> True, but that is still better than Vogon poetry

</comment></comment><comment><USER12> Okay, so looking over the post they didn't feel like CVSS 2 was giving a clear indication of risk, and CVSS 3 isn't done yet and lacks perfection. That's sensible enough, I suppose.

I hope they took more than a glance at what some other vendors are doing (EG Microsoft) before adding to what can already be a confusing collection of incompatible qualitative ratings :/

As noted by other commenters here a vague description of the category and some idea of the global risk, with a spot for you to add local risk seems a good tool here that serves both attack and defense with some balance. Oh, wait, we have that already in CVSS!

edit: spell acronyms right!

<comment><USER4> I don't know many practicing software security people that put much stock in CVSS. CVSS v2 in particular was not very useful in practice. Further: there aren't many people _even in the security industry_ that have an intuitive feel for how to respond to CVSS scores.

As an exercise, go to the CVSS v2 calculator and score Heartbleed. I bet you end up with something different than I do, and different from the next person to do it.

[https://nvd.nist.gov/CVSS-v2-Calculator](https://nvd.nist.gov/CVSS-v2-Calculator)

 _Later_

I polled my security friends Slack to do Heartbleed on CVSS3. Four different people, four very different scores, and the differences were significant; for instance: some people gave it integrity impact, others didn't. Also: CVSS version 3 remains as inscrutable as ever.

<comment><USER13> It's very murky whether loss of confidentiality should count as a loss of integrity. Obviously, the answer is almost always yes. If the system coughs up the root password to an exploit, and then you use the root password to rm /, there goes integrity and availability too. But should that be included in the score? Or is that simply a natural consequence that should be understood.

I vote the latter. Otherwise every bug reads like a classic medical waiver: "may result in death!" Severity: 10!

<comment><USER4> I gave Heartbleed no integrity impact.

The funny thing is: bumping up "integrity" from zero to nonzero only gets you from 8.x to 9.x. Which is obviously ridiculous! All things being equal, the difference between RCE (which CVSS can only encode as "integrity") and anything else is night and day.

I really dislike CVSS, and I think I speak for a big chunk of software security when I say that.

</comment></comment></comment></comment><comment><USER14> just as a side note: Check out the CVSS calculator. That's a really straightforward way to classify vulnerabilities. They have tooltips that go into detail about each field: [https://www.first.org/cvss/calculator/3.0](https://www.first.org/cvss/calculator/3.0)

</comment><comment><USER15> Ok, probably was just me but when I saw in the title the words "Severity" and "Critical" with the site being openssl.org I thought: "OMG, here we go again".</comment>


Using a Bomb Robot to Kill a Suspect Is an Unprecedented Shift in Policing - <AUTHOR> http://motherboard.vice.com/read/dallas-pd-using-a-bomb-robot-to-kill-a-suspect-is-an-unprecedented-shift-in-policing <comment><USER2> Very disappointing that this article, like almost all the ones being written right now, focus on exactly the wrong issue. Yes, robots and police psychology are fun to think about, but the heart of the matter in the Dallas case is _whether the suspect posed an imminent threat which could not be addressed any other way besides lethal force_. The reason the robot raises worries is not that it's shiny and represents the scary future, it's that robots are slow and unreliable, and it's hard to imagine a situation where lethal force is warranted and the robot is useful. In other words: If you can use the robot, you probably have the gunman contained. If the gunman is posing an imminent risk to the lives of others, the robot is probably useless.

The author doesn't even touch on it until one sentence all the way to the end.

> The ability for police to remotely kill suspects raises due process > concerns. If a shooter is holed up and alone, can they be qualified as an > imminent threat to life?

There have been lots of quotes by the police about how they "didn't want to risk the life of another officer", but no quotes I've seen about "the gunman was about to escape and go on to hurt others". Why wasn't the suspect containable? Why don't any of the journalists raise this issue, either in their interviews or articles? Hopefully this will eventually all be public as part of the investigation, but the public conversation about this is pretty much useless right now.

The comparisons to the military are not helpful:

> Brown raises an obvious question that the US military has grappled with: If > a shooter is holed up in a building, who do you send, a person or a bot?

Unlike the military, the police operate in an environment where simply containing the suspect and waiting him out are very viable options.

<comment><USER3> > (...) but the heart of the matter in the Dallas case is whether the suspect > posed an imminent threat which could not be addressed any other way besides > lethal force.

At that time, the assailant already stated his purpose of killing as many police officers he could, and during his rampage he already had killed 5 police officers and gunned down dozen or so victims.

The assailant planned for this sort of attack for some time, he purposely took military training in private weekend warrior schools specifically to conduct the attack he was planning, and he even planned and mobilized himself to use explosives.

The assailant's plans were all suicide missions, and their goal was to inflict the most damage possible.

I'm not an american, and I live in a country where there isn't a single police-involved death for years, and even I am well aware that going with such a radical option was quite obviously the only way the police could ensure that the assailant would cease to be a threat to the public.

<comment><USER2> None of your points fully address what's needed to justify lethal force.

The Police Executive Research Forum emphasizes that the police are not authorized to start executing someone who was engaged in active, suicidal shooting once that person is contained:

> Many [police department] policies note that Active Shooter protocols should > not be used as a response to "barricaded gunman" situations. And some > policies note that active shooter incidents are dynamic, and that an > incident may go in and out of active shooter status in ways that could alter > the police response. For example, a situation may begin as an active shooter > incident, but if the shooter barricades himself in a room where he no longer > has access to potential victims, and the police can secure that room and > contain the shooter, the police response should shift accordingly.

[http://www.policeforum.org/assets/docs/Critical_Issues_Serie...](http://www.policeforum.org/assets/docs/Critical_Issues_Series/the%20police%20response%20to%20active%20shooter%20incidents%202014.pdf)

The police had him trapped for two hours before they blew him up. Perhaps there really was a new development that forced them to take action, but it's not a call we can make merely knowing how bad the guys was. It depend on the details of the situation.</comment></comment></comment>


An Open Letter to Twitter: Let me pay for better service - <AUTHOR> http://vocamus.net/dave/?p=1276

<comment><USER2> People who want to pay needs to understand that:

A. You are the exception. I am willing to bet .1% of users would be a overestimation of Twitterers willing to pay.

B. Setting up premium accounts and a payment system would probably run fairly close to break even. Not mention the additional customer service that would be expected and the complications that arise from splitting the userbase.

C. You aren't the real money. Twitter wants Coca Cola's money, CBS's money, etc. They don't care about pocket change from Joe Blogger. They are selling a package of 200 million people straight up, not a package of 200 million minus the most engaged and loyal users.

<comment><USER3> Yeah but those companies, Coca Cola etc, can only pay as long as Twitter have the user-base. And if the adverts cause users to go visit the site less, then their revenue stream from advertising would shrink.

Would they put averts in the Developer-API responses too? One one hand it's free to use, on the other hand it's being paid for by advertising. What company wants to be a slave to advertising companies? That sounds like a difficult situation to be in.

<comment><USER4> A 30-minute long TV show is actually only about 21.5 minutes long. The rest is advertising. People will tolerate it if the rest of the content is relevant and engaging.

If the ads are well targeted then they make people even more accepting of them.

<comment><USER5> I pay Netflix $9 a month and I have no commercials to speak of. What is the marginal ad revenue of every user on Twitter? If it's <$1/mo then there should be a premium, ad-less Twitter available for purchase at $1.99/mo.

<comment><USER6> You're not accounting to the effect a premium service has on marginal ad revenue per user. It goes down as the people with disposable income (the most desirable demographic) opt out of ads.

<comment><USER7> I bet th effect of even of the most engaged users isn't worth $10/month in ad revenue. Although I think there would be an irrational element in the pitch of reach the whole Twitter userbase vs reach the users that haven't paid.

</comment></comment></comment></comment></comment></comment><comment><USER8> As someone who runs a site that receives similar requests (I paid for reddit gold, why don't I get faster access), let me tell you, it just isn't that easy.

Their architecture, like ours, can't just be split into fastlane and slowlane.

So while I appreciate what the guy is asking for, it just isn't that easy.

<comment><USER9> Oddly enough, it's something that Livejournal does: <http://www.livejournal.com/support/faqbrowse.bml?faqid=74>

<comment><USER10> Last.fm do something similar: subscribers get a special cookie which jumps the queue on the http load balancer (perlbal).

Thing is, if there are queues at the load balancer, something already went wrong.. so it only really benefits subscribers on certain, rare occasions.

</comment></comment></comment><comment><USER11> Twitter can't let you pay them. That would immediately cap the market value of each user and Twitter's target valuation per eyeball is way more than you'd likely be willing to pay.

<comment><USER12> Interesting point. Let's see what that really means.

Twitter was on track for 200m users in 2011 [1]. Twitter was valued at 7.7b dollars a few weeks back [2]. That's about $38.5 per user. Surely fewer than half the users would pay for Twitter, which would mean that those paying must be worth at least 77 dollars. At a discount rate of 15%, each of those paying customers must yield 11.55 annually in free cash flow (i.e. after costs) to justify Twitter's valuation.

Of course, Twitter could always find ways to extract money from the non- payers, but yes, you bring up a great point: Is it reasonable to expect that half the users will pay about $12 bucks a year on top of his fractional costs to continue to use the service?

[1] [http://www.tgdaily.com/software-brief/52284-twitter-on- pace-...](http://www.tgdaily.com/software-brief/52284-twitter-on-pace-to- reach200-million-users-by-2011) [2] [http://www.mediabistro.com/alltwitter/twitter-7-7-billion_b6...](http://www.mediabistro.com/alltwitter/twitter-7-7-billion_b6132)

<comment><USER11> Cool, real numbers. :) I think monetizing by any means half of all users is very optimistic though. I have several accounts, long dormant, created as jokes. If that's typical (perhaps not), you'd have to divide by at least five or ten to get a real eyeball count.

<comment><USER13> <http://twitter.com/#!/cooltedsays>

</comment></comment></comment></comment><comment><USER14> While this person would be willing to pay for twitter, giving a payable, better option, would make much of the user base feel like they're paying for something they should have and always have had for free. Blogging and microblogging have appeal in their universal availability, don't they? Either nobody would buy it, or everyone would and some twitter users not willing to pay will lose loyalty to Twitter inc for asking them to pay for the product which works. Creating pro accounts would be like handing out 600 sham-wows, and informing everyone that the sham-wows do not absorb properly, but they can pay for a working one. If the majority of the people liked it, why inform them that the product they are holding is sub par? And if one were to argue that this is a concern of the majority of users, then twitter would have to just fix the problem to hold onto such a huge percentage of their user base, not create fixed pro accounts and essentially ask people to leave if they're not willing to pay. Either way, loyalty and new accounts would drop, which would undoubtedly affect ad prices in the long term. Also, why the hell would twitter spend time and money debugging and then apply the improvement to only a select few users? They found the problems, why not just increase the comfort and experience of their website for everyone and establish a larger and more loyal user base? That'd kick up their ad revenue far more than any alienating platinum account will. At this stage of the start up game, Twitter better focus on creating the most loyal and comfortable user base they can, and work on finding a stronger long term source of revenue. This would be a short term pay off for twitter, and they're definitely working to break out of fad status rather than make a quick buck. Twitter is the only product I've ever observed that most celebrities and news stations use regularly that I can't convince most of my friends to get into because "its stupid and pointless" (Besides exploitation of public sympathy toward third world countries maybe. MAYBE.) Until Twitter doesn't have a user base which loves them and general aggression from everyone else (probably within the next few years), they can only debug and look for sources of revenue which won't create discomfort.

(To the Y combinator people who read this as they evaluate my application: Hey guys, Love your work, I got pretty into HN. I'd just like to mention that this highly informed and apt internet user states that he gets all of his news from Twitter right now. Just sayin'. Thanks, Donny P.s. I have a new twitter account, and its MrGreenbergMD. I listed a different account on my application.)

</comment><comment><USER15> Vote with your cash: buy a 3rd party Twitter client and skip the ads altogether. Maybe Twitter will come back to their senses and provide an ad- free, paid Tweetie^W Twitter app again.

</comment><comment><USER6> Bad idea for twitter. They can't get rich off a couple bucks a month for a tiny segment of their user base, I doubt they can even break even.

Worse, having a pro account would cause ad prices to plummet. Who's going to pay premium prices for ads when the people willing to spend money have opted out of seeing them?

</comment><comment><USER16> I wouldn't mind to pay for a twitter pro account myself (although I'm on a tight budget momentarily). How would this option hurt the current free business plan? I think there is even a possibility that it would enhance the perceived value not only with current users but also for would-be users. Could it be that there is some kind of inferiority complex behind the lack of decisiveness by twitter management? It's not 2007 anymore, a lot of people "got it" till now. The problem isn't the monetization of the service which could drive people away, it is the potential incremental death of the culture which would. Twitter management just need to carefully observe successful services like github or flickr (pre & shortly post yahoo) which were magnets to mavens and spread from there. Examples for big mistakes in that regard recently were Sony (killing Linux support for PS3), Nintendo (generally too many "casual games" over the last couple of years, and now the 3DS region lock - first on a Nintendo handheld). I know those companies are highly profitable but I see their base crumbling already which always are the "power users". I know talk is cheap and things are not that easy but don't be stupid, think 2011 already.

</comment><comment><USER17> I agree with everything you've stated. I'd pay just to remove the dickbar.

</comment><comment><USER18> I don't think that Twitter having any sort of paid service model would correct any of the beef that the author has got with them. I use Twitter on a pretty frequent basis just like the author claims, but have very few of the same arguements. The "Who to follow" section for me is always fairly accurate, suggesting individuals who are posting useful and cool information similar to what I already read. I've had very few UI problems with either the web client or the iPhone app. Kinda just sounds like the author either didn't really use it enough to find it useful, or just griping about simple problems that all social network sites will eventually face.

</comment><comment><USER19> How much would you actually pay for twitter? $2/mo.?

Twitter is trying to make way more money per month from you via advertising.

</comment><comment><USER20> Economics of startups and ad industry is a lot like that of farmers and corn. Hard to find quality food without junk load of corn syrup in it, and farmers are always poor. Ads, like corn will keep winning unless tech crowd is able to think of equally innovative ways of monetizing their innovative ideas.

</comment><comment><USER3> What is the actual issue?

What is the technical problem that Twitter are actually facing? Does it simply come down to something like processing power?

</comment><comment> Nick-e I will definitely be willing to trow 5 bucks a month for a PRO account that will let me read other people private messages.

<comment><USER21> OK, maybe I was wrong and this article did do something.

<http://news.ycombinator.com/item?id=2371530></comment></comment>


Facebook Valued at $65 billion in New Investment - <AUTHOR> http://www.reuters.com/article/2011/03/03/us-facebook-idUSTRE7227JZ20110303

<comment><USER2> These valuation numbers for facebook left the reality zone a while ago. I'm not sure they are meaningful at all anymore- other than perhaps as a sign of a certain level of collective insanity or collective delusional hope.</comment>


Ask HN: Is there a podcast on the history of Unix? - <AUTHOR> From Unics to AT&T stuff, Berkeley lawsuit, LICENSE wars, Stallman/FSF/GNU, Tannenbaum/Minix, POSIX standardisation, Torvalds/Linux, and maybe even the modern scenario? I'd love to listen to someone knowledgeable about this.
I found the introduction chapter in TLPI really interesting.
Looking at https://upload.wikimedia.org/wikipedia/commons/7/77/Unix_history-simple.svg I'd think there'd be tons of stories to tell. <comment><USER2> I think you might like Command Line Heroes. It's made by Red Hat and they released three episodes so far with good production quality. The first two episodes were about the early history of Linux.

</comment><comment><USER3> Not a podcast, but a diagram of Unix history. But is interesting, and below it there are many links to articles about Unix.

[https://www.levenez.com/unix/](https://www.levenez.com/unix/)

</comment><comment><USER4> Try this, just released a few days ago [http://www.podtrac.com/pts/redirect.mp3/traffic.libsyn.com/j...](http://www.podtrac.com/pts/redirect.mp3/traffic.libsyn.com/jnite/bsd-0231.mp3)

</comment><comment><USER5> You might enjoy reading archives of the Unix Heritage Society. [http://www.tuhs.org](http://www.tuhs.org) and here is the oral history of Unix -- [http://www.tuhs.org/Archive/Documentation/OralHistory/](http://www.tuhs.org/Archive/Documentation/OralHistory/)

</comment><comment><USER6> You might want to read A Quarter Century of Unix, [http://wiki.tuhs.org/lib/exe/fetch.php?media=publications:qc...](http://wiki.tuhs.org/lib/exe/fetch.php?media=publications:qcu.pdf)</comment>


Ask HN: Should I use Contentful or WordPress API for building a static site? - <AUTHOR> I'm thinking about freelancing my skills and designing websites for local groups in my area. I don't want to have them come to me to update their website everytime they need the content changed though. I was going to use a CMS like Siteleaf until I found out about Contentful and headless WordPress (not designing a site with WP but just using their API to pass data to a site). Right now, I'm leaning towards WP because it's a bigger name, but I glanced at Contentful's website and it looks interesting. I'm not sure which one to use, so what are the benefits of each? Also, are there any other interesting alternatives? <comment><USER2> For the developer side of you I'd say go with contentful or similar but for your clients I'd say go with wordpress. It's ubiquitous and easily extendable with whatever plugin they need.

> I don't want to have them come to me to update their website everytime they > need the content changed though.

No matter what site you set them up with, or how easy you make it for them, they'll still come to you. The 'trick' is to agree some service model up front so they know they have to pay you and you won't do it for free.

<comment><AUTHOR> If I understand you correctly you're saying if I'm working on my own project go with Contentful? Also would I still be able to use WordPress plugins if I'm only going to be using WordPress for it's API?</comment></comment>


LinkedIn is now officially blocked in Russia - <AUTHOR> https://techcrunch.com/2016/11/17/linkedin-is-now-officially-blocked-in-russia/ <comment><USER2> Honestly, if LinkedIn disappeared today worldwide, I wouldn't miss it one second. It's really more of a chore than anything else. When you're looking for a job, or looking to recruit, it's helpful, but they haven't made the case of general everyday use, and I doubt they ever will.

<comment><USER3> Last month I had to spend an hour making sure someone hadn't opened a LinkedIn account under my 8 year olds name after his aunt asked us why LinkedIn is suggesting she connect with him. Turned out she had his iCloud email in her contacts because she FaceTimes with him. LinkedIn thought it was OK to use her contact list to make it appear like he had an account there. The bastards found a way to waste my time even though I have no account with them. Humanity would be generally better off without LinkedIn.

<comment><USER4> I assume that LinkedIn has made deals with third party social networks to get the creepy connection suggestions. I'm curious how much $$$ is involved

<comment><USER5> You would be wrong.

It really isn't hard to build PYMK. It's basically just triangle closing on common friends and address book import.

</comment></comment></comment></comment><comment><USER6> I didn't know about this crazy new regulatory requirements until now. Quoting from an article [1] describing the new law:

> "When collecting personal data, including through information and the > internet telecommunications network, the operator is required to provide a > record that the systematization, accumulation, storage, updating and > retrieval of personal data of citizens of the Russian Federation, is held on > databases located in the territory of the Russian Federation."

I could imagine that complying to this regulation wont be worthwhile for most companies.

Edit: The interesting thing is, that the law seems not to forbid to store the data outside of Russia, it "just" dictates that the data has to be stored in Russia also.

[1] [https://techcrunch.com/2014/07/02/russia-moves-to-ban- online...](https://techcrunch.com/2014/07/02/russia-moves-to-ban-online- services-that-dont-store-personal-data-in-russia/)

<comment><USER7> At the end of the day, creating many of these services is trivial. Creating a LinkedIn clone is trivial, and one will pop up in Russia giving some Russian owners profit and creating jobs for Russians. So how it's bad for the Russian economy, or the economy of any country to do this, is beyond me. On the other hand, dictatorships and capitalist democracies love to gather as much information as they can on their citizens, so it will allow Russians to get more information on their citizens. Which may be bad for some of them.

<comment><USER8> It's not about the economy, it's about control. Give them control or get out. Eventually the only companies left are those that will acquiesce to Russian demands.

<comment><USER9> From how I understanding "Russian state philosophy" (if there's such a thing) I'd even intuitively assume they're not necessarily _primarily_ interested in gathering everything-about-everyone but in ensuring no other party (especially private western/multinational corps) gain potentially such an information advantage over them. We've arrived in an age when non-sovereign entities can gain leverage over sovereign entities and thus become "geopolitical players", to be "reckoned with".

<comment><USER10> That's my understanding of it, also. Just the other day I was discussing with a work colleague about what would have happened had FB not been blocked in China almost from the very beginning. Imagine all the Chinese' people data sitting on a server a couple of keystrokes away from entities like the NSA. Our example, made half-jokingly, was something along the lines of: "Imagine how much information you can gain just by tracking the GPS positions of the personal secretaries attached to important Chinese Communist Party power figures".

</comment></comment></comment></comment></comment><comment><USER11> Worth noticing that court blocked only HTTP version "[http://www.linkedin.com/"](http://www.linkedin.com/"), HTTPS works just fine :)

However some providers, who had no smart hardware, may block by IP instead of URL, and https version will be blocked as well (not my case).

<comment><USER12> Already not true as of 2016-11-18 10:50 MSK. All protocols/ports should be blocked by ISP's for both www and apex.

</comment></comment><comment><USER13> As a Russian citizen, I used LinkedIn heavily to find jobs in Europe (along with stackoverflow.com/jobs). I keep a lot of contacts there (e.g. former colleagues and European recruiters, some of them are very helpful).

I found it's alarming that LinkedIn is blocked in Russia. Blocking LinkedIn significantly reduces chances to find a job in Europe.

But I expected that since I watched closely on new laws restricting internet freedom in Russia.

Official motivation behind this law is to prevent US spying on Russian citizens (this law was proposed after Snowden's scandal).

Of course, this motivation was a lie as everything else which came out of dirty rotten mouths of nasty Kremlin bastards.

The real motivation is that the Kremlin loves to spy on its own citizens. And they already did that for a long time.

The problem is that these anti-freedom laws do bother only very small percentage of Russians. The rest of Russia won't even notice if Kremlin completely shuts down access to the global internet. Heck, the majority of Russians doesn't even bother to learn _elementary_ English!

 _Stupid_ people buy everything Kremlin tells them, including version about protecting Russian citizens from US NSA.

The general principle is that any government is constantly trying to expand itself and limit citizen's freedoms. The only force which can prevent government from endlessly limiting citizen's freedoms is the majority of citizens (definitely not a minority of non-rich citizens). Every freedom above what masses asking for is only at mercy of the government's bueracrats.

It means that in absolutely any country _masses_ fully deserve their government.

I wrote more details about this principle here:

[https://www.quora.com/Why-do-people-living-in- totalitarian-s...](https://www.quora.com/Why-do-people-living-in-totalitarian- states-love-their-dictators-1/answer/Eldar-Gaynetdinov?srid=xsEM)

So I consider myself as a part of absolute tiny minority of Russian citizens which has no voice at all (thanks to backward masses).

That's why I left Russia and I hope forever!

I think LinkedIn could be unblocked if LinkedIn agrees to meet these crazy requirements. Even if LinkedIn would be unblocked, it won't change sad state of freedoms in Russia.

P.S. I hope to get rid of _toxic_ Russian citizenship in the future.

<comment><USER14> > That's why I left Russia and I hope forever!

> dirty rotten mouths of nasty Kremlin bastards

> Heck, the majority of Russians doesn't even bother to learn elementary > English!

> Stupid people buy everything Kremlin tells them, including version about > protecting Russian citizens from US NSA.

> thanks to backward masses

> P.S. I hope to get rid of toxic Russian citizenship in the future.

I think the only thing toxic here is how you write and view other humans and your fellow countrymen as inferior beings.

I have no Russian heritage, but I lived in rural cities around Russia for a year and was there another 6 months in Moscow after Russia invaded Ukraine. Russia is definitely much different from the Western world and there are a lot of things I disagree with, but I would never call anyone stupid for supporting Putin or the government.

Calling folks stupid and backward for supporting stuff you dont support is just you thinking you are better than everyone else when you are not. Don't be a dick because some people are less fortunate than you and didn't have an opportunity to learn critical thinking. Even people much smarter than you might support what you don't like. The world isn't black and white.

You are in for a rude awakening if you believe that other governments don't lie to their citizens. Whatever government you currently support and get your new citizenship from, you are a pawn and part of the "backward masses" for whatever fucked up scheme that government is cooking up to screw you over.

<comment><USER13> This majority is totally fine to imprison unwanted minorities. This majority is totally fine to restrict my freedoms. This majority thinks they are right _because they are majority_.

So in short, the majority asks me to sacrifice myself for their sake because I'm in minority and they are in majority.

If so, f##k them!

P.S. [https://en.wikipedia.org/wiki/Atlas_Shrugged](https://en.wikipedia.org/wiki/Atlas_Shrugged)

<comment><USER15> That's how democracy works. Are you against democracy?

<comment><USER16> Yes. Any thinking person should be against democracy in the sense of "any time we can get one vote over 50% for something we should pass the something".

This is why the US government was set up with various undemocratic features. This is why there are things like constitutions that require supermajorities to modify.

Protecting minorities from the tyranny of the majority is one of the main purposes of good governmenance.

<comment><USER15> Yeah, thats why Trump won with minority of votes. Just as you like. And i like it too!

<comment><USER17> The US isn't even a democracy so it doesn't really apply, does it? He'd not have won in a democracy.

Democracy screws folks over very easily.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Please block as many services as possible in Russia, it will motivate our people to change government (by force, maybe) faster.

<comment><USER19> Similarly, please continue to leak as many illegal activities of the United States government as possible, it will motivate our people to change government (by force, maybe) faster.

</comment></comment><comment><USER20> That was quick - it's already not accessible from Megafon cellular networks.

LinkedIn is quite popular among international HRs hiring software developers in Russia. HRs may still have access, but the workforce now does not. What was the point not to comply with regulatory requirements? Too small market? Too hard to throw some user data to a server in some Moscow datacenter for persistent storage?

<comment><USER21> Risk of leaking of databases, which are vital for their business, is too high, IMHO. Did you remember closed government databases, with private information, written on CD and sold at Gorbushka for pennies?

<comment><USER20> That risk isn't bigger than anywhere else since we are talking about private company really concerned about security. How many leaks were there through government channels from Mail.ru Group or Yandex? None, and the reason is that, given all necessary security measures taken, you cannot just copy such a database to CD. The access will be limited to few well-paid people in IT Ops, the database can be secured using a solution certified by FSB (and even if FSB will hack it, these guys do not expose themselves by selling CDs on Gorbushka).

<comment><USER21> AFAIK, you _can_ buy mail.ru databases[1]. Quote:

«A vendor going by the online handle of "saul_berenson" is selling 57 million Mail.ru accounts on darknet in BTC 1.0000 (628.78 US Dollar).

The sold data includes emails and MD5 passwords of Mail.ru users. According to the seller, "these passwords are very easy to crack." Remember Mail.ru was hacked twice, one in July and August 2016 when 27 million accounts were stolen and before that in May 2016 when 57 million accounts were stolen. We suspect that the stolen data is from May 2016 breach.

Yandex is another Russian Internet giant serving as the country's largest search engine and like Mail.ru the corporation has been under attack by hackers numerous times. However, now, a vendor is selling 6.5 million Yandex accounts containing emails and passwords. The total number of sold accounts is 659,5756 with both hashed and clear-text passwords.»

The whole idea of an government operation, like that, is to put finger first, then whole hand. When data will be in Russia, government will demand 24x7 access to it. Then data will be copied somewhere, then sold.

[1] [https://www.hackread.com/utorrent-forum-mailru-yandex- data-d...](https://www.hackread.com/utorrent-forum-mailru-yandex-data- darknet/)

<comment><USER22> > selling 57 million Mail.ru accounts

Seriously? I can give you free access to credentials from 164,611,595 LinkedIn accounts right now. This data has been copied and sold many times over with zero help from any government.

</comment></comment></comment></comment></comment><comment><USER23> From Russia, can confirm. Finally roscomnadzor is preventing spam!

<comment><USER24> Unfortunatly, I still receieve emails from linkedin...

</comment></comment><comment><USER25> LinkedIn didn't just "get blocked" out of the blue. They got blocked after many warnings and plenty of time during which they refused to take basic steps to comply with the laws of a sovereign nation. Just set up some servers in a Russian datacenter and be done with it! But instead they blew it off, or created the impression of blowing it off, by going running to the Russian bureaucrats on the last day -- as if the whole thing were a big surprise!

If you wanted to insult them, show them you didn't take them seriously and didn't make a plan to comply with their laws, I can't think of a better way to do it than going to them on the last day to ask for more time. If I were those bureaucrats I would take especial relish in cutting them off. (And that's aside from the fact that it's a worthless site in the first place.)

Sometimes when you get Tased it's because of crooked cops, but most of the time it's because you're being an ass, disregarding the laws of the people, despite many warnings, and not taking simple steps to comply.

<comment><USER26> LinkedIn denied to play by rules of idiots. Shame on Google etc who supports and promotes censorship by accepting the rules of censorship. Internet ends when every country will start to force everyone else to do what they think is good.

</comment></comment><comment><USER27> Russia likes to copy EU strategies and uses them for other purposes. For example, the EU and its members really like to go after US companies for privacy protection. This is usually a good thing for the consumers, but can feel like a targeted attack to the US companies in question.

However, when the Russian Federation does - on the surface - almost the same thing, it suddenly has a very different impact...

<comment><USER28> so you say if Europe does something, it's good. If Russia does the same thing, it's bad, because it's Russia. OK.

<comment><USER27> Putin likes to make it look that way, yes. And on the surface it does. Beneath the surface, there are lots of important differences.

The EU doesn't block websites. It doesn't control the media. It ensures freedom of speech. It makes it possible even for US companies to do business in the EU, without the fear that their servers are seized whenever some corrupt regime decides to. The EU doesn't go after dissidents... and the list goes on and on...

<comment><USER12> Why does then wikipedia have articles with lists of websites blocked in different EU countries?

</comment></comment></comment></comment><comment><USER29> It still blows my mind that people are on linkedin. If you are not a recruiter/hiring manager it's only real purpose (that I can see) is to be a boasting board for achievements and a easy to ignore place to receive recruiting emails.

Does anyone get any other value out of it?

<comment><USER30> "receive recruiting emails"

That's pretty much it, right? That, and very easy job applications. Nowhere have I had an easier time applying for a job.

</comment></comment><comment><USER31> "We wanted as good as possible, but it turned out as always" Viktor Chernomyrdin, Russian politician

The law itself is more or less reasonable, but very poorly done and applied, like almost all recent Russian internet laws.

</comment><comment><USER32> >'It's not clear why LinkedIn — which has out of its 467 million users, only 5 million registered in Russia — was targeted in this case. '

Probably because they keep getting fucking hacked: [http://www.wired.co.uk/article/linkedin-data-breach-find- out...](http://www.wired.co.uk/article/linkedin-data-breach-find-out-included)

And Russia is tired of Russians getting fucked by shitty American software engineers.

</comment><comment><USER33> It seems like a reasonable requirement. If you want to do business there, then setup a data center and store data there.

<comment><USER26> Internet ends when every country will start to force everyone else to do what they think is good. In digital world physical geo-location doesn't matter unless you want to fool someone. You can store data in Russia but give access to it to CIA. You can store data in USA but make it impossible to access by CIA.

</comment></comment><comment><USER34> My friend. We use ВКонтакте for everything.

<comment><USER35> I'm not in Russia but I can pretty much confirm this. It feels like the number of reposts on VK containing videos from small companies asking for referrals to fill positions has almost quadrupled in last several months. I guess it's working out quite well.

</comment></comment><comment><USER36> Well I went to see if there was any news on this for an Australian, and all I found when I logged into LinkedIn was this advice regarding "restricting" my account from use:

[http://imgur.com/a/VOBQV](http://imgur.com/a/VOBQV)

I haven't sent out a direct message or "added" anyone in months, and the only recently posted content was this blog:

[https://lolware.net/2016/11/17/requesting_bank_login.html](https://lolware.net/2016/11/17/requesting_bank_login.html)

Despite not being able to log in, I've received two separate emails from them. I have a feeling I'll be letting LinkedIn go.

</comment><comment><USER37> > Amid a tense stand-off and attempt at negotiations, Russia's communications > regulator Roskomnadzor has started to enforce a proposed block of LinkedIn > in the country, after the social network failed to transfer Russian user > data to servers located in the country, violating a law instituted in Russia > requiring all online sites to store personal data on national servers.

Not the worst rationale. Keep in mind that countries such as Canada and EU countries also have different privacy laws that US corporations have ran afoul of from time to time.

</comment><comment><USER38> Given how LinkedIn works [0], it doesn't appear too bad.

[0] [https://news.ycombinator.com/item?id=11063178](https://news.ycombinator.com/item?id=11063178)

</comment><comment><USER39> I feel like LinkedIn will find a way in. They're the terminator of social networks

</comment><comment><USER40> A similar law is about to pass in my country and we are 15 weeks away from elections. I believe the targets are FB and Twitter.

So what is my best bet to rollout a Twitter clone fast and host it in-house? Impossible?

<comment><USER41> The magic of Facebook, Twitter, etc are not the technologies. Sure, as they grow, they need more elegant than off-the-shelf solutions. But hacking together a Twitter clone in a week is the easy part - getting people to use it, building a community, etc, is the hard part.

<comment><USER42> The hardest part is that once your Twitter clone functions well enough to replace Twitter it will be banned just the same.

<comment><USER40> Unless I can do it sans central server, web torrent maybe? Any ideas?

<comment><USER43> The only effective solution I can think of is Tor, but then you automatically lose probably >99% of users. Everything else can be blocked easily.

</comment></comment></comment></comment></comment><comment><USER44> Career has arrived? You must construct additional Tor-Nodes!

<comment><USER45> We require more vespene cash.

</comment></comment><comment><USER46> Great! Maybe now I'll stop getting spam connect requests from all these Russians I don't even know...

</comment><comment><USER47> Isn't this basically a protectionism move designed to strengthen local social networks?

</comment><comment><USER48> It should be blocked everywhere :)

</comment><comment><USER49> Lucky bastards.

/s

</comment><comment><USER50> I'm sure this has nothing to do with recent articles detailing how Russian FSB agents successfully use LinkedIn to find, contact, groom, and network with potential sources and agents on Wall Street.

</comment><comment><USER51> I wonder, where is Snowden now? What has he to say about it? Has he ever spoken anything against the oppression done by the Russian govt?

We should be asking him tough questions, not just joining in praising him to be some sort of hero, who is cozying up with criminals in Kremlin.

<comment><USER52> _Has he ever spoken anything against the oppression done by the Russian govt?_

If you'd bothered to look up, you'd know he has.</comment></comment>


Heroku and App Deployment - <AUTHOR> http://pulakonline.com/

<comment><AUTHOR> I attended a cloud training at my office recently for basic understandings of cloud & the training was really an eye opener for me in the cloud world. Further, I am involved in a POC project where we are deploying our node- express application in Heroku. So I thought of penning down my learnings in this article.</comment>