HTTPS on Your Landing Page Is Important - <AUTHOR> https://www.troyhunt.com/im-sorry-you-feel-this-way-natwest-but-https-on-your-landing-page-is-important/ <comment><USER2> Another lesson is to always host the login section on a sub domain of the company which website you visit. A prime example not to follow is Citibank in Europe. My account is with citibank.co.uk, but when I login to my account I get redirected to online.citi.eu. How do I know that citi.eu belongs to Citibank? I have no relationship with citi.eu, that's not the website I visited. How do I know I can trust it?

Microsoft is another major offender. When logging in, I get redirected 20 times between various domains, none of which in microsoft.com

<comment><USER3> Microsoft's sign in is a real mess, I think in part due to having to make your hotmail login that you made 15 years ago still work, along with the dozens of other services that MS has acquired or integrated.

I've had a real shitter of a time trying to login before, with redirect loops, or getting automatically signed out as soon as I sign in. Or accounts being a "games for Windows" account, but not an MS account, or an Xbox live account, so some other account. Often I've just found it easier to give up and make a new account.

<comment><USER4> Speaking of Microsoft's signin, I can no longer access my decade-old-held Skype since their SSO integration. I've tried over and over and over and tried every route possible. It is some edge case where the email was previously a microsoft account and the password cannot be reset. I'm not the only one with the issue. Shocking something like this doesnt get resolved for years on.

<comment><USER5> Authentication in Skype is awful. At one point, for reasons beyond me, I ended up having two accounts:

* One account required me to log in with a username, and was associated with my main email address. * The other account required me to log in with my main email address.

In a way, they were both related to the same email, but different accounts. This shouldn't even have been possible, but it seems that one was an old MS account, and the other was an old Skype account. My roster ended up being split half and half between the two.

</comment></comment></comment></comment><comment><USER6> It's 2017, and my social media account is protected by a tamper-proof phish- resistant embedded-encryption U2F microcontroller dongle, in addition to a password of virtually unlimited length and charset. Meanwhile, my bank has a max password length of 12 and I can only use an alphabet of roughly 64 characters.

The future is here folks. And it sucks.

<comment><USER7> Guess what! If your financial service restricts your password to letters and numbers, it's most likely because they want you to be able to enter your password on the phone.

So the passwords 'abc' 'ABC' and '222' are treated as equivalent. Try it out for fun!

<comment><USER8> I don't want to enter my password on the phone, I have fingerprint or pin in mobile banking app.

<comment><USER9> He meant over the phone, not on a phone.

Ex : I call my bank and I have to go through a menu leading me to the right agent. Eventually, it asks for my password over the phone that I need to type using the 10 numbers on a phone dial.

Good luck using your fingerprint there :)

<comment><USER8> For that i have separate numeric only password in my bank which is different than my web login password. So bank is saving couple of bucks to reuse same weak password that can be stolen on web and then used by attacker to authenticate as me over the phone. What a crappy bank. I am just happy that bank that I use is having all set better.

</comment></comment></comment></comment></comment><comment><USER10> About 8 years ago Natwest had a policy of having a "browser whitelist" which was rarely updated. Each time a security update for chrome or firefox came out it would be 2 weeks before online banking was accessible, and using any pre- release versions were out of the question.

I complained and a member of the dev team phoned me up and after a long discussion about why this was madness he told me that it was better to use older browsers for important things such as online banking (like IE6 which was in their whitelist) because they're tried and tested.

<comment><USER11> Reminiscent of Amex's password policy (at least what it was a few years ago): can't use punctuation in your password, because those keys are less frequently used, and using them frequently in passwords will cause visible wear on the keys, indicating to an attacker with physical access to your keyboard which punctuation characters are in your password. Trying so hard, but failing so badly.

<comment><USER3> "we require passwords to be a maximum of 8 characters, because if they were longer, people would forget them, and would have to write them down"

I'm sure that has been said by some manager somewhere.

<comment><USER12> Not that it's an excuse, but I've personally seen many "technology averse" people struggle with the changing "rules" about passwords.

When they started using computers, they were taught to NEVER write your password down and to do things like replace letters like I with numbers like 1 for security.

Not only are those not true any more, but the opposite is recommended. Making a unique LONG password is much more important, and writing it down on a sticky note next to your monitor is arguably more secure from some threats than even something like LastPass.

<comment><USER11> Well a lack of rules (but a list of recommendations, perhaps) would be a solution there, not a maximum of 8 characters. Maximum password lengths just screams out to me that they're not hashing and just storing passwords directly in a database with a fixed-size column for passwords.

<comment><USER12> Oh I absolutely 100% agree, I just wanted to point out that sometimes a lot of these seemingly crazy reasons come from somewhere, and that as developers that might work with product managers like this, it's our job to help teach them.

But maximum lengths (that aren't measured in kb) are a monumentally stupid thing, as are most other password "rules" (No, disallowing words in your password is not a good idea...)

Provide a minimum length, and check passwords against common password lists, and use a damn good hashing algorithm with a process in place to easily allow upgrading that hash.

</comment></comment></comment></comment></comment></comment><comment><USER3> A bit side topic:

It seems that every time Troy interacts with a company on Twitter, they never seem to click on to who he is, until it's probably too late and they look like fools.

It's just so amusing to see companies trying to condescend to Troy, when he's one of the most visible authorities on web security on the planet (not necessarily the most authoritative, but the most well known).

I occasionally get this when people try talking to me about computer science topics, when they don't realise that it's what I do for a living. I've probably done the same myself when talking to Doctors and other domain experts, I'm sure.

<comment><USER13> This being NatWest the penny probably still hasn't dropped, and they're probably trying to get him arrested for "hacking our internet". I doubt they'll actually implement a change. The general approach in the UK has been to not blame banks at all for poor security, and to punish anyone who finds a security issue severely.

<comment><USER14> NatWest are particularly terrible. Last time I checked, in-branch they were still using Internet Explorer to visit an http (not https) site on their intranet to launch via Java Web Start a thin client to log in to their (I assume) mainframe to actually do things.

There's a number of places in that chain of events that something could go nastily wrong, despite them owning every part of that chain.

<comment><USER15> I was in branch the other week and they were doing exactly that... from Windows XP. Staff member told me they were upgrading to Windows 10 soon and they couldn't wait.

</comment></comment></comment></comment><comment><USER16> Probably not a good person to piss off.

Several months ago I recall a website owner posted a bug to Firefox saying he didn't need HTTPs and that Firefox shouldn't tell users it's insecure. Within hours his database was pwned.

<comment><USER17> Are you suggesting that Troy Hunt is involved in illegal pentesting ( pwning their db )? I really doubt that. He is an industry professional.

The problem is not pissing off Troy Hunt; but more that they are advertising that their website is vulnerable and that they don't care.

<comment><USER18> I think it was more that Troy Hunt is incredibly high-profile in the security arena. If he blogs that your site security sucks, some of his readers will prove it.

</comment></comment></comment><comment><USER19> That edit, about NatWest buying up the example domain to "fix" the problem, gave me real good laugh. It's interesting how simple mindedness can be so unexpectedly expected.

<comment><USER20> Actually that is a smart thing to do in it's own right, as long as they quickly move to https.

<comment> yjftsjthsd-h Not even predicated on HTTPS; owning more domains helps combat some obvious forms of fraud. Though, really, I agree that HTTPS is more important.

<comment><USER20> > Not even predicated on HTTPS

Sorry that's what I meant. Both moves are smart. Doing both is smartest.

</comment></comment></comment></comment><comment><USER21> I'm not really surprised, UK banks are absolutely terrible in terms of their product and even worse in supporting clients having valid points. Another example would be MetroBank that recently changed password prompt to a masked password prompt (in addition to already existing masked PIN alongside) ignoring the research proving its a horrible user experience and in fact lowers the security or (not a bank, but still major company) Three mobile provider that asks your for your password while calling in for support. You heard it right, support representative asks you for your password to verify you are the account holder. There is no other way and no amount of explaining that it's insane and won't happen till I'm conscious was able to convince them to stop.

<comment><USER22> > Three mobile provider that asks your for your password while calling in for > support

When I got a new nano-SIM (in 2012, one hopes they've changed this since), they didn't check any ID and only needed a postcode and date of birth to move my account to a new SIM.

<comment><USER23> When I went in a couple of months ago to do the same thing (_slightly_ more complicated situation - I had two accounts but only one SIM card and had topped up the wrong account), the store manager told me he couldn't help me and handed me their store phone dialled to their call centre (!).

The man on the other end of the phone was totally unable to solve my problem and in the end just gave me £10 of free credit on the account I'd meant to top up. He didn't ask for any ID or verification at any point, except for the serial number on the SIM card. It was a pretty bizarre customer service experience.

</comment></comment></comment><comment><USER24> That feeling when you're arguing with an idiot, and the idiot isn't listening because he thinks it's YOU who's missing the point.

<comment><USER25> The important thing for all of us to remember, is that in any given conversation _we_ may be idiot.

Until I'm sure the other person doesn't know what they're talking about, I try and assume they're right.

<comment><USER26> > The important thing for all of us to remember, is that in any given > conversation we may be idiot.

Alternative take, particularly pertinent to this situation:

The person handling twitter is _not_ a technical person, but a customer support person who handles hundreds of dumb questions, day in, day out, from customers who have no clue what they're doing but will often throw technical terms around.

Expecting solid technical answers from a general twitter account for a business is beyond absurd.

<comment><USER27> The only expectation was an escalation.

</comment></comment></comment></comment><comment><USER28> >you could go register nuuolb.com right now

Not anymore!

[https://www.whois.com/whois/nuuolb.com](https://www.whois.com/whois/nuuolb.com)

It seems NatWest has quickly gone to secure this major attack point in their otherwise chink-free armour. Does someone want to inform them about nwalb.com as well?

<comment><USER29> Gives me an idea! Why not go buy up a bunch of these types of names then tell them that they look similar to their login url. THEN when they come to try to buy it they find you own it and then charge them an arm and a leg for the domain?!

<comment><USER30> That's typosquatting and it's not very ethical. It's also in a grey legal zone, you might get sued for this.

So I would advise you not to do it.

<comment><USER31> Do you have any examples of "You might get sued for this"?

<comment><USER32> There is the horrible example of the nice computer company that had called itself by a certain name. [1] They registered their domain in good faith and conducted business. Later, a multi-million dollar car company decided they wanted the domain for the name they choose after Datsun and lawyered up on the mom-and-pop computer company.

1: [http://nissan.com/](http://nissan.com/)

<comment><USER3> Well they've made the most of their situation by putting ads on the page.

I can also get "complex web design" for $100 per hour from them. Judging by the quality of that site, I might pass.

<comment><USER27> It's an old site, looks like an old site, and only recently (last 5 years or so) started running ads. It has been 15 years since the lawsuit was first filed.

<comment><USER3> It says copyright 2016 on it...

<comment><USER33> No, it says "Copyright © 1994-2016 Nissan.com". The layout and copyright indicates it was probably created ~20 odd years ago, and hasn't received significant updates in years.

The "2016" likely means they do minor/trivial updates now and again. Maybe it'll get a "2018" in the next 6 months or so too... :)

<comment><USER34> Shhh... don't tell them about `new Date()`

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER35> A great example for why we (the Google Web Developer Relations team) advocate for HTTPS everywhere.

[https://developers.google.com/web/fundamentals/security/encr...](https://developers.google.com/web/fundamentals/security/encrypt- in-transit/why-https)

<comment><USER36> Why is it you (or someone there) chose "Secure" in the address bar rather than something like "Private"? It seems like the people who don't understand what httpS means at all see "Secure" and think "oh this site is safe/secure" no matter what this site is, like if it's a phishing site. I'm not one to be very pedantic, but "Secure" up there really doesn't mean "Secure" at all. I know what it means, but people falling for dangerous sites don't get that at all. I don't really know what the best word is, but "Secure" seems like not the best choice there.

[Edit] Thank you to those people who had some honest replies, not sure why this got down voted, it was an honest question. When you go to the "Learn More" page on Chrome it doesn't even say "Secure" it says "Information you send or get through the site is private."

<comment><USER35> Words are hard. Anyone got an idea for a better word? Send your ideas to the security-dev mailing list (at least, I think that's the best forum...): [https://groups.google.com/a/chromium.org/forum/#!forum/secur...](https://groups.google.com/a/chromium.org/forum/#!forum/security- dev)

<comment><USER37> How about all it really means? "Encrypted"

<comment><USER38> HTTPS means more than just encryption. There is also authentication and integrity guarantees in SSL.

<comment><USER32> But the extras beyond encryption are definately not guarantees. [1] HTTPS means encrypted HTTP. Everything else is "I trust the certificate authority to provide oversight and verification." It may just be me, but I don't trust the fine, upstanding CAs we have now-a-days. 1: [https://stripe.ian.sh/](https://stripe.ian.sh/)

<comment><USER38> Authenticity indeed is only guaranteed if you trust the CAs. Though it is still nice to know that getting a false cert isn't trivial.

However, message integrity is a real benefit of SSL that doesn't need CAs. Consider the original article. In this case encryption doesn't matter and integrity does.

Without message integrity, considering the login link has a known location and value, using bit-flips one might be able to change the login link (depending on the kind of encryption used).

This message integrity is getting to be a much more important part of https. There are a lot of things that you don't want other parties able to change. Maybe even more things than you don't want them to be able to read.

</comment></comment></comment></comment></comment></comment></comment><comment><USER39> Fun story, my once CC provider (the now defunct "Egg") for a period responded with three A records for their main site (egg.com or something).

This is fine, except one of these A records was a 192.168.x.x address so their site didn't work intermittently.

I called them to report it and they refused to listen. Claimed the site was worked as intended from their office and they wouldn't escalate.

</comment><comment><USER40> Anyone want to hear a joke? Go to the financial ombudsman homepage [1]...

Bare in mind, on their complaints page you can download a complaints Word document, fully capable of having embedded VB script [2].

Also, it took them _months_ to sort out an issue where they would only check for 3 numbers (pin) and 3 letters (password), always asking for the first, second and third characters.

Also-also, I remember a while back not being able to access my card (for about a day) because a single engineer accidentally corrupted their main database.

[1] [http://financial-ombudsman.org.uk](http://financial-ombudsman.org.uk)

[2] [http://financial- ombudsman.org.uk/consumer/complaints.htm](http://financial- ombudsman.org.uk/consumer/complaints.htm)

</comment><comment><USER30> Maybe someday browsers won't accept http connections by default (except for a few domaines defined for test purpose, or for some specific tld like .local)

Only then we can have 100% of the web encrypted.

<comment><AUTHOR> It's moving that direction. As it stands, any website can opt-in to this behavior for future visitors with HSTS[0], or even for first time visitors with HSTS preload[1]. And Google has been doing HSTS preload on their .google TLD for several years, and recently rolled it out to their .foo and .dev [2] TLDs

[0] [https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)

[1] [https://hstspreload.org/](https://hstspreload.org/)

[2] [https://security.googleblog.com/2017/09/broadening-hsts- to-s...](https://security.googleblog.com/2017/09/broadening-hsts-to-secure- more-of-web.html)

<comment><USER41> I was excited until I realized that HSTS Preload is just a hardcoded list in the Chrome source!? Ugh, that's sort of disappointing :(

Couldn't something like a TXT record also address this, but on a cross-client, scalable fashion? Like how SMTP with SPF or DKIM works right now.

(And yes, I know DNS also has trust problems!)

At the very worst, a central, programmatic source of truth, like DNSBL and company... just like how Google offers their "malware sites" hash table for all to use.

<comment><USER42> Using a TXT record for this purpose would achieve nothing. Just like an SSLStrip attack would strip [https://](https://) links and redirects, an attacker can simply block or spoof the DNS response. This doesn't add anything that you don't get with regular header-based HSTS.

DNSSEC has no practical impact on this due to a lack of adoption both on the domain and end-user resolver side. (Not to mention that it's a terrible protocol.)

Note that the HSTS preload list is not only used by Chrome, but practically all major browsers. For all intents and purposes it currently is the central source of truth. I imagine if the size ever becomes a problem, browsers will switch to a mechanism like Safe Browsing to distribute the list.

</comment></comment></comment></comment><comment><USER43> Well, the bank seems to be stuck in the past...

10 years ago it was best practice for ecommerce shops to serve non sensitive pages (pages without forms or user data) without HTTPS to reduce the server load (HTTPS connections are a little more expensive than HTTP).

Nowadays, even the economical driven ecommerce shops got it that is better to just serve everything via HTTPS. It is very sad to see a bank (which should really know better) arguing that way.

<comment><USER44> In the UK there are major ecommerce sites still on HTTP.

<comment><USER45> Major sites, really?

<comment><USER44> marksandspencer.com very.co.uk asos.com next.co.uk

and many more.

<comment><USER46> Other than shopping privacy, who cares? As long as the checkout and account management pages are https, then I don't see the big issue here.

I'm just not one of these people who think there are armies of people at the NSA/GCHQ spying on me. I'm also against forcing every website in the world onto https. Doing so will significantly raise the bar of accessibility for tinkerers and makers. If I had a webcam that showed the world whether my coffee put needed refilling[1], are we all saying (on this thread, and troy hunt) that it needs serving over https because the privacy and security of coffee watchers is such a closely guarded secret that they need to be secure in their coffee pot watching habit?

By all means, https up important pages and sites, but lets not make it mandatory to the extent that http is no longer supported by browsers.

As an aside... a Barclays bank advert running in the UK at the moment is showing users that 'a padlock in your browser bar ensures that you are safe and that the site you are visiting is who you think it is' \- which is utter bullshit, all a padlock tells you is that site owner has spent 5 minutes setting up LetsEncrypt - it in NO way confirms that they are who they say they are, and it's this lie that Joe Public are being sold right now.

\---

[1] Apparently this was a thing once ;)

<comment><USER47> > As long as the checkout and account management pages are https, then I don't > see the big issue here.

How do you arrive at the checkout and account management pages? By clicking on a link. If the whole site isn't encrypted, the link can be modified to point to false checkout and account management pages. HTTPS is not only for privacy, it's also for integrity.

<comment><USER46> How far do you go down the chain? At some point you'll hit a layer that the internet has no control over - the users machine. You can https every page on every site if you want, but if the users machine is compromised, then it's not going to help one bit.

ALL https says is 'hey i'm encrypted' it doesn't PROVE to the end user that it's really who it says it is. Extended Validation was supposed to fix this, but that ended up as an evil money grabbing exercise by the CAs so that didn't get the adoption it needed.

Until there's a secure validation banner at the top of the browsers that contains an unfakeable and unbreakable 'this is who I am' statement, then https is just a sticking plaster/bandaid over the whole problem.

And for those who say 'https prevents man in the middle attacks' \- no it does not. There are several network level devices that by design decrypt/review/encrypt/spoof-cert traffic to clients (WAN Accelerators and Corporate Proxies being good examples) something that can only be overcome by Security Pinning the Certs to IP addresses... but again hardly anyone does that either.

<comment><USER47> > And for those who say 'https prevents man in the middle attacks' \- no it > does not. There are several network level devices that by design > decrypt/review/encrypt/spoof-cert traffic to clients

These network devices (middleboxes) can do that only if the client lets it. As you just said, once the client is compromised, all bets are off. HTTPS by design protects against a compromised network, not against a compromised client.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER48> Natwest is RBS - there is no point interacting with them - useless. Same with many UK household names, once they reach a certain size you are not a person and what's in your head is of no interest to anyone.

<comment><USER44> This can, sometimes, work in you favour though since it is possible to get a county court judgement against these organisations for trivial reasons because the original claim isn't responded to.

</comment></comment><comment><USER49> > Alarmingly though, nw0lb.com is still available as is nuu0lb.com and it- > doesnt-matter-because-that-isnt-the-point.com.

I can just imagine NatWest: "Oh, is that the problem? Ah, ok, well, let's just go get that domain then. Sorted!"

</comment><comment><USER20> A Bank! There is no excuse.

The thing about domains is that so many companies register companyname- someotherwords.com for legitimate use that if you are suspicious about the domain name you'll get little done. Azure is a case in point.

What if browsers record "tainted follows"? E.g. you visit http. Once you click a link, anything linked from there onwards is not trusted. No http post information is sent to the server without a hard to get around warning page.

</comment><comment><USER50> Monzo [1], Starling [2], Atom [3] and Tandem [4] all manage to have HTTPS landing pages. If they can, there isn't any excuse for the more established banks not to as well. Hopefully their mobile apps use HTTPS for everything too?

Apparently 35% of all UK banks have insecure landing pages. [5][6]

[1] [https://monzo.com](https://monzo.com)

[2] [https://www.starlingbank.com](https://www.starlingbank.com)

[3] [https://www.atombank.co.uk](https://www.atombank.co.uk)

[4] [https://www.tandem.co.uk](https://www.tandem.co.uk)

[5] [http://blog.softwareverify.com/list-of-uk-banks-that-are- sec...](http://blog.softwareverify.com/list-of-uk-banks-that-are-secure-by- default/)

[6] [https://twitter.com/softwareverify/status/940961044633149440](https://twitter.com/softwareverify/status/940961044633149440)

<comment><USER14> > Hopefully their mobile apps use HTTPS for everything too?

Well, HSBC's didn't: [https://threatpost.com/banking-apps-found-vulnerable-to- mitm...](https://threatpost.com/banking-apps-found-vulnerable-to-mitm- attacks/129105/)

</comment></comment><comment><USER51> I think the main point is to explain this kind of issue to non tech people.

A bit of programming, but most importantly, general concepts required to understand this kind of issue should be common knowledge.

For me it falls in the same category as the people putting an IP camera to watch their son sleep and broadcasting it to the whole internet. This kind of issue should be understood by them.

In this case, if the "banking manager" was aware of how security works, the issue would not have presented itself in the first place.

</comment><comment><USER52> NatWest is also guilty of storing passwords in plain text: their login page says 'enter the 5th, 8th and 12th character of your password'

<comment><USER53> Who's to say they haven't just hashed each individual character of the password?

<comment><USER52> Does that offer any real protection? I could try each possible character until I find the hash.

<comment><USER54> You are correct. He was joking

</comment></comment></comment></comment><comment><USER55> The fact that there is no HTTPs on a brand's landing page is no reason to annoy PR dudes on twitter though.

I think the attitude here is kind of douche.

</comment><comment><USER56> There need to be a public directory for these websites. Something similar to [https://haveibeenpwned.com/](https://haveibeenpwned.com/). Something like is- this-site-stupid.com.

Ridiculous password policy, http home page, virtual keyboard for password, loading javascript from http and what not..

<comment><USER57> Perhaps something like [https://securethe.news/sites/](https://securethe.news/sites/) but for every website, not just news sites?

<comment><USER56> Thanks for the link! Yes, would love to have one for every website. And visitor can input a website for "stupidness"

</comment></comment></comment><comment><USER58> What's concerning here is that they could have easily bought a certificate and configured it to their site.

Instead what they did as preventive measure is to buy the domain name that Troy mentioned as one of the possible vector to spoof their site.

Hate to say this, but whoever made that decision as a course of resolution should be axed.

</comment><comment><USER59> Scotiabank, one of the biggest banks in Canada, has the same issue:

[http://www.scotiabank.com/ca/en/0,,2,00.html](http://www.scotiabank.com/ca/en/0,,2,00.html)

Didn't find any contact to report it. Is Twitter really the right place?

</comment><comment><USER60> Note that [https://personal.natwest.com/](https://personal.natwest.com/) has a valid certificate, but it redirects back to HTTP. :-(

</comment><comment><USER61> Yes, not only your landing page should be getting HTTPS; instead all websites should have had HTTPS already, this will gave the users/customers a sign of safety and trust.

</comment><comment><USER62> I followed out this logic, and concluded that all pages on a site have to be encrypted, because someone may try to navigate to the login page from any page on the site. If the attacker can intercept one page they can lead the user to their own site (possibly even HTTPS, but with the wrong certificate). In a perfect worlds users would always check which certificate they're trusting (and have a plausible way to check who it belongs to) but that is not the real world.

<comment><USER63> Agreed, every page should be encrypted.

And the user shouldn't need to check the certs - if the CAs are trusted (yes there are problems there) then the domain name is enough.

</comment></comment><comment><USER64> A tweet from Troy Hunt is like a telelphone call from Brian Krebs: a sign your day is not going to get better, if you're a company infosec person.

<comment><USER63> Could be worse; could be @taviso.

</comment></comment><comment><USER65> It would be acceptable for your local Chinese food restaurant to serve their landing page without https. But a bank? of all things? A FUCKING BANK?.

</comment><comment><USER66> I wonder how GDPR would change this attitude? If Natwest were to lose some data after May 18 and it was possible to show that they were warned about the problem by a reputable professional, then they are more likely to get fined, one would presume. Maybe this legal liability is what $bigcorp needs

</comment><comment><USER67> I thought we are on "all pages should be HTTPS" since 2010 or something?

<comment><USER63> It looks like some markets have gotten the message more quickly than others.

</comment></comment><comment><USER68> Not defending the practice of not securing your landing page in 2017, but for balance I must say that NatWest has probably the best banking mobile app I've ever used.

</comment><comment><USER69> I'm so glad I bank with Nationwide who seem to do this right.

</comment><comment><USER70> it-doesnt-matter-because-that-isnt-the-point.com

<comment> yjftsjthsd-h What is the point?

<comment><USER71> An insecure page can be MITMed. The landing page is insecure. The links from the landing page to the login page can be redirected by an attacker to go to the attacker's login page. Links on HTTP pages cannot be trusted. NOTHING on HTTP pages can be trusted.

</comment></comment></comment><comment><USER17> What is the exact problem here? Who would be doing a MITM attack on someone and how?

It doesn't seem to matter to me if my ISP is MITM, because someone inside the ISP would need to cause that. If my ISP is forced to MITM by government etc, I am in trouble anyway.

I could see that it could be done by using a bad/spoofed wireless or a public network connection somewhere. That makes sense. I don't do that though; I only use my own secure home network in a wired fashion when accessing my bank account.

If people are able to spoof my network connection, they could interfere with non-https software updates on my machine, which would let them replace the root certs of my browser potentially, in which case https wouldn't matter. Is the assumption here that all software updates on my machine are happening via https and only the bank website is a danger?

My point here is that while I agree what the bank is doing is bad practice, I don't see how it would affect me in any way.

<comment><USER72> Don't think about _you_, think about the layman. Who probably has a WiFi router from 5 years ago with outdated firmware that their ISP can't be bothered patching.

<comment><USER17> The layman clicks on links that say "you have a virus; download this tool to remove it". They then click 'Yes I authorize' to verify that the downloaded program should be allowed to corrupt their machine.

I fail to see how the bank changing their website to HTTPS is going to save the average Joe.

There are so many websites and things that operate over HTTP that make our machines vulnerable, that I think it is foolishness to use a link that could be MITM to begin with.

That is, it seems to me, that if you simply avoid ever using wireless there is no danger of MITM. I could see that XSS could be done on some sites with ads, and that would be worsened by lack of HTTP.

Is it as simple as "Don't use wifi. Use adblock. HTTP/HTTPS then no longer matters." ?

<comment> yjftsjthsd-h This sounds a lot like "we can't protect average joes from themselves, so let's not bother adding protections"? Sure there are always other attack vectors, but that doesn't excuse ignoring the ones that are easy to fix.

</comment></comment></comment></comment><comment><USER73> So more specifically, HTTPS on pages where you log in is important, not necessarily on your landing / homepage? I am not disputing that may be a good idea, but it seems like the main complaint is that users are submitting credentials on an HTTP page?

<comment><USER74> This is exactly the opposite of what the article states.

The HTTP landing page serves a link to the login page. This link could be modified by a hostile network to another site. The fact that the login page is served over HTTPS is immaterial for this attack.

<comment><USER75> Honest question...

Under that attack, wouldn't be the same whether you are using https or not? If you are in a hostile network with a compromised DNS, Couldn't the domain be phished too? Meaning that a valid certificate trusted by a fake CA would be used by the browser?

<comment><USER76> > valid certificate trusted by a fake CA

I don't think that's possible. A fake CA can't issue out valid certificates because you wouldn't trust their certs to begin with -- it's all about trust and if you know they are a fake CA, then you would never trust them or anything they issue. It's like if a known counterfeiter claims to be selling legit products, you probably wouldn't trust them.

<comment><USER77> A compromised, but legitimate CA is a vector of attack in this case. Any CA can be compromised by nation-states through legal coercion, and all of them probably have some vulnerabilities that have yet to be found. There are also new CAs that are not yet trusted, and sometimes old ones that are on their way to being delisted.

So you need an up-to-date list of trusted CAs (which most of us are relying on google for, in this case), which means trusting google at the very least (a company that compiles and sells your data, and is also based in a nation that issues secret warrants and orders to tech companies). It would be pretty surprising if this wasn't already a vector of attack being actively used (the fact that a trusted list needs to be maintained suggests that it is).

<comment><USER78> While there are ways to compromise CA's (e.g. like you say, by nation-states for their intelligence goals), it is important to think about the appropriate risk profile.

For a NatWest customer accessing their internetbank, the expected, quite frequently observed risk comes from organized phishing teams pulling off mass semi-automated scams. For an attacker _that_ , getting a certificate signed by a fake CA is unrealistic, and the concerns that you list aren't going to change anything since they're not going to do that anyway. On the other hand, getting a misleading certificate signed by a real CA and passing it off as the real thing is entirely feasible by this type of attacker, so fixing _that_ is important.

Nation-state hacking, censorship and advanced persistent threats aren't what's causing the most damage/problems to most people on the internet right now, the multitude of random criminals is the largest issue. If you have to worry about a CA "compromised by nation-states through legal coercion", then this by itself means that you have a very different risk profile than pretty much everyone else; and the risk-reducing activities that make sense for you shouldn't be expected to be relevant for others and vice versa.

</comment></comment></comment></comment></comment></comment><comment><USER79> Troy is way overstating the case.

You want to know if the login page is NatWest?

Click on the Login link and look at the browsers security bar.

If it says "The Royal Bank of Scotland Group Plc [GB]" and that then entity with which you do business, great.

It seems as if Troy would be just fine with HTTPS rather than HTTP, but DV validated certs aren't what you want anyway with a financial institution.

It seems far more likely that you care about the entity you are working with (Royal Bank of Scotland), than the domain of the referring page (personal.natwest.com).

<comment><USER80> Unfortunately EV certs are not bulletproof:

[https://arstechnica.com/information- technology/2017/12/nope-...](https://arstechnica.com/information- technology/2017/12/nope-this-isnt-the-https-validated-stripe-website-you- think-it-is/)

For ~$170 apparently you can get an EV cert for "Stripe, Inc" (by forming a company with that name).

Even aside from that fact, users are very bad at knowing what a secure site looks like. I would wager that if most users clicked "login" and didn't see an EV cert, but instead saw "<padlock> Secure" (i.e. a non-EV HTTPS connection), they would not notice the difference.

Troy is right to kick up a fuss about this; this is a significant attack vector (anyone on a wifi network can MITM your banking login URL), and it's more egregious because of how easy it is to set up HTTPS.

<comment><USER79> Domain names don't solve that either.

For one tenth that cost, you can register stripeinc.net and get an SSL cert. Yay!

Domain registration is available instantly for anyone, anytime, and it can be phished at least as easily as anything else. [https://www.xn-- 80ak6aa92e.com/](https://www.xn--80ak6aa92e.com/) looks pretty legit in Firefox.

<comment><USER81> Sure, but that's just more reason to use HTTPS across their entire domain and would help prevent users from being phished as easily. If I enter "apple.com" I expect all links on that page to point me to the correct location. A MITM attack from a non-HTTP page could easily alter the page and link me to [https://www.xn--80ak6aa92e.com/login](https://www.xn--80ak6aa92e.com/login) instead.</comment></comment></comment></comment>


Huawei releases a mesh Wi-Fi system it claims has ultrafast connection speeds - <AUTHOR> https://www.theverge.com/2018/1/10/16873272/huawei-mesh-wifi-whole-home-system-ces-2018 <comment><USER2> >Huawei doesn't just make smartphones and laptops; it's also getting into mesh Wi-Fi.

Huawei is a giant in the networking world and has been for a long time.

I used to work in a lab in the networking space, and iirc Huawei products were blacklisted by the gov't because they were supposedly backdoored by the Chinese. Perhaps they were, I don't really know, but a couple years later (post Snowden) it became clear that their real motivation was ensuring people used networking gear _they_ (the NSA) had compromised.</comment>


Ask HN: When is it considered too early to start applying for S.E jobs? - <AUTHOR> I'll be graduating with my B.S. in Computer Science  this Spring. I've been applying to job postings every other day but unfortunately I only receive rejection emails. Am I applying too soon as my availability isn't until early June of next year? Or is it possible its a problem with my CV? <comment><USER2> In my experience, many companies are looking to hire "right now", and are unlikely to spend resources interviewing someone for a job in 9 months' time. _However_ , any silence or rejection you get right now isn't a reason not to reapply next year (I'd recommend in late April or May). Google, for example, usually recommends that candidates reapply in 6 months, which I'd say is a reasonable rule of thumb. There is no harm in getting your name in front of as many people as possible. Any reasonable recruiter or manager will keep your contact details for the future when they have another opening. If you are worried about CV, check the wording of the rejection emails and consider replying asking if you should reapply closer to your graduation date.</comment>


Grubwithus Also Says "Step Away From the Device"   - <AUTHOR> http://blog.grubwithus.com/post/27938991477/grubwithus-also-says-step-away-from-the-device

<comment><USER2> Indeed, I couldn't agree more.

Unfortunately, for whatever reason Grubwithus's user interface just doesn't click for me. I'm talking about this from a dinner organizer point of view, from the average user perspective, everything seems to work fine.

I've tried to organize dinners, but for whatever reason I haven't figured out how to get people to come out.

This is just my personal issue because I am lazy and I need to spend more time on the site, but...if it were smoother I would have already organized a lot more dinners.

I wish grubwithus the best of luck, what they're trying to do is definitely the right direction.

<comment><AUTHOR> Thanks for the feedback! Grubwithus dev here. Have you seen the create-a-meal interface, released about a week ago? One of the main issues we were facing was the lack of a restaurant for user created meals (which deters grubbers from booking), but we've solved this by allowing the creator to select a restaurant during the process. Now meals have a restaurant from the get go, which is appealing for grubbers. Not sure if this what you were referring to, but the revamp has been well received by organizers and bookers alike.

<comment><USER2> Awesome. Yes, this is one thing I was looking for, right on. I will make it a point to check it out again.

I have to admit, Grubwithus appeals to my laziness. I call it "push button organizing." It's not quite there yet, but it's getting close and I think it has the potential to make a really big impact.

I will continue to advocate for Grubwithus. Good luck and great job so far.</comment></comment></comment>


Ask HN: Where do you sell your side projects? - <AUTHOR> Folks who have sold side projects, how did you do it? <comment><USER2> There's Flippa [https://www.flippa.com/](https://www.flippa.com/) and you'll find more with a bit of googling.

But those are platforms for selling "online business" not "side projects".

People who buy want ROI (Return On Investment). They buy money-making business for some multiple of monthly revenue hoping that over time they'll make more than they spent.

It might be just a careless use of terminology on your part.

Or it could be fundamental misunderstanding of how the world works.

No one buys "side projects". Don't try to sell "side projects" because you can't.

People buy businesses. A business makes money. There are people who will buy a money-making business.

Some side projects could also be money-making businesses but not all of them are.

<comment><AUTHOR> Yes I'm aware that I oversimplified with "side projects". It was not my intention to try and sell fairy dust.

</comment></comment><comment><USER3> From those I know who have sold their side projects, the buyers usually came to them. I'm not aware of a marketplace for this.

<comment><AUTHOR> A friend built this crowdmna.com . Check it out.</comment></comment>


Ask HN: Is charging in AUD a significant barrier to getting clients? - <AUTHOR>

Without ending up having to use PayPal (and all its potential pitfalls), I'm finding it very difficult to get a payment processor to bill in USD from Australia.<p>So I'm curious, is paying in a foreign currency (for a US-citizen) a significant disincentive to using a web-service (this one will be specifically aimed at developers and, ironically, billing)? <comment><USER2> NAB in Australia allows you to open up multi currency merchant accounts. I believe they charge around 4% but, it will do the job until you have enough traction to setup a US entity.

</comment><comment><USER3> Thats a good question. We ended up using a drop down for USD prices, we are charging in EUR btw, but it didn't help much.</comment>


Gitlab is down - <AUTHOR> https://gitlab.com/users/sign_in <comment><USER2> I get the impression that Gitlab focuses a little too much on releasing new features at a rapid pace with every release. Maybe they should spend more time on running their infrastructure reliably and getting their engineering practices up to speed. The recent events will raise a red flag with enterprises who might be potential Gitlab customers and that directly affects their bottomline.

<comment><USER3> I questioned their engineering competence during their last outage and the general responses I got were very dismissive. Gitlabs were able to spin the last disaster into a publicity stun with the live streaming but I feel like that was a fluke. Bro coding and "openness" will only garner you so much good will with paying customers who are more concerned with availability.

The unavailability of a code repository might be more of an inconvenience for a single developer but in an enterprise environment with teams of coders being able to quickly disseminate code changes can be critical. The unavailability of a source repository becomes a huge liability and a waste of man hours.

<comment><USER4> If you are relying on something for your business that you paid nothing for, you get your money's worth.

<comment><USER3> That excuse doesn't really work because Gitlab offers a premium paid option for repositories hosted on Gitlab.com.

<comment><USER5> .com is free -- paying customers/CE users weren't affected by the outage.

<comment><USER3> > .com is free

Yes, and Gitlab.com Bronze Support is a premium service offered on the Gitlab.com platform. It is not the hosted or self hosted premium offerings.

> paying customers/CE users weren't affected by the outage.

That is incorrect. If you pay for Bronze Support you are definitely affected by this outage. Hosted and Self-hosted customers are unaffected.

</comment></comment></comment></comment></comment></comment><comment><USER6> Unfortunately, events like this are one of the reasons I never was able to go all in on Gitlab. When I first started trying it out the performance was not great (it is pretty good these days though) and they just seemed to have more of these smallish events. I realize Github also has problems but it feels like they are much less frequent. I don't have any data to back that up though.

Either way, went self hosted recently so now I only worry about my server haha.

<comment><USER7> Self-hosted is one of the main selling points of Gitlab software.

<comment><USER6> For sure and that's one of the reasons I think they have a chance of at least getting to the same level as Github. I've actually worked at two fortune 500 companies that are using the self hosted Gitlab which to me says a lot, I just wish the hosted option was a bit more... stable.

</comment></comment></comment><comment><USER8> Question: with a strict CI/CD in place, as well as a staging server, how can these problems be so common for Gitlab?

Isn't this exactly what CI is supposed to prevent?

Not blaming Gitlab for bad practices or anything, i'm just curious.

<comment><USER9> Even with a staging server, things can pass testing but fail in production if the staging environment provides an imperfect simulation of the production environment - and that's almost inevitable.

For example, your staging environment servers should be connecting to a different database with a different password. If the password's right in the staging config but wrong (or missing) in the production config, things that work in staging can fail in production.

<comment><USER10> > things can pass testing but fail in production if the staging environment > provides an imperfect simulation of the production environment

Your staging environment should match production, or it's not really staging at that point. It doesn't have to match it in _size_, just structure and process. Ignoring data loss, if you can't quickly switch staging to production it's not really staging. It's just a dorky test environment masquerading as a stage environment. It's also surprisingly not that difficult (the variation of difficulty depends on the type of data you're interacting with, and how isolated it needs to be) to "forward" a slice of real word traffic to your staging environment and monitor it for some duration of time.

>For example, your staging environment servers should be connecting to a different database with a different password.

Handled by proper CI/CD pipelines. Completely irrelevant to deploying new features, configuration for production specific users/passwords happens on the sysadmin/devops side of things.

</comment></comment></comment><comment><USER11> It was back 5mins ago: [https://twitter.com/gitlabstatus/status/829685770084548608](https://twitter.com/gitlabstatus/status/829685770084548608)

</comment><comment><USER12> I'm rapidly starting to question my use of mid-tier web services. Who else is operating like this? CI/CD, Staging, downtime playbooks, backup playbooks, all of this or any combination of it would have been a good idea. Folks, I just want to work without my tools failing so that I can go home and think about something else.

<comment><USER13> GitLab.com is a testing platform for their Enterprise version.

If you want to guarantee reliability you need to pay for hosting or self-host.

Otherwise, there are quite a few competitors in this market with 99.99%+ guarantees.

<comment><USER14> If this is even remotely true, they need to put that on the front page, in really big letters.

<comment><USER7> The letters are F, R, E and another E.

<comment><USER14> It's nice that you can spell and all, but bitbucket is also free and we don't see this type of issue there. Or github, or gmail, or google analytics, or...well, you get the point I hope. Free is not a synonym for unreliable, so if a company wants me to sign up to their product and _doesn 't_ tell me it's unstable, I'm not going to be terribly impressed if it fails. A clear notice on the homepage would sort this out. Heck, they can even link over to the enterprise edition for anyone who doesn't want to take the risk.

<comment><USER15> please search for "github outage" on hn search engine for example... or "bitbucket outage"... pay is not synonym for reliable either...

</comment></comment></comment></comment></comment></comment><comment><USER16> Gitlab is praised for being transparent in everything they do, so where is the backup infrastructure policy that they should now have in place? I'd like to see that situation proven resolved before we discuss rewriting their front end with Vue.js and any other new deployments.

<comment><USER17> It's still being written: [https://gitlab.com/gitlab-com/www-gitlab- com/merge_requests/...](https://gitlab.com/gitlab-com/www-gitlab- com/merge_requests/4779), in the mean time quite a bit of work is underway, see the issues mentioned in [https://gitlab.com/gitlab-com/www-gitlab- com/issues/1108](https://gitlab.com/gitlab-com/www-gitlab-com/issues/1108) for more info.

</comment></comment><comment><USER13> Status: Investigating

[https://twitter.com/gitlabstatus](https://twitter.com/gitlabstatus)

<comment><USER13> Should be all good again.

Updates:

Our Redis cluster is currently experiencing a split brain, we are looking into the problem

Split brain is fixed for Redis cluster we are currently investigating the cause

We're performing a hard restart of our Unicorns, this may lead to an increase in HTTP 500 errors

Deployment finished and (link: [http://GitLab.com](http://GitLab.com)) GitLab.com is available again. Apologies for the bumpy ride.

</comment></comment><comment><USER18> Unsuccessful deployment i guess.

We will be deploying 8.17.0 EE RC1 to [http://GitLab.com](http://GitLab.com) shortly, no downtime is expected

</comment><comment><USER19> > Our Redis cluster is currently experiencing a split brain, we are looking > into the problem

</comment><comment><USER20> After the backup catastrophe postmortem, have they published anything about what they're doing differently now?

i.e. here's how we're handling Postgres WAL archiving and logical backups, Redis RDB/AOF backups, etc?

<comment><USER21> [https://gitlab.com/gitlab-com/www-gitlab- com/merge_requests/...](https://gitlab.com/gitlab-com/www-gitlab- com/merge_requests/4779/diffs)

</comment></comment><comment><USER22> I understand gitlab to be a test bed. But at least this time they didn't delete the wrong directory. I know, I'm late to the party since service has restored.

</comment><comment><USER23> status.gitlab.com is also not loading. Gitlab pages hasn't been working properly for me(redirects to a 404)[1]

[1]: [https://gitlab.com/gitlab-org/gitlab- pages/issues/43](https://gitlab.com/gitlab-org/gitlab-pages/issues/43)

<comment><USER24> running your status page from the same infrastructure is a really bad idea

<comment><USER25> Doesn't look like they are, to me. Their main domain's IP address is owned by Microsoft (so, using Azure?), but the status page IP is in a block owned by Digital Ocean.

Edit: I could have sworn I refreshed the page before replying to make sure someone else hadn't already responded, and I didn't see your comment jschulenklopper. Scary how similar they are lol.

</comment></comment></comment><comment><USER26> Hey, where is the live video of this incident? :sarcasm:

</comment><comment><USER8> Me too. Came here to find this, wasn't disappointed.

</comment><comment><USER27> Welp. There goes gitlab. It was nice while it lasted.</comment>


HackerOne breach lets outside hacker read customers' private bug reports - <AUTHOR> https://arstechnica.com/information-technology/2019/12/hackerone-breach-lets-outside-hacker-read-customers-private-bug-reports/ <comment><USER2> Platforms really need to stop trying to shoot the messenger, just swallow their pride and get vulnerabilities fixed.

<comment><USER3> They paid the hacker $20,000. That's a nice way of shooting the messenger!</comment></comment>


Snapjoy (YC S11) is closing - <AUTHOR> http://blog.snapjoy.com/2013/snapjoy-is-closing/

<comment><USER2> Background Info: Snapjoy was bought by Dropbox a couple of months ago: [http://blog.snapjoy.com/2012/snapjoy-joins- dropbox/](http://blog.snapjoy.com/2012/snapjoy-joins-dropbox/)

<comment><USER3> That would have been helpful information in the blog entry.

<comment><USER4> The post is for their users not for external discussion sites that require additional context.

</comment></comment></comment><comment><USER5> "After two years of building Snapjoy, the time has come for us to shut down the service."

That is a really weird statement. Shutting down without offering any alternatives is not a normal thing to do for a software company. No word of why they're shutting down, just 'the time has come'. No apology. Nada.

I had to read the comments in this thread to find out they were acquired by Dropbox.

</comment><comment><USER6> Anyone else feel like a month of warning before permanently deleting your data is cutting it a bit close?

<comment><USER7> Obligatory XKCD: [http://xkcd.com/1150/](http://xkcd.com/1150/)

<comment><USER8> That XKCD assumes the person actually got the message, in which case a month is fine.

Sending an email doesn't cut it on this short of a timeline.

The really weird thing is they had _seven_ months to tell people about this deadline, and waited until _six_ of them had passed.

<comment><USER9> Why do you assume the decision was made upon acquisition? Things change.

<comment><USER10> Everyone who follows tech startups saw this one coming. This was a clear acquihire. My company was in the process of acquihiring. We knew from a mile away that they didn't give a crap about continuing the development our product, despite all their promises. We ended up declining (none of us wanted to move to the bay area).

</comment></comment></comment></comment></comment><comment><USER11> Why isn't there an automatic migration path to Dropbox?

</comment><comment><USER12> Did Dropbox buy Snapjoy or did the team decide to join Dropbox because their product was not working out?

</comment><comment><USER13> Perhaps a one-click migrate-to-dropbox option is in order?

<comment> mh- perhaps if the Snapjoy folks were in a better position to collaborate with these Dropbox people.

maybe they can reach out on LinkedIn or something.

</comment></comment><comment><USER14> Data in the cloud might be safe from disk failures, but not safe from acquisitions.

</comment><comment><USER15> Anyone looking for a place to migrate their library, I recommend Everpix -- at least until they are also acqui-hired. Flickr, too, is looking much more attractive with their revamped free tier, and is certainly likely to be in it for the long haul.

</comment><comment><USER16> Yah, after convincing my daughter it was the way to keep her photos from filling her iPhone she gets a message from the app today saying this. She's in a panic of course about it.

And as one last slap in the face, it's 8 separate downloads!

</comment><comment><USER17> Once again Archive Team has a job to do.

<comment><USER18> I'm guessing this isn't serious. But if you are, I'm pretty sure most of the data on Snapjoy is private rather than public.

<comment><USER19> Doesn't mean we aren't looking at it, we are :)

</comment></comment></comment><comment><USER15> This one really has me scratching my head. I always assumed that Snapjoy would merge into Dropbox's photo system, but I also assumed that they would give users the explicit option to port over their accounts to Dropbox.

Customer acquisition has always been the name of the game for Dropbox, this seems like a missed opportunity to bring over a good chunk of committed users.

<comment><USER20> > Customer acquisition has always been the name of the game for Dropbox, this > seems like a missed opportunity to bring over a good chunk of committed > users.

Have you considered the fact that perhaps there was no customers to acquire in the first place?

I couldn't find the app in the appstore but a Google search for "itunes snapjoy" showed that the app had only being rated with 7 votes.

</comment></comment><comment><USER21> _" What's Snapjoy? We're building the smart photo library in the cloud"_

s/We're/We were

</comment><comment><USER22> Bummer. Was it really costing Dropbox a lot to keep the service? From the aquihire blog post in December, I got the impression there never was an intention to keep things running.

</comment><comment><USER23> Lacking easy migrate support, at least the export option exists.

</comment><comment><USER24> A sad day. Big ups to Michael, JP, and the rest of the team. Snapjoy, RIP</comment>


Why couchdb is better than mysql - <AUTHOR> http://pylab.blogspot.com/2009/01/ten-reasons-why-couchdb-is-better-than.html

<comment><USER2> As much as I like couch, declaring that it is better than mysql is overgeneralizing. The couchdb developers themselves declare that couchdb is not a replacement for mysql, nor should it be publicized as such.

</comment><comment><USER3> replace 'mysql' with 'csv files' and the arguments still hold..

</comment><comment><USER4> couchdb is really good.. and made for the web, but how does it perform in production environment</comment>


Kickstarter, but With Stock - <AUTHOR> http://www.slate.com/articles/business/moneybox/2014/06/sec_and_equity_crowdfunding_it_s_a_disaster_waiting_to_happen.html <comment><USER2> I could go to vegas and drop $40k in cash on the casinos, gambling it all away. There's nothing to stop me from dong that.

But even with 20 years experience in startups, I can't put $40k into a startup's round?

Slate would say I need to be "protected" from that?

Sorry, in this case, the regulations that only allow the well connected and wealthy to invest in startups also serve to keep those with domain expertise out of the market.

All too often regulations are used to exclude competition. This is one example.

<comment><USER3> Very few people would go to a casino with their life savings with the expectation of retiring off the winnings. Most people understand the risks involved (even if they are very poor at understanding the real odds, they still know they aren't good). Further, casinos would never be allowed to sell their games that way; gambling is a massively regulated industry.

Now consider a company selling itself. With no rules, they are able to say anything they want about themselves. The stock market is seen by many (most?) as an investment, and therefore fairly safe (possibly even _safe_ ). How well dispersed is the knowledge that, while investing most of your money in the _market_ is relatively safe, investing it in _one dstock_ is horribly risky? How easy is it for a semi-reputable (much less disreputable) company to paint an overly rosey picture, appealing to somebody's hopes and dreams?

I completely agree you should be able to invest. There is a real problem with how _qualified investor_ is defined today, but I'm not convinced removing that concept is a good idea at all.

<comment><USER4> "Now consider a company selling itself. With no rules, they are able to say anything they want about themselves. The stock market is seen by many (most?) as an investment, and therefore fairly safe (possibly even safe). How well dispersed is the knowledge that, while investing most of your money in the market is relatively safe, investing it in one dstock is horribly risky? How easy is it for a semi-reputable (much less disreputable) company to paint an overly rosey picture, appealing to somebody's hopes and dreams?"

I don't know where you extract that there are "no rules" in crownfunding stock. The stock market is crownfunding by nature. At first NY Stock market was a tree under which interested people traded part of their companies.

With more than one hundred kickstarter projects backed on my belt, I have been duped in... ZERO.

They are free to say whatever they want but it is very easy to catch a liar.

Part of my family comes from socialist East Europe economies. In those places even very smart people like nuclear scientists or very bright philosophers were protected "for their own good" against taking risks(or doing anything on their own by the way, good competent people were dangerous if they did good things because it made the very incompetent look bad).

The only problem is that "protectors" were very Mediocre people, people that spent their time banging pretty girls and drinking Vodka. Bureaucrats whose only merit were kissing asses of someone higher in the monopolistic hierarchy of power.

Let me be a grown up, an adult who takes his own decisions.

</comment></comment></comment><comment><USER5> _"We find it very hard to believe that any attractive companies will use" non- accredited investor crowdfunding_

On any given day, there are millions of English-speaking people on the internet. If you can capture the hope and imagination of those people, they will give you money, and the total amount you receive will be significant. Alternatively, if you can convince a small number of them to give you a large sum of money (à la Occulus), your result will be the same. This, obviously, requires the right sort of idea; one that resonates with large numbers of people, or resonates so strongly with a small number of people that they're willing to part with hundreds of dollars. But it's quite possible, and I see no reason why a serious company wouldn't explore this possibility.

On the other hand, after reading some history about the concept of the stock market, I think legal protections aren't a bad thing. The goal is to protect uninformed consumers from predatory behavior. It's an important goal, because no one likes admitting they're uninformed (least of all to themselves) so you end up in a situation where people are throwing around their nest eggs at emotional appeals (companies who convince you that they can make your fantasy happen). It's easy for people to convince themselves they've stumbled onto a big opportunity, and it's rather easy for them to believe in it so strongly that they're willing to invest large sums of money; sums they sometimes can't afford. If their investment disappears, so does their ability to participate in the economy. The history of the idea of stocks is filled with this sort of behavior, and sometimes the consequences can be disastrous. Due to information asymmetry, those tempted to invest in a new phenomenon are usually the ones least qualified to judge whether the phenomenon will yield returns. Hence, predatory behavior, and the original motive for protective legislation.

There's a balance to be struck between taking advantage of small sums of money from millions of people, and protecting those people from dumping money they can't afford into a new phenomenon. Some tasteful regulation isn't necessarily a bad thing.

<comment><USER6> Sibling replier Cyther606, you have been hellbanned and most poeple can't see your posts unbeknownst to you.

<comment><USER5> Cyther, it looks like you just made a new account. Since your comment was autokilled, I'm guessing you're posting through Tor. HN autokills comments from new accounts if they're made through Tor due to past abuses. If you email firstname.lastname@example.com and include a link to this subthread then they'll mark your account as legit.

Your comment was good. The autokill was unrelated.

<comment><USER7> That is correct. We unkilled the comment.

</comment></comment></comment></comment><comment><USER8> How does crowdfunding successfully work in the UK, but not in the US? Having done startups in both environments, structurally, I don't see much of a difference.

UK crowdfunding websites for reference:

[https://www.seedrs.com/](https://www.seedrs.com/)

[http://www.crowdcube.com/](http://www.crowdcube.com/)

<comment><USER5> I'm interested in how many of those investors achieved >1x ROI. Are there any publicly available stats?

<comment><USER8> AFAIK no. I know you're not refuting this, but my general point is that in the UK this system does exist and hasn't created the supposed chaos in the UK that the US financial authority believes will happen in the US.

</comment></comment></comment><comment><USER9> This whole "controversy" over companies who do Kickstarters and later raise money (or sell their company) seems overblown. When you're backing a Kickstarter for these types of companies you're often trying to get the product as a pre-order. So in addition to a potentially low margin business, these companies are now supposed to feel inclined to give you -- the customer -- equity in their company? As a backer, do you want the product or do you want the equity? They are two completely different ideas that seem to be conflated in the press. Perhaps all this controversy is fabricated by the press and not an actual problem.

Kickstarter in particular is about rewards and/or patronage. There is an avenue for equity based crowdfunding elsewhere, the question is whether there is a big enough demand on the consumer side (with people who have little information about the company) and the business side (with founders who don't want to share equity). I'm not referencing AngelList, but rather companies who would run Kickstarter-like projects.

<comment><USER10> If everyone called it pre-ordering and not crowdfunding, I think there would be less "controversy"/ upset people. (I realize the crowd might be providing the funding to make whatever endeavor possible, but if it's ultimately pre- ordering...) the conceptual framework of crowdfunding means you're a part of something bigger. It taps into the language of start up funding. If a successful campaign results in the people putting on the project making tons of money, all you might get is a refund and disappointment. That result is more palatable if all you did was pre-order something.

Edit: spelling

</comment></comment><comment><USER11> > From an investor's perspective, crowdfunding operates most similarly to > angel investment. But most crowdfunding investors won't be able to act like > successful angel investors. "Successful angel investors invest in industries > they know well, do a lot of due diligence, spend time mentoring the > companies they invest in, and diversify their investments," said Dorff.

A single non-accredited investor may not invest as well as an experienced angel investor. But the idea is to invest with "the crowd". The funding sites will help with some of the due diligence, and people will gravitate to the most promising startups. Instead of providing advice individually, the crowdfunders will provide group feedback, marketing, etc. And they'll be able to diversify just like angels, since they'll invest smaller amounts in each startup.

</comment><comment><USER12> >Had the backers received company stock instead of company T-shirts, they would have seen close to a 1,000 percent ROI.

This assumes Oculus would have sold 100% of its shares at a $2 million valuation, and then still sold again for $2B after the developers had cashed out.

It's a nonsense comparison.

<comment><USER13> Isn't that for a 1000x ROI? 1000%=10x, so even selling 1% on Kickstarter at a 200M valuation would yield something like that.

<comment><USER12> You're right, but now I'm wondering where the article got a 200M valuation from...

</comment></comment></comment><comment><USER14> A lot of people dont realize that that you can begin trading stock OTC by just filling some paperwork with the SEC though lawyers fees for that paperwork are not cheap. You can do what is called direct public offering and directly sell your stock without using an exchange aka over the counter. Many people refer to these stocks as penny stocks and the OTC market as the pink sheets. What these new laws are trying to change is the way you register to sell OTC and the people you are allowed to sell to. The real problem is that just like no one trusts penny stocks and the otc market no one is going to trust crowdfunded stocks. They are going to be full of scams and pump and dump schems. Just look at the movie wolf of wall street for an example of the kind of scheming that goes on in the otc markets

</comment><comment><USER15> Let's get one thing straight - the SEC "worrying" about fraudulent behavior in crowd-based equity is laughable.

Yes, fraud can happen in crowd-based equity - that's not what I'm talking about though.

What is laughable is that the one thing the SEC is supposed to monitor (the stock market) is the single biggest fraud perpetuated on the American people. It is where young, naive people like myself put their life savings only to have it crushed by people who were richer than me, who could generate volume on whim, perform insider trading while not worrying about the consequences, and take bailouts from a government that milks the rest of the population for taxes. I'll honestly be damned if the SEC isn't in the pocket of those who would benefit from it.

<comment><USER5> Have you written about your experiences anywhere? I'd be interested in hearing specifics.

<comment><USER15> I've probably written about it a few times in various comments, but the essence of it can be found here:

[http://blogmaverick.com/2010/08/20/the-stock-market-is- still...](http://blogmaverick.com/2010/08/20/the-stock-market-is-still-for- suckers-and-why-you-should-put-your-money-in-the-bank/)

and here:

[http://blogmaverick.com/2008/09/08/talking-stocks-and- money/](http://blogmaverick.com/2008/09/08/talking-stocks-and-money/)

(I don't always agree with Mark Cuban, but most of what he says here seems pretty sensible).

As far as investing goes, I always seemed to be pretty "good" \- or at least, lucky. It was not unusual for me to make a few thousand dollars in a week (and occasionally lose a little). I typically never invested in very risky prospects, always things that I knew would be around for quite a while like Google and Apple.

I made the foolish mistake of investing in Freddie Mac and Fannie Mae, companies that were once labeled "too big to fail" (and now trade OTC, if at all - have not checked since they became junk). Actually, my "mistake" appeared to be a brilliant move at first, as I made $30,000 in a few hours. But in a few more hours, that number was negative. However, I was not investing out of speculation, I invested because I thought that these companies were going to survive the recession - in fact, because of a statement from Hank Paulson (then Secretary of Treasury) who said that the government would not be taking over these entities (they were GSEs, but publicly traded). Hours later rumors turned against this, and within weeks it was trading at $0.25 or less (down from $7 to $11 a share where I originally was trading it at).

But it gets better - little did I know (at the time) that Paulson was a Goldman Sachs alum: [http://www.nytimes.com/2008/10/19/business/19gold.html?pagew...](http://www.nytimes.com/2008/10/19/business/19gold.html?pagewanted=all&_r=0)

And that he gave advance word of their failure. Some people might call that insider trading, but, what do I know? :)

[http://www.bloomberg.com/news/2011-11-29/how-henry- paulson-g...](http://www.bloomberg.com/news/2011-11-29/how-henry-paulson-gave- hedge-funds-advance-word-of-2008-fannie-mae-rescue.html)

</comment></comment></comment><comment><USER12> >The SEC estimates that it would cost $39,000 in fees to accountants, lawyers, and the funding portal to raise just $100,000, and more than $150,000 to raise $1 million. Those are insanely high capital costs—companies would be better off financing their operations with credit cards.

15% on money that never has to be paid back? If we're comparing to Kickstarter, fees are at least 8% and you are contractually obligated to supply a product.

>For comparison, underwriting fees for a large public offering are usually under 4 percent.

Why are we comparing this to a large public offering?

</comment><comment><USER16> You'd have to be crazy to give away stock as part of a kickstarter campaign. Even it were possible I can't imagine many project creators making that choice. The numbers just don't make sense. Especially given how successful kickstarter has been without it.

<comment><USER17> Following your logic: "You'd have to be crazy to give away stock as part of an investment round. Even it were possible I can't imagine many project creators making that choice. The numbers just don't make sense. Especially given how successful kickstarter has been without it."

<comment><USER16> Let's say your a 2-4 man startup of industry professionals with a game prototype and a great trailer. You have the potential to bring in upwards of $1,000,000 on Kickstarter. That money is pretty much equivalent to pre-orders plus varying levels of "special edition" perks and physical goods.

How much equity would you put on the table and how much money would you want for it? Keep in mind that if you have a good pitch you can bring in $1,000,000 for no equity and if your game is successful it could bring in another $3,000,000 to $10,000,000.

<comment><USER18> Those are some very generous numbers you have there! Of course, there are examples of successful KS campaigns but it's not exactly a sure thing.

Also, it requires that you have a (typically consumer) product that you can pre-sell. What if you are making a Saas that could turn into a profitable business but that cannot be launched on Kickstarter? It might still be a good investment opportunity so the other model could work.

<comment><USER16> YC funds $120k for 7%. But the majority of the value in being a YC startup isn't the cash. Cash is a much bigger portion of the Kickstarter value proposition but it also provides value as a marketing tool and in establishing a hardcore fan base.

I wonder what fair numbers would be. Hrm. Hard to say. A lot of 1-4 man small teams would do it on second thought. I think $100k for 10% is a pretty crap deal but creators would probably take that offer. Hard to know how Joe Public would respond. Definitely hard to predict after 5 years when people compile lists of games that even gave a break even return. Game companies and software startups don't exactly have a high success rate.

</comment></comment></comment></comment></comment><comment><USER19> Honestly, I don't think it's going to work because a small number of people are always going to try to cheat the system and end up ruining the whole thing.

<comment><USER20> That's pretty much every system in the world. You could say that about credit cards, tax returns, democracy, road rules, marriage... etc. They need to set up a framework that minimises opportunity for cheats and accept there is risk in everything.

<comment><USER19> security fraud is much lower and SEC is successful at enforcing cheaters. We need this level of regulation for kickstarter with equity to be successful, otherwise we are going to see innocent people getting duped easily and slip away without facing any restitution.

I just don't see this happening without support from government regulatory body and without it, the result would be disastrous.</comment></comment></comment>


Bug Labs fleshes out BUGbase, BUGmodule details (hackable hardware) - <AUTHOR> http://www.engadget.com/2007/08/28/bug-labs-fleshes-out-bugbase-bugmodule-details/ <comment><USER2> This thing looks so cool... I'm really excited to buy one, I think there is a huge market for great software in consumer electronics - this might be a fun and cool way to build things fast.</comment>


Malwarebytes: With Anti-Exploit, we'll stop the worst attacks on PCs - <AUTHOR> http://www.cnet.com/news/malwarebytes-finally-unveils-freeware-exploit-killer

<comment><AUTHOR> _Worried about giving away the keys to kingdom, Bustamante wouldn 't go into further detail on how Anti-Exploit works._

Big red flag for me here. If their success is dependent on obfuscation, then it will surely be short-lived.

<comment><USER2> It also means that their entire marketing message is "we're better, but we can't tell you why, so just trust us" \- which doesn't sound very convincing.</comment></comment>


Warning Signs You're About to Be Laid-Off - <AUTHOR> http://www.geekademy.com/2015/11/warning-signs-youre-about-to-be-laid-off.html <comment><USER2> When you try to enter office's multi-level parking but your access key doesn't work.

When the Director/VP/Head says "even though the market has turned, we have _no_ plans to lay people off"

When you receive a notification that your <enter company's source control> privileges have been revoked.

When you see a voicemail (or tweet in case of Twitter) from HR around Friday afternoon/evening or early Monday morning.

When you apply for vacation but the request is denied for unspecified reasons ("We may need you here during that period").

When your manager keeps postponing your ++year() roadmap meeting requests.

<comment><USER3> >> When you see a voicemail (or tweet in case of Twitter) from HR around Friday afternoon/evening or early Monday morning.

Not quite - layoffs usually happen on Thursdays (so that any problems/issues can be sorted out on Friday), last week of the second to last month before the end of the fiscal year (so that severance pay is booked in this fiscal year), but never on a payday week (too much work for payroll).

<comment><USER2> I was partly referring to this [https://twitter.com/bartt/status/653946266938818561](https://twitter.com/bartt/status/653946266938818561)

</comment></comment></comment><comment><USER4> Personal experience: when you are working late and you hear suspicious noises in the executive quarter. After arming yourself with a nice long bar of metal you come across the CFO who is hurriedly packing all the expensive computers into the back of his car. When confronted he offers to pay you your outstanding invoice cash in return for your silence...

</comment><comment><USER5> I'd say watch out for a meeting that's so important that it's split into two groups, and you're in the first group.

<comment><USER6> I had the unusual experience of having everyone else in the office being summoned to an HR meeting and me left at my desk as I'd already resigned...

<comment><USER7> I once got called at home the Monday after I'd left a company to hear that I'd been "laid off". The previous Friday had been my official last day (planned exit, I was going off to college), but I had banked a bunch of unused vacation days, and they were calling to let me know that they wouldn't be able to pay out the remainder of my vacation pay.

Much later, when I got into the workforce for real, I learned that I could've collected unemployment checks for this, and that if I'd played my cards right, I could've been drawing unemployment for my first year at college. Ah well - one of my coworkers told me "If you'd done that, I might have to hate you. Unemployment is for workers who need it, not college students who take a gap year at a dot-com."

<comment><USER8> >if I'd played my cards right, I could've been drawing unemployment for my first year at college.

What state was this in? That is certainly illegal in California, and I would assume most states, though people do get away with defrauding the system.

<comment><USER7> It was Massachusetts. A number of people told me later that I could've collected, and a quick glance through Massachusett's Unemployment Insurance FAQ shows no mention of being a student other than UI not covering student work-study programs for financial aid:

[http://www.mass.gov/lwd/unemployment- insur/resources/questio...](http://www.mass.gov/lwd/unemployment- insur/resources/questions-and-answers/claimants/eligibility.html)

I didn't because it never occurred to me - as far as I was concerned, I left my job normally to go to college and they just didn't pay out the vacation pay. I wasn't hurting for money then or now (I was still living with my parents at the time), so I don't really regret it, but it does appear to be a real, genuine loophole in the system.

</comment></comment></comment></comment></comment><comment><USER9> When everything has been "We have to work really hard and long hours just to keep the startup alive!" (we were working 60+ hour weeks every week) and suddenly there's nothing to work on, and you're told you can take a few days off, and the boss is suddenly a lot harder to get ahold of (he worked in the parent office and came by to visit as much as possible).

...the next time you see your boss in person might be to tell you the apps he pretended were successful didn't actually make any money and he has to close the company down.

</comment><comment><USER9> When you make a hotel reservation to go to a conference in three weeks (Nintendo conference in Los Angeles in my case) and the parent company calls and tells your boss "Wait! Don't make any travel plans! Also, we're going to visit in two weeks!"

....yeah, we basically twiddled our thumbs for two weeks until they came by to pack up our servers and fire everyone.

</comment><comment><USER10> When your company sends a press release about the layoffs to the wire services and it accidentally gets released 24 hours before the event.

</comment><comment><USER11> One-on-one meetings suddenly scheduled after management themselves have been in meetings for an unusually long time.

</comment><comment><USER12> The one that got me, was the German company I was working for was bankrupted by the president of the company as a key sale of the software product fell through. He did it on December 23rd, before any of the directors could intervene (A quirk of german company law).

I found out on the phone on the 28th while back in the UK. Fun times.

So my contribution: "When it appears the directors bet the company on a single sale and failed."

<comment><USER13> Honestly, I think that is what you heard down the grapevine. Sounds like a cover up for something much more heinous. Was this information public/private, how did you find out? (Not attacking your trust, just sounds a bit odd to me)

<comment><USER12> I flew back and collected my stuff, even going back to the office. The place was dead and I met with some of the people. They were in utter shock. Over 30 people's livelihoods destroyed.

<comment><USER13> Really terrible. Since working at a corporation, I no longer look at Dilbert comics the same way. Man, so much waste, so much lack of backbone, so many of the wrong people in the right positions. I'd really like to read a book that explains why almost every corporation, aside from maybe a select few, have the "oh-thats-just-a-quirk-of-XYZ-leave-it-alone-not-worth-getting-fired-over." You basically end up getting a workforce that does the bare minimum to say they are still working. I mean, I talked to my manager the other day, an abusive one at that, and I told him, just do it already, fucking fire me. But he says he can't. I will just be "purged" by the performance review process.. What a fucking joke.

</comment></comment></comment></comment><comment><USER14> When the CTO stands up and says "there will be no layoffs" it's time to clean up your resume. Happened to me twice.

</comment><comment><USER9> When you're a contractor and a project you were working on gets cancelled internally, the only other developer leaves for greener pastures, and suddenly your boss takes an added interest in everything related to your work, and makes sure to get the passwords for various things.

... you might get a call as your driving home from work that day to tell you not to come in to work the next day because your contract has been terminated, and they'll ship your desk contents to you, eventually.

<comment><USER15> Or you get that call telling you not to come in the next day. Then a day later they call you telling you need to bring the computer back in right now.

What follows is a back and forth exchange of "I'll bring it in when I feel like." "That's unprofessional." "You mean unprofessional like having someone do something for you when you're not paying them or laying someone off by email unprofessional?"

</comment></comment><comment><USER16> Cancelling the company Christmas party has been the sign of a death spiral for two companies that I worked at.

<comment><USER17> A similar anecdote from one previous employer: at that company, we had a lot of remote B2B sales people all over the country and even one overseas. On rare occasions, there would be a sales meeting where all the sales people come in to meet with the top executives personally and discuss strategy.

Well, my first couple of years at the company, there was a sales meeting to coincide with the Christmas party. Basically, all of the sales people were flown in to attend the Christmas party and they justified it as a business expense by having a strategy meeting sometime that week. One year, that didn't happen. I mentioned offhand to somebody "too bad the sales guys couldn't make it", and I was outright told that they skipped out on the sales meeting to save money. So we had a Christmas party, but we cut back the invitations.

That was no surprise, given the events of the previous few months. They had been actively trying to shrink the company by attrition; i.e., letting employees quit and declining to hire a replacement. I also don't know anyone who got a raise that year. We ended up losing a lot of people just from that alone. They also fired a bunch of sales guys for underperforming and hired a bunch more who were almost exclusively paid on commission... and I'd heard that the CEO specifically intended to flood the company with commission-only sales hires because he didn't have to pay them more than peanuts unless they brought in money.

The next few months were brutal. January opened up with two executives being fired -- while the actual _reasons_ for the firings were because of a power struggle, they weren't really replaced. One of them had his power distributed among the people who reported to him, and another was replaced by "promoting" multiple existing employees while still making them do their previous jobs. One of those was fired only a few days after being promoted, too. The next month, I was laid off. I heard through the grapevine that shortly after I was laid off, they laid off another guy and closed the entire India office, letting everyone go except one or two employees who were transferred to the home office.

</comment></comment><comment><USER18> When you are asked to sign a non-compete agreement, or agreement to use binding arbitration where no such agreement was in place before.

When your supervisor isn't interested in keeping you busy.

When suppliers call you instead of accounts payable because no one in accounts payable is answering the phone.

When you can't get approval from the top for ANY large purchase requisition.

When the VP of HR is extremely busy just before really bad quarterly results are announced.

When the CEO of a California-based Corporation is overheard in the hallway bitching about onerous employment laws.

When there are lots of unfamiliar people walking around the place in suits, and a lot of closed door meetings.

<comment><USER10> Closed door meetings with odd combinations of managers that don't normally meet is a HUGE red flag.

</comment></comment><comment><USER19> When you wake up to this [https://twitter.com/bartt/status/653946266938818561](https://twitter.com/bartt/status/653946266938818561)

<comment><USER20> Wow that's brutal, especially the Github subject but from what I gathered he missed a call that went to voicemail.

</comment></comment><comment><USER21> Your manager wants to add an admin account to the laptop you have been using for over a year.

</comment><comment><USER22> When the CEO puts "restructuring meeting" on the shared calendar accidentally.

</comment><comment><USER23> "It's not you, it's us. We still want to be friends."

</comment><comment><USER9> When you get asked to wait two weeks because the main client hasn't paid yet because their assets aren't "liquid enough" (the client said that to everyone himself). And then they ask you to do it again a month later.

...you might get called in to be told the company can't afford you anymore and get laid off with two-thirds of the staff.

</comment><comment><USER24> When you move into a New (New Lease/New Construction) building for the organization. Two for Two so far in my career.

</comment><comment><USER25> Warning sign you're getting bought: someone asks for the licenses of all the open-source libraries in your stack...

<comment><USER26> Or that a "board member" wants detailed write ups on your processes.

</comment></comment><comment><USER17> Here's another one:

Executives leave the company, and their replacements have lesser titles and are existing employees who have to continue to do their existing jobs in addition to whatever function they absorbed. Bonus points if the executive's function gets divided up among multiple employees.

</comment><comment><USER27> When a consultant comes in and interviews you about "what exactly you do," nodding generously and saying, "oh wow, yeah" every few sentences.

When management seems to continually allow ridiculous overreaches in employee behavior, especially when such behavior is critical of management.

</comment><comment><USER28> When higher ups who barely acknowledged your existence suddenly become very interested in your future availability. Companies love to settle group layoffs in 1 swell swoop. My multi week vacation may have bought my team more time and more importantly another month of health insurance.

</comment><comment><USER29> When all your external vendors and subcontractors are told to stop working and ship back all materials.

<comment><USER30> Also when external vendors start dropping hints to you that they haven't been paid for their previous invoice (and you are not responsible for finances).

<comment><USER29> That's a great one.

</comment></comment></comment><comment><USER17> I got hit by II, back in 2010. They hired an intern, asked me to train her... a month later, I was laid off.

Also, I knew a number of people who worked for a local video game company who got the axe after their paychecks had been late for a while. They were all complaining that they haven't been paid in about two months, and then one day the CEO calls people into his office one at a time... 11 people were let go that day. A bunch more got the axe about a month later. They weren't a big company. It took a while for them to get their final paychecks, and I think that was only because a couple of them threatened to sue.

(edit: just to make this clear, I didn't work at that video game company, but several friends of mine did, and I got to hear the stories)

<comment><USER20> Sounds very similar to Crytek.

<comment><USER17> It wasn't. The company I'm talking about was based in a suburb of Dallas and only had the one office. In fact, I believe that after the layoffs they actually got rid of their office for a while and worked out of the CEO's house for a bit before they could afford to rent space again.

Much smaller and lower-profile than Crytek, though they still have their own Wikipedia article.

By the way, even before the layoffs, the CEO was notorious for firing anyone he felt had a "bad attitude", including a world-renowned living legend of a developer who was suffering from severe depression and had been previously hospitalized for a suicide attempt.

He was known for working his employees to the bone, developers regularly slept at the office, and the company was a caricature of every overtime-happy game developer. One of my friends took up smoking and was addicted for a few years because the only way she was allowed to leave her desk was to go on a smoke break and sitting in one place for so long was getting physically painful. They also had a policy where no matter how late you stayed the previous night, even if you were there until 3am, you had to be in by 10am the next day or they'd dock you a vacation day.

</comment></comment></comment><comment><USER31> There was this one time that I suggested cross-training to reduce the bus factor, and management went with it. I was being sincere, but I have to admit that it was amusing watching everyone think they were going to be laid off when we implemented it.

<comment><USER32> I am big on cross-training to avoid the bus factor! But everyone gets paranoid, the problem is it needs to be ingrained in the culture to thats "what you do" and not have it just pop up all of a sudden, thats what gives people trepidation.

</comment></comment><comment><USER33> When your network login suddenly stops working.

<comment><USER33> Or, when you get a weird email from the payroll system about having just withdrawn /exactly/ how much PTO you've accrued.

</comment></comment><comment><USER34> When the Director of HR and VP of Legal send a meeting request to you.

<comment><USER6> Actually, I got a surprise meeting request with CIO and Global Head of HR (and not even of his grim minions) - which I didn't think was good.

Got the meeting request while I was out of the office - got in to find my account locked out...

Not good I think - but I was on 6 months notice so WTF...

Turns out I was being notified of a restructuring and a new boss and my account being locked out was an unfortunate coincidence.

Mind you the entire office did get the bullet about a year later - I'd left by that point as it was clear that something was up....

</comment></comment><comment><USER35> here's another sign you're about to be laid off: none of this happens, and you haven't done any real work in months.

</comment><comment><USER36> When you are told to stay in your cube and NOT MOVE.

Then people walk by and pat you and the back to come to another room.

Source: [http://www.ihatedell.net/forum/phpBB3/viewtopic.php?f=9&t=17...](http://www.ihatedell.net/forum/phpBB3/viewtopic.php?f=9&t=17068)

(search for "day in 2001")

</comment><comment><USER37> When somebody needs to say "let's get all outstanding code checked-in ASAP!"

<comment> nevi-me That one's in the article.

My contribution: when we have a new CEO and she starts asking how much revenue cost centers generate.

<comment><USER37> You misunderstand me - the fact that there is "outstanding code" should have alarm bells ringing

</comment></comment></comment><comment><USER38> An old one, but also be weary of private meetings with your boss on Friday.

</comment><comment><USER6> When a company that was previously very strict about line managers setting yearly and half-yearly performance objectives suddenly doesn't set any....

</comment><comment><USER30> Having the entire team suddenly focus on a superfluous project like the company intranet or any non-critical busywork. Not a good sign!

</comment><comment><USER39> Any announcements on a Friday especially before a long weekend.

</comment><comment><USER40> Looks like I'm going to be laid off soon :'(</comment>