Amazon to ramp up counterfeit reporting to law enforcement - <AUTHOR> https://www.reuters.com/article/us-amazon-com-counterfeit/amazon-to-ramp-up-counterfeit-reporting-to-law-enforcement-idUSKBN1ZC25U <comment><USER2> The problem is not that counterfeiting is not being reported to law enforcement. The problem is that Amazon is doing far too little to allow them to enter Amazon's marketplace in the first place.

Amazon is making it far too easy for fraudsters to sell their crap, and (from what I hear) repeatedly: products removed because of counterfeit issues get re-added the next day under some other (or new) product code, or seller ID.

I work in the banking industry. It's not very unusual to discover that a client might be doing something that is suspicious enough to notify law enforcement of it (these notices are mandatory).

But that's the _last_ line of defense. You're supposed to attempt to prevent these situations from happening in the first place, hence there are strict AML/KYC procedures.

If a bank were to open a new account for a client they had banned in the past for other reasons, financial supervisory authorities would bring down the hammer on them so fast and so hard, they'd regret it a thousand times more than whatever business they expected to make with that client.

Amazon's claim that they can't do more against counterfeits than they are already doing now is bullshit. There's an entire industry with decades of experience in that matter that they could turn to. But why would they.

<comment><USER3> 100% this.

Buying counterfeit items unintentionally can create huge problems for the consumer (eg [1]). Why is the onus on the consumer to look at a listing and decide if it's counterfeit or not?

Amazon is probably taking the stand they're no different to a search engine and Google isn't (mostly) responsible for search results. But that analogy is not apt.

The comparison to banking is far better. Banks can be held responsible is they fail due diligence with customers. Amazon should be held to the same standard.

Like how drop shipping fraud can even exist on Amazon is amazing. This should be so easy to detect (ie lots of shipments to one address or cluster of addresses).

No one should be able to sell branded products on Amazon without being verified. Period. And Amazon should be wholly responsible for any counterfeit that occurs as a result.

[1]: [https://www.racked.com/2018/1/8/16849298/amazon- counterfeits...](https://www.racked.com/2018/1/8/16849298/amazon-counterfeits- global-entry-customs)

<comment><USER4> If Pirate Bay can be charged with contributory infringement, then Amazon should be held liable as well.

<comment><USER5> This is a really good point.

We could probably even pile on the health risks associated with products like cosmetics and otc medicine.

</comment></comment></comment></comment><comment><USER6> Seems to me to be a minimum response meant to satisfy vendor outrage and hold off law enforcement investigations.

The headline is very misleading and makes me wonder if it came from an Amazon press release: _any_ crack-down on counterfeiters on Amazon, no matter how slight, would statistically qualify as a "significant ramp-up" compared to their previous habit of doing nothing until being threatened with a law suit by vendors.

<comment><USER7> It seems like permanently freezing counterfeiters out of the marketplace would be the obvious thing to do, and if Amazon lacks the technical capacity to do so or to prevent their return I'd say that's a pretty fundamental problem.

<comment><USER8> > It seems like permanently freezing counterfeiters out of the marketplace > would be the obvious thing to do, and if Amazon lacks the technical capacity > to do so or to prevent their return I'd say that's a pretty fundamental > problem.

If it was that easy to "permanently freezing counterfeiters out of the marketplace", they would have done it already. Blocking somebody, especially somebody with a strong financial motive, from doing something on the internet is incredibly challenging. They'll go to great lengths to route around your block using all kinds of fun exciting methods. Methods might include creating a new account with a different business & address, taking over the account of a dormant but reputable seller, and probably a huge list of other things I can't even think of right now.

But seriously. Blocking or banning people on the internet is almost impossible. If they have the will, they'll find a way back onto your site.

<comment><USER7> I reject that entirely - we're talking about giving people access to a selling platform, not a social website which depends on maximum user growth and minimal barrier to participation.

Amazon has prioritized growing the number of sellers, but they're in complete control of who they allow to sell on their platform, and what they require from sellers prior to beginning. You seem to be accepting, uncritically, the argument of "platforms" everywhere who don't want to be held responsible for what their "users" do. I don't agree with that perspective generally, and I think it's especially silly with respect to a web commerce company like Amazon.

<comment><USER8> You can reject all you want, but the reality is that it is almost impossible to block people on the internet. You cannot change this fact no matter how much you wish it were so.

This is probably why amazon wants to get law enforcement involved. Those folks _can_ stop the people behind the fraud....

<comment><USER9> Account verification is orthogonal to communication channel. There's nothing about the internet that precludes identity and other KYC checks. Your argument only makes sense if Amazon needs an extremely high throughput and low latency of new vendors coming online. The status quo has certainly been fantastic for their business, but I don't see any reason why they can't afford to add a little friction there.

<comment><USER10> So what do you do when someone passes KYC and is still a fraudster?

I would think you would report them to the authorities... which seems like what they are doing

<comment><USER11> You ban them from your platform, and since you know them, they'll have a really hard time getting back on. And yes, report them to the authorities too.

<comment><USER8> If you think it is that simple, clearly you've never worked in the field.

<comment><USER11> I never said anything about it being simple. But what's the alternative? Just give up, and accept bad behavior?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> And what exactly is "law enforcement" going to do about this? Not much.

It's not like Mr. FBI Guy is going to knock on the door of a counterfeit factory in China and say, "Can you pretty please stop making garbage that looks like quality merchandise? KTHXBAI"

It's my understanding that stopping counterfeits are usually the province of Customs. But that department is already overwhelmed by dealing with the existing flow of counterfeit items and only stops a very small percent of them getting into the country as it is.

This move by Amazon feels like a PR stunt, or offloading its responsibility to its customers onto the government, and will not actually have a material impact.

</comment><comment><USER13> The cognitive load of trying to figure out which items are possibly counterfeit is one of the reasons why I closed my Amazon Prime account.

<comment><AUTHOR> I shared your unhappiness re: not knowing if I was unwittingly buying a counterfeit. However, rather than close my account, I do my research on Amazon as far as I can take it, then go to the website of the manufacturer (Garmin, Das Keyboard, Bluelounge, etc.) and buy direct from them. No counterfeits EVER.

<comment><USER14> I do the opposite. Amazon browsing is next to impossible unless you already know what you're looking for. For all the complaints about counterfeits I've never once received one.

Even stuff I thought would definitely be fake (electrical components) was legit.

</comment></comment></comment><comment><USER15> I bought a cologne from Amazon that I felt is not genuine. I bought another one from Amazon and bought the exact same thing from the company online store. Surprised to see they were very different in packages and product shape. The scent was different according to many blind tests I did myself and using my friends help. I posted a review on the listing[1] pointing all of this out. Called Amazon and they refunded my money immediately and asked me to discard the product.

This product was SHIPED AND SOLD BY AMAZON.

It's not a 3rd party seller problem. Amazon might be using 3rd party suppliers too.

[1] [https://www.amazon.com/gp/customer- reviews/R2AHKXNOEL585S/re...](https://www.amazon.com/gp/customer- reviews/R2AHKXNOEL585S/ref=cm_cr_dp_d_rvw_ttl)

<comment><USER16> I bought a counterfeit hummingbird feeder on Amazon, which leaked sugary water everywhere.

I didn't even know it was counterfeit until I saw the identical one at Home Depot. Surprised that HD would sell something so non-functional, I took it apart and noticed it was assembled entirely differently - excluding the screw on the bottom that caused the Amazon one to leak. Both were completely identical on the outside.

Imagine what else we're buying if something as banal as a _hummingbird feeder_ is counterfeited and sold via Amazon.

<comment><USER17> Was it this one: [https://www.wpri.com/news/call-12-for-action/counterfeits- on...](https://www.wpri.com/news/call-12-for-action/counterfeits-on-amazon- cost-warren-bird-feeder-business-1-5m/)

<comment><USER16> No, it was a cheap red plastic one, but that's kind of hilarious that there's more than one counterfeit hummingbird feeder.

<comment><USER17> That is not even the only fake birdfeeder I've seen on Amazon! I'm in a couple bird nerd fandom subreddits and people discuss counterfit birdfeeders and anti-squirrel feeders on the subs weirdly frequently. Basically Chinese firms reverse engineer the designs, swap out for bottom barrel components and profit off the price arbitrage.

At least when you go to the faux-product markets in real life on the streets of NYC and SF you know you're getting a "Kate Slade" bag not a Kate Spade bag etc. But on Amazon you're just fish in the barrel and not even getting a good deal for buying the sketchy or off-label item.

It's a bummer and I wish Amazon would deal with it.

</comment></comment></comment></comment></comment><comment><USER18> Seems to be a lot of comments in here supporting Amazon (I never got any counterfeits) and even victim blaming like you noted (if you got counterfeit, you should have known; therefore, you wanted it).

Reminds me of the PR attack on lawyers and the plaintiff and the McDonald's coffee. Sure its easy to spin a case that awarded millions for spilling hot coffee and victim/lawyer blaming...then come to find out the McDonald's systematically heated their coffee above safety and industry standards, had already been warned, and lid was not fasten properly, and the woman had 3rd degree burns through her jeans on her privates/thighs requiring skin grafts. The "millions" was punitive for McDonald's willfully disregarding prior warnings about their coffee and calculated as 1 day of coffee sales (seems pretty reasonable).

I can't wait until someone sues Amazon and all the documents and communications leak revealing what Amazon executives knew about the counterfeits and how they willfully refused to make changes to curb counterfeits, and rather took actions to facilitate and cover up the source of counterfeits (co-mingling products).

<comment><USER19> Unfortunately it probably won't happen until something happens to someone.

Remember Amazons response to the counterfeit eclipse sunglasses? They knew if something serious happened then they would be up a creek on it.

But if someone buys a fake purse or SD card, how much damage is going to happen.

There might be a class action with certain products and I could see damages from SD cards that were defective.

</comment></comment><comment><USER20> Can someone explain why (legally) amazon is not itself, "the culprit?" What are the obligations/liabilities of a retailer?

<comment><USER21> They claim they are just a platform for their third party sellers so if a third party seller send you a fake or dangerous product then they are "the culprit," not Amazon, Amazon is just a middleman. Of course, most third party sellers who send counterfeits are Chinese fly-by-night operations that can't be located to sue when someone gets hurt.

<comment><USER22> I wonder how tested in the court is this theory? Is it established precedent? Because as a consumer, I'm shopping on Amazon.com and I pay Amazon.com and I receive goods from Amazon.com. Maybe they're legally sound, but it sure looks like I'm transacting with Amazon.com and not some third-party seller most of the time.

<comment><USER23> Yes it has been tested in court and amazon has lost. In the case of Oberdorf v. Amazon.com Inc a woman was able to sue Amazon. However this ruling depended on the original seller not being available.

<comment><USER22> Nice, thanks for the reference case. I'll check it out.

</comment></comment></comment></comment></comment><comment><USER24> I don't know about other people but I've never had this issue and I use amazon for everything I can...

<comment><USER25> > I've never had this issue

We're talking about counterfeits. You don't _believe_ you've ever had this issue, but why would you be certain?

<comment><USER24> At the risk of going all zen... If I receive a counterfeit good and it's so good I don't notice, was it really counterfeit?

<comment><USER26> I guess there's safety concerns from sub-standard components burning out, or storage sizes being fraudulent and you only noticing when it's too late, or good-old lead paint, or more issues.

But yeah, I have never even had a hint of any suspicion that anything I've bought on Amazon was a fake.

<comment><USER24> I read a really interesting article once about a 128MB sd card having its firmware flashed so it claimed to be a 512MB. You saved files and when you got to the "128th" MB it just started writing at the 0th sector again...

I thought that was a very clever fraud. Can't find the article now but I'll check on desktop later and share if I can...

<comment><USER27> This is a very common problem. SD cards have microcontrollers running on-board that the manufacturers can reprogram to report any size.

</comment></comment></comment></comment></comment></comment><comment><USER28> The risk of counterfeits means I will rarely buy anything electronic from Amazon.

On the other hand, take a category like pet toys. Cheap plastic things where I'm not concerned with getting the genuine article, like a collapsible dog bowl. There are dozens of identical "brands" with thrown-together phonetic names for an entirely identical product with slight price differences. How do I began to choose? And who's to say any of them are produced with safe materials?

I'd really like to know how well Amazon's "put anything on the digital shelf" strategy works over a curated product inventory. Exceedingly well, I suspect, but it seems like the blowback over poor product will continue increasing.

<comment><USER29> Pet toys and food were the first thing I stopped buying off of Amazon. I have zero faith in the quality control of the product coming down - in the United States, at least, pet food and pet toys are actually held to a decent standard.

<comment><USER30> Even American pet food/treats is riddled with frauds or questionable companies. There's a treat called No-Hide that people have sent in for DNA testing and other testing that is suspiciously similar to rawhide despite being claimed to be starch based The Pennsylvania Department of Agriculture did an investigation and this person FOIA'd the documents and the testing shows a lot of discrepancies even though the government cleared them of misbranding. [https://truthaboutpetfood.com/is-it-no-hide-or-rawhide- from-...](https://truthaboutpetfood.com/is-it-no-hide-or-rawhide-from-china/)

</comment></comment></comment><comment><USER31> Law enforcement is going to love being inundated with tons of different requests from Amazon constantly. Counterfeit goods is probably one of their lowest policing priorities. This is just Amazon passing the buck so they can point and say "we did something!".

</comment><comment><USER32> {Will, Does} Amazon report back to buyers that they've bought counterfeit merchandise?

<comment><USER33> Currently, no.

I bought a car part on Amazon that, when I opened it, was a chunk of blue clay in a box that was poorly-printed to look like the box of the correct part. I never bothered to return it because the cost of shipping and my time would have been more than the cost of the part.

I'm sure this seller was eventually discovered to be selling obvious fraudulent goods, but I never received any notification saying as much.

<comment><USER34> Cost of shipping? Time? Returning this kind of stuff is something Amazon if very good at. It won't cost you anything and they have dozens of ways of returning things (by mail, from a UPS store, from Kohls, they will come and pick it up, etc.) Returns are easy and free.

<comment><USER33> My hourly rate after tax is about $50, let's say $60 for easy math. That means that returning a $7 item has to take less than 7 minutes to be worth it, less if there's other costs besides time. I'll easily spend that much time in the car.

In many (most?) cases time=money is a false equivalence because time spent doing something isn't necessarily always time you would be spending working, but the local postal services are only open during hours I would be working, so it's not a false equivalence in my case.

Receiving the item you ordered and paid for is easy and free. Returns are not.

Why are we even having this conversation? They sent me a box of clay when I ordered a car part. This isn't an ambiguous situation.

<comment><USER35> For the time you spent typing this comment you could have created a return and had UPS come pick up your package or in my experience, Amazon wouldn't have even required you to return the item and would have just sent you a replacement.

Also, I see your rationale and think you are really missing the point. You may have a small hourly rate of $60 and use that as justification but its complete garbage. I do better than that and I work with guys who literally make 10's of millions a year. Taking a preventable loss that only requires a phone call or a chat is foolish, even if it is $7.00.

<comment><USER33> If we're going to talk about missing the point: Which is the better way to prevent the loss?

1\. Order item from Amazon, discover item is a block of clay, go through the Amazon returns process, reorder item, which may be a block of clay again.

2\. Order item from a site that ships me the item I order instead of a block of clay.

So again, why are we talking about this? We can argue as much as we want about Amazon's return policies, but the return policy would be irrelevant if they had sent me the item I ordered instead of a block of clay.

</comment></comment></comment></comment></comment></comment><comment><USER36> I've bugged Amazon about counterfeit dust masks (and complained about it on HN too). Some masks claim to have valid NIOSH certification but don't, some advertise themselves as NIOSH certified but use a certification number that was revoked by the CDC 10 years ago, make claims about being N95 without providing any lab references, etc. All of the listings I've complained about are still up on Amazon.

<comment> munk-a Have you tried contacting legitimate manufacturer's? The way America works it's sort of incumbent on you, the consumer, to try suing Amazon on their fraudulent listings, but that takes a lot of money - but I bet actual mask manufacturers would be quite willing to defend their territory.

Especially with dust masks I feel like there might be departments in OSHA or the FDA that would help out here, but I don't know what they are or if they've been declawed.

</comment></comment><comment><USER37> I left a negative review on a 4GB USB thumb drive that was being sold as a 1TB model by a seller on Amazon. The review was rejected by Amazon because my claims didn't follow their guidelines (no specifics as to how so). Amazon is ___actively_ __engaged in false advertising, counterfeiting, and bait and switch scams.

Where is the FTC? How is this not the most clear situation where government action against a corporation (Amazon) is needed? I've been called a libertarian and even I think this the kind of situation we need government for.

<comment><USER38> > The review was rejected by Amazon because my claims didn't follow their > guidelines (no specifics as to how so).

Reviews have to be about the product. Amazon likely interpreted your review as "I received an incorrect product" which is a seller issue and has to be in seller feedback, not product review (which are shared between multiple sellers).

</comment></comment><comment><USER39> I've had a few instances where I have ordered a product that was listed as "Ships and sold by Amazon.com" and still received a counterfeit product.

Only to go back to the reviews later and see the "Most Helpful" review reports that their item was counterfeit as well.

Anyone care to elaborate how this is possible? Surely Amazon is not doing this intentionally, are they just getting ripped off by their suppliers?

<comment><USER40> AFAIK it's because Amazon mixes their inventory with other fulfilled by amazon vendors.

</comment></comment><comment><USER41> Amazon trying to outsource their product quality to the federal government like they outsource food costs by having their employees on food stamps.

</comment><comment><USER42> Wasn't the main problem that Amazon comingles inventory, therefore making the main way product quality would be signalled to buyers (reviews) useless?

</comment><comment><USER43> I wonder if this has anything to do with the fake 1TB USB drives John Carmack bought and wrote about on Twitter.

Edit: well thanks for the downvotes... anyone want to me what I did wrong?

<comment><USER44> If I had to guess, I'd say you're being downvoted because a tweet from John Carmack is not influential enough (by several orders of magnitude) to cause policy change at a company the size of Amazon.

<comment><USER43> I figured he has plenty of followers to ignite some kind of larger discussion about policy, just a few days after tweeting about it. I guess we don't reply to disagree these days, just downvote.

Serves me right, I'll keep it to myself rather; might as well have made a troll comment about Trump or something, didn't expect that at HN.

<comment><USER44> It's a tweet with 139 retweets and 1400 likes. If you think that would influence Amazon, I have a bridge to sell you. And it's not like this was a previously unknown issue.

<comment><USER43> > If you think that would influence Amazon, I have a bridge to sell you.

You know I didn't even presuppose it, I dared to wonder out loud if it might be related since I'd seen an example of this Amazon counterfeiting just the other day from a somewhat well-known guy called John Carmack. Maybe there would have been some interesting discussion, I dunno; but it looks like no one is selling any bridges, just downvoting questions.

You're probably right, and I never disagreed with you; thanks for the snark.

</comment></comment></comment></comment></comment><comment><USER45> Is counterfeiting really bad?

<comment> dan-robertson Is it bad when you carefully try to make sure you are ordering a good quality product and instead get something shit quality? I think it's wasteful and bad for the environment. It's also a waste of time spent trying to choose the right thing and a waste of time and thought spent returning it (if one even bothers).

It is also bad for the company whose product is being counterfeited because their brand is associated with the poor quality knock off.

This is also the reason I hate print on demand and think the seller should have to specify how a book was printed.

Maybe you think counterfeits are equal in quality to the genuine articles. In that case I think the argument is different. But I don't believe that is the case.

<comment><USER46> The issue - as I see it - can be divided in two.

I mean, if you are really willing to buy an original product, a minimal check can be the price asked for it.

Any good today is made of materials+manufacturing+marketing, it has some costs and a corresponding selling price with a given markup.

Once said that a number of branded items can have a selling price that seem completely disconnected from the relative costs, there are limits.

If you can find an item on the manufacturer site at US$ 100, do you really believe that you can find the SAME item on Amazon for US$ 10?

If you find it at say US$ 80 or 75 or even US$ 50[1] and it comes out as being counterfeited, you may have some valid expectations ruined by Amazon, but if you ordered it for 19.95, free shipping, did you really believe it was "original"?

[1] it is one of my per peeves, if you look at the price of many electronic goods, let's say printers or TV on the official site of the manufacturer they are often double their "street price", either online or at the nearest large shop chain. I often wonder how many printers Brother (say) sells from their site.

<comment><USER47> 20 years ago, I was looking for a SCSI card, direct from the manufacturer and knew it should be like $250-$300. However, no price was listed. I figured if I added it to my cart and went to checkout, theyd have to tell the price. It showed as $0. Proceeded to checkout, paid $7. Thought for sure theyd cancel the order, but nope, it shipped and arrived in about a week. That card was awesome.

<comment><USER46> I don't understand the relevance, you exploited a bug in the vendor's paying or ordering/delivering system, what has this to do with counterfeiting?

</comment></comment></comment></comment></comment><comment><USER48> The only occasions I've received counterfeit items the price had been suspiciously low to the point that I had a pretty good idea what I was in for, and was OK with potentially receiving knock-offs at a massively reduced price.

Is this not usually the case, are scammers out there charging full price?

For better or worse, I like having the _option_ , as long as I am getting a discount and know what I am getting into.

<comment><USER49> > For better or worse, I like having the option, as long as I am getting a > discount and know what I am getting into.

I kinda agree with you there - sometimes I want the cheapest thing possible, and I know I may get junk, but it's my money to spend.

Recently on Ebay I purchased a welder. This welder was supposed to be a multi- process switch-mode DC mig/tig wire feed welder, somewhat similar to the mid- range models Harbor Freight sells.

Now - this is the thing - similar welders on Ebay were selling for around $200.00. But I spotted one listing, that was being drop-shipped out of Hong Kong, posted for "buy it now, free shipping" for $20.00!

I thought "well, I'm not going to pass this up - let's see what happens" and I put an order in. I figure it's either going to be rejected by the seller (that they would see they forgot to enter an extra zero), or it's going to take the slow-boat well past the return period, and if I'm lucky I'll receive a "DIY" put it together yourself box-o-junk.

Amazingly, it supposedly "shipped" \- now, I didn't even get a simple China Post "tracking" number - but it said it cleared customs in Hong Kong and was on its way. I guess I'll see if and when it gets here.

I'll be shocked, though, if it's a full and working welder. If it looks anything like an actual welder, I'll probably take it over to my friend's house (he has a full metal working shop) to try it out and see if it catches on fire or something.

That's the kind of thing I like to see - sometimes, I get surprised by sellers; maybe it was counterfeit, or maybe they made a mistake, but they still honor it. Heck, I've had sellers in the past send me the wrong item, tell me to keep it, and then send me two of the right item for free. Yeah - they get a good review for that kind of service.

<comment><USER50> You can pay with your life or your health if you're willing to take such gambles. But, yes, i agree that you should be able to risk. However, I think this should have some sort of flag for whoever isn't aware that they're taking a risk.</comment></comment></comment>


SSHelper is going away after recent Android changes - <AUTHOR> https://arachnoid.com/android/SSHelper/index.html <comment><USER2> Bad to hear. I use Termux and aware they used an older API to support SD- Cards. Although to be honest, I don't do anything with Android anymore aside using it as a phone. I think iOS and Android are both bad operating systems. Not by technical merit, but certainly by policy decisions.

I don't really buy the security angle here to be honest and Google wouldn't need to catch up with anyone, Android has a ~75% market share, iOS is at ~22%. Forecast say it is rising. They want an ad and surveillance platform with lock-in to their services.

</comment><comment><AUTHOR> I'm an enthusiastic user of SSHelper, a tool that starts an SSH server on your Android phone. For me it is the fastest way to rsync pictures from my phone to my PC. Today I've realized that soon it won't be possible any more. Another recent HN post complained about the lack of Android push solutions that do not require the cloud. My concerns go in the same direction. Manufacturers want us more and more to rely on cloud services, where a more intimate LAN + SSH combo would do the job.

What are the alternatives for the tinkerers of us?</comment>


Why the Feds Want to Give Aspiring Entrepreneurs Unemployment Benefits - <AUTHOR> http://www.businessweek.com/articles/2012-12-17/why-the-feds-want-to-give-aspiring-entrepreneurs-unemployment-benefits

<comment><USER2> This should bring more honestly about how the system is actually working in practice. I would wager that anyone aspiring to start a business with their unemployment benefits could do so by being discreet and waiting until the business is off the ground before canceling their unemployment benefits. I personally know people gaming or even outright scamming this system. You only need to show good-faith evidence of applying to full-time jobs to receive the benefits. As long as you ensure your business is not making money until you're off unemployment benefits, it's hard to get caught.</comment>


Why Healthcare.gov Sucks? They Hired Political Cronies, Not Internet Natives - <AUTHOR> http://www.techdirt.com/articles/20131010/01484924821/

<comment><USER2> pretty much explains why the 10th amendment to the us constitution needs to be followed. centralized government inherently migrates towards corruption. competition between the states is a nice restraint against such stupidity.</comment>


Don't use class names to find HTML elements with JS (follow-up w/ new metrics) - <AUTHOR> http://roytomeij.com/2012/follow-up-don-t-use-class-names-to-find-html-elements-with-js.html

<comment><USER2> Accessing the DOM is always slow in relative terms. In might not be applicable to everyone, but if you're accessing the DOM for view template purposes - I'd recommend using require.js with the text plugin instead.

And in all other cases, cache the jQuery object as early as possible in your module (i.e. assign `this.$targetEl = ...` in any init function you have ... so by the time you need to actually access/move/etc. that element, its already waiting for you.</comment>


Harmful Drinks in America (Diet info + nice graphics) - <AUTHOR> http://worldmysteries9.blogspot.com/2010/05/harmful-drinks-in-america.html

<comment><USER2> Cold Stone PB&C (Gotta Have It size, 24 fl oz) 2,010 calories 131 g fat (68 g saturated) 153 g sugars

Wow. Just wow! You must feel bad/ill after drinking it, right?

<comment><USER3> I suspect people develop a tolerance and their bodies grow accustomed to the large sizes. I see a guy at my local convenience store who fills up on a 24-ounce (700ml) soda and a king-size candy bar every morning. I swear he's gotten fatter over the last few years.

Of course, I'm usually getting a similar volume of coffee so I can't say anything...though in my defense, that usually takes me until 3pm to drink (I don't mind it going cold).</comment></comment>


A smart way to get a job; using google. - <AUTHOR> http://gizmodo.com/5538241/the-smartest-way-to-find-a-new-job-on-google What you you put in your ad to get a tech job? <comment><USER2> Dupe: <http://news.ycombinator.com/item?id=1342748></comment>


Ask HN: How to get recruited at a US based startup? - <AUTHOR>

I am a python developer from India and have applied to many startups in Silicon valley and California and get rejected every time even though they like my profile due to their inability to sponsor my work visa. Where can I find the startups who offer work visa sponsorship? <comment><USER2> Without a lot more details, it's impossible to say anything specific. At the very least, I don't think anyone here could tell you if visa is really the reason you were rejected by the startup - it could just be the most convenient reason that the startups gave you.

It's very very hard for startup to sponsor you a work visa, whether they want to or not. Every year, the new window for applying the working visa (H1B) starts at April 1st, last year it took one week to fill out 210% quota of the visa for the whole year (translation: even if you did apply, you have less than 40% of getting the visa). And the visa won't take effect until October of the same year. It means that for a company, they have to wait for you at least 6 months before you can work (not counting any other months of interviewing and otherwise). For that reasons, most companies that can sponsor visa only do so for people who can already work using another visa, while waiting for the H1B visa. Not to mention the chance of not getting the visa in the first place.

That said, do you _want_ to work for a startup, or just come to work in the US? If it's the latter, you might have better chance with finding a subsidiary of a US company in India, and hope that you can negotiate/ get them to send you to the US (you would be working for them first in India, obviously). I've known friends who came to the US this way. But beware of what you're getting into, many HN users here will gladly tell you that the H1B visa is evil, or might I say, _literally_ Hitler.

<comment><AUTHOR> It's not just about coming to work in the US. I want to work at a fast paced environment generally seen at a startup and I have previously worked for indian startups and they tend to exploit the developers(atleast thats what I have experienced), hence US. Infact, I have earned more by freelancing for US based startups/companies on Odesk in a month than what I got after working for a startup for 6 months in India. and btw what do you mean by 'H1B visa is evil'?

<comment><USER2> I don't know the situation in India, but there are a whole lot of horror stories of startups (and non-startup companies) in the US exploiting employees. Just because you earn more freelancing for US companies doesn't necessary mean coming working for startups in the US will give you higher living standard, Silicon Valley - and California on average - is ridiculously expensive to live in. Again, do your research, I'm not in a position to know your situation.

That actually ties to the part of "H1B is evil". I'd rather not bring up that discussion, just search on HN (in both stories and comments) for "indentured servants" and/ or "H1B" to see all the comments from both sides in the past.

Anyway, the general advice for young-ish (I assume you are) programmer wanting to work for startup is to find not early stage startups, but mid-size one (think of current Uber/ Lyft/ Wanelo, or Facebook 2006-2007 etc.). As you will learn more, have an easier life (not that the work is not as challenging as early stage startup, but early stage startup is quite ... insane in some aspects), and further more, you can already filter out the crappy companies.

Remember, most startups die in the first two years or so, and if us programmers can pick who doesn't... well, I think I have a better job for you :-)

<comment><AUTHOR> yes, mid-size startups are what I meant by working at US based startup. I dont want to risk coming to US to work for a startup who is at very early stage until and unless I believe in the idea and seem doable as a startup.

</comment></comment></comment></comment><comment><USER3> You are in a tough position. Even if someone is willing to sponsor a visa, you are competing with everyone who doesn't need a visa. You cannot just be "as good" as the next guy - you need to be better, because it is more trouble to bring you on board. And if the job explicitly says they will sponsor a visa, you also need to be better than everyone else internationally.

This should not stop you from trying - but you need to focus on making yourself stand out from the crowd. They may like your profile, but if they like 45 other profiles, too, you need to tell them what makes you the one to choose.

If you are really the best guy for the job, they will figure out the visa issues. But if you are only 2nd best, they won't.

EDIT: I was also just thinking of how people I know who came from India made their move here. Most of them worked for one of the big Indian firms who outsource from the US. They would start working remotely in India, and then get a role that moved them to the US. Once they were here, they could get to know people, network, etc, and then find permanent US-based jobs through that network.

</comment><comment><USER4> I was in same shoes as yours around two years ago. I feel your pain. I asked similar question on HN then (1). My advice is apply at startups that explicitly invite international candidates, especially the ones that lists 'can sponsor visa' info in their job postings. Even if they are willing to offer a job, it's just very difficult to get a visa to US. I have interviewed with one or two from Valley, it always came down to visa.

If you don't find a great startup, try looking for one in India. Hard to filter through awful lot of crappy ones, but put some time. Talk to as many startups as possible, don't just interview, but go to the offices, see how they work and try to work for a week before you join. You will find something good. Be patient, I must have talked to at least 40 startups face to face, went to at least 10 offices. It's funny though, at last I found my job through monthly HN-hiring thread.

1-[https://news.ycombinator.com/item?id=5462515](https://news.ycombinator.com/item?id=5462515)

<comment><AUTHOR> I have few offers from some really good startups in India and thats why I am looking for options abroad.

<comment><USER5> How about taking the offer at one of the startups that potentially expand to the US in the future. Then you could go with that team to the US

<comment><AUTHOR> The thing is I am already freelancing on Odesk and currently I am earning twice the money than what a startup can offer in India. On the same note, I dont want to work as a freelancer working from home anymore. So I am looking for a US based startup instead.

</comment></comment></comment></comment><comment><USER6> Recently, I was researching about moving back to India and continue working for my employer from there and get paid in USD. In theory, this should be possible. My employers might agree to this (they do it to other colleagues of mine in different countries). However, the taxation laws in India are not straight forward around this. You can explore to see if this is a legit option for you. If you have a solid profile as in open source contributions and you can pull off working remotely (definitely not easy), this is the most lucrative option for you. Trust me, living in USA is not what it used to be. The whole political climate with so many wars, government snooping, highly variant economy and things like Ferguson make it less attractive. If I were considering a move today, I'd definitely think 10 times. Plus the stress levels here are amazingly high. Everyone seems to be lost in their "careers". Of course there are positive aspects of living here. It's definitely a trade off like anywhere else. Good luck. I hope to bump into you someday and hear your story of sailing the boat ;).

<comment><AUTHOR> Well I worked for a swedish company for 4 months remotely from India and dint find any trouble with the taxes. And I agree, working remotely for a US based company is the best that can happen. Earning in dollars and spending is local currency makes life alot easier.

</comment></comment><comment><USER7> Why don't you consider Germany? US is great in terms of taking technological inspirations but I wouldn't want to live there as that would mean working for the landlords. I've been to Berlin for a year and consider working for any company there (big or small) because the prices (rents, food, travel, entertainment) are low and the incomes (whether salary or hour based) are high and they pay satisfactorily to IT workers. They prefer more enterprise stuff though such as Java and SAP. And in some areas being fluent in German is a requirement. Still, it's worth it, they have more open and straightforward visa applications.

<comment><USER8> Second this. Moved to Germany over an year ago. Lot of companies looking for programmers. You can find some jobs here - [http://berlinstartupjobs.com/](http://berlinstartupjobs.com/) and the super simple visa process here - [http://www.make-it-in- germany.com/](http://www.make-it-in-germany.com/)

<comment><USER9> >Moved to Germany over an year ago.

From where?

<comment><USER8> India

<comment><USER9> Thanks.

</comment></comment></comment></comment></comment><comment><USER10> Someone here has already suggested that you enter the US through another country. For some reason, that comment is dead. However, you should be sure to spend some time considering that option and similar alternatives that will not put you at a Silicon Valley startup immediately but which will could put you at one eventually, or at a non-Silicon-Valley startup (maybe Berlin?) and if you're really lucky you might be able to find a US-based startup with an international office (possibly in India) that can get you the sort of visa where you transfer to the US office after working there a year. (Currently I'm doing something quite similar to this myself, except at the US offices of a company that has offices in London too. For non-EU/EEA residents the UK immigration regime is a little better than the US regime, but not that much, and worsening.)

The visa sponsorship regime in the US is ridiculous and extraordinarily risky (in the sense you must put in a lot of time and effort for a small chance of getting a visa). Not a lot of startups are able to put up with that. If I recall correctly, the H-1B in particular involves (a) posting a job requirement that you don't end up filling with an existing citizen/resident - a little game to appease the bureaucracy that's meant to ensure you're not TAKING OUR JOBS!!!11 (gag) (b) applying for a visa and paying $$$ at the right time of the year when they reset the annual quotas (c) waiting months for an answer.

:(

That said, if you don't take risks you don't get lucky.

<comment><USER2> Had anyone here getting in to the US through another country? As someone who might have to plan for some thing similar, I'd love to hear your stories.

</comment></comment><comment><USER11> Since this thread is pretty popular, i'll try to latch on to it.

I too am a developer from India, college student to be more precise. I'll get my degree in 2016. I want to move out of India to US or a country in Europe and am trying to find a way to do so.

As for my skills, i have done a ton of open source work and am proficient in popular languages like Python, PHP(?), Go, Clojure, etc. and some obscure languages as well.

I am not sure which field of the industry i want to specialize in right now but have done web, mobile, game-dev, desktop apps (linux & windows) and a bit of embedded stuff.

Whats the best way to get a job and move out of the country?

<comment><AUTHOR> Well, till you graduate, you should try working as a freelancer on Odesk/Elance to get some real work experience.

<comment><USER11> well i've done some work through odesk, 2 internships (one at a startup and another at a company with a billion dollar revenue)

</comment></comment></comment><comment><USER12> Others might have scratched the surface on this, but based on my network's experience and my own, don't even try the startup route, it's not worth it. Outside the US, you'll either get a) no sponsorship b) non-competitive salaries c) mentor roles and that's being on the real top of your field. I'd go for a bigger company which has a) the resources b) the legal expertise c) the demand

Given you do Python, Dropbox comes to mind, but you can always Google or stackshare.io for targets.

Good luck.

</comment><comment><USER13> From my experience, being present in a country is going to greatly increase your chances of being able to be hired there (even with the visa).

I would also give another vote for Berlin. I have lived here for the last year & it has a very low cost of living, yet still a strong tech/startup focus.

Are you able to travel to Berlin for 1 or 2 months & find a job? As mentioned, the visa process is much easier than the US & to be honest, your salary is going to go a lot further in Europe than in Silicon Valley.

</comment><comment><USER14> My tip:Get a job at a company in Ireland that has US headquarters(they have great immigration laws when it comes to qualified workers),you'll be able to transfer to the US sooner or later.Will it increase your life quality? Well I don't think so.

</comment><comment><USER15> Send me an example of your Python work.

I have visas available for Python devs from India or Eastern Europe.

In depth knowledge of systems programming and distributed computing, and familiarity with cloud service provider APIs and automation frameworks (e.g. Ansible/Chef) a plus.

<comment><USER16> >I have visas available for Python devs from India or Eastern Europe.

What do you mean by that? Under H-1B one has job openings; you apply for the visa when you decide to hire an immigrant.

Also, it sounds like you're saying there are job positions at your company that are open only to people of particular national origins, or ethnic backgrounds. Isn't that illegal under the 1964 Civil Rights Act?

<comment><USER10> That's not how H-1B works in practice. You find a candidate, make a fake job offering that matches only that candidate, wait for that to go unfilled for a certain period of time (oh noes!!), and then proceed.

That said, parent poster is plenty sketchy :)

</comment></comment></comment><comment><AUTHOR> I did come this website [http://tyba.com/](http://tyba.com/) which has listing of jobs and internships worldwide but it hasn't proved to be useful yet.

</comment><comment><USER17> Try bigger companies. Early and mid stage startups won't have the resources for all the paperwork.

But bigger companies lacking talent have no problem with it.

</comment><comment><USER18> Not a startup but have you considered Google? They have a whole legal team dedicated to this kind of stuff, you'd have a lot more luck there.

<comment><USER19> I think it's an understatement to say that the competition to get into Google is high.

</comment></comment><comment><USER20> Can you work in the US as a freelancer without the H1B visa?

<comment><AUTHOR> Yes, absolutely. The companies pay you via either one of the freelancing sites or direct bank transfer(paypal isn't working in India right now) and you pay your taxes in India.

<comment><USER10> I'm pretty sure that's directly at odds with what the State Department has to say about things. If you care about the legality of what you're doing, use extreme caution here and consider getting real legal advice.

<comment><AUTHOR> How is a US based company hiring someone via odesk and paying him via odesk illegal?

<comment><USER21> Working in the U.S., even on odesk, without a proper visa is illegal.

<comment><AUTHOR> As an indian, living in India and working on Odesk is not illegal. I don't need a visa or anything to work via Odesk.

<comment><USER21> Except the question was not about living in India, it was about living in the United States.

If you live in the United States and you say you are working from India, you are committing fraud AND violating immigration laws.

If you live in the United States and you say you are working from the United States, you are just violating immigration laws.

Its about where you are physically located and as the original comment I replied to was referring to being physically located in the U.S., it would be illegal.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Damn! I also want to work in Silicon valley... But I don't write python, I write C++.

<comment><USER23> There are plenty of high-level C++ engineer jobs in the US. Google, for instance, will make a healthy offer to an engineer who is a real C++ expert. Google is famous for their Python advocacy, but a lot of their infrastructure is still built with C++.

<comment><USER9> >built with C++

And Java, and probably, more recently, some in Go. [1]

[1] This is anecdata :), but I don't think a majority of their work is in Python, though they do have some, and I also read the recent threads about their hiring Python devs.

More like C++ and Java (and JavaScript for the front-end), and nowadays some Go, as I said. This is just based on reading about them on various sites, though, I don't have internal info, so could be wrong.

</comment></comment></comment><comment><USER22> Damn! I also want to work in Silicon valley... But I don't write python, I write C++.</comment>


Beyond Frontal Faces: Improving Person Recognition Using Multiple Cues [pdf] - <AUTHOR> http://www.cv-foundation.org/openaccess/content_cvpr_2015/papers/Zhang_Beyond_Frontal_Faces_2015_CVPR_paper.pdf

<comment><USER2> So much for CV Dazzle</comment>


Google, Ubisoft Debut Agones Cloud Gaming-Server Project - <AUTHOR> http://fortune.com/2018/03/13/google-ubisoft-cloud-gaming/ <comment><USER2> Speaking not for my employer (for obvious reasons) I think it's a huge strategic advantage for Ubisoft to be partnering with google, especially on cloud stuff.

I haven't deployed a full production game on google cloud yet, but of the cloud offerings; theirs seems to be the least "hand-wavy cloud magic"-marketing and more engineering focused, which I think Ubisoft is in dire need of.

Our internal IT organisation that hosts games is not quite competent enough to bring us into the 21st century of always-online titles, I mean, being always online means you kinda have to always _be_ online otherwise you're locking people out of their purchase which is quite abhorrent.

The development teams in Ubi tend to be pretty good, but the IT org lets them down, whether via forcing people into sub-standard testing scenarios or by being rigidly frugal with necessary infrastructure, we're a long way from SRE/DevOPs hopefully this forces the hand of the powers that be on the IT side.

(Btw, I'm self-criticising, I'm part of the IT organisation I'm referring to.)

</comment><comment><USER3> FYI: Google's announcement blogpost for this was pointed to 2 weeks ago: [https://news.ycombinator.com/item?id=16576133](https://news.ycombinator.com/item?id=16576133)

Github for it: [https://github.com/GoogleCloudPlatform/agones](https://github.com/GoogleCloudPlatform/agones)</comment>


Writing a cron job microservice with Serverless and AWS Lambda - <AUTHOR> https://blog.readme.io/writing-a-cron-job-microservice-with-serverless-and-aws-lambda/ <comment><USER2> I have written this reply and started over 3 times -- hopefully this one sticks.

I really feel like the author boxed himself into a solution by faulty reasoning.

1) Cron jobs are not hard to set up. Being able to control these things on one or more server is just part of proper server deployment.

2) If it is not part of the application but seems to have to do with information about users who used the application in trial then maybe it should be part of the application? If you are deploying a application and you require to know information about users who trials are going to end I sure would bet that is part of the application and should be a trigger coded into the application itself.

3) I am shocked that you are already did not have a central spot for running time interval code and maintenance on your systems. At a minimum there should have been backups and reports generated on your mongodb instances. If these functions were already built into the application then then the same generic task system you used to run that is likely where you wanted to run this new functionality.

tl;dr Not knowing much about the application or its architecture I feel like the author painted themselves into a corner to justify using some AWS tools.

<comment><USER3> Having just written a bunch of scripts to populate a Google Sheet with some KPI data for the business folks, I _completely_ agree.

At first I wanted to put my scripts in Lambda, put an API Gateway in front, and have them be callable by the Google Sheet on a schedule. This seemed "pure" because I didn't really _need_ independent resources to do the task. The sheet could just update itself using an on-demand server!

Then I realized there was a 30-second max execution time. My scripts, in serial, couldn't hit that. I'd need to rewrite them all to be parallel. Also, they were a bunch of bash/jq/curl I'd just thrown together. I'd have to write a Python wrapper to shell out and handle streams (ugh).

At this point, I gave up and fell back to the advice of an (ex-Heroku) coworker: why not just run them in a cron job and put the data in a Heroku DB and use Heroku Dataclips to update the Google Sheet.

Sure I have to "have" an EC2 instance and a Heroku PG box, but they're both so small they're either free or essentially so. After cloning my script repos, everything worked right away.

Sometimes it's better just to do the "inelegant" thing and move on.

<comment><USER4> _Then I realized there was a 30-second max execution time._

Perhaps you're talking about a limitation on your spreadsheet, but the max execution time for a Lambda function is configurable up to 300 seconds.

<comment><USER3> I believe it may have been a limitation of the API Gateway + Lambda thing. Just checked the docs again and it says there is an "Integration Timeout" as follows:

> 30 seconds for all integration types, including Lambda, Lambda proxy, HTTP, > HTTP proxy, and AWS integrations.

So not Lambda alone, but in conjunction with the API Gateway.

</comment></comment></comment></comment><comment><USER5> I believe Amazon added scheduled execution because of high demand from customers who never understood why Lambdas are there. I saw also many people complaining about lacking SQS support of Lambda. It is totally normal that Lambda's are not supporting SQS because SQS is a pull model, while Lambda is designed differently. Very very probably, AWS will also add SQS support but it will mean that they preferred non-sense user complaints over their design.

Lambda functions are there to process a single message and produce output. It is a code piece that should be invoked responding to events (A new file on S3 bucket, a new record on DynamoDB, a HTTP request coming from API Gateway etc.) If you are designing a system where you execute Lambda function on its own without any meaninful event and get it pull data from an external source upon execution, you are designing your system wrong. Let us assume that this "cronjob" works every day at 10 pm and that day there was more than 5000 users whose trials end. Lambda has an execution limit of 5 minutes. In 5 minutes you are likely to fail to process 5000 users and Lambda execution will be interrupted. And what then? You are not designing a scalable system.

The correct approach would be to book a future Lambda execution (per user) when you register the user. A single Lambda function per user would then execute exactly when the trial ends for the user. Also this Lambda function would receive all the data it needs for its operation, so it would not need to connect to MongoDB to fetch user information. This can be probably done by SWF.

<comment><USER6> Unless you designed Lambda, this is an arrogant tone.

Sure, some of the things you mention are "better" or at least otherwise accomplished using event-triggered Lambdas. But there's plenty of reasons why you might want to run a job that takes under 5 minutes on a schedule.

For instance, daily or weekly "digest" emails. Or a nightly stats job, where expensive-to-calculate yet not-immediately-critical queries are performed and the results stored or exported. These are things where you want them to happen at a certain time. Cron does that.

It's possible that customers didn't understand why _AWS_ thought Lambdas were there, but that's irrelevant. Suddenly, Lambdas were there, and people thought of more use cases (SQS triggering, connection to API Gateway, etc) than AWS had implemented from the start. That's not the customers' fault for being creative.

<comment><USER7> Yep, I agree. If you rely on Cron/SCheduled Tasks, then you end up needing to run a server to run them. If Lambda did scheduled tasks, I'd have 1-2 boxes less in each environment ...

<comment><USER8> Not sure based on your wording, but you -can- execute scheduled tasks with Lambda. It's a little tricky, as the actual configuration takes place in Cloudwatch (Cloudwatch Events). You also will be sure to want to set up a dead letter queue, and have that broadcast to an SNS topic that will email you, so that in the event the lambda fails, you'll be alerted.

<comment><USER7> I've read about external services that will hit a SQS queue for you, but it would be a lot nicer if it was just supported natively in Lambda.

<comment><USER8> No, like, [http://docs.aws.amazon.com/lambda/latest/dg/with- scheduled-e...](http://docs.aws.amazon.com/lambda/latest/dg/with-scheduled- events.html) (and linked from that page, [http://docs.aws.amazon.com/lambda/latest/dg/tutorial- schedul...](http://docs.aws.amazon.com/lambda/latest/dg/tutorial-scheduled- events-schedule-expressions.html) )

You can just set up "here's my cron string, run this function", and it will run that function when applicable. No external services, no SQS. Just a Cloudwatch event, that executes your lambda, at a set schedule.

<comment><USER7> Perfect! Thanks. I'm going to retire some boxes ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Here is a similar solution but with an AWS Lambda function in Python and using a cloudwatch event to trigger the lambda function on a schedule. [0]

[0] [https://kerneltrick.in/aws-lambda-cronjob- schedule/](https://kerneltrick.in/aws-lambda-cronjob-schedule/)

</comment><comment><USER10> I'm confused. Is this a microservice as a cron replacement or is this just running a script with AWS lambda? If it's the latter, it's a bit of a stretch to call this a microservice, or a cron job for that matter.

It seems like it might be a nice post about using serverless, but the whole cron + microservice bit is muddying the water for me :/

Edit: spelling

</comment><comment><USER11> Sure, cron is easy to use, but it also involves maintaining a sever to some degree. I use a Lambda "cronjob" to run health checks on various other servers/services- I don't have to worry about healthchecking my healthchecking machine.

</comment><comment><USER12> Cron is hard. I think it's better to just build in good locks and assume it will fail occasionally, and on failure repeat.

This approach works on a small scale, but it seems like the logic should be at the application layer. Secrets, API keys, ACL, etc all need to be duplicated on Lambda. Developers can't easily run it locally. Testing (eg integration testing on database migrations) is separate from the core app. Build promotion / rollbacks are different than the core application. Error tracking / logging may be different. Monitoring will be separate.

Seems like a cool demo, but I think that running the code will have more overhead than writing it.

<comment><USER13> so, i'm not a very good engineer so maybe this is a stupid question... but i am going to ask it anyways.

Cron _is_ hard. Not in the sense that its challenging to set up but its a challenge to maintain and have visibility into. It seems like you need a whole set of infrastructure just to feel confident that things are running as intended.

This has always lead me down the path of building a task manager type of micro-service running on an independent server to manage everything. But by the time im done, it feels like over kill. I just don't know what to do differently. Am I missing something?

<comment><USER14> Sounds like you might be better off using Jenkins than roll your own. I use Jenkins over cron when I want easier auditing & authentication. I got the idea to use Jenkins as a 1-size fits all hammer from [https://www.cloudbees.com/blog/drop-cron-use-jenkins- instead...](https://www.cloudbees.com/blog/drop-cron-use-jenkins-instead- scheduled-jobs)

<comment> mickael-kerjean Great to see I'm not the only one using Jenkins to look after crown jobs!

However, it's to me way more than simply auditing & auth. The main advantage I found with Jenkins are:

\- you get a central place for all the cron jobs. That comes with all the advantages the most important one being nobody has to remember on which server is this freaking script

\- making an update can easily be done

\- running the task can even be done by non technical people.

\- easy backup

\- when a script become deprecated you can easily remove it and you're not very likely to let it there running for nothing forever

\- easy documentation for you tasks

There's probably more but Jenkins is definitely awesome for cron jobs

</comment></comment></comment></comment><comment><USER15> For anyone interested in a lightweight approach, I've built the following package using AWS Chalice:

[https://github.com/kislyuk/domovoi](https://github.com/kislyuk/domovoi)

It specializes in plugging Chalice into all the various event sources that can trigger Lambda, including the AWS Events API's "cron" functionality highlighted here.

</comment><comment><USER16> Was actually just working on a Lambda function myself when I read this, though for something a good bit more complex.

My reaction to this particular case is more like - yeah, I guess you could do that, but it seems a little odd. I could see it making sense depending on what your infrastructure is like. Might be handy if you're heavily into AWS and need to coordinate AWS actions with appropriate IAM roles and VPC access and such things. The auto Cloudwatch logging can be handy if you don't have your own logging set up already. But on the other hand, who's running something like a business that doesn't have better logging already set up, and better infrastructure for running infrequent tasks, or at least a few servers lying around somewhere that can run some modest Cron jobs in addition to whatever they're already doing?

</comment><comment><USER17> I have been thinking about how to approach this in several projects, and while scheduled lambda calls do the job, besides being AWS specific, do not integrate well with the "old way": launching shell commands.

The beauty of shell commands to me was that you can launch them both with cron and manually. Arguably you could do the same with lambda, but here we go, another service to set up (api gateway).

I built [http://croningen.io](http://croningen.io) \- which is a hosted version of cron that schedule jobs on clusters of servers, with central error reporting. It is in my opinion as easy to use as cron, with most annoyances removed. Early days, but feedback welcome!

</comment><comment><USER18> > Cron jobs are easy to write, but difficult to setup

Please explain to me, how is cron hard to set up?

(slightly of topic: if you didn't learn cron don't worry. It is just a matter of time before it is replaced with some systemd service that only works half the time)

<comment><USER19> I'm not the author and didn't write that line, but I can speculate about the kinds of concerns he's imagining, looking at the situation from a DevOps/automation-focused point of view:

How do you set up cron in such a way that your cron job runs on a machine somewhere, and will continue to do so for a long period of time?

Sure, you can log into a machine and edit the crontab manually, but what will happen if that machine fails? Ka-blam, it suffered a hardware failure and is gone. Do you repeat your manual edits on another machine? (If someone _else_ did this three years ago and is no longer with the organization, does anyone know what edits to reproduce?)

OK so we need to build a mechanism that can ensure that at least one machine is running, and has this crontab installed on it. If the currently active machine fails, it needs to replace the machine and reinstall the crontab and software that the crontab runs. You need to monitor to detect when this happens, to kick that off, and you need to test the stack to be adequately sure it's going to work when it really does happen. There's infrastructure you can use to do that, of course, but it's all complexity to be mastered.

With the approach the author's describing, one only needs to define configuration: what code to run on what schedule. It's declarative, and the infrastructure handles actually executing it on a machine somewhere, completely encapsulating the concerns related to "getting some hardware running" and "installing the code".

<comment><USER18> > How do you set up cron in such a way that your cron job runs on a machine > somewhere, and will continue to do so for a long period of time?

Use supervisord? Or (god forgive me) systemd services?

<comment><USER19> Cron itself is a system service and is not something I'd hope you would need to run under supervisord.

Some of the challenges that I mentioned, though, are not just arranging the configuration that you want to have on the machine (whether cron or supervisord configuration), but getting the configuration onto the machine and ensuring it stays up and working long term. When looking at the problem with a long time horizon and larger system context, one expects any machine to fail and need to be replaced, so handling that is important. With this perspective, it doesn't matter how reliable your process supervisor is: the code can be written perfectly and the application will still fail to do its job if the machine it's running on halts! I don't want to have to care if my machines suffer a hardware failure; I just want a replacement to be brought online seamlessly.

Sometimes in cases like this, one needs a whole lot of infrastructure to solve what feels like it ought to be a simple problem. In larger system contexts it can be quite inconvenient to invoke the full complexity needed for reliable servers just to run a job periodically.

Once you start to tie the satisfaction of any business requirement to the successful completion of a cron job, lots of problems crop up. Even after you set that configuration up, there are still tricky issues to consider like: what if the host running the cron job fails at _just_ the wrong time, like at 11:59 when the job starts at 12:00? Is it possible the job might not run at all today even if the host is replaced promptly? Is that OK, and if not what do we do about it?

If you have many different cron jobs with slightly different security contexts and permission, then do you launch a separate machine for each one? Do you set them up to share the same server? How will you know if, a few years from now, that server doesn't have enough power to run all the jobs fast enough? Will you notice if it's gradually slowing down? These are some of the issues I'd consider if I was tackling a business problem that required doing something on a regular schedule.

Serverless-style infrastructure takes away a lot of these concerns. There's nothing to host or maintain yourself; no servers needed at all: just the definition of the code you want to run, how frequently you want to run it, and what resources (if any) it needs access to. A serverless task that runs once today will continue to run indefinitely, and it doesn't cost more to set up than the naive crontab approach.

</comment></comment></comment></comment><comment><USER20> "I'm too elite to use cron and bash scripts. If it doesn't require npm to install and an AWS account, I don't bother."

Seriously, it takes all of 10 minutes of reading the cron and related man pages to figure this out. (and your Lambda code needed the exact same syntax for cron! )

And you already have a MongoDB server running, so it is not really any additional server config time to do it.

<comment><USER18> Yeah, I find that hilarious. Cron is probably over of the simplest unix-y things you will ever encounter.

I am also getting tired of this "npm all things" mentality. I don't want to install npm and a ton of npm packages to do something that has nothing to do with web development and java script.

</comment></comment><comment><USER21> This seems fine for a single job but if you have dozens to manage it would become unwieldy. I'm excited to see the ins and outs of AWS Glue[0]. Hopefully that will make projects like this more manageable.

[0]: [https://aws.amazon.com/glue/](https://aws.amazon.com/glue/)

<comment><USER22> _This seems fine for a single job but if you have dozens to manage it would become unwieldy._

Just like with good old... cron jobs. One wonders what's really new under the sun, here.

We even have to put "use strict" up at the top, like in the Perl days!

</comment></comment><comment><USER23> A slight variation I'd like to plug for _random_ scheduled jobs (3rd party) : [http://ikura.co](http://ikura.co)

</comment><comment><USER24> This maybe a silly/newbie question. How is the function getting triggered at 10 AM? Who/what in awe is triggering it?

<comment><USER25> According to the documentation for Serverless ([https://serverless.com/framework/docs/providers/aws/events/s...](https://serverless.com/framework/docs/providers/aws/events/schedule/)) it is using AWS scheduled CloudWatch events ([http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/Sc...](http://docs.aws.amazon.com/AmazonCloudWatch/latest/events/ScheduledEvents.html)).

</comment></comment><comment><USER26> why not use AWS Maintenance windows for this?</comment>


Huawei Says It Would Offer Access To Its Source Code - <AUTHOR> http://www.securityweek.com/huawei-says-it-would-offer-access-its-source-code-independent-testing-center <comment><USER2> I think it's a nice political move, but I will be surprised if it makes much difference in the end.

It is impossible to demonstrate trustworthiness to someone who isn't willing to believe it.

Some issues which would get raised by your friends if they didn't want you to buy Huawei:

Firstly, you have the problem of underhanded code (e.g <http://underhanded.xcott.com/>) e.g. deniable backdoors. Auditing a large C codebase to the point where you have confidence in it is Expensive and Time Consuming.

Secondly, version control gets to be a huge problem. If you are going to rely on the results of your audit, now you have to build the firmware yourself with a trusted toolchain. This is going to be a lot of work. Especially since you now have to do this for every firmware release for every product you use. Most organisations aren't getting patching and release management right even as things stand right now.

Thirdly: do we need to look at the FPGAs, ASICs and "auxiliary" firmware? Are all the parts standard? Where were they fabbed? Can we trust _those_ guys? Is the router we get next month going to be the same board revision, with parts from the same vendors?

Fourthly: how comfortable are the players in various countries going to be with a Chinese state-owned company having their detailed network designs for telcos and core networks? (I mean, pretending they don't already ;)

Paranoid hat mode: I do wonder whether the huge mistrust of Huawei is standard anti-competitiveness... or because everyone's agencies have been using {backdoors, bugs, info} provided by various companies and "friendly employees" for years - and buying Huawei kit just seems like it's making things too easy for certain parties.

If you are interested in these kinds of shenigans: [http://spectrum.ieee.org/telecom/security/the-athens- affair/...](http://spectrum.ieee.org/telecom/security/the-athens-affair/0) is a fascinating read.

<comment><USER3> Thank you. "Ability to read the source code" is amazingly low for knowing if the code is trustworthy.

And don't forget we have to trust the compiler that compiled the compiler. _EDIT_ : I see you mention "trusted toolchain" in your second point.

</comment></comment><comment><USER4> In my opinion it's the right way to address this.

They enter the US market to have their reputation instantly destroyed by official US institutions, that are filing concern about possible spying through their products at a moment where they haven't even looked at it, to later conclude that there were security risks found but none of the allegations were true.

I don't know how big the final damage for Huawei is, but that in order to avoid this just to let them look at their source code seems like a good way of addressing this.

And that is actually one of the big pro free software arguments in general:

By having the source code openly* available you know when you are screwed over.

Congrats Huawei for an in my opinion right way to address this issue!

* _in the scenario of Huawei they only want to make source code available for analyzing purposes by governmental institutions. That does not change the statement issued above though_

<comment><USER5> I see a flaw here. How would we know that the source code made available to US officials is the actual code built and shipped on their devices? They could be showing officials 'cleaned' code, and then ship different code with spyware/malware baked in. The only way to really trust the code is if an end user can download the source, review it, build it, and install it on their device.

<comment><USER4> I see a flaw in your flaw.

1st) small chance that spying features are implemented that a paranoid analyzing by US officials wouldn't have revealed* (or that the US would have said the products are good, while still having reasonable concerns about potential spying)

2nd) i don't know how they would give their source code to government officials but i guess it's fair to assume that it can be done in private and trusting nature (also they probably are able to test if a piece of hardware runs the code given or not)

3rd) risk of secretive spying features being found is high * * (even if you want to argue it might be lower than described by myself above -> see 1st), therefore generally would lead to one of the biggest company scandals in the 21st history and completely destroy all of Huawei's business in all of the Western World (not worth it)

* _somebody shall correct me if i might be wrong, but wouldn't it be pretty hard to hide spyware in software being used worldwide by millions of users and that is center of attention by governments for a long time_

* * _think of the amount of Huawei contractors, the sheer quantity of their sales_

<comment><USER2> It doesn't have to be "spyware" per se. It just has to be a bug or problem that you (and your friends) know about that your customer doesn't.

</comment></comment></comment></comment><comment><USER6> Still, it would be very hard to make sure that the provided code is indeed the one running on the suspicious machines. The only way I see to make sure of that would be to provide tools to compile and flash the hardware, which doesn't make much business sense. This also gives no protection to silicon based backdoors that has nothing to do with OS code.

</comment><comment><USER7> Has anyone compared Ericssons tech with Huawei? Honest question. I feel like if you're setting up infrastructure, take it from the countries that does it the best. Ericsson is Swedish and _THE_ first country to roll out with 4G (around my parents place, even).

<comment><USER8> The technology isn't really relevant. Sure, organizations with unlimited budget would probably choose some other vendor than Huawei. But that really doesn't include most mobile operators in the world. And then what starts mattering is that Ericsson or NSN charges twice as much for the same capacity. Or that Huawei is willing to give financing on good terms (including on parts of the network supplied by other vendors).

<comment><USER7> I beg the differ. It is very relevant if you want proper infrastructure with reliability and speed.

3G sucks in Singapore, but the 4g is amazing. Ericsson is in charge of the 4g infrastructure here. It's not fully done, but for me it feels like island wide coverage.

[http://www.techinasia.com/wake-disastrous-rainstorm- beijing-...](http://www.techinasia.com/wake-disastrous-rainstorm-beijing-text- message-warning-system-impossible/)

</comment></comment></comment><comment><USER9> Let's not forget: Aliyun OS is an admitted illegal closed-source Linux fork (And likely an Android ripoff).

Perhaps China should comply with basic U.S. law if they want to sell things here.

<comment><USER4> The point is that you can't judge a company solely on where they are from and that simply because of the company's origin to not only state concern, but to actually completely ruin their reputation by issuing serious concerns about possible spying activities, before having analyzed the products in suspicion, is just wrong.

That is btw exactly what you are doing.

Aliyun OS is illegal, so Huawei has to suffer?

 _This is at least what is the logic i draw from your statement in connection with the article_

Note: And after having destroyed part of their reputation in the US and having analyzed their products, the official conclusion was that there were security risks found, but no possible spying or anything.

<comment><USER10> I guess at some points I can judge a company based on where it's from, especially with the political system in China.

</comment></comment></comment><comment><USER11> For the US would never allow spying in the telecommunications infrastructure, would they?

</comment><comment><USER12> Yes, and get all the bugs they want to fix fixed for free, is it not? And leave open those they deem worth leaving.

<comment><USER4> Huawei wants to enter US market

 _- > spying suspicions_

Huawei makes source code open

 _- > all they want is free bug fixing_

Is that really fair?

Note: Have you even read the article? They say they would make the source code available for official governmental institutions to analyze it if they wanted, they don't say anything about making it completely open-source!

<comment><USER13> Making the source code open doesn't help unless you can flash the devices, since you have no guarantee the source code is what's on the devices.

Plus, if the backdoors are in hardware (say the hardware AES implementation has a small key scheduling "bug" or something) , not software, source code wouldn't help.

<comment><AUTHOR> Exactly. And any update feature, which is typically built into most networking products, could enable a backdoor to be installed at a later date. Could be clean now, but doesn't mean always!</comment></comment></comment></comment>


Bone Marrow Donors Can Be Paid, Appeals Court Rules - <AUTHOR> http://www.medpagetoday.com/PublicHealthPolicy/Ethics/29990 <comment><AUTHOR> This is related to the discussion at <http://news.ycombinator.com/item?id=3302144></comment>


Debunking the myth of higher pay in Silicon Valley - <AUTHOR> https://medium.com/@srlake/debunking-the-myth-of-higher-pay-in-silicon-valley-87828cbf6698#.qf1tu0qxw <comment><USER2> The maths only works in Waterloo's favour if you're single and want to live on your own. If you're a couple, and consequently have two incomes instead of just one, you're better off to the tune of about $150,000 a year living in the Bay Area. You could get the same benefit just by sharing the two bedroom apartment with someone. That's not a great advert for Waterloo.</comment>


Affordable moving holography - <AUTHOR> http://www.economist.com/news/science-and-technology/21643058-affordable-moving-holography-may-not-be-too-far-away-light-end-tunnel?fsrc=scn/tw/te/pe/lightattheendofatunnel

<comment><USER2> where's the Demo?

<comment><USER3> Google is your friend.

[http://holography.byu.edu/Background.html](http://holography.byu.edu/Background.html)</comment></comment>


GSoC 2012 accepted organizations announced - <AUTHOR> http://www.google-melange.com/gsoc/program/accepted_orgs/google/gsoc2012

<comment><USER2> For the first hours, not all organizations will be listed there, as listing depends on having an up-to-date profile sent by admins. Don't fret if you don't see your org there yet: there are 180 selected organizations, compare to the number shown at the bottom of the page (88 as I write this).

</comment><comment><USER3> Clojure/core has been accepted for the first time. If you're a student and you're excited about compilers, debuggers, logic programming, web development, app-engine, android, audio, javascript, and more - consider submitting a proposal idea or getting behind an existing one!

[http://dev.clojure.org/display/community/Google+Summer+of+Co...](http://dev.clojure.org/display/community/Google+Summer+of+Code+2012)

</comment><comment><USER4> Did the Python Software Foundation not apply this year?

<comment><USER2> I would guess they did and that they were probably selected. It's just that the list is still incomplete (180 orgs selected, displaying less than 100 as of right now).

</comment></comment><comment><USER5> Most of the projects listed are pretty well known. I'm curious to see the rest of the list.

</comment><comment><USER6> Haskell.org has been accepted this year despite its non-presence on the list.

<comment><USER7> The list is actually just a list of accepted organizations who have filled out their profile on Melange. Check back in a few days as all the orgs create profiles.

</comment></comment><comment><USER8> Whats very interesting to see is libav present vs ffmpeg.

</comment><comment><USER9> Interesting to see Twitter on the list!

</comment><comment><USER10> Weren't Ruby groups trying really hard to get into GSoC? None were accepted.

<comment><USER11> jRuby was accepted: <http://www.google- melange.com/gsoc/org/google/gsoc2012/jruby></comment></comment>


Microconf 2012 videos - <AUTHOR> http://www.microconf.com/videos-2012.html

<comment><USER2> You can almost get a degree in marketing from watching all these videos. Lots of hands-on actionable advice.</comment>


Gregory Hays discusses his translation of Marcus Aurelius (2002) [video] - <AUTHOR> http://www.c-span.org/video/?173488-1/book-discussion-meditations-marcus-aurelius <comment><USER2> The Hays translation is definitely currently my favorite, so this is particularly fascinating, especially given how much variance there is in translation (both in general and with this specific text).</comment>


Ask HN: What password managers do you use? - <AUTHOR> Hi,
I have been using LastPass for about the last 3 years. It has never really been stellar. But it was the best option as of a couple years ago.
I'm kind of getting a bit sick of it though. There are tons of little bugs in the web extension. The Android app crashes left and right. And performs mediocre at best. On top of that, they just took away copy paste functionality from the Firefox extension.
So I'm in the market for a new password manager. Right now I am checking out Enpass. Any other suggestions?
Tldr: LastPass getting too buggy, looking for a new password manager. <comment><USER2> I been thinking about switching to or atleast try pass (the unix password manager). I find it a bit strange that I never see anyone atleast mentioning it in these kinds of threads.

I mean it is very basic and simple but that is kinda what made me want to try it. Pure files, no platform fuckery, no application lock-in. The simpleness has been something I've been searching for lately.

It might be that it is to simple and that makes it too fiddly to work with effectively but I figured I might atleast try it.

For hosting I haven't decided yet but that is kinda the beautiful part of it - it is just files - I can host them almost anywhere.

<comment><AUTHOR> I very much like the philosophy behind it. I'll definitely check it out.

</comment></comment><comment><USER3> I use Password Gorilla ([https://github.com/zdia/gorilla/wiki](https://github.com/zdia/gorilla/wiki)) on Linux and Windows and use the PasswdSafe app on Android ([https://sourceforge.net/p/passwdsafe/wiki/Home/](https://sourceforge.net/p/passwdsafe/wiki/Home/)). Both use the same file format (the Password Safe format) and so far the Android app has never crashed on me.

</comment><comment><USER4> KeePass ([https://keepass.info/](https://keepass.info/)) and KeePassXC.

I can use them in conjunction with Google Drive, OneDrive, Dropbox, etc. instead of relying on yet another proprietary service. Plus they are both open source and have a ton of open source clients for various platforms.

</comment><comment><USER5> I share your frustration missing the perfect password manager.

I have not tried it but I heard [https://www.passbolt.com/](https://www.passbolt.com/) the self hosted aspect would be a turn off for me but some might like it.

<comment><AUTHOR> Oo I like the self-hosted and PGP based parts of it. I've also recently found BitWarden, which you can self-host as well.

</comment></comment><comment><USER6> I started to use lastpass recently.

my only complain is I can't dismiss its dialog for saving passwords for certain sites.

Those are internal work related sites, I don't want to save passwords for them. but there is no option to disable lasspass's popup on those sites.

<comment><AUTHOR> Were you using a different service before LastPass? If so I'd be interested in hearing about it.

<comment><USER6> no. before I have a set of passwords. a really complex one for important sites and few simpler ones.

but websites keep asking for complex passwords, I started to lose track of them.</comment></comment></comment>


Why We Need a Theory for Software Engineering - <AUTHOR> http://www.ddj.com/architect/220300840?cid=RSSfeed_DDJ_All

<comment><USER2> Ok, I'll go out on a limb and say no we don't. If you followup to the authors blog, he states:

"At its core the theory relies on practices. Now there are good and bad practice concepts. The idea of practices has been around for fifty years, but these practices are loosely defined. We need a practice concept that is more precise."

That doesn't seem to really drive home the need for a theory of software engineering to me.

What we need is a better definition of what the craft of software requires (the practice of writing software) - not a theory of software engineering. Then we need to think about how we encapsulate those basics of software craftmanship in a way that we can communicate to each other and apprentice newbies into. There's still no silver bullet for managing software development.

I recognize that in some ways, the author is pointing out that we tend to drop everything and reinvent the wheel every few years. But that's how the consultants make their money, right? Isn't incumbent on us (practitioners) to call BS when we see it? If the point of having a theory of software engineering is to stop the rush from one process to another, that's not going to stop the snake-oil salesmen. They'll just move on and talk about how the "theory" doesn't measure how much better the new process is because it is such a radical new process.

I'm also curious about the number of successful software deliverables that are due to the software engineering process followed by the team that created the software. Anybody here feel like the most successful project you worked on was due to the specific software engineering process that was used?

</comment><comment><USER3> I agree.

I TA what I believe to be one of the better undergrad Software Engineering courses around, "Fundamentals of Software Engineering." As the undergrad TA (the other is a Ph.D. student with real-life industry experience), I can honestly say that it's a nightmare.

Software Engineering today basically amounts to anecdotes and marketing. I mean, if you look closely enough, there are some interesting theoretical nuggets: static/dynamic analysis, theories of testing, etc. But the reality is, a semester of the fundamentals of software engineering leaves you only slightly more able to choose a good development path than the next guy. In the end, choosing a quality process is a task left up to the reader, which is why we have so many pair and agile programmers (and so many more Duct Tape Programmers), IMHO. Developers either go for what's best marketed or for what's easiest.

At the end of the day, something unifying would be a huge benefit to everyone, but we're a long way off from that. Right now, the question is: Is that even possible?

<comment><USER4> what is TA?

<comment><USER3> I'm a Teacher's Assistant for it. It means I teach recitation, answer questions, and grade stuff.

</comment></comment></comment><comment><USER5> One question we need to answer first is that are new frameworks, practices and methods simply a fashion and reinventing the wheel or is it because the pace of change of software industry is so fast that we need to have new innovations every couple of years in order to keep up with it?

<comment><USER6> We have plenty of theories of Software Engineering. The problem is that there are impediments to empirical _verification_ of these theories. There are other impediments to _replicating_ the results.

Hang those impediments on any discipline, and you transform it from a technical field to mumbo-jumbo. Basically, the problem has to do with flows of information.

Free/Open Source helps, as it facilitates the flow of information. However, it's not a complete solution.

<comment><USER7> _We have plenty of theories of Software Engineering. The problem is that there are impediments to empirical verification of these theories._

I don't get it - software engineering is not physics. There doesn't need to be a Grand Unifying Theory. Software engineering is like skinning a cat - there's more than one way to do it.

<comment><USER8> The problem is that company's will either conduct _no_ analysis of their own software engineering processes or they will conduct an analysis but the data for it will be hidden meaning that it cannot be verified or reproduced.

So everyone has a theory, but there is little data to support the theories and getting that data is very difficult.

<comment><USER6> Right, it's like the dark old days of _Alchemy_ before the scientific discipline of _Chemistry_. We are still transitioning from quirky weirdo/geniuses doing arcane things in secret for a wealthy patron to doing things in the open, with peer review and an open fact-based debate.

</comment></comment></comment></comment></comment><comment><USER9> Spoken like a true theorist.

<comment><USER10> No, a true theorist would say we need theory or theories, not _a_ theory.</comment></comment>


A Weapon for Readers by Tim Parks (2014) - <AUTHOR> http://www.nybooks.com/daily/2014/12/03/weapon-for-readers/ <comment><USER2> Quote: We have too much respect for the printed word, too little awareness of the power words hold over us. We allow worlds to be conjured up for us with very little concern for the implications. We overlook glaring incongruities. We are suckers for alliteration, assonance, and rhythm. We rejoice over stories, whether fiction or "documentary," whose outcomes are flagrantly manipulative, self-serving, or both. Usually both. If a piece of writing manifests the stigmata of literature— symbols, metaphors, unreliable narrators, multiple points of view, structural ambiguities—we afford it unlimited credit. With occasional exceptions, the only "criticism" brought to such writing is the kind that seeks to elaborate its brilliance, its cleverness, its creativity. What surprised me most when I first began publishing fiction myself was how much at every level a novelist can get away with.</comment>


Show HN: Ethereum Address Monitoring, Bootstrapped Startup - <AUTHOR> https://ethwatch.io <comment><USER2> Usage by Financial Institutions - great. Might be worth open-sourcing some of the code - they might want to inspect it, and could also contribute.

Is there a way to upload a bunch of addresses using a text file, then downloading a backup of those addresses too?

Perhaps there should be a way to signup without an email address? Just a random string to get it.

</comment><comment><USER3> Very interesting . One of my favourite security features with my bank is configurable deposit/withdrawal notifications. Is that a (planned) feature?

This has basic utility from a security audit logging perspective as well. Arguably that data can be pulled from the chain on demand anyway, but integration is always a pain.

<comment><AUTHOR> We've already implemented highly configurable alerts for monitored addresses. Examples are transaction amount thresholds, whitelisted incoming and outgoing addresses, and low balance thresholds.</comment></comment>


The Future of Social Networks - <AUTHOR> http://mmoorejones.com/2011/01/25/future-of-social-networks/

<comment><USER2> There's a great presentation about the issues of current online social networks (namely facebook): [http://www.slideshare.net/padday/the-real-life- social-networ...](http://www.slideshare.net/padday/the-real-life-social- network-v2)

One key point he makes is that your social groups are usually disjoint sets of people and you may not want to share the same information across multiple groups. For example, you don't want your family to see pictures of you at a wild party that your college friend tagged you in.

<comment><USER3> After criticizing Facebook for overlapping social circles, Paul Adams joined Facebook last year. He was a Google employee before. And Facebook launched "Facebook Groups" to tackle this very problem.

</comment></comment><comment><USER3> "Facebook says that all my friends and contacts are of equal importance to me. They know this isn't true, but there is no way for me to distinguish between friends I am truly close with or contacts that I met at a conference and felt obliged to accept on Facebook."

Facebook tackles this problem with EdgeRank algorithm that controls the updates that appear in Newsfeeds. EdgeRank takes into consideration the people you interact with the most on Facebook. And I guess, a person interacts a lot with close friends only.

<comment><USER4> Thats not at all useful though.

Because there are things that you want to share only with some people (your girlfriend) or close family.

Interestingly enough there are things I wouldn't care if the entire world except my family knew so the circles aren't enclosed within one and other.

<comment><USER3> Ya, Facebook has answer for this- "Facebook GROUPS". It lets you separate people based on the connection you have with them. For ex, you could have groups like Family, Friends, Collegeus etc. So that an update is restricted within than circle.

<comment><USER5> Well I haven't had success in getting my old girlfriends to join my "psycho exes" group, so I'm not sure how effective Facebook's system currently is ;)

<comment><USER6> He's referring to Friend Lists (<https://www.facebook.com/help/?page=768>). If you use Twitter, it's like Twitter's lists.

Facebook's privacy settings are now pretty good. You can make things visible or invisible to everyone, networks, friends of friends, friends, friend lists or individuals and any combination of these things, e.g. a status update visible only to family except my mother.

<comment> mike-cardwell Will it allow me to split my friends into separate lists, and then have separate news feeds for each of those lists? I can see that I am able to post a status update and specify a list when I do it, but it ends up getting mixed into my normal news feed and doesn't have any indication of who can see it. This just feels dangerous to me.

I'll start using Facebook lists when they implement it properly. I want my lists of friends to be 100% completely separate. Separate walls, separate news feeds, and I want it to be very obvious which group I am currently working with at any time. If they can't give me that, I'm not interested.

<comment><USER5> That's exactly my take on these features.

Some of this functionality may be there, but the UI and UX is so horrible that there is little way to predict the output of the system.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> In fact, Facebook allows to differentiate between friends and connections using friends lists. It's even possible to restrict certain content to some of these lists.

What Facebook does not do - and I believe for a good reason - is to make these lists public. It's awkward enough when friends drift apart (which is something that I guess has happened to everyone), but nobody would want to be the first to reset a friend to a connection. So the system just would not work.

</comment><comment><USER8> I think everyone is aware of these issues and can clearly express the problem based on the real life social network presentation, but its about execution. How do you create this system that works for users ? Even if you built it, would users even care or care enough to leave facebook ? Describing the problem is the easy part.

<comment><USER9> Maybe not model all your entities as "friends"?

</comment></comment><comment><USER10> I just avoid Facebook all-together. am content with IRC and HN-style sites. when i really need to chat, I use Gmail's Chat or use Skype.

For me, anonymity and control are the reasons</comment>


A free cookbook for people living on $4/day Kickstarter for print edition - <AUTHOR> https://www.kickstarter.com/projects/490865454/good-and-cheap

<comment><USER2> Very cool - and reminds me of Jack Monroe's recipes & work in the UK: [http://agirlcalledjack.com/](http://agirlcalledjack.com/)

</comment><comment><USER3> Free PDF available here: [http://www.leannebrown.ca/cookbooks](http://www.leannebrown.ca/cookbooks) Great project with great recipes.</comment>