Git Is Not Revision Control (2017) - <AUTHOR> https://blog.feld.me/posts/2018/01/git-is-not-revision-control/ <comment><USER2> I feel like there isn't much of an argument made here. It's just "we chose VCS and we're clearly right" with the veneer of examples.

> Git is clearly not a VCS, and it has never tried to be one, and people > calling it one doesn't change that. The absense of a progressing version > number and lack of a definitive timeline, not to mention all the many > "unnatural acts" you can do to a git repo are sufficient arguments to settle > this point.

OK - all of these things you can get by having a central authority thereby creating a VCS (by your definition) out of git. So git matches your definition of a VCS under constraints you already have.

> But in many cases Git is an adequate substitute for a VCS, you just have to > augment it with an out-of-band definition of which tree is the 'definitive', > and settle who gets to define what 'a version' means. This is why github > exists in the first place.

Oh great so you agree that you can make git into a VCS based on your definition. So what's wrong with git again?

>In FreeBSD we have insisted on "proper version control" from day one, 23 years ago, and while it is a decision we should revisit periodically, everytime it has come up, it has been overwhelmingly confirmed as "the way we do things here".

Ah, it's just not "the way we do things here". That's what's wrong with git. Got it.

An argument that might make some sense to me is "the beneficial collaboration features we'd get out of git isn't worth the switching costs". But I just found this written so matter o-factly ("It's impossible to refute this line of reasoning in my opinion.") for something that seems to make no actual point at all

<comment><USER3> > But I just found this written so matter o-factly ("It's impossible to refute > this line of reasoning in my opinion.") for something that seems to make no > actual point at all

What's truly terrifying is this style of argumentation being applied to _every_ technical decision.

</comment></comment><comment><USER4> In my opinion, this is mental gymnastics to try to eliminate git from some discussion. There's nothing of merit here. Plenty of people use Git every day to control their software revisions and it works just fine.

</comment><comment><USER3> This argument is absurd. Git is clearly useful for revision control tasks, and so if it doesn't meet this guy's definition of a revision control system, the definition isn't particularly useful. The proof of the pudding is in the eating, even if someone doesn't think the delicious pudding qualifies as pudding.

<comment><USER5> This guy is Paul-Henning Kamp.

<comment><USER3> So what? He could be the almighty blogging from a burning bush and he'd still be wrong.

</comment></comment></comment><comment><USER6> From the title, I was rather expecting an argument along the lines of "Git is not revision control of code, but of snapshots of a filesystem"; I opened the link expecting to see an introduction to a patch-based system like Darcs or Pijul.

Pijul's theory, in particular, is extremely intuitive (if your intuition extends to "cocompletion of the category of files and patches", anyway) and it truly is born for the task of versioning text (and hence code). Git, by contrast, versions _anything_ , with the result that very weird and counterintuitive things can happen when you merge branches. I recommend [https://jneem.github.io/merging/](https://jneem.github.io/merging/) for a glimpse of what a distributed version control system could have been.

</comment><comment><USER7> For me, rewriting history is a feature of Git, and not a bug. I used to use Mercurial, which prioritized immutability of history, and I found that I was too frightened of some of the more advanced features with not-obvious side effects to bother messing around with them, because if I messed up, there was often no easy way for me to revert my repository back to the way it was. Immutability of the central repository is a reasonable thing to want, but let me blow up my own local clone if I want to.

What's more, I find that phk's tone and the blog's tone are at odds with each other. The blog seems to have the attitude of "Git sucks and this is why", while phk's e-mail is far more interesting, instead arguing that Git fits into another class of software entirely and saying "It's not for us, but that's okay, and oh by the way we should probably accommodate those who prefer git".

<comment><USER8> With Mercurial you can rewrite history like an Orwellian Minister of Truth :)

It's just a bit harder for newbies to shoot themselves in the foot.

<comment><USER9> Um, no, you cannot really rewrite so-called "published" history (one with the "public" _phase_ ). Both Git newbies and seasoned users could make use of such concept, should it be ever implemented (it probably wouldn't in vanilla though since the deafening silence in reply to anyone voicing ideas to prevent rewriting (some) shared refs).

</comment></comment></comment><comment><USER10> How could software prevent rewriting history though? It can't be physical impossibility. If ensuring client rejection is a solution to this, then won't a git client also reject history changes?

<comment><USER11> It can't. Even SVN at some point has some sort of data structure that can be modified by an admin.

Data is not permanent unless it's somehow written into the permanent fabric of space/time, and if you think about it long enough, deleting an svn or a git repo is just another way of changing history.

<comment><USER12> > Data is not permanent

A blockchain is getting close to permanent. I wonder if there is a blockchain- based version control.

<comment><USER11> Well, if you look at the number of abandoned alt coins and torrents out there, it seems far from permanent. Coinopsy has a list of abandoned coins if you're curious.

And even if you had history in a blockchain, it's possible for someone to prevent you from seeing the blocks that come in the future (breaking/filtering your internet connection), which is also in a sense changing history (by means of denying the future).

</comment></comment></comment></comment><comment><USER13> What's so important about progressing version numbers for commits?

<comment><USER14> I find it very useful for questioning things like "If I'm on rev 1000 and see the bug and you are on rev 990 and don't see the bug then we have 9 possible culprit commits".

This is possible to talk about in git given "HEAD~N" etc but it's cumbersome. Git should out of the box have support for the default scenario: there is a blessed branch on a blessed server. Revisions-as-numbers are the ordered (first parent) commits on that branch. Probably easy enough to hack into a tool, but to me it's a mystery why this isn't part of the standard behavior.

<comment><USER15> > "If I'm on rev 1000 and see the bug and you are on rev 990 and don't see the > bug then we have 9 possible culprit commits"

Sure, that's easy for humans, but on the other hand "If I'm on rev 4093e8 and see the bug and you are on rev 9b6dd8 and don't see the bug then we have $(git log --oneline 4093e8..9b6dd8) possible culprit commits" works just as well.

As for why there is no blessed-branch-on-blessed-server-and-commits-are- numbered-there behavior, it's just not conceptually clean for a distributed, decentralized version control system. GitHub or GitLab or Bitbucket could build this sort of behavior... but it still doesn't feel very Git-y.

<comment><USER14> > then we have $(git log --oneline 4093e8..9b6dd8) possible culprit commits" > works just as well.

It does - but that's also why it's so annoying that it's behind a very cumbersome cli front end.

As fotdistributed vcs: I realize that Git was designed as decentralized, and almost not even designed as version control - just a "stupid content manager", and that higher level functionality is built on top (such as GitHub). But that doesn't change the fact that the 99 or 99.9% use case is _centralized version control_ in the sense that there is a central blessed repo, making it absolutely trivial to agree on a shared global history in git just like in subversion.

I still think this sort of behavior should be part of core git, ie a higher level functionality layer of the kind now added by GitHub or some plugin code. Such as features for the centralized development model that _almost everyone uses git for_.

These features include:

\- file locking for non-text content (now available e.g in lfs).

\- pull requests (now added eg by GitHub)

\- Simple chronological history

Etc.

</comment></comment></comment></comment><comment><USER16> I don't understand why git so hard for people. Just

> $ git help everyday

And start from there. It's really quite easy, and I'd even say the single best designed piece of software I use everyday.

<comment><USER17> I remember a time before I understood git. I was working on a small team where no one did and never really wrapped my head around it while I was there. 99% of the git you use is super obvious once you understand it. It took just a week or two sitting next to someone I could bounce questions off of and the groking was complete.

It's powerful and I can't using imagine a VCS without getting to manipulate (rebase) history but I do remember a time when it was opaque to me.

<comment><USER18> > It took just a week or two sitting next to someone I could bounce questions > off of and the groking was complete.

That is insane. At $dayjob we teach SVN to non-devs (graphic designers and marketing types) in 30 minutes, and never have to train them again. They even do merges.

Git is truly a cool tool under the hood, but the UX is a massive drain on productivity.

We should be trying to get _more_ non-technical people to use VCS in lieu of Sharepoint, not having engineers spend weeks to "grok Git"

<comment><USER19> Totally this.

I use SVN exclusively when non-IT people are involved, such as designers, site editors etc. Random person and even those without high school diploma can grok SVN in less then an hour, particularly as you don't need to `git pull` all the time which is HUGE saver as most people in the team work on independent repository paths and thus git pulls are meaningless. Git stage is also more of an obstacle then a benefit in that context.

Everybody using computers should know SVN, I consider it as basic as managing files.

Git is great tool, but IMO targeted at developers.

</comment></comment></comment></comment><comment><USER20> > There was an internal discussion about the possible merits of switching to > git _to increase user contributions_.

That's a great discussion for a FLOSS project to have. It makes me think of a broader issue of how to judge whether or not to devote time to contributing to a given project.

Here's the logic I'd use as a reference case for making that decision. Hopefully others agree, or if not have some feedback for my course of thought...

The two reasonable initial branches to take in a discussion of changing the repo tech are a) that increased contributions are an important priority for the project at this time, or b) they are not. If consensus is they are not, there is little reason to discuss switching to git (or at least no urgency in this context).

If it is a priority, then there there are two obvious follow-ups: a) whether changing to git would even increase contributions to a significant level, and b) the cost of switching to git.

These are the obvious follow-ups because a) git is _wildly_ popular with an enormous knowledgebase accessible in the usual places, and b) git is stable, actively maintained, and has lots of stable, actively maintained tooling around it.

As a side-note, I can think of an unlikely yet possible objection: that the popular usage of git has a design flaw that causes data corruption, catastrophic usability issues, or security problems that are trivially avoided with other stable, actively-maintained software. But outside of that, it seems to me a healthy functioning project would focus their attention on the branches I outlined above.

A nice side-effect of such focus is that a community could quickly make a decision (e.g., "too costly for too little gain atm") without stepping on toes or closing themselves off from future discussion. (Alternatively, they could spend more time and even take a more assertive position, but again without starting flamewars or unduly closing off future possibilities.)

To me, any of these branches seem like a sign of a functioning developerbase that is minimally welcoming from an outsider's perspective, and not so likely to waste new developer's time.

> On Sun, Feb 26, 2017, at 14:59, Poul-Henning Kamp wrote:

> It is fundamentally wrong to ask "SVN or Git ?"

I'm stuck here. I can't figure out how this could be a relevant branch to take in such a discussion, nor how a project could have a leader who so casually takes this branch.

Keep in mind one obvious branch I mentioned above was consensus on a desire to increase contributions. Even if that isn't a priority now, it's always a potential priority in the near future. But now if that ever becomes the consensus, the project will have an _immediate_ inescapable conflict because _everyone knows a leading dev doesn 't even think git is a VCS_. And even without a leader opining, someone is going to _reference_ this obscurantist notion that git and SVN cannot be compared. _Remember the time so-and-so wrote that screed, and do we agree with it it?_

It's a guarantee of wasted time, both now and more importantly in the future of the project.

Honestly, I find the quoted message fascinating wrt the history of version control in FreeBSD. I can see why the author keeps coming back to it.

But as part of a FLOSS dev-process it looks quite dysfunctional to an outsider. If I make a suggestion to switch from SVN to git in order to increase contribs, the response should not feel like it was chosen by spinning a roulette-wheel of obscurantist responses. (And even then, the obscurantist response probably shouldn't alienate the entire userbase of Github.)</comment>


Windows, that's a step too far - <AUTHOR> http://robmanuel.blogspot.co.uk/2012/06/fuck-you-windows-thats-step-too-far.html

<comment><USER2> While I don't necessarily agree with the way Microsoft has this setup, they aren't preventing you from backing up. They're preventing you from using THEIR software package to backup to an external drive. You can use any number of free or paid alternatives, just not the one that's built into the Windows OS.

</comment><comment><USER3> Forget running Photoshop on Wine, or dual-booting. Run Windows XP within Virtualbox on Linux, and set it to "Seamless" mode. XP is lightweight and runs well on Virtualbox, although you may want to use the 64-bit version of XP if you'll be doing a lot of work with Photoshop. And under Seamless mode, it's almost as Windows apps are running natively on Ubuntu (or whatever Linux distro). I've not run Photoshop on Virtualbox (although I know others do successfully), but I regularly run a number of relatively complex Windows applications (such as Office) in this manner as part of my job. And it works so much better for me than Wine, or dual booting.

<comment><USER4> Completely agree. If you're in Ubuntu and need to get work done in a Windows app, do it in XP on VirtualBox. It's the right way.

Nlite your XP install down so it's "wather thin" for extra credit. I can be in Ubuntu one second, load up my VBox image and three seconds later I'm sitting at a usable XP desktop. Photoshop (et al) are fast but most importantly they're reliable and stable.

Wine does work for some things (games mostly) but you lose any sort of guaranteed reliability.

<comment><USER5> Why not win7?

<comment><USER4> Two reasons: I don't own a license for it and based on my preview testing, I don't need it.

I don't boot an instance of Windows for the Windows experience, I'm doing it so I can load another application so I can get things done.

Plus XP's Minesweeper and Sol are much better... For much the same reasons.

</comment></comment></comment></comment><comment> jack-r-abbit WOW. That is a lot of anger just because Windows doesn't have a built in SSH client (which I probably wouldn't use anyway... PuTTY is tops) and his version won't back up to a NAS (but there is other software to do that). Haters gotta hate.

</comment><comment><USER6> Did Windows go too far or did you not go far enough in properly selecting your machine upgrade? The differences between Windows and OSX run deep but it isn't Microsoft or Apple's job to tell you about them.

I will agree that Microsoft's rope-a-doping with feature deplete Windows variants is very rude and off putting.

</comment><comment><USER7> This is why I prefer the "Just Works" philosophy of the Mac (and it's a philosophy, not a guarantee of problem-free operation) to what I call the "Just Have To" philosophy of Windows.

Complain that you can't do something on Windows, and someone will come along, call you a name, and inform you that you can indeed do that... "You Just Have To" install this, configure that, tweak that. Eventually you've got a list of those things a mile long, and good luck to you if you ever switch to another machine.

<comment><USER8> Funny, I've resisted switching to Apple products for the same "Just Have To" philosophy in the other direction.

"You want to maximize a window from the window manager chrome? No problem, you Just Have To install (some app). What do you mean you don't want to pay $10 to be able to maximize a window, it's only $10, don't you think programmers should get paid?"

By comparison, Windows 7 "just works" for my needs, which is essentially providing a shell around Chrome and PuTTY.

<comment><USER9> So true: I've paid for window managers, Finder replacements, and clipboard managers for OS X as everything is an upsell. I still like my Mac, though. This entire article could be said about any of the OSes and XYZ features.

</comment></comment></comment><comment><USER10> I read this on a day when I'm about to head home and install Windows 7 on my new machine, because Ubuntu12/Mint13/Fedora17 all crash on the hardware because of known bugs with the modern hardware that haven't been fixed yet and I don't have a PhD in kernel development to fix it myself.

There's just something cruel in the world for reading this and being reminded of why I've dreaded the install I'm about to do.

</comment><comment><USER9> Wait until Time Machine Fucks you. (Written on my Mac)

</comment><comment><USER11> Apple: double clicked on the title bar.. nothing happened clicked on the green button.. window scaled vertically but not horizontally edit a text file and forget to save with .html extension.. try to change it in the file browser. it doesn't work.

</comment><comment><USER12> "I have no idea whether I'll be able to pull off living in Linux world and still do my work - I haven't had to do any photoshopping yet and the thought of Gimp or trying to get Photoshop to work under Wine is a bit daunting."

VM? Dual boot?

<comment><USER13> Actually I think (for me at least; also a web dev that does unix based stuff but also needs photoshop), the lower-friction route is to run Windows as the native OS, and virtualbox the linux install. (I'm also these days of the opinion that this is actually a better solution than cygwin)

Basically the unix bits are (far) less resource hungry than Photoshop...

<comment><USER12> "Basically the unix bits are (far) less resource hungry than Photoshop.."

I had never thought of it that way round!

</comment></comment></comment><comment><USER14> There was a short window about 10 years ago where OSX was the best unix workstation, no contest. But cygwin is really good these days, so good that the Apple premium cost and batshit insane vendor make it a non-starter.

<comment><USER15> in no way does cygwin make windows a unix workstation.

<comment><USER14> bash, ssh, screen, rsync, cron, gcc, perl/python/ruby, X, and excellent terminal emulation.

Treat cygwin as just another unix variant and it will go pretty far. Windows native apps and virtualbox are guaranteed to cover any missed requirements.

</comment></comment></comment><comment><USER16> Why didn't you just buy a big ol' honking external monitor and hook that up to your Macbook?

I develop on a Macbook Air, and that works quite well for me.

<comment><AUTHOR> To clarify, I'm not the author of the post.

But yes, this was what I thought. A nice monitor for ~£200-300 and you don't have to change a thing about what you do, assuming that for on-the-go, the 13" is just fine.

</comment></comment><comment><USER17> Childish rant is childish.

</comment><comment><USER18> Never thought I'd see the Ginger Fuhrer on Hacker news.

</comment><comment><USER19> That was silly.</comment>


Why People Don't Do What They Say and What to Do About It - <AUTHOR> https://edittress.com/why-people-dont-do-what-they-say-and-what-to-do-about-it/ <comment><USER2> Glad to see this on HN!

We've all been on both sides of this article. Sometimes (especially in startups) we overcommit and fail to hit our deadlines. This can burn relationships and do such harm that I think it's an incredibly important skill to develop, particularly for entrepreneurs.

This skill seems to go hand in hand with the ability to say "no" when you have too much on your plate.

As a side note... the Edittress platform is pretty cool! It looks like a much needed mentorship platform that I think will receive a warm welcome into the tech community particularly now that we are having more open discussions about mental health, inclusion, and diversity.

I hope we can expect a ShowHN soon! I just signed up.

</comment><comment><USER3> Lot's of practical tips but, the best part is the phrase "It's a sleigh ride to frustration."</comment>


Steve Jobs's worst decision was promoting Tim Cook - <AUTHOR> https://qz.com/819739/why-tim-cook-is-steve-ballmer-and-why-he-still-has-his-job-at-apple/ <comment><USER2> Why does everything have to be hyperbolic? It wasn't his worst decision. The man died because he didn't get his curable cancer taken care of soon enough. Or his worst decision might be he didn't acknowledging his daughter sooner.

Tim Cook isn't Steve and has done a lot of things right, but he's still not Steve so this story will be written 100 more times until a new "Visionary" CEO is anointed.

This speaks more to journalism then it does to Steve. Please stop.

<comment><USER3> Journalist these days feel that every single title needs to be as shocking as possible because they are _desperate_ for you to click.

I've learned to hate the words "baffled", "shocked", etc. because journalists basically spam them for clickbait.

</comment></comment><comment><USER4> >>>Satya Nadella ... released a new version of Windows without the usual trauma...

That's about the third time I've read similar sentiments in a 'Nadella is perfect' tinted article. I guess the massive uproar about; forced updates, phoning home and data-slurping, in Windows 10 must have completely passed some tech journalists by.</comment>


Future Node.js releases will be from the io.js repo - <AUTHOR> https://github.com/nodejs/node#cnv <comment><USER2> Future Node.js releases will come from what is current io.js. That is all. The name is not changing. This is nothing to get excited about--this has been the plan all along.

</comment><comment><USER3> This is a dumb posting with a really misleading title. Nowhere on the linked page does it say "Node.js/node is now io.js". Perhaps the maintainers should have updated the reamde before switching repos, but I suspect they're concentrating more on coding than on marketing.

<comment><USER4> Just above the commit count: > Future Node.js releases will be from this repo. [https://iojs.org](https://iojs.org)

It is part of github's repo description.

<comment><USER3> Yes that is the title of this thread now. It is in some sense the converse of the original title that I quoted above.

</comment></comment></comment><comment><USER5> The official name is Node.js. That repo is the combined source of Node.js 0.12 and io.js master and future releases will be coming from there.

I think the next major release will be "Node.js v4.0.0"

</comment><comment><USER6> For those wondering, this was a premature posting. Node.js is the name still, it's using io.js' source code from Node.js v4.0.0 and on. The Readme hasn't been updated yet.

</comment><comment><USER7> Misleading title, if you read the issue link that drunkcatsdgaf posted ([https://github.com/nodejs/node/issues/2327](https://github.com/nodejs/node/issues/2327)).

</comment><comment><USER8> They're really giving up one of the most recognizable platform names in tech (node.js)? Is this so Joyent can maintain control over its trademark? (However that implies they'll still use the name node.js for something.)

Is there an explanation of why nodejs became iojs somewhere and not the reverse? (and whether code will be updated to remove "node" references?)

<comment><USER9> (Guessing) it is a signal to the community that node 'belongs' to the community -- hence renaming it after the community/nonjoyent fork.

<comment><USER10> It was node pre-Joyent

<comment><USER8> There was no node pre-Joyent. Ryan Dahl and other early contributors were all working at Joyent. It is Joynet IP and they own the trademark.

<comment><USER10> (sorry for delayed response)

I don't think this is accurate. I don't know when Ryan went to work for node, but if you listen to his earliest talks, where he discusses the journey he took to develop node, it was an independent project.

Additionally, these posts identify when Joyent took node under its umbrella (along with the IP):

[https://www.joyent.com/blog/a-new-abode-for- node/](https://www.joyent.com/blog/a-new-abode-for-node/) [https://groups.google.com/forum/#!topic/nodejs/lWo0MbHZ6Tc](https://groups.google.com/forum/#!topic/nodejs/lWo0MbHZ6Tc)

</comment></comment></comment></comment></comment><comment><USER11> Good work! That happened way faster than I expected

</comment><comment><USER12> This blog post[1] should clear up a lot of the confusion... Most of this is just the transition of the organizational structure from io.js to the Node Foundation.

[https://medium.com/@nodesource/essential-steps-long-term- sup...](https://medium.com/@nodesource/essential-steps-long-term-support-for- node-js-8ecf7514dbd)

</comment><comment><USER13> Since no official statement has been made, I will just assume that they're arranging the repo.

</comment><comment><USER14> Now I have to change my pinboard tags...

</comment><comment><USER15> Interesting that they are moving forward with the name io.js rather than merging into node and keeping the legacy name.

<comment><USER16> I'm confused, I thought they were ditching io.js

<comment><USER17> I'd thought so too and assume the readmes havent been updated yet

<comment><USER16> see: [https://github.com/nodejs/node/issues/2327](https://github.com/nodejs/node/issues/2327)

</comment></comment></comment></comment><comment><USER18> Detente is over, schism returns?

</comment><comment><USER19> Someone ping me when JS removes mutability.

</comment><comment><USER20> We changed the title from "Node.js/node is now io.js".

Submitters: please don't make up your own title on a post you didn't write. If you change it to something misleading, the entire thread can easily become about that, as here. Use the original title unless it is misleading or linkbait, and if necessary find some representative language in the OP.</comment>


CSS Variables: Why Should You Care? - <AUTHOR> https://developers.google.com/web/updates/2016/02/css-variables-why-should-you-care <comment><USER2> After reading, I'm still not sure why I should care.

I've been using "CSS variables" for years -- in _less_. If I'm modifying CSS on the fly in JS, then I don't need CSS variables; I have _JavaScript_ variables.

Don't get me wrong: I'm not against this change. CSS has been a rather unexpressive language for some time; removing that deficiency can hardly be called a bad thing, as long as the change is consistent across browsers.

So, if someone wants to use this idea, well, good for them. But I've gotten along find without this feature for a long time. I don't see any particular reason to start using it now.</comment>


Ask HN: Go-to app building stack today? - <AUTHOR> I haven't written an app for many years. If you wanted to make one, let's say something simple, how would you make it? Is there "the way" to make an android/ios app, write once, deploy on both? <comment><USER2> Try [https://flutter.io/](https://flutter.io/)

<comment><AUTHOR> Thank you. Will do</comment></comment>


Add Muni bus stop times to your Mac menu bar - <AUTHOR>

Github Repo: https://github.com/adviceadam/Muni-Menu-Bar
README is on imgur: http://imgur.com/a/4pmRM
Screenshot: http://i.imgur.com/GMWnmiG.png <comment><USER2> Whoa, way too complicated for a non-dev. You should build it in such a way that a non-dev can easily select a stop from a dropdown or something. Also, this means if I want to change the stop, I have to edit the .m file and then recompile?

No thanks.

Cool idea, though.</comment>


Objects and Collections in pure C like Java - <AUTHOR> https://github.com/josuemnb/SimpleC2.0 <comment><USER2> I believe C++ was a preprocessor at the beginning, and I had long time ago a book in French explaining how to do OOP with standard C. This attempt provides probably as much I need of OOP, I always (since 1994) thought that C++ was an ugly thing.

Thanks!</comment>


How to win like Waze: turn users into contributors - <AUTHOR> http://www.bigdatarepublic.com/author.asp?section_id=2817&doc_id=264506&

<comment><AUTHOR> One thing I missed out from the article: Waze contributors get direct access to the Waze devs once their data collection is high enough. This is a fascinating model that doesn't condescend to app users, but elevates them to having an active role in improving the app.

</comment><comment><USER2> so what will happens with Waze now?</comment>


Web Security – Client side certs - <AUTHOR> http://www.w3.org/DesignIssues/Security-ClientCerts.html <comment><USER3> Our development server at work is authenticated using client-side certificates that I install on every employee's computer (along with our Root CA cert). This takes me about 5 minutes to generate for them [1] and another 2 minutes to put into their OSX keychain. It's fun to sit there with each person and show them what I'm doing and how this wonderful system works.

But if I asked ANY ONE of them to do ANY step along the way, they'd throw their hands up and quit. My brother who is extremely tech competent can't do this. I like these suggestions but I just don't know fundamentally if this system can be used by people without a drastic overhaul to the UI.

[1] [https://github.com/TeachBoost/pki](https://github.com/TeachBoost/pki)

<comment><USER4> You might also like cloudflare's cfssl toolsuite: [https://github.com/cloudflare/cfssl](https://github.com/cloudflare/cfssl)

I've reduced most of my cert-generating to just a one-liner and a JSON metadata file. For example: [https://twitter.com/shazow/status/582262725683777536](https://twitter.com/shazow/status/582262725683777536)

<comment><USER3> Wow, thanks for that link. That's an awesome set of tools.

</comment></comment></comment><comment><USER5> Actually there's not a lot of work for browsers to do. Polish UI, make "logout" button, provide JS API, allow apps to handle errors better. Actually they should provide JS API to work with standard security cards and that will help to extinguish Java Applets from a lot of places. Not a lot of work, but it might start new era of web security.

I always wondered, why password-bases authentication is so prevalent, when asymmetric cryptography is there and actually used under the hood. That's a dream: one key to rule them all and no security problems with leaked accounts, unified UI to register, login, logout.

<comment><USER6> Why stop at one key? Personally I'd generate separate keys for all sites, just like I generate separate SSH keys. Apart from the obvious security benefit, it also means that your identities on different sites can't be tied together solely by your public keys, which companies could plausibly be convinced to share with governments, other organizations, or even individuals. (They're "public" after all, right?)

<comment><USER5> I would use one key for most websites, as I use one login for most websites, because that's not something I'm trying to hide and I like the convenience and simplicity. But of course it must be possible to use multiple keys.

<comment><USER6> Right, but it would be very difficult to put forward the case that a company should provide you with passwords, email addresses, or physical addresses. It's recognised that these are all private and personal information, because they're used for other purposes.

Your public key, however, would have one purpose and one purpose only - <USER2> identify you. As the public half of an asymmetric crypto pair, and given that people share their public keys on keyservers and on webpages all the time, it wouldn't be too difficult to convince an organisation that wasn't aware of the issues to give you the public keys associated with their accounts.

With that information, it would be really easy to definitively tie your identities together because you only need the public key in order to do so. Very few other pieces of information taken in solitude can do that - names are not unique, passwords are not unique, even physical addresses are not unique. (I'll grant that email addresses might be, but even then, companies aren't going to hand out email addresses to anyone who asks because of spam.)

That's why I'd use a different key per site.

</comment></comment></comment></comment><comment><USER7> There's a fundamental problem with client certs as currently implemented in browsers as well as the <keygen> tag: these certificates aren't origin-bound and violate the same-origin policy.

The method of authorizing client certs without using the same-origin policy is the source of the horrible UX problems: ask the user (often without a "remember this choice" checkbox, so users were asked every session)! Determining which certificate to use can be difficult depending on the subject/issuer, and in general this is a terrible choice to ask a user to make.

The problem gets a _lot_ easier if you use origin-bound certificates:

[http://www.browserauth.net/origin-bound- certificates](http://www.browserauth.net/origin-bound-certificates)

With origin-bound certs there's a clear and unambiguous answer as to what cert to use for a given origin by-design. These certs can either be dynamically provisioned in a browser or device-locked to e.g. a Yubikey U2F token. There's no need to ask the user anything more than to push the button on their hardware token if they have one. Otherwise the process is completely automatic.

I really don't think efforts to use in-browser client cert authentication that don't respect the same-origin policy are going to get anywhere because of this problem.

</comment><comment><USER8> If this has to take off, even with browsers providing an easier UI to create and manage client side certificates, two things would be important to avoid confusing users and a lot of "<insert browser name here> is crap and broke my login" messages:

1\. Easy sync of the certificates across devices (as mentioned in the article, allow the user to choose which ones to sync). Most (non-tech-savvy) people still don't use password managers, and instead remember or write down passwords. You have to make it easy for these people to use multiple devices without having to jump through hoops. Even private keys protected by a passphrase/password add one more barrier (assuming each user has a separate OS account and is logged in). How would a user setup a new device with a previously setup client certificate? What fallback mechanisms (other than form based user/password auth) would be required for cases where a user wants to use a public computer or a shared computer account?

2\. Handling the reissue of client side certificates for the expiring/expired ones along with revocation (if/when necessary). I believe this is a huge topic by itself on both the usability and security fronts. What would be the sweet spots for the expiry enforced for a particular site? Six months? One year? Two years? Ten years? Considering that most users in the current form based authentication scheme rarely change passwords, the convenience, or rather, the reduction in annoyance to end users, should be an important consideration.

I have seen client side certificates used in corporate environments where the management of these is easier, but even in those cases I have always seen alternatives like form based authentication available, along with other things like NTLM, etc.

Please comment/inform if any/what prior work has been done in these areas (I'm sure many people must have thought about these).

<comment><USER9> Regarding device synchronization, I wonder if having per-device certificates with something similar to 2FA, where you have to confirm the new certificate on a device with an already-trusted certificate, wouldn't be a better option. This would make revocation in case of a lost device easier (i.e. your other devices would continue working, no need to fall back to some other authentication method).

</comment></comment><comment><USER10> Back in 2008 I have blogged ([http://pilif.github.io/2008/05/why-is-nobody- using-ssl-clien...](http://pilif.github.io/2008/05/why-is-nobody-using-ssl- client-certificates/)) about client certs. The UI around them is horrendous and they also serve as a very good solution to uniquely identify clients across sites. This was a good idea, but in its current implementation it's unusable.

<comment><USER11> I agree as far as unsupported consumers are concerned, but it is perfectly usable in a corporate setting. As commenter mikegioia already noted; it takes only five minutes to help install the certificate on a user's computer. After that it just works.

</comment></comment><comment><USER12> One problem is that keygen is either deprecated or not supported. So you have to create the client cert on the server, then have the user download it (including private key). Or the client has to create a signing request and then upload it to the server, and then download the certificate.

Once that is done though, client certificates works pretty well, the browser will pop up a "what certificate to use" dialog when entering the web site. And the server (nginx) will send all the details like name, city etc to the web- server application.

Another problem vs passwords, is that the user has to copy or download the certificate to each computer device. And just like passwords, you need to have a process for identifying the user in case he lose the certificate/key.

<comment><USER13> I've used the HTML5 <keygen> element in Chrome and Firefox with great results. Chrome (on a Chromebook) even stored the generate key in the TPM on the device

<comment><USER14> I believe z3t4's point is that the element is deprecated after HTML5, so you can't rely on it working forever, or gaining adoption in new browsers that don't already have it.

</comment></comment></comment><comment><USER15> Mobile browsers/devices handle client certs better than any desktop I've seen. Especially since they have hw trusted storage.

The issue is identity/linkage. If they let you set up an arbitrary number of keys, so you could do one per site, that's fine (and really, if you use the same username everywhere it's sort of the same thing)

</comment><comment><USER11> Good set of recommendations. Client-side certificates are great for securing web applications in a corporate setting, but the client-side is indeed a bit rough in the UI — although once set-up, it is no hassle at all.

A major benefit of client-side certificates, is that you can increase the security of all internet-facing web applications you have by routing all external traffic through a gateway proxy, and performing the certificate check there. We use Nginx for that, and host applications such as GitLab, MatterMost, OwnCloud, and DokuWiki that way (performing authentication with LDAP so users can log in with the same credentials on all services).

I'm not sure I agree with his suggestion of having the ability to automatically synchronize client-side certificates between devices. I would rather have that be a conscious (security) choice rather than an automatic feature.

<comment><USER16> Agreed on certificate synchronization... especially since a certificate isn't the same as an account, it's just a key for an account... Having each device have its' own cert allows you to disallow a specific device without disallowing all devices for a user account.

</comment></comment><comment><USER17> Actually creating client side certificates is quite easy if you use the <keygen> tag. See [http://www.w3.org/2005/Incubator/webid/spec/tls/#certificate...](http://www.w3.org/2005/Incubator/webid/spec/tls/#certificate- creation) Sadly some browser vendors have been threatening to remove that functionality rather than trying to improve it. But see the work by the Technical Architecture Group There is also this document now produced by the TAG. [https://github.com/w3ctag/client- certificates](https://github.com/w3ctag/client-certificates)

<comment><USER18> I have been trying to find a way to use the `<keygen>` tag in production for a very long time, but I am consistently thwarted by the browsers simply not supporting it well enough. Where does the generated private key go? How do I sign things with it again? It's never clear, and browser support is terribly inconsistent.

</comment></comment><comment><USER19> We're using client certs for some mobile sites. But it hasn't been an ideal experience. Has anybody else experienced a problem where Android prompts for selecting which cert to use for a given site every time? iOS seems to remember which one to use for a specific site, but Android prompts EVERY time. I can't tell if it's just something misconfigured, or if its just the behavior of the OS by design.

</comment><comment><USER20> There's almost no point of client certs for consumers without smart cards. Malware can steal your certs. People lose them or delete them or don't sync them.

Can we not devise a system to use our existing bank cards (with chips on them) to store client certs too?

<comment><USER9> Interestingly, that's already _kind of_ available in some countries. I live in Austria, where we have a system called Bürgerkarte which utilizes PKI. One of the supported options are ATM cards (others being public health insurance cards, mobile phones or "real" smart cards). Unfortunately, it's not very widely used and quite complicated to set up. This would definitely need to be an international effort to become viable.

<comment><USER21> Exactly, e.g. Estonia has ID cards with smart card functionality.

[https://e-estonia.com/component/electronic-id- card/](https://e-estonia.com/component/electronic-id-card/)

</comment></comment></comment><comment><USER22> This is interesting , to use cross device there needs to be a vault of some kind to share btw browser would it make sense to have a recommendation for that also , so it would be standardized ?

<comment><USER23> One approach is to issue one certificate per device per subject. The subject identifier could remain the same. If this approach is taken, revocation checking is critical -- you end up having a bunch of certificates that all claim to be the same subject, so you need to make sure any presented certificate is valid. However, while revocation checking is often problematic for clients, some of those issues are more easily managed on a sessile server.</comment></comment>


I'm fed up of being asked for feedback – when did companies get so needy? (2016) - <AUTHOR> https://www.theguardian.com/commentisfree/2016/mar/07/feedback-companies-shopping-online-theatre <comment><USER2> When I get something from Amazon that's genuinely great, or genuinely terrible, I leave feedback. Otherwise I agree with the article - you've had my money, now stop bothering me!

</comment><comment><USER3> I always wonder how many people do those surveys online for legitimate sites that offer to enter you into a drawing for a gift card or some other relatively small prize. It seems like whenever I do click on one the survey is ridiculously extensive and most questions don't even apply to me.</comment>


Tips for work-life balance - <AUTHOR> http://matt.might.net/articles/work-life-balance/ <comment><USER2> "The internet" is a giant drain of time. In my final year in school, I experimented with not getting internet access and instead relied on a friend to update my Debian mirror and read mail in batches. My grades rocketed skywards without me doing much of anything at all...

If you can, turn it off, in more or less drastic ways. Restrict sites like this one with LeechBlock. Try recording yourself, then watch and experience the pain... Never(tm) sit down in front of a computer without a hand-written plan of things to do. Once the task is done, consciously plan the next one, write it down, and repeat. GTD, Pomodoro all can help.

What works for you depends on many factors. Usually one or two of the available techniques are enough to stop oneself from drifting around aimlessly on the web.

We have created this giant information-distraction machine. We should therefore also be able to control it...

</comment><comment><USER3> Solid post and there's a lot to agree with. However, one statement was difficult to digest.

 __ _If factors like "health", "happiness", or "family" rank below professional goals, your long-term priorities are not stable._ __

The second factor, happiness, is probably the most difficult of the three to qualify. Professional goals and happiness may be intimately related for many people, and activities that bring more immediate happiness may be ones that detract from long-term satisfaction. Maybe a more accurate way to put this would be to avoid pursuing __ _professional goals_ __if it involves sacrificing __ _life goals_ __.

<comment><USER4> Agreed. I loved the methodical, organized view of the issue, but that sentence bugged me too.

Specifically: I think it completely reasonable (possibly, recommended) to decide "I'm going to prioritize work over having a family until age (30, 35, 40)".

The article completely misses the dimension of calendar time.

<comment><USER5> Family does not only mean partner and kids. Most people have parents, siblings, maybe nieces & nephews. You might choose to be available for them too.

</comment></comment></comment><comment><USER6> Explicit boundaries are extremely helpful. Time-based boundaries like mentioned in the OP are good ("disable Internet access at night"), but I've found that location-based boundaries are also extremely helpful.

As an example: no work in the bedroom, _ever_. This includes reading work email, doing web research, taking work calls, logging into a server, etc. If you have to do something work-related, take it outside. This helps you (and your partner, if you have one) keep good sleep hygiene, and also provides a good barrier to obsessing with work. ("I could check my email, but do I really want to get out of bed?")

This also applies to side-projects. Take it outside.

My wife and I have periodically enforced a "no screens in the bedroom" rule (with exceptions for e-Ink), but this breaks down sometimes when we need to have a phone in the room for emergencies, and when one or the other of us gets obsessed with a new tablet game. ;-) But it's usually possible to at least keep objects with physical keyboards out, which provides an additional protection for me against cheating on the "no work" rule.

</comment><comment><USER7> I used to work 7 days a week. Pretty much every hour was at a computer or laptop. My partner wasn't happy and looking back I wasn't particularly happy either.

To correct that I set specific work hours and chose not to work weekends. Obviously there are exceptions to this. Sometimes work demands working a little longer. Sometimes the world ends on a weekend. This is fine. However these events should be few and far between.

I found though that I still wasn't too happy. I would get anxious and stressed at the weekends. I discovered the reason for this was because I was still checking my email. I would see bug reports or requests and I would anxiously look at the time and realize it was still 32 hours till I started work on Monday.

To fix that I stopped checking emails. If it is truly urgent I will get a phone call. If it is "email urgent" it can almost always wait till Monday.

The result has been a much better work/life balance and I have been happier in general.

</comment><comment><USER8> "productivity systems like The Pomodoro Technique are useful when it comes time to execute tasks"

I highly recommend Pomodoro technique (<http://www.pomodorotechnique.com/>) for greater productivity with less stress.

<comment><USER9> I can't recommend Pomodoro enough for most tasks!

Don't use it for writing and similar things though, the breaks will be noticeable in your output.

<comment><USER10> Curious. I've actually found the opposite, even when writing fiction. In my case, at least, I find that the mandatory breaks both keep me from diving too deep down off-topic rabbit holes and free my subconscious to solve plot or structure problems.

</comment></comment></comment><comment><USER11> One of the simplest ways I find to manage my work/life balanceis to deactivate incoming emails on my iPhone over weekends.

It would be nice if you could automate it, but removing the inbox on Friday night and reinstating it on Monday morning works like a charm.

Can be done with the flick of a switch in your mail settings in iOS. I am sure there is something similar on android.

</comment><comment><USER12> If you like this article you may also love Jack Cheng's "Maxing out Your Triangle" which explains the love-growth-cash triangle. [http://blog.jackcheng.com/post/2521829568/maxing-out-your- tr...](http://blog.jackcheng.com/post/2521829568/maxing-out-your-triangle)

</comment><comment><USER13> It's almost like the diet and weight-loss industry. We spend way more time and effort on trying to solve the problems than on preventing them in the first place.

Want to balance work/life? Here's the secret formula which I'm giving away for free today only:

Work 40 hours / week

Sleep 56 hours / week

Play 72 hours / week

This formula covers everything discussed in the blog post. What's surprising about it is that it is nothing new!

We're way overthinking this. The American workforce has been getting up, going to work, coming home and enjoying time with friends and family and hobbies for decades without having an industry of workflow systems and work-life balance editorials. But to make it this simple sells no books, attracts no seminar attendees, and brings in no blog readers.

</comment><comment><USER14> Two things me sane: I get up an hour earlier than I need to in the morning to sit, think (high level/long term), plan and occasionally write. I set "Do not disturb" on my phone to automatically enable at 6pm daily.

</comment><comment><USER15> Regarding the productivity thread:

Similar to the tactics of disabling internet access at certain intervals, there's a good way to cut you off from compulsively checking Facebook, LinkedIn etc. at work.

Create a very long, random password and store it in your computer (e.g. KeePass Portable) but do not memorize it. That way you'll be unable to log in at work unless you ask for password reset. If that's not enough, create a special email account for time-suckers and do the same. Works like a charm.

It's a pity HN works for guest users ;)

</comment><comment><USER16> i figured much of this out years ago. the biggest piece of advice i can wholeheartedly recommend is be explicit about your priorities. once you do that, everything falls into place, decisions become easy.

my wife is sometimes confused as to why i haven't taken certain jobs or career paths but when i explain to her the impact it would have on things that are more important to me, she seems to understand. about a year ago, i was reminded of this in reading william whyte's "the organization man", in particular the chapters about family. right then and there i made a decision, i backed out of some job offers and have been pleased.

take care of yourself, that's the most basic lesson of all, and that doesn't mean focusing strictly on finances (real or anticipated) or your career.

</comment><comment><USER17> very good points.

right now i have the same problems...still studing, more then one job, setting up/finishing my new apartment.

Respect to you, that u shotdown ur internet on ur laptop at 8.30pm - you never enter ur router and deactivate this feature?

i will try to adopt some of your points to get rid of some stress in my life.

thank you.

<comment><USER18> actually he said 6:30pm, heh</comment></comment>


Ask HN: YC rejected. Now an acquisition scenario came up. Help? - <AUTHOR> Anyone out there that can help me?
So I found out the unfortunate news that I didn't get the interview for YC W'14. However, yesterday, I received an inbound inquiry on my startup from a global player asking if we want to sit down for a potential acquisition discussion.
Quick Background: - my company is in public beta and haven't even launched yet! No crazy traction, proprietary technologies, some revenue (nothing meaningful). - we're going to start our angel fundraising efforts soon - player is the largest in the space (I'm not even sure if I can disclose details/name that's why I'm not disclosing specifics). - they specifically said that their senior M&A team and C-level execs have been thinking about building a product similar to ours and would want to discuss potential for team/product acquisition.
There's a million scenarios/questions going through my head from fundraising to why I didn't even get a YC interview.
Anyone who can opine on the best way to approach this would be greatly appreciated. <comment><USER2> YC's advice around these kind of talks is that they're a colossal waste of time. If you're interested in an acquihire situation then there may be some value in meeting, but otherwise the chances of something meaningful coming from this is very low.

Remember, for these M&A guys, meeting people like you is there job. For them having these meetings is a productive use of their time. It costs them nothing, and they only gain more insight into the marketplace.

What do you get out of these meetings? They're not going to tell you anything special/secret about their product/market.

What I've seen some people do is have an initial call/meeting (don't travel for it) for about an hour to feel things out. If it seems like there's genuine interest then have there be a "break up" penalty. i.e. if things don't work out they pay you $5-10K.

That way you get something for your time if it doesn't work out, and if they're not serious they won't agree to it.

<comment><AUTHOR> Hmmm. That's interesting (breakup-fee). Is that market or would you say it's an exception for startups in acqui-hire situations?

My only reason why I would take this a bit more seriously is that I know the following: a) a friend of mine who plays in the similar space - she has had talks with them for couple of months earlier this year about starting something similar for them before her business got got acquired by someone else. She told me that they seemed to be pretty serious and have been contemplating for a while how to get it started. b) there's also not many players who really understand that market and/or are in the market. c) they have precedence of similar behavior in different part of their business within the past 6 months (early stage acquisitions - one was series a then 6 months acquired but they're definitely on a talent or talent/hire acquisition spree).

Thank you so much for your advice!

<comment><USER3> Rather than a break up fee, perhaps it's worth charging them consultancy rates for explaining what you're doing to them - after all, they can't unhear that information so why not charge it at rates matching the value to them in their conversations with the next company if you end up not coming tot terms?

<comment><USER4> I would think the standard would be a breakup fee. The fee can be orders of magnitudes larger than any time involved (see AT&T & TMobile acquisition)

</comment></comment></comment></comment><comment><USER5> It doesn't hurt to be a cynical in this situation. They will want to do "due diligence" which means they discover many valuable things about your product before they have really committed to anything. This is certainly to their advantage. They are also likely to make you a low-ball offer if you come across as inexperienced or gullible.

When you engage in any sort of negotiation with M&A guys (who are bound to be much better at negotiating than you are) you really need some sort of leverage or you'll get a raw deal. So unless there are multiple suitors that you can play off against each other this is likely to turn out to be an expensive distraction for you.

<comment><AUTHOR> Thanks for the insight. I'm pretty sure I can negotiate better than them as my partners and I have done a ton of complex M&A deals in the past so no one is going to fk me over in any way, but I do agree with you that this can be an expensive distraction. I was thinking whether to invite other suitors to play it off each other to make it worth my while and this in turn, can help with the fundraising side with the whole intention of just maximizing the deal structure and terms and amount raised w/r/t fundraising. Thanks so much for your input!

</comment></comment><comment><USER6> From my experience, I would open the discussion with them and be honest about where you are trying to go with the product. Offer up potential partnership arrangements/rev share (whatever makes plausible sense.)

In my opinion, if they could (and it's rare that they would) knock you off overnight, then maybe you don't have a business to begin with. YMMV with that one, but thats what I generally think about it.

Although everyone will say, don't let it be a distraction. It's a HUGE distraction. Your motivation to continuing building the product may wane, you may start to devote a lot of time to the negotiation strategy. It's a distraction.

Now should you get to the point where you think the acquisition is a good route for you, really the only way to improve the offer is to have other offers (whether that's raising money, or a different acquisition offer.) If you have little revenue to speak of, I'm not sure how you argue you should get a 5000x multiple instead of a 300x multiple.

<comment><AUTHOR> I play in a multi-winner space if you play it one way; a winner-takes most space if you play it another way so I'm not too worried about competition. They're actually worried about another competitor who just got in so they want to build out something similar (is my guess).

Do you think that this in any way helps me to be able to raise money or would real investors just brush it aside (i.e. does it provide any real validation of concept)? Thanks!

<comment><USER6> I can't say whether or not an acquisition offer is validation of an idea from an investor's perspective.

To play devils advocate, I could also argue that if you are considering it, then you weren't hockey sticking, and thus i shouldn't invest in you.

Also, one thing to consider is, and this is my opinion, that taking early investors could potentially be an impediment to an acquisition. The reason being is that your investors are interested in getting some kind of multiplier on their return. If you were considering a talent acquisition, not having investors means that almost any sum of money could be worth it to you.

When my-cofounder and I were shopping around for investment before, we were at a point where we weren't sure if we needed to hire a sales force to help us grow our customer base. So we put together a plan for what kind of money we needed.

One kind VC gave us the advice to try doing the sales ourselves for the summer. If it worked out, then we wouldn't need to raise any money. If it didn't work out, then at least we would know it was really hard, and then we could go try to take outside money. Either way we would know something.

Fortunately for us, we ended up trying to do sales that summer (it was hard.) And because we had been so open with potential partners (and acquirers), we ended up with a deal that worked out well for us. I'm not sure it would have made sense had we raised any money.

</comment></comment></comment><comment><USER7> Had a friend who was recently in a similar situation minus the YC part and basically it turned out to be a massive waste of time (and legal fees) when they decided he wasn't the 'right fit' for their culture. It was more of an acqui-hire, but the lessons learned are still relevant here. Start discussions but don't let it take over everything as they might just be testing the water.

So in summary, continue business as usual while you negotiate and be skeptical of their motivations.

<comment><AUTHOR> Thanks for the insight! Please let me know if there is any way for me to be able to reach out to your buddy.

</comment></comment><comment><USER8> 1\. Why are you still mourning YC'14? 2\. Why are you asking for uninformed advice on a public forum?

In situations like these, I like the Mathew Looks rule.

Mathew was a USCF expert on my high school chess team, trying to teach me to be a better player. He set up a chess position with chances for both sides, and asked which side I liked better. "I have no idea," I replied. "That's why you lose. It doesn't matter whether you're right or wrong. It matters that you have an opinion."

Form your own opinion about this situation. Like it. Feel confident about it. Then follow through, as well you can.

It doesn't matter what anyone else thinks. It matters what you think.

<comment><AUTHOR> 1\. not mourning but stating a fact and also successfully got people to comment and provide feedback.

2\. as an uninformed participant, even if 9/10 are deemed irrelevant information any incremental and relevant information will be beneficial in my decision-making. I have my own opinion but opinions are usually just that. Opinions formed through ignorance when there are market participants willing to provide insight in order to help me better prepare for what's to come is a naive way to attack this problem.

I simply asked for advice. Insight. I know when to pull the trigger and know how to pull it. I just want to know before I pull the trigger, do I have as much information to form my own opinion. When you don't know enough to even form you own opinion, then what good does going with instinct do?

</comment></comment><comment><USER9> Are you properly incorporated yet? If so, ask for their specific legal advice and take the meeting. Don't disclose anything that the potential acquirers could use to build their own product and see if their interest is sincere. If so, then make a decision. Until then chances are they are really just trying to pick your brain for insights before they build their own competitor.

The way I see it is that if the fit is good and the money is solid then maybe it's worth it. If not you have at least one fantastic example of validation when it comes time to raise funds...

</comment><comment><USER10> Disclaimer: I don't know anything about anything.

>my company is in public beta and haven't even launched yet!

Buy low, sell high. You don't approach this early for no reason.

>they specifically said that their senior M&A team and C-level execs have been thinking about building a product similar to ours

That was meant to scare you. Ironically, if you're smart, it achieves the opposite. "Ok, so why don't you? What does a 6-man startup have that a global player doesn't?"

My tentative vote, pending further information: Nay. From your thread comments, you seem psyched about the product - see how far that enthusiasm can push your product before you risk losing it. When you're enthusiastic, you want to "control your own destiny," as they say in college football. Also, beware "best case scenario" bias. If it were me, I would promise you creative control, teams on top of teams beneath you, fair captain. But where do you see that. Google acqui-kills 100 companies a year.

</comment><comment><USER11> The "YC advice" is similar to the oversimplifications I have heard, pawned off as wisdom. Take it as a chance to listen, learn and develope a relationship with those guys. Just make sure you understand who the decision makers are, and only deal with them.

<comment><AUTHOR> cool. Thanks!

</comment></comment><comment><USER12> If you don't love your product, just sell it.

</comment><comment><USER13> What do _you_ want out of this?

Unless you can answer this question, any advice is essentially pointless. In my experience, you can imagine up all the scenarios in the world (I know I have many times), but reality depends on so many factors outside your control that things are likely to go in a direction you do not expect anyway.

Regardless of whether you want be acquired or not, you should take that meeting. You have nothing to lose, and everything to gain: Even if nothing comes of it, it will be an opportunity to gather valuable information, create useful connections that could be useful later on, or lead to other business opportunities that aren't even on your radar right now.

Most importantly, you need to look at this and every other meeting you take as the beginning of a negotiation—even if you never discuss an actual business opportunity. And the trick with being a good negotiator is not necessarily to win, because nobody wins all the time. Instead, the trick is to stay in control of the process. Talk to these folks, and see what they want. A company that is serious about acquiring you will want to get to know you first, understand your strengths and weaknesses, and so on. Your job is to steer the discussion in a direction that's worthwhile to you and never, ever, ever, ever (ever!) let it take more of your time than it deserves.

So many of the other folks who have commented seem to worry about this being a waste of time, or the other company attempting to steal your ideas and businesses through the due diligence process. But how else are you ever going to get a deal done if you don't interact? In my experience, due diligence is the _last_ step of an M&A exercise: after the parties have agreed on all the terms, its role is to simply make sure that neither party is trying to pull one over the other. And it's an expensive process, so no-one really wants to do it until they're sure they want to go ahead with the deal.

So, nobody is going to start a serious negotiation by asking to look at your financials or read through your source code (and, if they do, you should probably walk away) until they are willing to put a commitment of their own on the table. In the meantime, just let the discussion take its course and push back, firmly but politely, every time you feel that the process asks more of your involvement than you feel is warranted at that particular time. Again, any serious businessperson won't mind—heck, they may even try to measure up your worth by seeing how far you're willing to be pushed before you start pushing back.

Oh, and you should run—_run_—and find a good advisor. This is the kind of discussion you want to sound off with someone who can help you examine your specific situation… which is hard to do in a public forum like HN :-)

<comment><AUTHOR> Thanks so much for your insights. This one is my favorite so far! Actual meat in here for me to chew on.

What I want or what I want for my company? I work with a team, not for myself and even though my team works for me, I like to think that I want to do what's best for my team because at the end of the day, without my team, I have no company. If I had it my way, I wouldn't even consider it as for me, it's all about going big or going home. However, some of my best friends are part of this team, those who do not have luxury career hedges that I am fortunate to have, and for some of them, even an acqui-hire would do wonders for their careers.

I do agree with you that I should take that meeting. The meeting, I found out, was referred internally by an insider who knows my team and my qualifications - so she would not advise us to waste time knowing that we're about to embark on a fundraising process; and I don't think she would have referred us to talk to them if she didn't think it was serious (at the minimum a great opportunity to learn and network).

I've worked on enough deals where a lot looked promising and serious but just didn't make it to the finish line. I'm fine with that. I just have no idea what the process is like, what the expected probabilities are on a timeline, what is appropriate for me to push back on, what are these type of companies looking for, etc. On top of that, if there is any way if this gets fairly real, I can maximize the value of this company with respect to fundraising. But even there I have no idea as to how investors perceive these kind of things and what impact it may have (i.e. do I go talk to investors and say hey look X company wants to potentially buy my team out? But I'm just getting started and so I want your money and really make this thing take off? Or does that make me look foolish because they simply don't care?

I wish I had an advisor to ask these specific questions! Hence, why communities like YC would have been great for where I am at this point of my startup.

Thanks again.

</comment></comment><comment><USER14> Will this be able to make $100M/year in revenue within the next 3 years?

If it won't probably be able to make >$10M rev/year, you're not super passionate about it and they want to buy it for $3M+, I'd go for it.

</comment><comment><USER15> Acquisition talks are usually a huge distraction. They will likely drag you out and hurt the moral of the team to get a sweetheart deal if they really are that interested.

</comment><comment><USER16> If you are looking for a job, take the meeting.

<comment><AUTHOR> haha. love it. if that job pays 200k a year with 1m+ option vesting over 3 years... i'd have to think about it for a day. otherwise, it'd be npv negative for the risk i've already undertaken to do a startup in the first place!

<comment><USER17> > if that job pays 200k a year with 1m+ option vesting over 3 years...

Assuming they can't fire you and leave you with nothing, not even the technology you created.

<comment><AUTHOR> that's right! gotta make sure if they fire me for no good reason my options vest pronto : )

</comment></comment></comment></comment><comment><USER18> Do you love the idea and product?

<comment><AUTHOR> I love the idea and product is coming around. People seem to like the initial product of what we are offering (beta test users avg time spent 9 min on site which I heard is pretty steller for what I'm doing).

I have 5 guys who all used to make well into six figures who are not taking a single penny and working 80 hours a week because we are passionate about the idea. If it was up to me, as long as I got enough funding to eating 3x a day and sleep 6 hours a day, I would love to work on it for a year to really see where this thing can go.

<comment><USER18> Then do that. Getting the funding should be no problem at all with the people already working on it.

</comment></comment></comment><comment><USER19> Is the offer that good?

If you do sell it now, do you have other startup ideas worth working on? (I assume this was your best one).

Is there any vesting involved, or is it a cash deal?

<comment><AUTHOR> I have no idea what the offer would be like but I'm sure if they were to acquire me then they'll force me to work there for 3-4 years before anything vests. If it is just team acquisition then maybe it's just pay back seed investors and give us some bonus / equity options but I find that hard to believe as the outcome (if it happens) because why the hell would I ever take that deal considering that I can probably raise some angel funding to see it through and if it doesn't work out then I'll go to them and plead my case...

I have lots of cool startup ideas but this is my baby and I'm a specialist in it. Not a super viral idea though like a Snapchat or anything; it would take time to scale but just a big market if penetrated.

</comment></comment><comment><USER20> uninformed prediction: "pg called us to correct their mistake, we got an interview and we're in" by the end of next week, though you might be asked not to talk about it in public. meanwhile, nothing will come of the "acquisition" talks.

<comment><USER21> uninformed speculation: this is the hope of the author of this post. and intention behind this post.

But too hard to say if this is realistic, without nothing about the product or founders.

<comment><AUTHOR> very true. i wish i could reveal a lot more. at least my product and what i'm going for and have the yc community tell me their honest opinion.

founders on the other hand - from the tech end nothing extraordinary but solid. on the business end, pretty top-notch caliber (i.e. 99 percentile in their respective fields).

<comment><USER21> Awesome. Wish you the best of luck, regardless of what happens. Wasn't trying to be cynical - apologies if my comment was interpreted that way.

<comment><AUTHOR> Thanks lbr. I got a chuckle out of your comment so didn't take any offense to it whatsoever! I'm pretty sure PG is too busy to care about a potential oversight of an interview based on some off-chance strategic acquisition happening, but we can all dream about it : )</comment></comment></comment></comment></comment>


Building a PWA was our best idea ever - <AUTHOR> https://medium.com/javascript-in-plain-english/building-a-pwa-was-our-best-idea-ever-b7b233726b41 <comment><USER2> I personally would not have been happy to release this since it's pretty sluggish on my current gen mid range Android. The user numbers don't lie though so I'm the fool for valuing performance so highly over functionality. I love the idea of PWAs, owning the server, single frontend, native like experience, it's the performance issues that prevent me from moving away from native.

What was the distribution of users like? Is it mostly mobile?</comment>


FBI lawyer who tried to force crypto backdoor now says working crypto essential - <AUTHOR> https://boingboing.net/2019/10/28/san-bernadino-conversion.html <comment><USER2> "Talking head follows script"

<comment><USER3> If it's a good script, I'm all for it.</comment></comment>


The US Military Is Responsible for Almost All the Technology in Your iPhone - <AUTHOR> http://www.businessinsider.com/the-us-military-is-responsible-for-almost-all-the-technology-in-your-iphone-2014-10

<comment><USER2> If the tax money stollen to people to finance the military (and of which a small part is returned as research grants directed by the military), wouln't this money be used more usefully by the people, and why not, wouldn't they have promoted research leading to useful devices like iPhones (but probably without the privacy privating features you encounter in those smart phones)?</comment>


Plastic particles falling out of sky with snow in Arctic - <AUTHOR> https://www.bbc.com/news/science-environment-49295051 <comment><USER2> Governments are slowly starting to take single use plastic seriously. A good list of government actions varying from Countries to cities is here: [https://www.nationalgeographic.com/environment/2018/07/ocean...](https://www.nationalgeographic.com/environment/2018/07/ocean- plastic-pollution-solutions/)

Private industry as well like Coke is going to put water into cans under the Dasani brand. It's not everything but it's a major step in reducing the waste caused my plastic.

But plastic is in other products as well like toys, electronics, etc... Individuals must be aware of this and need to make better choices or else this problem will just continue.

I am hopeful we can take collective action to clean up the environment and live sustainably.

<comment><USER3> > Individuals must be aware of this and need to make better choices or else > this problem will just continue.

No they don't. At least not if they live in the developed world. Virtually all disposed of plastic in the US and Europe is sequestered in solid-waste landfills. Modern landfills leak virtually nothing to the outside environment.

Virtually all environmental plastic contamination comes from third world countries in Asia or Africa. In particular China, Vietnam, the Philippines and Indonesia. Due to rampant corruption and lack of oversight these countries have gross mismanagement of their solid waste disposal.

Plastic is completely fine to use. As long as it's properly disposed of, there's essentially zero environmental impact. If you live in a first world country, I can assure you that your plastic straw will absolutely not end up in a turtle's nose. The issue is that the international community needs to hold Asia and Africa accountable for not upholding global standards on ocean pollution.

[1] [https://www.dumpsters.com/blog/how-do-modern-landfills- work](https://www.dumpsters.com/blog/how-do-modern-landfills-work) [2] [https://ourworldindata.org/plastic-pollution#mismanaged- plas...](https://ourworldindata.org/plastic-pollution#mismanaged-plastic- waste)

<comment><USER4> It seems at least one first world country is sending recycling waste to developing countries for supposed processing [http://www.abc.net.au/news/2019-05-22/malaysia-flooded- with-...](http://www.abc.net.au/news/2019-05-22/malaysia-flooded-with-plastic- waste-to-send-scrap-back/11136322)

<comment><USER5> Yes it is becoming a real problem here in Australia.

[https://www.abc.net.au/news/2019-01-11/australias- recycling-...](https://www.abc.net.au/news/2019-01-11/australias-recycling- crisis-one-year-on-whats-changed/10701418)

And just recently we started sending recycling to landfill in many places:

[https://www.abc.net.au/news/2019-08-06/councils-sending- thou...](https://www.abc.net.au/news/2019-08-06/councils-sending-thousands-of- tonnes-of-recycling-to-landfill/11385458)

Historically we've "outsourced" our recycling problem to Asian nations rather than develop or implement solutions at home, and unfortunately now our chickens are coming home to roost.

<comment><USER6> > rather than develop or implement solutions at home

I find this absolutely infuriating... it's the perfect job to give to the CSIRO (our public scientific research organisation) and provide government grants to get local recycling off the ground. There's so much talk around "supporting local industry", but when decisions are actually made, they use overseas suppliers 9 times out of 10.

<comment><USER5> Agreed. I mean if we look at the CSIRO's list of achievements:

[https://www.csiro.au/en/About/History- achievements/Top-10-in...](https://www.csiro.au/en/About/History- achievements/Top-10-inventions)

and considering the defunding that has been going on, particularly with respect to climate change:

[https://www.theage.com.au/national/victoria/csiro- australia-...](https://www.theage.com.au/national/victoria/csiro-australia-to- suffer-for-ignorance-on-research-20160207-gmno7t.html)

It really is a sad picture indeed.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm scared and feel totally powerless. Everyone around me who I've talked to about this either feels the same or thinks its a complete hoax.

The whole habitable planet thing was nice while it lasted.

But seriously, does anyone have any suggestions on how a software engineer can make any sort of meaningful impact on this? Or even groups of software engineers, as many of the people here feel similarly. This is a problem that must be solved.

<comment><USER8> Software engineer here. I wouldn't necessarily say this is specific to software engineers. But I do think individuals can make an impact in many ways. Using your money to purchase products that are free of plastic and is sustainably made is one way.

Another action people can take is to refuse working for an employer who doesn't take sustainability seriously or is an obvious polluter. I recently switched jobs from a place that put API's in front of warehousing, logistics, and fulfillment. They did not take sustainably seriously. Tons of plastic packaging and inefficient warehouses.

I'm now at a retailer that is extremely conscious of sustainability. Their warehouses and stores are all 100% carbon neutral and are starting to divert 90%+ of all waste from ending up in landfills. Data centers are also carbon neutral. Sustainability decisions ARE business decisions. In my experience, I've seen most businesses separate sustainability and business. It's refreshing to be somewhere that molds the two together. I wish more businesses took this approach.

If you are interested in making an impact then do some research on the company before your next interview. At the end of interviews they give you the opportunity to ask questions. Ask about sustainability and see what their reaction is.

<comment><USER9> I think it's misguided to talk up individual action over government regulation. I'm sure it feels nice to "do the right thing" but it's not impactful. In some cases, it frees up resources to be further wasted by the problematic % of people who just don't give a damn.

My suggestion is always to elect better politicians and write better laws.

<comment><USER10> You can do both.

<comment><USER9> The focus belongs on government regulation and smart polices. Example: the current landscape of recycling in America is a complete scam for the most part, outside of aluminum cans.

Personal behavioral changes will not impact on the scale required.

</comment></comment></comment></comment></comment><comment><USER11> "Number of particles" is a bad metric. One way to formalize this complaint is that this measure is independent of Avagadro's number. In particular, there are many more molecules in a liter of water (~10^24) than there are liters of water in the oceans (~10^21). So if you tag all the water molecules in a single glass of water, fully mix that water in the oceans, and then scoop out another glass from the ocean on the other side of the world, that second glass will contain many tagged molecules.

These misleading sorts of statistics also appear when people discuss detection of radiation, e.g., detecting minute radioactive fallout in the US after the Fukushima meltdown.

<comment><USER12> Which part of "freaking plastic is falling out of the sky in fucking ARCTIC" is misleading?

<comment><USER11> Maybe this will help. Consider the first cup of water that Egyptian pharaoh Tutankhamun drank on his 18th birthday. That water is currently raining down on the Amazon forest. This is not a good argument that we are being overwhelmed by pharaoh water. (Of course, the plastic could be a big problem; this just doesn't show it.)

<comment><USER12> So what in your view would be a better statistic?

<comment><USER11> The fraction of the snow by weight that is plastic (ppm, or whatever), especially with a comparison to the amounts historically and to levels that are known or reasonably suspected of having bad consequences. This, for instance, is how particulate matter is quantified for assessing air quality in urban areas (one of the more harmful and less appreciated environmental damages).

</comment></comment></comment></comment></comment><comment><USER13> Direct link to the (open access) paper: [https://advances.sciencemag.org/content/5/8/eaax1157](https://advances.sciencemag.org/content/5/8/eaax1157)

</comment><comment> 08-15 By what kind of logic does one get from

"some of the contamination may have come from ships grinding against the ice. [...] some may have come off wind turbines."

to

"do we need so much plastic packaging?"

</comment><comment><USER14> I think we should ban the use of plastic where there are viable alternatives. Kids toys are mostly made of plastic when they could easily be made of wood.

</comment><comment><USER15> I dream about one day opening a non-profit/co-op grocery chain called "Tarable Grocery". The capital outlay would be considerable of course, but ultimately and optimally, the chain would lease containers to members who would fill them with bulk products, returning to refill them or return them as appropriate. My vision here would be to make available quantities of essentially any bulk food option that would be consumed by the local market before spoiling. The stocking system would be a hoot and there would definitely have to be some sort of central purchasing apparatus, but I think it's doable.

</comment><comment><USER16> Could we please get paper bags back by default in stores again? Ban the plastic checkout bags.

I can see having a fee for 'luxury' versions of the bags (EG handles) or for an oversized bag (compared to small single items)...

However I'm pretty sure the stores loose more on the bulk of credit card transactions than they do on the item bagging fees.

</comment><comment><USER17> Pretty sure future generations will treat microplastics as asbestos or leaded fuel today. Especially since its widespread in the air. [https://www.nature.com/articles/srep46687](https://www.nature.com/articles/srep46687)

</comment><comment><USER18> Want to use your CS/dev skills to help solve this problem? Come join us at Citrine Informatics: [https://citrine.io/careers](https://citrine.io/careers)

<comment><USER19> Mind sharing a bit about what your company does and how is it trying to help solve this problem?

</comment></comment><comment><USER20> sick and tired of the media saying this is irrelevant. global warming is a straw man.

<comment><USER2> They are linked because plastic is produced from petroleum. Green house gases are emitted to extract and make plastic. The growth of plastics is highly linked with our increased use of fossil fuels.

</comment></comment><comment><USER21> RIP humanity/world. We had a good run

Supposedly it's even in the water. Measured in Germany by german labs. They're introduced by cosmetics like the abrasive perls some cosmetics use.

<comment><USER22> Cosmetics were a scapegoat. All plastics breakdown into smaller and smaller particles, but never fully degrade. Ever seen UV damaged plastic that felt like it just turned to dust? That dust is microparticles.

<comment> 08-15 Not true. Plastic that is collected and incinerated degrades to carbon dioxide, water and nitrogen. You can't collect used cosmetics.

<comment><USER23> Only if it were that clean: "Finally, waste-to-energy plants have the potential to emit low levels of toxic pollutants such as dioxins, acid gases, and heavy metals." [0]

Just plastic is never "just" plastic. There will always be contamination of trash with potential for emission of pollutants.

[0] [https://www.nationalgeographic.com/environment/2019/03/shoul...](https://www.nationalgeographic.com/environment/2019/03/should- we-burn-plastic-waste/)

<comment> 08-15 Your whataboutism still proves that not all plastics degrade to microplastics, doesn't it?

There is also a difference between the bulk of some material becoming something else and traces of some side product being emitted, not to mention potentially better technologies like molten salt oxidation or plasma gasification.</comment></comment></comment></comment></comment>


The Myth of American Military Dominance - <AUTHOR> https://warontherocks.com/2019/08/the-myth-of-american-military-dominance/ <comment><USER2> Something I never understand when defence spending is compared: how do they account for differences in PPP and different levels of grease/corruption?

E.g if the US spends twice as much as X on fighter planes, but they are built in an uneconomic place because of politics and wages there are double than the average of X. I would say it might mean it actually spends only half, no?

</comment><comment><USER3> This article is trying to claim that the Nazis only lost on the eastern front because of the Soviets ("but the Soviet Union destroyed the largest portion of the Nazi military and defeated the Army of Manchuria, Japan's strongest ground force.") But fails to mention that the US was actively supplying the Soviet forces with food and equipment through the lend lease program.

A few paragraphs later they try to downplay the first gumf war ("Unfortunately, the first Gulf War was not a strong indicator of American military power compared to other major powers") while completely failing to mention that the iraqi army was considered top 5 world wide. The fact that the US beat the Iraqis in such a short time frame was an "oh shit" moment that caused a crisis of faith in the Soviet leaders and directly led to the military overthrowing the Soviet Union.

This author seems to be trying to change history to fit his narrative by cherry picking interpretations of events and making false claims about the effectiveness of America's past allies and enemies.</comment>


Show HN: Beyond Broker – Make real estate agents compete to sell your home - <AUTHOR> https://beyondbroker.com/ <comment><USER2> Hi HN! I'm the founder of Beyond Broker, and I thought I'd share a bit about the service.

First, a seller's information is kept private from agents, so they won't be getting unsolicited emails or phone calls.

Second, agents compete by providing sellers with an analysis of how they will sell the home. This includes a listing price range, commission, services offered, marketing plan, and comparative market analysis. We also allow them to write a personal message so the seller can get to know them better.

There are only a few steps to get started, and it's completely free for home sellers. Also, there is no obligation or contracts, so if the seller doesn't like any of the agents, they don't have to choose any of them.

[https://beyondbroker.com](https://beyondbroker.com)

Also, check out our promo video… [https://www.youtube.com/watch?v=QqPUwZTm0Lg](https://www.youtube.com/watch?v=QqPUwZTm0Lg)</comment>