W3C approves WebAuthn as the web standard for password-free logins - <AUTHOR> https://venturebeat.com/2019/03/04/w3c-approves-webauthn-as-the-web-standard-for-password-free-logins/ <comment><USER2> I recently used auth0 to implement passwordless login (via "magic link" emails) for a client project. Auth0's documentation is not great, but some of their blog posts are pretty good. In any case, if you're interested in WebAuthN, you could do worse than reading what Auth0 has to say about it:

[https://auth0.com/blog/web-authentication-webauthn- overview-...](https://auth0.com/blog/web-authentication-webauthn-overview- demo-tool/)

<comment><USER3> Can I just say I detest magic link emails that don't offer me a way to just use my password manager?

<comment><USER4> How would a magic link email be used with a password manager?

<comment><USER3> im talking products like notion that only support magic links (or google auth I guess but I'm not doing that). Slack does it right. You can use a magic link or use your password.

<comment><USER5> I think Medium does that

</comment></comment></comment></comment></comment><comment><USER6> I don't want to let the password go. It gives me the freedom to rightfully access my service if I just know the secret, without any entanglent to some app, device, or other account.

<comment><USER7> I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)

<comment><USER8> I agree it's annoying. They're working on it, but they should have really enabled it sooner. There's no technical reason, iPhone has the necessary NFC hardware. [https://www.wired.com/story/yubikey-lightning-ios- authentica...](https://www.wired.com/story/yubikey-lightning-ios- authentication-passwords/)

<comment><USER9> Their main page for mobile heavily implies they are already there with iPhone/NFC.

[https://www.yubico.com/products/yubikey-for- mobile/](https://www.yubico.com/products/yubikey-for-mobile/)

<comment><USER8> Actually, you're right - that capability has apparently been available since last year: [https://www.yubico.com/2018/05/yubikey-comes-to-iphone- with-...](https://www.yubico.com/2018/05/yubikey-comes-to-iphone-with-mobile- sdk-for-ios-and-lastpass-support/). The link I cited is for lightning- connected Yubikey hardware, which is supposed to come out this year.

</comment></comment></comment></comment></comment><comment><USER10> I think fundamentally most users don't understand anything more complicated than passwords. Passwords are easy. They make sense. A kindergartener understands the idea of a secret word that only they know.

Tokens, certificates, FIDO -- it's black magic. Therefore people don't trust it.

It has to be as easy and intuitive as passwords or it's a non-starter.

That's why the SMS codes (though insecure) are so popular. People understand "enter this number that I just texted to you"

<comment><USER11> Passwords are only easy if you're using them in an insecure fashion (sharing common passwords across multiple sites). Doing passwords _right_ is actually really, really hard without the assistance of an external tool (password manager).

I get what you're saying though. Users are used to passwords, so moving to an alternative means of authentication will introduce a bit of friction. That said, I think that done right WebAuthn will actually be way easier to use than passwords. Users will just be able to sign in to their browser once, then use what is effectively single-sign-on for every site thereafter.

We're still quite a ways away from that point, but that's where we're headed.

</comment></comment><comment><USER12> I don't understand how does it work. If I'm using just desktop and don't have mobile phone or any specialized hardware, I can't login?

<comment><USER13> Correct. You'll need a FIDO key to log in in that case

<comment><USER14> What in the spec precludes this from being implemented in software?

[edit] Reading more of the spec it definitely seems like they meant for it to be possible to implement this in software. So while a physical FIDO device might be preferable, it shouldn't be necessary.

<comment><USER15> It looks like [https://github.com/github/SoftU2F](https://github.com/github/SoftU2F) would work for that.

I believe Chrome's dev channel also has experimental soft webauthn support.

<comment><USER16> Currently, it does not because the browser aborts when it loses focus: [https://github.com/github/SoftU2F/issues/51](https://github.com/github/SoftU2F/issues/51)

</comment></comment></comment></comment></comment><comment><USER17> Does anyone else find these informal specifications difficult to digest?

The informative appendices link to papers on TPM and the like but it's hard to find a formal description of the protocol, or at least the sensitive parts, that could be independently validated or verified.

Has there been any work to formally verify/validate the design of this protocol that I'm not seeing?

<comment><USER18> You're not alone. I'm self-taught in english and it's not my first language. Although native english speakers have commended me I still find reading technical texts taxing.

They fall in the category of any academic text. Be it from a uni, research group, specfication manual. I did not receive formal education in English so I don't understand those formal words. Every other sentence there's something I have to look up and then I'm in a rabbit hole.

Actually same goes for my native tongue in some respect since I dropped out of school before reaching university.

I've still managed to make a career in IT and often desire to read technical specifications but feel helpless when I try.

My strategy so far has been to wait for an implementation in a language I can understand like Python, hopefully.

<comment><USER19> They're commending you because your English is terrific =) Learning a language is tough work, but if you didn't say anything I would have had no idea.

</comment></comment></comment><comment><USER8> Shameless plug of a WebAuthn relying party (RP) library that I implemented recently (Python server, JS client): [https://github.com/pyauth/pywarp](https://github.com/pyauth/pywarp)

Having worked with a few different standards before, I was pleasantly surprised by how easy to understand and ergonomic ([https://github.com/google/mundane/blob/master/DESIGN.md](https://github.com/google/mundane/blob/master/DESIGN.md)) the WebAuthn spec was.

</comment><comment><USER20> W3C press release: [https://www.w3.org/2019/03/pressrelease-webauthn- rec.html](https://www.w3.org/2019/03/pressrelease-webauthn-rec.html)

<comment><USER21> [https://www.w3.org/2019/03/pressrelease-webauthn- rec.html.en](https://www.w3.org/2019/03/pressrelease-webauthn-rec.html.en)

English version. (It wasn't originally in English for me, but maybe it was autodetecting something?)

<comment><USER22> It was in my native language (French). According to the "Translation" link[0] it's available in English, Japanese, Chinese and French.

[0] [https://www.w3.org/Press/Releases-2019#webauthn- rec](https://www.w3.org/Press/Releases-2019#webauthn-rec)

<comment><USER23> It uses HTTP content negotiation, based on the Accept-Language header.

</comment></comment></comment></comment><comment><USER24> [https://caniuse.com/#search=webauthn](https://caniuse.com/#search=webauthn)

<comment><USER25> That's... actually not as bad as I was expecting it to be. If you're willing to limit your audience to modern browsers only, the only holdout is Safari; and on that score, what else is new.

<comment><USER26> Its not just whether the API is available but whether its practical to use. I'm not sure which browsers recognize or support fingerprint readers, though all the implementations seem to support usb u2f.

Feels like a total failure to launch that the spec doesn't recommend the use of browser accounts as credential providers. Every single major browser has an associated web account with it (Firefox Account, Google account, Microsoft account, Apple id, etc) and could trivially use those accounts as authentication providers.

<comment><USER27> That would make it difficult to change browsers, wouldn't it? Or indeed to use different mobile and desktop browsers?

</comment></comment></comment></comment><comment><USER11> Almost there; now we just need some cross-platform implementations with synced credentials, and support from a couple major sites. Ideally some password managers will step in and implement support, and Google will add support to their own login flow as a primary authentication factor.

<comment><USER28> Agree. Credential syncing is important.

Use case: I create an account using using a Yubikey on my desktop, then want to access that account from my mobile phone using a fingerprint. How does the website know I'm the same person?

Keybase has a nifty personal web-of-trust for this stuff, but (A) that ties you to a single strong identity and (B) you can't really use that identity outside of their services.

</comment></comment><comment><USER29> Still waiting for Google Chrome and Firefox to support User Verification in the form of PIN prompts and Resident Keys for true passwordless login (at the moment WebAuthN in Chrome is basically just 2FA, no option for Passwordless).

Hopefully soon!

<comment><USER30> Early support should be appearing in the coming weeks on Canary channel when run with --enable-features=WebAuthenticationPINSupport

</comment></comment><comment><USER31> Somewhat random thought: is Challenge-Response sufficient or should it be 'Challenge-Challenge-Response' so that the client only answers a challenge it requested? Otherwise, what's to stop an XSS attack on page A from effectively MITM page B by overriding the event listener for the login on page A, asking to sign for page B, then exfiltrating the response?

EDIT: looks like the dialog attempts to give you some information, but it doesn't say WHICH profile on the domain and people could certainly not pay attention to the domain in that prompt (I had to check if it existed because I hadn't noticed).

<comment><USER32> From what I understand, the way that FIDO defeats phishing is that it signs a response on the basis of the presented domain. If a phisher stands in the middle with a domain looks similar to human eyes to the legitimate domain, then the attacker is returning to the legitimate domain a response that was signed for the wrong domain, causing origin to reject the response.

If your site makes it even remotely possible to have an XSS attack on the login page (by not being a separate page with no user-provided input apart from the login credentials) then you're doing login pages wrong to begin with.

<comment><USER31> I'm not sure this addresses my point.

> If your site makes it possible to XSS the login page, you're doing login > pages wrong.

Agreed, but the point was that a DIFFERENT service might be vulnerable and have XSS on their page which allows an attacker to request credentials for the real target. Your service isn't hacked, your users are.

> signs a response on the basis of the presented domain

This might do it, depending on what this means... Does this mean that if my address bar says `www.serviceA.com` that I include that domain in the response? Then if I asked the client for their credentials with a challenge and `rawId` (I think that's what identifies the relying party, IIRC) matching `www.serviceB.com`, it's possible that `www.serviceB.com` can reject the MITMed response because the attestation has the wrong domain. This is similar to JWT implementations only verifying the signature is valid and not checking that the signature type is the kind expected (i.e., not none). So, a weakness but nothing fatal.

I am curious how that works. I'll need to try it out.

</comment></comment></comment><comment><USER33> If only Microsoft hadn't chosen to use the code-name Hailstorm for its authentication proposal back in the days (and generally had a better image and a more open approach etc). Would have alleviated a lot of the pain earlier.

<comment><USER25> Hailstorm wasn't really the same thing. It positioned Microsoft as a centralized identity provider, with MS holding all the user data and everyone else just connecting to proprietary Microsoft online services to check if the user was who they said they were. Kind of like Facebook Login, but built around 2000s-era-trendy technologies like XML and SOAP instead of JavaScript and JSON.

It's hard to see how Hailstorm wouldn't have run into the same issues people have today with Facebook Login, the big one being that it's maybe not awesome to have a gigantic, notoriously ethically-challenged competitor sitting directly between you and your users.

<comment><USER33> yeah i mixed that up, I meant CardSpace as was pointed out. Still a no-go for other reasons though.

</comment></comment></comment><comment><USER34> So what happens if you lose one of those USB devices?

Can you use multiple USB devices on the same site?

<comment><USER27> OK, so here are the options I've seen people deploy for 2FA:

1\. Force users to register two U2F tokens. Google's 'advanced protection' requires this.

2\. Have users print out one-time-use recovery codes and put them somewhere safe. This is what Google does without 'advanced protection'.

3\. Require the user to provide a cell phone number, thus offloading the problem to cell phone companies, introducing all the insecurities that result from that. This is what Apple does (as far as I can tell)

4\. AWS is similar, but requires both an e-mail and an automated phone call.

5\. Github delegates 2FA recovery to Facebook, via their "Recover Accounts Elsewhere"

6\. Facebook allows the user to designate 'trusted contacts' who can get a code they can give to the user in person or over the phone.

7\. Have the customer contact customer services, who follow a process companies are cagey about disclosing.

8\. In corporate settings, just have them visit helpdesk in person.

<comment><USER35> #2 sounds most appealing. I live in Japan and don't have a reachable phone #. Wife and I simply FaceTime if we need anything. Otherwise I have no mobile means of authentication. There have been several occasions where I simply couldn't use the service because I could not authenticate via a phone number. I feel that companies that force this method of authentication have never considered my use case and could care less if they lose me in the signup process. Too bad. I for one actually have the money to pay them, but hey, if you don't want it that's fine with me.

</comment></comment></comment><comment><USER21> The last time I saw 2fa and fido talked about on here, someone recommended a set of 2 keys, but they ones they recommended are now out of stock.

Does anyone have a recommendation with the reason?

Thanks.

Edit: _With_ the reason. Jeez, what a typo.

<comment><USER36> I can tell you that I own a couple of off-brand devices and a blue Yubico "Security Key".

But rather than specifically recommend things I will tell you what I believe you should care about:

1\. Does it actually connect to things you authenticate on? If you always authenticate a Mac Book Pro with only USB C ports, then the USB-A Security Key is stupid because it'd need an adaptor. For physical connections if it shows the connector you can feel comfortable, this isn't 4Gbps video it either works or it doesn't. But for stuff like Bluetooth, find somebody who has actually seen the thing you want to use working.

2\. For the primary device (if you don't have them identical) be sure how you are going to carry it. Will it go on your key ring, or in your wallet? If you have to carry an extra device and you're someone who has never owned an umbrella for more than a month, that's futile, they're too tiny to rely on getting them back but too expensive to throw away - pick something you won't lose.

3\. Robustness. Again for the primary device, the Yubico key I have (USB-A one) has good reputation here, with people leaving them in jeans pockets through a wash or dropping them onto concrete floors without trouble. Others, even from Yubico, vary, you may be super clumsy or not.

Beyond that there are some technical things you could decide you really care about, hardware bugs, but none of them are exactly show stoppers that I've seen. And there are extra features, that Yubico device I own does FIDO2, which means it could be a true password _replacement_ not only a second factor. But I think that feature has even less chance of taking off than WebAuthn itself, so I didn't rate this in choosing the device.

</comment></comment><comment><USER37> >Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.

Neither of these methods are simple. I don't have a camera or fingerprint reader, idk what is FIDO security key or how to get one, and mobile phone can be lost or cease working at any moment so it's not a reliable method of authentication.

<comment><USER38> So what is your suggested simple, reliable method of authentication? Does one exist?

<comment><USER37> A password sent over an encrypted connection and hashed+salted on the backend? It's an extremely reliable and proven method that has been used for decades!

<comment><USER39> Totally secure against data breaches and phishing, as we've seen over and over again.

Oh wait...

</comment></comment></comment></comment><comment><USER40> How easy will it be to implement? We should keep in mind the most dangerous guys out there store passwords in clear text in databases and other amateurish rookie mistakes. Having _easy to use_ / _impossible to f__k up_ libraries for every major platform is going to be critical.

<comment><USER31> There are two methods, IIRC. `get` and `create`. Everything is done with Challenge/Response with the browser handling the Private Stuff. It's hard to mess up, at a glance.

You ask the browser to create an asymetric key pair. It returns the public key, which the server saves. On login, you provide a challenge to the browser to sign using the private key from earlier. It returns the signed message and the server verifies the signature.

<comment><USER41> What if the user is trying to login via a device different from the first one?

<comment><USER36> I can't tell what "a device" means here.

If you mean "what it I only used Security Key A to register, but now I want to sign in with Security Key B?" the answer is that you can't, that's the wrong key. Register all the keys you want to use.

If you meant what if I registered with my Pixel phone and now want to sign in on my Windows PC, that just works fine. The client "state" lives in the Security Key (actually there is no state whatsoever in affordable designs), it's very clever cryptography.

</comment></comment></comment></comment><comment><USER42> Working group's repo: [https://github.com/w3c/webauthn](https://github.com/w3c/webauthn)

</comment><comment><USER43> I was saying for a long time that a new protocol for a biometric driven login scheme should become the new default. We use biometrics to log into our phone, then a password manager uses the same biometric to authenticate on the same device to log me into a website by auto populating the username + password for me. Afterwards I'll get a 2FA confirmation on the same device which again I'll have to confirm via the same biometric. Instead of having so many moving parts which all boil down to authenticate via a single vector (my fingerprint or eye) on a single device we might as well have a new auth scheme and get away with insecure passwords and expensive password managers and replace them all with a new biometric driven login scheme.

Yes, there are still some issues that biometrics don't solve, but they should not be a concern to most websites. If everything authenticates me via my AppleID (which uses FaceID or Fingerprint) then I only need to remember one password for Apple - which is just the same as remembering one password for a third party password manager - except it's overall much safer and better for me as a user as I don't have to upload all my online identities to yet another third party that I don't know anything about (= password managers).

<comment><USER44> Biometrics are just fine as a username or one factor of a MFA, but they are terrible for usage as a password due to the simple fact that if they are ever compromised, they cannot be changed.

<comment><USER43> The truth is though that everyone is using biometrics to log into their device which controls everything from emails, to password managers and 2FA codes. Does it mean if your fingerprint gets compromised that you'll be unable to use the biometric feature of any device for the rest of your life?

It's a good point which you raise, but ultimately biometrics will be the best way to authenticate someone. It might have to evolve and get smarter and better, but one day if someone is able to reproduce all your unique attributes of who you are then nothing will probably hold them back to reset your password manager, email and what not either. They will socially engineer whatever they need and even when a human will verify that you are you they will probably be able to provide enough believable evidence at which point it doesn't matter anymore if they hacked a biometric login or socially engineered your password manager.

<comment><USER45> > The truth is though that everyone is using biometrics to log into their > device which controls everything from emails, to password managers and 2FA > codes. Does it mean if your fingerprint gets compromised that you'll be > unable to use the biometric feature of any device for the rest of your life?

No, because the device is only using that to protect local storage and anything which leaves the device is using strong keys which can be rotated. If they don't have the device, the fingerprint doesn't matter. If they do have the device (and are within the timeout period, etc.), it's like any other credential compromise: you get a replacement, rotate passwords, etc. but the replay value is sharply capped because at no point is a network service depending on the component which can't be changed.

(If you have an attacker who gets a scan of your fingerprint/face and keeps stealing phones you need a restraining order; that's reasonably outside of the threat model for consumer devices)

This is also important since there's a subset of users who won't be able to use biometrics for some reason and the decoupled approach avoids making it impossible for them to use.

</comment></comment></comment></comment><comment><USER46> I moved from primarily using a MacBook Pro to an iMac Pro a few months ago, and have struggled to find a non-awkward FIDO U2F key due to the ports being on the back. I'm really looking forward to a decent range of BLE U2F keys that are supported on Desktop and Mobile.

<comment><USER47> I've previously seen (but never used) this product to make an iMac USB port accessible from the front: [https://www.bluelounge.com/products/jimi/](https://www.bluelounge.com/products/jimi/)

</comment></comment><comment><USER48> tl;dr: Every downside to 2fa is out of scope, so this doesn't solve them, and doesn't require sites solve them.

It then suggests using this as both factors.

Most of all is reliability.

all "Something you have" based factors have one key issue, reliability.

Backup codes are not a solution, I'm not going to have those when i'm at a friends house and get an alert the server is dead but i left my token at home.

Customer service is not a solution, its hard getting me to change my address in the millions of places that have it, now I have to call up, to change my token, because I lost it and have no idea where the fuck i put the backup codes? Across the millions of websites I have an account on? Where each provides their own backup codes?

Backup tokens are barely a solution. In that they only work once, lose your backup token and you are back to the above. At the least you now have to buy another one to become the new backup and go and load it on to all of your sites.

I can't lose, break, forget at home, or otherwise invalidate a password. I can forget it outright, something we know a lot of about, and something we have workflows setup to deal with, some better than others, but I can't just one day lose it and get locked out of _everything_ , I would have to forget all of my passwords simultaneously to do that.

2fa for people who care about it seeing adoption: cloneable tokens. I shouldn't need to re-setup my token across every site when it lose it. Habadab about security all you want, as long as this is a barrier to entry it will stay a barrier.

Also, with fancy crypo, it would be piss easy to make a token key base where each token had its own key and that key can be revoked, but in a way where all tokens work out of the box once you add 1 to a site.

</comment><comment><USER49> Is it only me or at first glance this VentureBeat article looks like popup- ridden page from late 90s?

[https://imgur.com/a/vjGuFKs](https://imgur.com/a/vjGuFKs)

(yes, I know it's off topic)

</comment><comment><USER5> This will make sharing accounts between people much harder

</comment><comment><USER50> As long as websites support password reset using email, anything but OTP sent to email is unnecessary and over complicated.

</comment><comment><USER51> sqrl

<comment><USER52> You're being downvoted because the comment isn't really adding anything to the discussion because its so short.

What Brian_K_White is referring to is SQRL by Steve Gibson from GRC. [https://en.wikipedia.org/wiki/SQRL](https://en.wikipedia.org/wiki/SQRL).

Its an alternative simpler secure protocol that has been in development for a few years that is frequently discussed on the Security Now podcast.

<comment><USER53> Steve Gibson has been promoting his solution for years but as far as I'm aware security professionals have yet to see it as a serious alternative.

<comment><USER36> SQRL is a half measure, like SMS-TOTP it barely raises the bar because it doesn't solve a key real problem we actually see happening in the wild and so that would just happen more.

If site A is protected by SQRL, and I'm a bad guy, I can just live phish sign- ins for site A using SQRL from my phishing site, site B. The users all believe (as with other phishing attacks) that they're being asked for credentials by a legitimate site and so they provide them with SQRL, and I'm in.

This (very common and fully automatable) trick doens't work on WebAuthn, completely defeating phishing. This is because the fundamental idea in phishing is "Humans are idiots, fool the human into mistaking site A for site B". In WebAuthn the credentials are mechanically derived from the site you're on, so for site A they will always be site A credentials, and for site B, site B credentials. Convincing page design, an urgent email "from the boss", clever use of IDNs to fake the URL, those fool the human but not the machine, and the human is taken out of the "what site is this?" decision by WebAuthn.

But the human is left _in_ the loop in another way that leverages our strengths. WebAuthn requires a physical interaction, typically a button press by the human. So a hypothetical attack that takes say, 50 million authentications, cannot work because the human will not press the button 50 million times while you do the attack. They'll get sick of it and go on Twitter to moan instead.

<comment><USER54> SQRL protects against phishing by using the site's URL to generate a per-site Curve25519 keypair on the fly.

Same anti-phishing properties as being discussed here.

SQRL also has key revocation and rotation, but ultimately places responsibily for keeping backups of revocation codes on paper to the end user.

But since you only need to do this once for your SQRL master secret, and not for every damn site, it's a lot more likely to happen in practice.

<comment><USER36> Nope. SQRL assumes that phishing simply won't work. Users are going to be shown example.com and realise that's not right and abort. That's their "protection". But phishing does work, people have tested. Some users notice the domain name is wrong. Some don't. All press on anyway.

Why? Because Humans have a psychological problem that makes them bad at giving up. We need to explicitly train safety critical people to go "Oh, this isn't working. I will now report that I failed" rather than keep trying. In normal people the drive to press on is almost unstoppable.

Hence "brick wall UI" design for things like HSTS. If you give humans two options, destroy everything versus admit defeat, they pick destroy everything, every single time. So we changed the UI to not have options. "Defeat" announces the UI. And, defeated, the human gives up and doesn't destroy everything. Hooray.

<comment><USER54> SQRL does not give the real identity to a phishing site. Full stop.

Now a phishing site can do a fake SQRL login, accepting any credentials. But the client will send a different identity (derived keypair) with no information linking to the real identity, so the phisher will have no information with which to persinalize their fake site.

The user might press on anyway and divulge some sensitive data if the fake site is really convincing. But the phisher cannot use any credentials passed to them against the "real" site.

WebAuthn does NOT solve this "look-like site exists and accepts any credentials" problem either, nor does any other _authentication_ mechanism.

The only protection against against what you describe is preventing registration of look-alike domain names entirely, and ensuring all DNS is secured with DNSsec or TLS. Good luck with that; it's been tried.

</comment></comment></comment></comment></comment></comment></comment><comment><USER48> [https://www.troyhunt.com/heres-why-insert-thing-here-is- not-...](https://www.troyhunt.com/heres-why-insert-thing-here-is-not-a- password-killer/)

<comment><USER55> Troy Hunt writes ...

> I'm referring to passwordless solutions that involves things like QR codes, > pictorial representations, 3rd party mobile apps, dedicated hardware devices > or "magic" links sent via email.

Which of these is AuthN, in your view?

Edit:

Troy Hunt also writes ...

> WebAuthn has the potential to be awesome, not least of which because it's a > W3C initiative and not a vendor pushing their cyber thing. But it's also > extremely early days and even then, as with [insert things here], it will > lead to a change in process that brings with it friction. The difference > though - the great hope - is that it might redefine authentication to online > services in an open, standardised way and ultimately achieve broad adoption. > But that's many years out yet.

.., so perhaps the many years have passed.

</comment></comment><comment><USER56> What does this solve exactly? We already have client-side certificates in TLS, am I missing something?

<comment><USER36> Aside from the awful UX of client certs, which we could imagine being fixed, FIDO tokens are very narrowly conceived to solve the exact second factor problem - and nothing else.

If you do client certs you've got this whole identity thing baked into the certs. But the FIDO token doesn't have an identity, it only knows how to prove it's still the same FIDO token you had before. So that's immediately much better.

If I use a client cert to sign into GitHub and Facebook, it's a matter of moments for that to be correlated. If I share the client cert with my sister or a colleague, again easily correlated.

But with WebAuthn there's nothing to correlate. The only way to check that Bill and Suzy are using the same FIDO token is to wait until say Bill tries to log in, and ask his token to prove that it's still Suzy's token. This requires a physical interaction (e.g. button press) from Bill. If the guess was wrong you learn nothing but Bill notices it didn't work. So, maybe, if you're nearly certain but just want to be 100% that could work, but ordinarily it's not viable at all.

<comment><USER57> Also with a decent WebAuthn implementation (e.g., FIDO U2F hardware tokens, or using a TPM), the private key material cannot be copied by a compromised device, or even by someone with direct access to the hardware (unless they actually disassemble the hardware with quite professional hardware).

Client-side certificates are a great technology, but you can copy the certificates without the owner knowing it. Getting the password is just a matter of social engineering or (further) compromising the device. It beats plain username plus password though!

<comment><USER48> You tout it as an upside that it can't be copied.

But its really not.

How to prepare for losing tokens is the major barrier to entry for 2fa, and it will be why it never sees mass adoption.</comment></comment></comment></comment>


What you need to know about the Covid-19 vaccine - <AUTHOR> https://www.gatesnotes.com/Health/What-you-need-to-know-about-the-COVID-19-vaccine?WT.mc_id=20200430100000_COVID-19-vaccine_BG-EM_&WT.tsrc=BGEM <comment><USER2> All very promising but I am simply not interested in a brand new vaccine that has been minimally tested. Especially an mRNA vaccine, a technology which is only a few years old now and comes with side effects like inducing autoimmunity. We're talking about altering your genome, permanently.

The Gates article mentions the mRNA solution needs to be kept at -80C up until delivery. In a controlled environment, a test lab in a first world country this is completely feasible. However the logistical challenges that presents seem impossible when you consider the infrastructure (or lack thereof) of a continent like Africa.

The normal development cycle of a vaccine is 5 years and we're shortening that to 18 months? By having years less human testing? And side stepping government regulators? No thank you.

And really all I get out of it is short term immunity which requires boosters or worse a yearly shot like the flu shot? Honestly it sounds worse and worse the more I research it.

<comment><USER3> IIRC, while Moderna's solution is RNA based, Inovio's should be DNA based, which means -20C instead of -80C, a definite improvement.

</comment></comment><comment><USER4> Does anyone have a list of the 8-10 vaccines Bill Gates think are especially promising?

<comment><USER5> This resource[1] linked by Gates in the article says

> "Most of the active projects are in exploratory or preclinical stages. > However, 5 candidates have recently moved into clinical development, > including mRNA-1273 (Moderna), Ad5-nCoV (CanSino Biologicals), INO-4800 > (Inovio), LV-SMENP-DC and pathogen-specific aAPC (Shenzhen Geno-Immune > Medical Institute). Notably, Moderna was able to start clinical testing of > its mRNA-based vaccine just 63 days after sequence identification."

Presumably, those are 5 out of the 8-10 that Gates thinks is promising

[1]: [https://cepi.net/news_cepi/cepi-publishes-analysis-of- covid-...](https://cepi.net/news_cepi/cepi-publishes-analysis-of- covid-19-vaccine-development-landscape/)

<comment><USER3> I'm surprised the one from Oxford isn't mentioned.

<comment><USER6> Why are you surprised?

<comment><USER3> Because it's one that's been aggressively pushed by the institution itself and the only one that I know of that seeks partnerships with many companies / institutions without any royalty involved (that I know of, at least).

Also because they were quickly able to get 1000+ people for the Phase 1 study, and they're starting the Phase 2/3 study next month (objective: 6000 people recruited).

They want ( _assuming that it is effective_ , of course, which is absolutely not guaranteed) to have something ready for emergency use by early autumn.

Perhaps it's just better communication on their part, mind you.

<comment><USER7> I'm curious about this. Could you please point me towards more information?

<comment><USER3> Here are some resources:

\- [http://www.ox.ac.uk/news/2020-04-23-oxford- covid-19-vaccine-...](http://www.ox.ac.uk/news/2020-04-23-oxford- covid-19-vaccine-begins-human-trial-stage)

\- [https://covid19vaccinetrial.co.uk/](https://covid19vaccinetrial.co.uk/)

\- [https://www.nytimes.com/2020/04/27/world/europe/coronavirus-...](https://www.nytimes.com/2020/04/27/world/europe/coronavirus- vaccine-update-oxford.html)

\- [https://www.biocentury.com/article/305063/](https://www.biocentury.com/article/305063/)

The NY Times story is a bit of storytelling but it's kind of fascinating how they got there.

For now I'm placing my bets on this one because they do not want royalties out of it and they're seeking deals with many companies to manufacture as much as possible (at risk, because at this point it is not known if it works).

<comment><USER8> The other promising factor is that their work is a continuation of a 10 year project to develop a coronavirus vaccine. They are just modifying it to work with sars-cov2. So it already had a lot of work out into it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Well, you can start mixing the concrete for the factories before the vaccine is ready if you want to save time.

</comment><comment><USER10> Given how quickly the virus is spreading in NYC will the vaccine be ready before most people have already gotten it?

<comment><USER11> It's kind of irrelevant, timing-wise. If other varieties of coronavirus are anything to go by, it's likely that people's immunity will fade in something like 12-18 months and we'll get another round of this (albeit more localized based on where the cases peaked 12-18 months before) if a vaccine isn't available yet.

<comment><USER12> Well, if fighting off the disease doesn't produce long term immunity, then neither will a vaccine. I guess we'll either have to keep-up with booster doses, and hope for the best that the the virus doesn't mutate enough to not be neutralized by the given vaccine.

<comment><USER13> I feel reasonably confident about vaccine efficacy, I suspect the reason this thing is so bad is because of the binding affinity of its spike protein. If that mutates, it will become less lethal so waning vaccine efficacy becomes less of an issue.

<comment><USER12> Well, even if it mutates in a way that is beneficial (to us), you still have the original strain which will continue to spread unabated without a vaccine. It was just a handful of people who were infective initially, and now the diseases has spread everywhere. It can still happen again.

Also, for diseases that are considered "eradicated" because we now have a vaccine, if you are one of the insane anti-vax people and stop giving vaccines to your kids you can still have outbreaks because of natural reservoirs for the disease. (For e.g. measles outbreak in the state of Washington). Infectious diseases rarely just go away completely.

</comment></comment></comment></comment></comment><comment><USER14> As long as it doesn't come mandatory with the mark of the beast...</comment>


YesGraph Simplifies The Process Of Using Referrals To Hire The Best Candidates - <AUTHOR> http://techcrunch.com/2014/01/16/yesgraph/ <comment><USER2> wow, so simple, so elegant. Personally, I value strong Referrals more than math questions, gpa, past work experience, etc. so it's great to have help managing the otherwise extremely opaque process.

</comment><comment><USER3> I cofounded [http://yesgraph.com](http://yesgraph.com)

AMA :-D

<comment><USER4> what's your favorite graphic interchange format?

<comment><USER3> [https://dl.dropboxusercontent.com/s/v2cl98fkxl33ckb/cookie%2...](https://dl.dropboxusercontent.com/s/v2cl98fkxl33ckb/cookie%20monster.gif)</comment></comment></comment>


Please help provide feedback on my SaaS experiment? - <AUTHOR>

Hello,
A friend and I are experimenting with a conference room booking app SaaS solution: http://getaroomapp.com/
We built the smallest version of this possible to appeal to non-Enterprise people like co-working spaces and small to medium offices that have shared conference rooms.
I've copied some feature information and links to screenshots below (if you'd like a demo please email us: firstname.lastname@example.com).
We're not sure yet if there is a market for this product, we're still trying to validate that. Right now the app does not tie into other, personal calendar apps like Google Calendar or Outlook, which we understand may be problematic.
On the upside we have ONE paying customer, which we got about two weeks out of the gate. We've had a handful of inquiries (less than 100) but much lower conversion rates (to be expected) unless low conversation rates are due to us not addressing a bigger pain point.
Would love some honest feedback on this SaaS idea and any thoughts on possible markets to target.
Current Get a Room Features • Shared, Group Calendar
• Support for rooms in different spaces and or buildings • User Management (add, edit, delete) • Admin permissions/roles • All Day Events • Locked Events
Get a Room Screenshots • Main Calendar Page: http://cl.ly/image/2T0A3V2B2D08 • Manage Users Page: http://cl.ly/image/3v0t0B1S3y1h • Create Room Reservation: http://cl.ly/image/1O260r3V2R3a <comment><USER2> I think there is a major need for this, especially for dare I say "new" features in this space.

\- Daily Morning Lists of your meetings/attendies and attachments all rolled up

\- SMS alerts for room/reminders 5 minutes before

I would recommend a few other insightful things - e.g.

\- adding a photo of the room \- labeling how many seats/chairs are avaliable \- Integrating a raspberry pi or some other open source hack (ipad/andriod app?) to show what is happening in the room each day (scheduler)

I wish you the best of luck with this and think it's needed not just in coworking spaces, but every startup that has more than 3 conference rooms.

good luck!

</comment><comment><AUTHOR> John, thanks a lot for responding - really appreciate it. All good thoughts.</comment>


A Canticle for Leibowitz Still Smolders (2014) - <AUTHOR> https://www.newyorker.com/books/page-turner/science-fiction-classic-still-smolders <comment><USER2> FYI:

> The world's most glorious monastery, at Monte Cassino in Italy, was > destroyed during the second world war because of a mistake by a British > junior officer, according to new evidence in a book due out this week.

> The officer - translating an intercepted radio message - mistook the German > word for abbot for a similar word meaning battalion. His version convinced > his superiors this meant a German military unit was using the monastery as > its command post, in breach of a Vatican agreement which treated it as > neutral.

> Allied generals ordered a huge bombing attack. Only when the planes were in > the air did a British intelligence officer, Colonel David Hunt, recheck the > full radio intercept. He found that what it actually said was: "The abbot is > with the monks in the monastery".

[https://www.theguardian.com/world/2000/apr/04/johnezard](https://www.theguardian.com/world/2000/apr/04/johnezard)

<comment><USER3> Some more information on the German: The word for abbot is "Abt", and in some cases the word for batallion is "Abteilung" which could be abbreviated to "Abt."

</comment></comment><comment><USER4> I don't have a lot to say, other than I love this book. It's difficult to articulate why. But I make a point to read it every couple of years, and I recommend it often to others. It's funny and sad and contains some beautiful reflections on faith and doubt and history and human nature.

</comment><comment><USER5> There's a magnificent little scene at the end of Fiat Homo, where Brother Francis confesses to the Pope that he cannot understand anything in Leibowitz's blueprint. The Pope confides, with a wink, than neither can he. And for a just moment after that wink, Francis notices how shabby and poor everything about the church is.

</comment><comment><USER6> Those who really enjoy it may also enjoy the 1997 sequel (finished after Miller's death) "Saint Leibowitz and the Wild Horse Woman". (Took me a while to try it, glad I did.)

If you can find it (it was once available at I.A.) the 1981 WHA radio-play version is well done.

<comment><USER7> I've listened to the version available at [http://www.oldradioworld.com/shows/A_Canticle_for_Liebowitz....](http://www.oldradioworld.com/shows/A_Canticle_for_Liebowitz.php) and it's great.

</comment></comment><comment><USER8> I like this book because it provides plenty of interesting discussion topics. I attended Catholic high school, and one of my teachers recommended it. My teacher was a devout Lutheran while I've always been an atheist, but anyone can enjoy the book and get something out of it.

</comment><comment><USER9> I like the book because its well written, but it is also because I read it when younger. Its hard to be entirely dispassionate about childhood favourites.

<comment><USER10> I've had a couple books (including this one), that I've gone 30 years between reading. Most of them have resulted in disappointment or at least haven't aged well. This is the exception.

It is exceptional read or listen.

<comment><USER11> Agreed this would be the case. I read it for the first time as an adult, and thought it well written. Around the same time I re-read the original Foundation trilogy, which I hadn't touched since high school, and was disappointed by the writing and also various (minor) plot holes.

</comment></comment></comment><comment><USER12> It's interesting to read about the 10,000-year clock while thinking about Canticle.

<comment><USER13> indeed!

I wonder if there is something to say for "build an organization that will last" in contrast to "build an object that will last".

Will some incarnation of the catholic church be around in a few thousand years? Seems unlikely. Will the Long Now foundation be? Also seems unlikely.

But hey, the first did manage to last two thousand years already, and things have a tendency to survive once they get the habit..

</comment></comment><comment><USER14> I noticed yesterday that someone in the Reddit AMA for the Wikipedia guy with 3M edits randomly recommend he read "A Canticle for Leibowitz".

<comment><USER15> I was going through my Pocket to-read list and came across the AMA for the guy who wrote Metro 2033 and they were discussing this book. Now it appears here. Guess someone or something wants me to read this.

</comment></comment><comment><USER16> This book was one of the inspirations for the original "Fallout" game - alongside "I Am Legend" and "On The Beach."

[https://www.youtube.com/watch?v=Xa5IzHhAdi4&feature=youtu.be...](https://www.youtube.com/watch?v=Xa5IzHhAdi4&feature=youtu.be&t=8m2s)</comment>


Northern California reservoirs inch toward capacity - <AUTHOR> http://www.latimes.com/local/lanow/la-me-ln-northern-california-reservoir-levels-20160314-story.html <comment><USER2> Department of Water Resources' reservoir status map: [http://cdec.water.ca.gov/cgi- progs/products/rescond.pdf](http://cdec.water.ca.gov/cgi- progs/products/rescond.pdf)</comment>


Ask HN: How to sure data is safe after 50 years? - <AUTHOR>

Just organizing my bits and bobs and I wonder how to ensure this data is secure after 50 years...
Are there any existing solutions?
Thanks <comment><USER2> The one that seems to work historically, is take pictures or make it into a book, then lock it in a safe.

I would say the best practice would be don't ignore it for 50 years, every time new technology looks to overtake old, you need to revisit your data and convert it to whatever technology seems robust enough to to work with.

</comment><comment><USER3> The ceramic M-Disc lasts forever [http://www.mdisc.com/what-is- mdisc/](http://www.mdisc.com/what-is-mdisc/) \- [http://shop.cintrexav.com/m-disc- archival-p31.aspx](http://shop.cintrexav.com/m-disc-archival-p31.aspx) \- [http://www.hdmediaservices.com/blog/now-offering-m-disc- tech...](http://www.hdmediaservices.com/blog/now-offering-m-disc-technology- your-data-etched-in-stone.html)

For smaller files in the 100KB - 1MB range, optical paper is a reasonable option. [http://google.com/search?q=optar+paperback](http://google.com/search?q=optar+paperback)</comment>


Biggest grossing Bollywood film about engineering geeks - <AUTHOR> http://www.wired.com/beyond_the_beyond/2010/01/the-biggest-grossing-bollywood-film-ever-made-is-about-engineering-geeks/ <comment><USER2> If I know anything about Bollywood, I'm guessing this movie will have about as much to do with engineering as Legally Blonde had to do with law.

<comment><USER3> I thought as much. But being the perfectionist that he is, Aamir Khan(Rancho), the lead actor has ensured that nothing seems fake or too unreal, for example the scene where he carries out the delivery of a new-born with help from a surgeon over webcam is quite well shot. When he's told that a vacuum pump will be required to get the baby out safely, he uses a vacuum cleaner, controls it's pressure by mounting a pressure gauge in between and uses his photographer friend's equipment cleaning nozzle as the tip of the pump. I thought it was a brilliant hack. The lead character is as close to a hacker as it can get, and best of all he's not called a hacker even once in the film, it is not a poor stereotype you see in hollywood films. My guess is that the director just made the character to suit his film but by mere accident he's managed to get a very good portrayal of a hacker.

After I watched the movie, I could relate so much to Rancho, except for he always complained about the education system, but still stuck on and also topped his class whereas I chose to drop out. Engineering colleges in India are very much like a rat race. My neighbour took an year off after high school just to prepare for cracking the IIT entrance exam. He didn't manage, and is now on the verge of completing his engineering degree from an above average college. I just met him yesterday almost after 2 yrs. and he told me that while he's managed to get this far, he has no clue of what he wants to do with his life, he said he always did what all his peers were doing, what his seniors said he should be doing, without having interest in any of it. And now he's stuck. He doesn't whether to get a job or do an MBA. Now I see him preparing for entrance exams for B-schools just the way he did for IIT's 5 years back. He's finished one rat race and about to get into another one!

OTOH, I enrolled in distance learning program after I dropped out of engineering and spend most of my time self learning and experimenting. I know what I wanna do with my life and am not confused.

But there is a social stigma at play here, my parents never know what to tell friends and family about what their son is doing, whereas my friend is a "well-educated, hard-working engineer" in the eyes of everybody who has done his parents proud.

<comment><USER4> > But there is a social stigma at play here, my parents never know what to > tell friends and family about what their son is doing

LOL, I can totally relate to this! About 6 months ago I walked away from a fairly cushy job to try striking it out on my own. I don't intend to go back into the corporat culture ever again. My parents are too embarrassed to tell others that their scholarship winning, academic hotshot of a son is now "jobless" :-)

A very nice side effect was that the pressure to get married stopped. BTW, can you even imagine what this pressure must be like for the _women_.

</comment></comment></comment><comment><USER5> Why is this on Wired? (or HN, for that matter)

It is nothing more than a plot summary, copied word-for-word from Wikipedia (<http://en.wikipedia.org/wiki/3_Idiots>)

<comment><USER6> Or more likely copied _to_ wikipedia.

</comment></comment><comment><USER7> Seeing as how this was just a cursory review of the movie, let me add a few things I noticed about this film as I watched it with my wife earlier this week. This being a Hindi film catering to a large Indian population, you may miss out on the subtle play-on-words humor and you might find the song and dance sequences unnecessary. Do not let that deter you from watching this movie till the end as the crux of the movie lies in the uniqueness of the central character, Rancho and his views of the entire education system.

I was born in India and unlike most of my friends at home, I went to a boarding school for about 7 years. Those years I spent at RKC ( <http://rajkumarcollege.com/> ) helped develop my personality from a wannabe- Chatur to someone who personally identified with Rancho. While attending undergrad and grad school here in US I realized how heavily creativity is emphasized even in non-art/non-literature classes. By and large studying in India is the same from kindergarten all the way through undergrad and grad school - rote memorization and re-application of known techniques. This is what the movie repeatedly tries to call out against and this is a first public attempt of it's kind. Every single educated person in India has gone through decades of miserable memorization to prove that they are intelligent even though recollecting from memory isn't the same as solving the unknown. Now we have a country of billion people who think the smartest ones are those who can remember everything and regurgitate it during a 3 hour exam.

The underlying theme of the movie is questioning if higher education is really the answer to India's problems. The sole mantra in India for past sixty years has been that education is the only way to rise out of dire poverty. Family and social well-being are core to the Indian value-system and this movie highlights the pressure on the students to succeed at all costs, failing which the sister doesn't get married or the mom doesn't get to buy food. Not much room for exploration and discussion when, as one of the actors puts it, mom's sari (garment) gets in the way.

Education as a surefire way to success was indeed possible when a vast section of the populace was uneducated and just being fluent in English guaranteed a job at a multinational corporation opening a branch in the country. However, now that the country is full of educated, ambitious youth, what good is it if they all read the same books and answered the same exams in the same exact correct way? The lack of diversity and creativity gives rise to the only way for students to gain competitive advantage - better grades.

Here on HN we spend hours each day coming up with a new, unique, more efficient solution to a problem faced by all. Now imagine studying for 15-20 years and not being allowed to come up with ONE new idea because it is not in the book or course schedule. In most of the western world, people take the ability to "do what you want" for granted so much so that not getting to do what you want is treated as failure. You like photography but due to bills have to work as an insurance agent? You're a failure! In India, you have a job as an insurance agent with a steady paycheck instead of some random fad- profession like photography? You're a success!

Personally, what hit home the most (and caused me to tear up uncontrollably) was the scene where Farhan talks to his dad about leaving his engineering degree and going to pursue his passion of photography. In 2000, I had nearly the same confrontation with my father. I was sick of studying business and wanted to come to US to learn Computer Science. Everyone in my family and our social circle was a business-owner or salesman. It wasn't that I was breaking social boundaries that shocked everyone. It was that I was fighting for my right to pursue a field I loved instead of a safe-bet field such as business like everyone else I knew. At one point, Rancho says that the only reason he got the highest grades in Engineering was because that was his passion. I have felt the same about computers ever since I was the kid and even though my family encouraged me to pursue my interest in the field as a hobby, taking it up as a career was frowned upon.

There's a small bit in the movie about Indian degrees being a mere stepping stone for securing a job in the US and having a successful life. That belief is absolutely true and is often what negatively impacts me the most here in US. I've lived and breathed computers, numbers, science, and programming for two decades now and yet most everyone back home and even here think that I'm doing it solely for the money like a million others. Immediately I'm lumped in with anyone who went through a 2 month Aptech course.

Every now and then people back in India ask me why I'm not making millions and billions starting my own software company because that is regarded as the only path to success for expatriates. After all, why else would I have come all the way to US if not for unlimited wealth? I have a hard time explaining to them that I did it for passion and knowledge instead of money. The simple issue here is that we Indians push our children too hard to do what everyone says is the "right" path to success - study hard, work harder - instead of letting the children and youth choose what they truly want to do. My dad supported and encouraged me to learn everything I wanted but when it came to choosing a career and life, I had to stand up and fight for my dreams and I don't regret one bit of it.

I know this isn't a direct review of the movie but I just wanted to write how I truly felt from the perspective of someone who has lived through what the movie talks about.

<comment><USER8> A Chinese friend of mine had a similar experience. After getting her undergrad & masters engineering degree at MIT, she lands her first job as a writer. The job pays less than what she earned as a graduate student at MIT, but I've never seen her happier. Her parents were both born & raised in the same memorization culture back in China. Let's just say knives went flying when she broke news to her parents about her writing job...

</comment></comment><comment><USER9> While I totally agree with most points in the movie, my experience has always been mixed. I have had teachers who prefer an answer which speaks for my understanding of the concept rather than rewriting (or what they called vomitting) of what is in the text book. They were my real inspiration. I have had teachers in the other side too.

I had made up my mind to become a software engineer in 1996 after seeing a paint program made completely in BASIC by our physics teacher. When the day came to choose my career, there was opposition. It was 2002; things weren't looking good for a software engineer then. Inspite of the stiff opposition of the so called "people around me" my parents fully supported in choosing CS. It was definitely not because I would make a lot of money.

I bump into people with similar experience almost everyday in my life. People who chose CS over doctor; people who are singers and not engineers; people who run their own factory instead of working in an MNC; people who work in "techy" jobs when MBA/Management is the order of the day and people who just do what they want to do. It all boils down to the guts you have and to some extent the ability to earn the trust of people who matter to you.

Simply blaming on the system is not acceptable to me. If you feel you are right, stand up to it. Convince people who think you are wrong. If you feel it's not your job, don't expect to be spoon fed. End of the day we are to be blamed if we feel we have a miserable life.

</comment><comment><USER10> It sounds like they drew a lot of inspiration from the book Five Point Someone by Chetan Bhagat, which follows three similar students making their way through IIT Delhi, one of the most prestigious (real) universities of India. It's a great read, quite light and slapsticky at times, sad at others. I spent six months at IIT and it's really quite realistic.

<comment><USER11> i spent 4 years, and it isn't realistic at all...

<comment><USER10> Also in reply to sid0 below - ok, so it seems I've maybe picked the wrong term saying it's "realistic". Obviously, the book is a novel, and on top of that partly a comedy. Hopefully no one believes that crashing into a professor's home and wearing his shirts is everyday life at IIT.

However, would you not agree that the general atmosphere, such as the hostel life, the exam pressure, going out for ice cream to check out the girls, their conversations about the future, and all this is pretty much the real thing? It's how it felt to me, but then I'm a foreigner.

<comment><USER12> > hostel life

Eh, a bit, but not really.

> exam pressure

Again, a bit, but a lot of people are quite unconcerned about their exams.

> going out for ice cream to check out the girls

I don't know anyone who has ever done that here.

> their conversations about the future

Yeah, pardon my French, but most people don't give a fuck about the future. Most people just want to get their four or five years done with and then get out of here. There are a few people who genuinely care about the future, but you won't find them discussing anything in the manner given in the book.

<comment><USER10> That's funny, my memories must be all fantasy then? Pretty arrogant to tell me what I can and cannot have found at IIT. I have found all of the things mentioned above, and they were more the norm than the exception.

<comment><USER12> You asked

> However, would you not agree that the general atmosphere, such as the hostel > life, the exam pressure, going out for ice cream to check out the girls, > their conversations about the future, and all this is pretty much the real > thing?

My response was to your question. My point was that I disagree with your assessment of IIT life. I didn't make any claims about your experience anywhere. Maybe your experience wasn't representative. Maybe my experience isn't representative. Maybe it differs across IITs (I'm in IIT Kanpur). Who knows?</comment></comment></comment></comment></comment></comment>


The ROI on being an entrepreneur vs. an employee - <AUTHOR> http://marcbarros.com/the-value-of-a-founders-time/ <comment><USER3> A VC funded company, assuming you are capable of raising a seed round, can generally pay sfba founders 50-120k for full time work pretty soon after (founding, or people going full-time). Those same people are generally forgoing 100-200k jobs.

The equity value of a founder's shares is an order of magnitude higher than an early hire, or two orders higher than a late A or B round hire, and 3-4 orders higher than a pre IPO employee. No one gets rich as a regular IC hire at series B or C, even at a Google -- it probably tops out at 10-15mm, vs 15b for the founders. Even more so at companies less successful than Google.

On top of that, founders get supremely preferential tax treatment. Founders shares are generally bought near nil, and the entirety of gains are long term capital gains. If you do it right with QSBS and moving to WA before the sale, it can be taxed at zero. An employee often ends up paying hella AMT on almost all gain from ISOs since he didn't early exercise (or, early exercises at substantial out-of-pocket cost), and gets less freedom to sell in later financings, less return in a sub-optimal exit where the sale is covered with preference but "retention grants" are given to founders, etc.

I think the optimal strategy is to work for the most prestigious and successful companies purely as a learning and reputation building exercise, and then either be a founder or consultant to make money. It might be possible to enter a slightly earlier (series b) company as a director or better and still get a reasonable amount of equity (1%+ in a 100-200mm company), but otherwise either going for the tax advantaged, high variance outcome as a founder, or the high cash, flexible, also tax optimized outcome as a consultant, is the best way to actually get paid.

<comment><USER4> 10-15mm isn't rich?

<comment><USER3> As the extreme high water mark of success, not really.

<comment><USER5> It's about how much pg netted from Viaweb, isn't it?

<comment><USER6> in what year? Multiply 1990's money by 3x...for $ today.

<comment><USER7> More like 1.45x: [http://data.bls.gov/cgi- bin/cpicalc.pl?cost1=10%2C000%2C000....](http://data.bls.gov/cgi- bin/cpicalc.pl?cost1=10%2C000%2C000.00&year1=1998&year2=2014)

<comment><USER6> Not a precise fit for places like SF, NY, or London.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This article is basically the conclusion of the book the millionaire next door. The authors comb through statistics of the rich and interviews with wealthy people.

Building a business is probably the best way to make a large lump sum of money. Unfortunately the business is more likely than not to fail before bearing fruit and even after successfully running the business for large profits over time competition, laws, and factors out of your control usually kill the business. Due to the inherent risks and stress involved the book states that most successful people would not advise their children to start businesses but to get professional degrees, especially the kind that can work for themselves or consult such as law, medicine and accounting. Not so much the non-professional jobs such as business management.

</comment><comment><USER9> Not sure an unbounded 6% annual salary increase is plausible, especially over a 35-year period. That makes the "get a job" numbers quite inflated. I think its clear that the potential payoff from being an entrepreneur is _very_ significantly higher than being an employee; it's a question of when someone's willingness to accept a higher risk matches their circumstances (luck, market, idea, etc.)

<comment><USER10> Definitely. Average wage growth [1] from 2010 to 2012 has been about 4.7%, varying heavily on region (and likely profession). And this is the average (across all levels of experience). If you're not senior management, you're hitting a wage ceiling after about 10 years, where your pay won't be going up year after year even if you job hop.

A more realistic model would assume your wage growth starts at, say 8-10% your first year and then tapers off to 0-1% after 10 years or so.

1: [http://www.comparebloomington.us/include/reportsmedia_157_15...](http://www.comparebloomington.us/include/reportsmedia_157_1541923639.pdf)

<comment><USER11> At a glance, that suggests the optimal time to start a startup is when you have 10 years of career behind you.

</comment></comment></comment><comment><USER12> There's not a single mention of taxes in the article.

I don't think that the average employee is aware that an entrepreneur/founder/self-employed person can save a lot of tax if they structure it right and are meticulous about it.

A self-employed person earning $70K a year can be better off than an employee earning $100K.

<comment><USER13> Can you expand upon that? I am always looking to reduce my taxes. I got killed with my 1099s this year.

<comment><USER14> (Sorry in advance for this long, rambling response) This applies to the US and forgive me if you have already done some of this. The first step is to get your corporation set up (use an online service or an accountant). It's a bit of paperwork but you can do it for around $400. Once you do that you can open a corporate bank account. At that point you bill your clients as a corporation and provide them with your corporate tax ID instead of your personal SS. The money goes into your business account. Then to pay yourself, the next step is to setup payroll (easiest way is to use an online service like quicken payroll) which will run you about $50/month but will handle all of your withholding and tax filing requirements.

It's somewhat of a pain getting this all going but once you do, you are operating as a corporation. Corporations do not pay income tax as such - <USER2> do have some filing fee type of taxes, but basically the taxes you pay come out of your payroll. So you do not pay tax on income that your company earns until you withdraw it from the company account via payroll. However, you can spend directly from the corporate account on anything that is reasonably considered a business expense. Computers and equipment, of course, can be purchased. Your company can pay the phone bills, internet connection, travel expenses, business lunches, etc. You can also charge your company rent as well if you are working out of your home.

What happens is that you wind up paying yourself a meager salary on which you pay normal tax just like everybody else. So for instance, your company earns $80. You pay yourself a salary of $15k and the remaining $65k money is spent on operating expenses and is a tax write-off. You only pay tax on that $15k. You're likely to even get a small tax refund check instead of a huge bill from the IRS. In some extreme cases you might pay yourself even less, or even come in at a loss and pay no income tax. There is nothing illegal about this as long as your write-offs can be legitimately considered a business expense.

This is also great because with payroll setup you are in a position to pay employees and sub-contractors via payroll as well and eventually grow your company with the proper financial system in place.

I would highly recommend having an accountant set this up for you and file your taxes though because it is a ton of work and requires understanding the ever-changing tax laws.

<comment><USER15> The IRS requires that you pay yourself a defensible fair market salary. If you're paying yourself only $15k, you will quite likely get audited, and unless you can defend the idea that your work is truly minimum-wage level work, you will owe quite a lot in fines. If this is advice from your accountant, I think you need a second opinion.

Edit to add citation. Also, I'm assuming you're talking about an S-Corp, since it would make not sense for a C-Corp. From [http://www.irs.gov/Businesses/Small-Businesses-&-Self- Employ...](http://www.irs.gov/Businesses/Small-Businesses-&-Self- Employed/S-Corporation-Compensation-and-Medical-Insurance-Issues) :

"If most of the gross receipts and profits are associated with the shareholder's personal services [i.e. not from other employees or capital], then most of the profit distribution should be allocated as compensation."

If you're only paying yourself $15k of the %80k your company brings in, and that $80k comes from payment by clients for work that you personally did, then you are definitely on the wrong side of the tax code.

<comment><USER14> Your tax advice is that if an S-Corporation brought in $80k and incurred $65k of legitimate, legal expenses, that the proprietor should run something more than $15k through payroll because of the "going rate" for developers or for some other reason?

I can't help but notice that your quoted text says "most of the PROFIT distribution" rather than "most of the GROSS INCOME distribution" The company can't pay out more than it brought in.

Obviously if you don't have $65k in expenses then you can't claim them. But, working as a contractor can have a lot of expenses - travel, office rent, utilities, etc. Giant corporations claim these expenses, a single-person company is entitled to the same deductions.

In 15 years of business I have been audited twice by the IRS with very minor amounts due (< $500) and nothing to do with deductions or expenses. The reason I bring it up is simply to illustrate that I'm not just lucky or flying under the radar. One time it was my mistake of a missing payment in my records and I simply paid the amount due. The other time was the IRS's mistake and I successfully contested it. If I had anything to hide I sure as hell would not be contesting an IRS audit for some small amount of money. My point is that I am in no way hiding or trying to sneak around tax codes. I do not encourage anybody to do anything illegal. I only encourage anyone to claim the maximum amount of legitimate deductions that they're entitled to claim. I also highly recommend having an accountant handle it for you who knows the tax laws and ensures that you are operating within them.

</comment></comment></comment></comment></comment><comment><USER16> Google Cache Link

[http://webcache.googleusercontent.com/search?q=cache:kvX1Y03...](http://webcache.googleusercontent.com/search?q=cache:kvX1Y037yzoJ:marcbarros.com/the- value-of-a-founders-time/+&cd=1&hl=en&ct=clnk&gl=us)

</comment><comment><USER17> Through Founder Institute I've spoken with several successful entrepreneurs (reasonably wealthy with at least one successful exit) about this issue and nearly all of them said if your goal is simply to make money you're better off getting a job.

However, if you want to build something that you own, are passionate about, and are comfortable with the possibility of not having much money for many years then being an entrepreneur is definitely a worthwhile endeavor.

<comment><USER18> I picked up "The Founder's Dilemmas" and the first chapter tries to talk you out of starting a business by telling you that your business will probably fail, and you'd probably end up wealthier working for other people.

It's good to remember, after the hype surrounding large exits, that the chances of creating a similarly valuable company are incredibly small. So yeah, if you're in it for the money it's probably not worth it.

</comment></comment><comment><USER19> A little over halfway through the author mentions a billion dollar sale netting each of three founders only $300,000. Am I misunderstanding, or is that a mistake?

<comment><USER20> Expected value is the key phrase.

So 0.00006% of the time you start a billion dollar company and take home $300MM. 67% of the time you fail and take home $0. The rest of the time you fall somewhere in between, and so your expected value is $300,000. Divide that into an average of 4 years and your expected value is $75,000.

So if you're perfectly rational, you should be willing to work as an employee with no equity for an extra $80,000 over whatever you'd pay yourself as a startup founder, because your expected value is higher.

<comment><USER21> If you're optimizing for the expected value. One can also optimize for the greatest chance to have more than X$ for some X.

<comment><USER20> If your goal is to make at least $100MM, and your chance of founding a billion dollar company is 0.00006%, then you should go buy a thousand lottery tickets the next time the powerball is up in the hundred millions. Your odds will be higher and you'll find out the next day you lost.

</comment></comment></comment></comment><comment><USER22> This is very theoretical and I would say there are a lot of mistakes in the analysis

I would look more simply at all the people I know that are entrepreneurs versus those that work in a job.

At least 50 percent of the entrepreneurs have over $1 million In assets and in a few cases over $10 million

Zero employees that I know have over $1 million in assets

I think it is far more likely to be wealthy as an entrepreneur, it's possibly a bit safer as an employee.

<comment><USER23> I know quite a few employees with over $1M in assets.

Unless you're a relatively close personal friend, there's basically zero reason for someone who earned over $1M in non-public transactions (notably salary) to tell you about it, though.

<comment><USER24> There is zero reason to tell close personal friend that you have more than $1M in assets unless your friend have comparable assets. People are jealous and telling somebody that you have much higher salary (especially if are in the same industry) or you have a lot of assets is the sure way to destroy friendship.

<comment><USER23> Well, there are other ways to infer it if you hang out with someone on a regular basis, eg. if they say "I'll just work for another 5 years and retire", or if they own 3 homes in the Bay Area and aren't complaining about mortgage payments, or if you do an anonymous net-worth survey among many of your friends and see that some of the top rows are over $1M.

</comment></comment></comment></comment><comment><USER25> Great article, two issues:

1\. Instead of looking at averages for entrepreneurs (and stock-holding employees) it should look at expected values. Those take probabilities into account. So with a 0.1 chance of a $100MM payout[1] gives you an expected payout of just $10MM for ~7 years of very hard work. Not too shabby, but not spectacular either.

2\. _" Assuming you don't have any exits and you work 65 hours a week while running a company (compared to 50 hours per week with a regular job)"_ ... while I agree that people work this much and more, the funny part is how a lot of cold hard research proves that working that much makes you less productive and lowers your chances of a serious payout.

Now can someone make this for freelancers? I feel like we're somewhere between employees and entrepreneurs. Salary definitely grows quicker than 6% and risk is definitely smaller than "pure" entrepreneurs.

[1] billion dollar exit, let's say $100MM actually gets into a founder's pocket

<comment><USER26> Whats the actual probability of a $1bil exit? Something more like .00001 I'd imagine, nowhere near that $100MM payout. Granted, nobody becomes an entrepreneur looking at that math - they have some reason to believe they're better than the rest, and as long as it looks good rather than poor on a resume to have your own failed company there's little reason not to try for it.

</comment></comment><comment><USER27> "This unexpected success is just unbelievable. When we video chat, we still want to pinch ourselves through the monitor.

Peldi started Balsamiq on nights and weekends, and now it is supporting half a dozen families.

We were lucky to able to learn so much in our former jobs at Macromedia and Adobe. If he hadn't had the courage to leave, if the stars hadn't aligned just right"

If that is not a real, tangible definition of a successful startup, I do not know what one would be. Having been part of at least one failed side venture startup, I know how hard it is to build a product and how much harder it is to build the right team.

[https://blog.supportbee.com//2010/12/02/delivering-wow- custo...](https://blog.supportbee.com//2010/12/02/delivering-wow-customer- service-an-interview-with-valerie-liberty-from-balsamiq/)

</comment><comment><USER28> Small probabilities trend towards incomputability in tail events. The rate of error for the measure becomes so explosive that in that arena individual parameters seem to be more relevant, among many other things. We'd be better off with PG's intuition than this.

</comment><comment><USER29> 80,000 Hours did a write-up on this: [http://80000hours.org/blog/12-salary-or- startup-how-do-goode...](http://80000hours.org/blog/12-salary-or-startup-how- do-gooders-can-gain-more-from-risky-careers)

</comment><comment><USER30> There seems to be so much variance in starting a company that I'm not sure how valid it is to use the 'averages' to create an earnings graph.

<comment><USER31> That's the entire purpose of averages, though.

<comment><USER30> Not in this case, because a lot of business fail in a year or two, and a lot businesses survive for 10, 20+ years.

I'll bet there's a lot of '$ made' graphs for entrepreneurs that don't go up much, or even go down; and a few that are hockey-sticks. There's really no point of averaging the two out into a scenario that rarely/never happens.

</comment></comment></comment><comment><USER32> negative skew & fat tails vs. fixed income stream.

</comment><comment><USER33> Who manages to only save 6% of their salary? For $75,000/year that's a measly $4,500.

For someone working in tech on a good salary this should be closer to 50%, easily.

Even paying a high rent, and heading out every night one should be saving at least 25%.

<comment><USER34> I've never met a person that could save 50% of their income that wasn't making $250k+.

If you're living in California and making $125,000 per year at a job, you're paying $33,000 in income taxes alone. Your 50% savings rate would be $62,500 - after taxes you have $92,000, so the person can live off of $30,000 per year. Rent alone can easily run $1,500 to $2,500 per month. This is an impossible scenario without even getting into the real costs of existing (ie bills, families, debts, vehicle & getting to work, accidents, problems, charity, social life, doing things).

My ex, who lives in Los Angeles, and makes $70k per year in the medical field, can't save more than $400 to $500 per month max after all costs and taxes. That savings is inevitably slashed in half due to once-per-year events that cost a few thousand dollars to fix. Her only salvation is her 401k.

<comment><USER35> Its ridiculously easy to live off about $20,000. You don't even have to try very hard. Source: any graduate student.

<comment><USER36> As a successfully graduated grad student, I disagree. It is possible, but not at all easy, healthy or sustainable.

<comment><USER35> I've never seen anyone fail at it?

<comment><USER36> Fail at being a grad student? Tons of folks do. Grad degrees have a fairly low success rate and living conditions are certainly one of the reasons people drop out or leave early (the case where the student goes for a PhD and leaves after getting a masters). I'm not claiming it's the only reason, but it's certainly on the list.</comment></comment></comment></comment></comment></comment>


How Much Is the Government Spending on Climate Change? No One Knows - <AUTHOR> https://fivethirtyeight.com/features/how-much-is-the-government-spending-on-climate-change-we-dont-know-and-neither-do-they/ <comment><AUTHOR> In a recent discussion of Bezos's Blue Origin, a commenter made the point that

>>> [...] technology developed for space (1957-present) has made huge improvements in ground based life. At its absolute peak the Apollo program consumed 4.4% of the US federal government budget. <<<

This was used as an argument that we should all be glad that Bezos is diverting some resources toward escaping Earth instead of saving it. That only makes sense if a comparable amount of money is being spent preventing climate change. In 2018, the federal budget was $4.109 trillion, and we don't know what the federal government spent on preventing climate change, but it was probably less than $15.0 billion, or 0.3 % of the budget. In other words, we're not making a serious effort to prevent climate change.</comment>


Understanding HTTPS Graphically - <AUTHOR> https://howhttps.works/why-do-we-need-https/ <comment><USER2> That page incorrectly identifies man in the middle attacks as messages being manipulated on an unencrypted connection.

In fact, a man in the middle attacks occurs when the connection is encrypted, so you might believe you messages are safe from sniffing. The attacker intercepts messages from both parties, replaces their public keys with its own so it can decrypt all the messages, then re-encrypts them with the other party's key before forwarding them on so they still see the connection as encrypted.

The way to avoid that is with digital certificates. Those are mentioned in the next section on the page, but as it's presented you could imagine that it's a separate step layered on top of an encrypted connection, when in fact it needs to be intimately tied to key exchange to verify that a man in the middle attack hasn't taken place.

<comment><AUTHOR> Thank you. This is insightful</comment></comment>


7 Uncommon Questions I'd Ask A Startup If I Were A Venture Capitalist - <AUTHOR> http://onstartups.com/home/tabid/3339/bid/4419/7-Uncommon-Questions-I-d-Ask-A-Startup-If-I-Were-A-Venture-Capitalist.aspx <comment><USER2> _What will you do to find and retain the best people possible for the company?_

What has worked for your company? What did you do to retain the best possible people?

</comment><comment><USER3> The questions feel like tricks to get the entrepreneur to reveal negative information about himself or his company that he wouldn't otherwise reveal. If I were an entrepreneur sitting through a round of questions like these, I would be a bit offended. I suppose for a fledgling entrepreneur who actually may not have thought everything through, these may be appropriate. For everybody else, I'd skip them.

<comment><USER4> "What is the longest debate the team has had in the last 30 days?"

Whether or not to answer your next 6 questions.

<comment><USER5> Ha! That made me laugh!

</comment></comment></comment><comment><USER6> "2. If your equity/salary was based completely on the accuracy of your projections, what would your forecast be?"

Is it even relevant that the entrepreneur be able to make accurate predictions? Shouldn't you just focus on making stuff people want? And isn't speculating on how the size of company X the VC's job anyway? I bet Larry and Sergey didn't see Google getting THAT big on day 1.

<comment><USER7> It's less about the actual forecast and more about the way someone thinks about the business. If someone adamantly believes they're going to be a billion dollar company in a couple of years, that would be a signal. Either it's a really, really big idea and they're super-ambitious -- or, they're being unrealistic.

</comment></comment><comment><USER8> I like to ask where the founders grew up - I actually like to know alot about people's backgrounds as kids

</comment><comment><USER9> Great list of contrarian questions everyone should ask themselves!</comment>


Q and A: Mark Zuckerberg, Facebook's Chief Executive - <AUTHOR> http://bits.blogs.nytimes.com/2010/05/26/qa-mark-zuckerberg-facebooks-chief-executive/ <comment><USER2> these are pretty sub-par questions that were probably written by a marketing person: "But completely opting out of the platform won't allow you to play any games and other third party features on the site?"

and this is one of the first times that i have ever seen 0 comments on a NYT post, especially on a topic this controversial. am i just missing something? where are all the comments? (when i tried to post mine, i got a message that all comments are pre-moderated.)

compare this article to the last Q and A with Eliot Schrage: [http://bits.blogs.nytimes.com/2010/05/11/facebook- executive-...](http://bits.blogs.nytimes.com/2010/05/11/facebook-executive- answers-reader-questions/)

EDIT: there are also no comments on this NYT facebook article that came out the same day: [http://www.nytimes.com/2010/05/27/technology/27facebook.html...](http://www.nytimes.com/2010/05/27/technology/27facebook.html?ref=technology). it looks like facebook is pulling strings to quash dissent.</comment>


Basho (Riak) raises 7.5M - <AUTHOR> http://www.masshightech.com/stories/2011/02/07/daily18-Basho-raises-75M-to-expand-NoSQL-database-sales.html

<comment><USER2> Big day for Nosql news. First Couchone + Membase = Couchbase and now Basho get some big bucks. Just shows that there are real companies out there making real money on alternate database technologies. Congrats to Basho.

</comment><comment><USER3> They raised a 2.5M friends & family round? Need you call it a friends & family round when they're all accredited investors? :)

<comment><USER4> No kidding. That's one hell of a family. :)

</comment></comment><comment><USER5> > ...a more scalable alternative to traditional relational database management > systems (RDMS) written in the SQL language.

Huh, apparently RDBMS' are written in SQL...and all this time I thought SQL wasn't even Turing complete.

</comment><comment><USER6> The guys at Basho have an awesome support. They do everything possible to help you, can stay with you in a Campfire room during hours, won't leave you until the problem is fixed, and best of all, will write a report about the problem as soon as it's resolved.

</comment><comment><AUTHOR> I'm currently migrating from HBase to Riak.. and I'll just say that it is a _huge_ breath of fresh air, compared to dealing with HBase. I also played with MongoDB for a bit, prior to Riak, and found it to be incredibly fast -- but Riak's ease of scalability was a huge win for me.

</comment><comment><USER7> What does Riak do that Cassandra doesn't?

<comment><USER8> (disclaimer: I haven't looked at Cassandra in 6 months)

Riak doesn't involve Java. It sounds trite, but that was a huge plus for our team. It has commit hooks. Search. Builtin JS VMs for mapreduce. More straightforward administration. Most operations are automatic or on-the-fly. Even though I think Cassandra+Hadoop is a technically superior product for managing absolutely huge gobs of multidimensional data (especially with its support for range queries), Riak's ease of use is pretty sweet.

Plus the team is superhumanly helpful about addressing bugs and gotchas. Everything's on Github, and contributing is pretty easy.

<comment><USER9> I can attest to their support being phenomenal. I found a critical bug last week and got a patch within hours of reporting it to their customer advocate. You don't see that kind of turnaround very often.

</comment></comment></comment><comment><USER10> I've evaluated almost all of the "NoSQL" databases out there (excluding graph databases) and have settled on riak-search as the solution for my startups infrastructure.

I've been on the painful side of scaling more than once, and while I'm not planning to be bigger than facebook, I am not going to buy the world of operational hurt I have experienced in the past. Especially given that avoiding it actually saves me time and money.

At least with Riak-Search it does. Riak is a dynamo style document store / key-value database and in that regard it benefits from all notes being of a homogenous type. The thing that hurts most key-value stores is finding documents based on what they contain, and the integration of indexes (inspired by lucene, and seemingly compatible with their APIs, though I don't care about that) makes RiakSearch the winner for me. This allows for amazing power when combined with the built in map-reduce, and their flexible API.

I really want to emphasize the operational issue for me. My experiences have left me with a prejudice against any system that has more than one type of node. In riak the cluster is all homogenous nodes. No masters, no slaves, no bottlenecks. I love that scaling Riak means simply cloning another machine, and pointing it at the existing cluster, and all the machines spread the load out a bit more. That's the kind of operational story you want for a tiny startup.

FWIW, I also liked what cloudant has done with couchdb, and they are adding search features too, so that's worth checking out.

Further, we're working on several initiatives all in the same area. Most will likely produce small amounts of traffic, but when we get it right, we're going to tap into a flood. With Riak, all of these apps will be backed by the same cluster, so it doesn't matter which one happens to hit it right. I won't have to build a custom configuration or scale one particular database for the particular app that works. (This is part of our iterative process for finding product-market fit.) What matters is the total capacity of the whole cluster, and we can add nodes, and when there's enough replication, bring down a node and replace it with a bigger box... without having to shuffle data around or worry. The data just gets redistributed around the cluster to accommodate the loss or gain in capacity. The backup story is straightforward as well.

It may sound like I'm going on and on about this one feature, but easy, and brainless and automatic means it is harder for me to screw up and that lets me sleep well at night. We'll be starting tiny with a trio of cheap dedicated machines of low capacity at low cost. If we need to grow, we can do so economically, and I expect Riak will scale probably father than we will. This means I don't have to worry about architecture and I don't have to worry about operations, I just worry about the business and the product. That's a savings of two worries!

Basho is also the home to seemingly all the erlang action these days (outside of the couchdb scene)... webmachine lives there, rebar lives there, erlang-js lives there. Even the developer of nitrogen (I think) works there. And erlang is most def the right tool for the job. If your project wants to be distributed and it isn't written in erlang, you gotta have some good reasons, I think. (or be using something more exotic and more purpose built than erlang.)

I'll close with one final thing- Riak is so well engineered, and they have added so much value, that they have sucked a lot of the hard work out of the apps we're building. They really are providing a fairly complete platform to build on. Besides RiakSearch we're using webmachine, erlang-js & rebar.

Frankly, I don't mind seeing people go on about cassandra or mongodb... it just makes me feel like riak is my secret weapon that gives me a significant competitive advantage. Basho's products boost my leverage significantly.

What more could a startup engineer want?

Anyway, glad to hear Basho is able to raise the cash, and best wishes to the whole crew there.

<comment><USER11> I totally agree with you, except for the competitive advantage part. Commodity stuff, like OpenSource software is in a certain sense, has no intrinsic competitive advantage value. Nevertheless, I really wish you great success with your startup and that you derive a lot of value from Riak search over time

<comment><USER8> _Has no intrinsic competitive advantage_

Sure it does. You're just thinking about "cost" only in terms of money. In order to use a piece of software (and use it well) you need smart people, time, the right kind of infrastructure, and the knowledge that it's actually worth using.</comment></comment></comment>


Show HN: The nest way to contribute to projects and get rewarded for it - <AUTHOR> http://www.crowdraising.co/metacampaign <comment><AUTHOR> Github exists for coders, people are massaging it for other projects. Crowdsourcing platforms are many but each have their faults. I am building a platform for anyone to contribute to projects. We are disrupting the future of work. PLease check out www.crowdraising.co/metacampaign and there is an explainer video that does the job [https://www.youtube.com/watch?v=w3QT4lqco8M](https://www.youtube.com/watch?v=w3QT4lqco8M)</comment>


German streaming website burning-series down - <AUTHOR> https://www.burning-seri.es/ Down 23.02.2015 <comment><USER2> Works fine for me and [http://downforeveryoneorjustme.com/burning- seri.es](http://downforeveryoneorjustme.com/burning-seri.es) agrees.

(I don't understand why websites/hosters being down is newsworthy.)</comment>


BT devices are breaking Android notifs. with dupl. alerts and ignored settings - <AUTHOR> https://www.androidpolice.com/2019/06/03/bluetooth-devices-are-breaking-android-notifications-with-duplicate-alerts-and-ignored-settings/ <comment><USER2> I almost thought BT was British Telecom a UK ISP/Landline/Mobile service provider.</comment>


Ask HN: How do you keep track of your group/shared expenses ? - <AUTHOR>

We are working on a web application to help people manage and keep track of shared expenses.
1. Just wanted to get feedback on what do you guys use to keep track of such expenses ? e.g. apartment rent you split with your room mates,groceries you bought for your home, informal debts/loan
2. Is there any problem you face in the current solution you are using ? <comment><USER2> we have a shared bank account where everybody transfers his share of the combined flat and from this bank account the rent/utilities are paid. takes 10min to setup ONCE and never has to be touched again (until the amounts change but thats at most once a year)

</comment><comment><USER3> Buxfer <http://www.buxfer.com/>

</comment><comment><USER4> 1\. Spreadsheet shared through Dropbox 2\. No, no problems

</comment><comment><AUTHOR> Thanks for your responses</comment>


Video: Using Trailing Commas in Python - <AUTHOR> https://blog.miguelgrinberg.com/post/video-using-trailing-commas-in-python <comment><AUTHOR> I was unaware of the diff case for the "oxford comma" in the code, but I noticed that the black formatter put it in.

The reordering case makes great sense, but I actually prefer putting the commas on the left in a data structure for aesthetic inefficiency.

Which is why setting aside superficial preference in favor of a standard formatter is superior.</comment>


The history of our world in 18 minutes - <AUTHOR> https://www.ted.com/talks/david_christian_big_history

<comment><USER2> It feels it starts from a false premise to me.

If the 2nd law of thermodynamics is true, how is it _counterintuitive_ that the universe creates complex structures?

Going from order to chaos is exactly what is happening. We only see structures because the universe is not completely homogeneous.

<comment><AUTHOR> I think the point about the 2nd law of thermodynamics helps to frame the narrative in such a way that he can point out how (as far as we know) unique and perhaps rare, and almost certainly fragile, the existence of intelligent life is in the universe.</comment></comment>


Uber data breach could have affected thousands of drivers - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-uber-data-breach-20150227-story.html <comment><USER2> This makes me so mad I was a driver for a while had had some major issues with the company eventually souring any interest in any of the similar services (car related or otherwise) this really get's me going as the reported time frames put me in the "crosshairs" now.</comment>