Uber facing ban in Geneva - <AUTHOR> https://www.thelocal.ch/20191101/uber-facing-ban-in-geneva <comment><USER2> I'm quite surprised that Uber was able to even have any sort of hold in Geneva. I visited my Aunt in Geneva for a few weeks in 2006 and she lived 5-10 miles from the city center and even that far out there was a bus that came by every 9 minutes. The only time we drove was when we went into France. From my short visit I also got the impression that Switzerland is very serious about their taxes. We went grocery shopping across the border in France for the lower prices/taxes and every time we crossed back into Switzerland we got searched by border crossing security to ensure we weren't bringing too many goods across the border based on the number of occupants in the vehicle.

<comment><USER3> Can you please explain a bit more what the border looked like? I was under the impression that there was no border within the Schengen area.

<comment><USER2> It's been over a decade and I didn't drive while we were there but I remember it looking a lot like a tollbooth in the US, but one with military/police looking people that would randomly, or not so randomly, select people to pull off to the side so that they could search your vehicle. At least one time when we crossed into France to go grocery shopping we were searched and had to show our passports and they looked through our groceries and asked to see the receipt.

<comment><USER2> I'm no expert on the EU or Schengen Area, but the Wikipedia page says that "Switzerland was allowed to participate in the same manner in 2008" so it's certainly possible that the situation is completely different now.

</comment></comment></comment></comment><comment><USER4> What if Uber capped driver hours to something low like 2-3 per day to eliminate co-dependence?

<comment><USER5> Then who would drive for them but true gigsters? People only looking for sidejobs.

<comment><USER4> That's precisely the point. If letting people drive full time is creating all if this ethical dilemma and regulatory pressure, cut it out of the equation. It might even drive prices up.

<comment><USER5> True but some people will want more than a few hours a day.

I mean I don't care much either way.

<comment><USER4> Totally agree but it's causing way too many problems.

<comment><USER6> What are the problems it's causing?</comment></comment></comment></comment></comment></comment>


Ask HN:  Closed vs. Open in the context of Apple's products. - <AUTHOR>

The thing that has always surprised me about Apple's recent success is that they seem to have found a way to convince developers that open doesn't matter as much as it used to.
For years and years, geeks complained about Microsoft being "closed".  There were near constant rants against proprietary software, and Microsoft was the most evil amongst other evil companies.
Apple, is and for as long as I can remember been consistently more "closed" than Microsoft, but since OSX was released, rage against "closed" has all but died.  Now, people like the iPhone and OSX so much that when the subject of closed vs open systems come up in relation to software these days, people shuffle around nervously, shrug and then start talking excitedly about how beautiful Apple's products are, and how revolutionary they continue to be.
I certainly understand why developers are so enthusiastic about a great GUI on top of a *nix.  I certainly understand that the iPhone and iPod were revolutionary products.  I'm sure the iPad will be stunning.  I just find it incredibly ironic that as Microsoft and other "closed" companies are opening up and releaseing a lot more software under open licenses, Apple continues to tighten and tighten control over it's products, platforms and services.
Full disclosure, I use I Win 7 + OSS for my apps, and I've tried to like apple for years, I just have emotional issues vs them. :) I'm obviously biased, but I hope I didn't flame here.  I'd love to have a calm, reasoned, discussion about this.
Does closed vs open matter any more?
Thoughts? <comment><USER2> I think Apple gets some benefit of the doubt because of how they've gone back and forth, and produced enough cool things that they get some geek cred.

The mystique of the Woz days, getting full specs for an Apple I along with the machine, etc., probably has considerable lingering impact on techies considering Apple a fellow techie company, as opposed to an Evil Corporate Behemoth.

Subsequent Apple II and pre-OSX Mac stuff was pretty closed, but at least balanced that a bit with relatively vibrant 3rd-party software development, so lots of us have good memories of educational games we played on an Apple II or Mac in school, while the PC was just for Lotus or whatever.

And OSX of course is quite open for a mainstream desktop OS. The sub-GUI part of the base OS is open as Darwin, and even the closed-source full thing is relatively tinkerable--- comes with gcc/python, allows for things like DarwinPorts to be built on top of it, etc.

</comment><comment><USER3> I'd say it does matter quite a lot, which is why I use Fedora on my computer and Android on my phone. OS X itself is even rather open by comparison to the iPhone OS platform, which illustrates rather nicely that Apple tends to favor openness when they're the underdog and closed platforms when they're in the lead.

</comment><comment><USER4> Like most things Apple it comes down to good marketing.

Even though almost all their end products are closed-source and some are even in a closed ecosystem, there tool-chain for building these products is almost all open source and based on standards. In general they greatly contribute to the open source projects they use. This probably allows most people to rationalize championing both openness and Apple at the same time.

So while I don't own any Apple products, I do appreciate the projects they have contributed to.

</comment><comment><USER5> Separate from the whole open vs. closed debate is the matter of usability and design.

Simply stated, Apple products are the best at this for most products. Developers are driven to the quality of the environment and the subsequent quality of the products that they'll be making.

I work mostly in the enterprises realm where it's easy to see that the baseline "quality" of the ecosystem (mostly Microsoft, but also other related stuff) affects the quality of the the products built around it.

A quick glance at the products built around the Apple ecosystem shows a stark difference. Ever since I started bringing my Mac to work (since the switch to the Intel processor), the difference has been even more obvious to me.

I think that in this instance, open vs. closed is a means to an end. If people never had any problems with how Microsoft stuff worked, then no one would have been griping about their stuff being closed. And since Apple stuff is generally pretty good, people are willing to forgo the "closed" ecosystem since they are getting what they need out of it.

I also think that the closed nature of Apple's ecosystem is a little overstated. For instance: it's true that the iPhone app store has pretty draconian policies, but on the other hand, nobody has to truly go through it to get an app onto the iPhone. They could just make a web app. However, people choose to create native iPhone apps because they work better. But then again, they probably work better because Apple tends to enforce their strict policies.</comment>


The business strategy drawing Walt Disney gave to investors (1957) - <AUTHOR> https://hbr.org/resources/images/article_assets/2013/05/disney-2.jpeg

<comment><USER2> A de facto illustration that content creation is the most profitable business model of all.

<comment><USER3> how do you define content creation

lol, and how content creation become business model

<comment><USER2> I should have said creators rather than content creators. (My bad) I will refer to an MIT PDF titled "Do Some Business Models Perform Better than Others?"

Creator is defined on page-7 and on page-17 creators are acknowledged per the MIT study as most profitable at the time of the study:

"...Creators account for 49.6% of all revenues in our dataset at both the beginning and end of the period. Landlord models are next, followed by Distributors and Brokers...."

Hope this helps.

[http://seeit.mit.edu/Publications/BusinessModelsPerformance1...](http://seeit.mit.edu/Publications/BusinessModelsPerformance12July2006.pdf)</comment></comment></comment>


Why Do People Who Chose Not to Study Science and Math Suggest That Others Should - <AUTHOR> http://blogs.law.harvard.edu/philg/2013/12/12/why-do-people-who-chose-not-to-study-science-and-math-opine-on-the-virtues-of-studying-science-and-math/ <comment><USER2> >"In the scope of my research, a feminist programming language is to be built around a non-normative paradigm that represents alternative ways of abstracting. The intent is to encourage and allow new ways of thinking about problems such that we can code using a feminist ideology."

>"I realized that to program in a feminist way, one would ideally want to use a feminist programming language."

How does this drivel pass for serious academic rigor? How does constructing a "non-normative paradigm" centered around a "feminist ideology" for the purposes of creating a "feminist programming language" further the cause of getting more women into computer science? What relevance does it have to the titular question of the blog post? Maybe I'm just particularly nasty today after being sick all week, but this ivory tower gobbledygook really rustles my jimmies.

<comment><USER3> I'm guessing that people think twice before speaking up because there is not all that much to gain but a lot to lose if people misinterpreted their argument.

</comment></comment><comment><USER4> >"I realized that to program in a feminist way, one would ideally want to use a feminist programming language."

Tell that to Admiral Hopper.

Programming languages aren't masculine or feminine. Programming is hard because you're a human trying to express yourself in the language of a computer. Not because you're a woman trying to express yourself in the language of a man.

There are barriers to women in tech, for sure, but those are social and cultural barriers, not "sexist tools".

<comment><USER5> I'm almost afraid to ask if they think there needs to be a "feminist mathematics" as well. Because, really, the division between "mathematical notation" and "programming language" is somewhat arbitrary, especially with languages such as Prolog and Metamath.

[http://us.metamath.org/](http://us.metamath.org/)

<comment><USER6> And thus the mathematical perspective of "Herithmetic" was born.

</comment></comment></comment><comment><USER7> _[Among existing technologies, my personal choice for a feminist programming language would be SQL. The woman expresses her demands for data with five lines of code; a team of 100 men writes 2 million lines of C that must consider all possible ways of satisfying the the query and ultimately supply the answer.]_

Man, what an unfortunate way to end an otherwise interesting article. The project honestly sounds pretty interesting -- I have no idea what a _feminist programming language_ is, but it doesn't sound particularly more far-fetched than other graduate studies I've run across.

<comment><USER8> Last I checked, Lisp/Scheme had some nice curves.

<comment><USER9> "I privately say to you, old friend... please accept from me this unpretentious bouquet of early-blooming parentheses: (((())))."

</comment></comment></comment><comment><USER10> For the same reasons that those who chose not to study culture see themselves fit to comment upon it...well at least those who suggest studying math and science in order to share their latest sexist snark with the world.

Or to put it another way, so that there are some voices which are not like the author's and Rush Limbaugh's. What a boatload of misogynist horse shit.

</comment><comment><USER11> > [Among existing technologies, my personal choice for a

> feminist programming language would be SQL. The woman

> expresses her demands for data with five lines of code; a

> team of 100 men writes 2 million lines of C that must

> consider all possible ways of satisfying the the query

> and ultimately supply the answer.]

I will print it and put on the wall. rofl

</comment><comment><USER12> Because people can recognize the importance of certain paths in life, even as they themselves choose different paths?

<comment><USER13> No, try again.

<comment><USER12> Could you elaborate? I can't say I find this argument very compelling.

</comment></comment></comment><comment><USER14> I like the question itself - my friend went into journalism and now preaches STEM. I believe there is a disproportionate representation of those folks (rather than STEM folks preaching STEM themselves) because they are aware of the media distribution channels while the STEM crowd is more of a dark-room thing... And not-as-able to spread our ideas to the non-STEM crowd due to unfamiliar channels we by nature deal with less. Because of that we should continue to observe this paradigm - And I, one of the crowd, will meanwhile warn the potential traveller that the STEM road is harder, but the reward is inherent to the choice of going through it. I find the following applies much:

      "Two roads diverged in a yellow wood,
      And sorry I could not travel both
      And be one traveler, long I stood
      And looked down one as far as I could
      To where it bent in the undergrowth;

      Then took the other, as just as fair,
      And having perhaps the better claim
      Because it was grassy and wanted wear,
      Though as for that the passing there
      Had worn them really about the same,

      And both that morning equally lay
      In leaves no step had trodden black.
      Oh, I kept the first for another day!
      Yet knowing how way leads on to way
      I doubted if I should ever come back.

      I shall be telling this with a sigh
      Somewhere ages and ages hence:
      Two roads diverged in a wood, and I,
      I took the one less traveled by,
      And that has made all the difference."

      -R.Frost

</comment><comment><USER15> Well, here we go

I teach _basic_ mathematics to adults in a couple of institutions in the UK.

Fact: Most of my students are women, but the male proportion increases significantly for evening classes compared to daytime classes

Fact: A lot of my students (both genders) begin to realise that _basic_ mathematics is stable, has a logical 'rule' based structure, and that it is possible to reduce most of the _technical_ parts to checklists on 5by3 cards

Opinion: I spend a lot of time encouraging students (both genders) to take the slightly harder and more challenging exam[1]

The upshot is that a disproportionate number of male students have a go at Higher compared to Foundation _because of perceived valence of maths_. They will _make_ time for the extra study whereas the female students feel constrained not to take time away from other commitments (children, jobs, older relatives) and will _suffice_ by working in the lesson times only, not between. I do what I can.

Anecdote: I was teaching probability today[2]. I managed to link a two coin tossing experiment where we tossed a couple of different coins 20 times per student (aggregating to 400 tosses) to genetics (Punnet squares where Heads represented dominant alleles, and tails recessive).

Historical note: Mendel's rivals refused to see aA as distinct from Aa (HT as different from TH using coins). Links to sickle cell anaemia and Hardy Weinberg equilibrium. Not a bad two hours...

[1]UK:GCSE Mathematics is offered at Foundation and Higher tier. There is a significant gap between the two. We used to have a _middle path_ called Intermediate that really suited adult students, but some Tory idiot removed it on the grounds that we should _do the same in mathematics as in other subjects_. But we have _subjects_ so that we can address the different traditions...

[2] see below for a sample of my methodology

[http://www.sohcahtoa.org.uk/pages/probability-sorting- statem...](http://www.sohcahtoa.org.uk/pages/probability-sorting-statements- by-likelihood.html)

[http://www.sohcahtoa.org.uk/pages/rolling-two-dice- experimen...](http://www.sohcahtoa.org.uk/pages/rolling-two-dice- experiment.html)

</comment><comment><USER6> Because job demand and the way people make a living has changed since these pundits were in school? 30 years ago, there was a greater demand for legal knowledge, so Barack Obama attended law school. That doesn't mean he can't recognize a higher need for technologists in today's workforce.

This is like criticizing successful farmers for encouraging their children to go into mechanics during the Industrial Revolution.

</comment><comment><USER16> The entire premise of the article is the fallacy of equivocation: when the people referred to are advocating study of STEM subjects, it isn't narrowly focussed on STEM degrees (especially obvious when that advocacy is for general, primary/secondary STEM education), but to set up the "people who chose not to study" is based solely on the fact that those people don't have STEM degrees.

</comment><comment><USER17> Uhg, I worry this will explode... really it's a college thesis and I'm sure it's not the worst one out there:

[http://www.thecrimson.com/article/2013/2/28/spot-the- imposto...](http://www.thecrimson.com/article/2013/2/28/spot-the-impostor- fake-thesis-titles/)

</comment><comment><USER18> This seems pretty close to "if you can't do better, don't criticize."

Abstract concepts and figurative thinking are important factors in _not_ being completely ignorant of the world around you and the existence/potential of things you may not entirely understand or be able to implement.

<comment><USER19> Many of the people who talk about this _could_ probably have studied maths or science, though - they just chose not to in favour of other fields which are traditionally more attractive to women. Yet somehow they never question whether their fields of study - which, naturally, they have far more influence over - are drawing women away from maths and science in a way that they aren't men (and I suspect they are in a pretty big way). It's always exclusively the fault of male scientists and mathematicians, who must obviously be sexist if they're not attracting as many women to courses as men.

<comment><USER20> I have yet to hear a man tell me he was discouraged from entering some field (with the two possible exceptions of nursing and elementary education) by a woman, telling him 'boys aren't good at that'. (Fathers on the other hand are great for making sure their boys don't do too good at the sissy stuff).

On the other hand, I have directly witnessed math teachers and professors telling women that they needn't worry too much about understanding the class, "because you girls don't need it - you're graded on effort" (despite actually wanting to know). I've heard plenty of stories from women about being told "girls are bad at math, it's natural you don't understand". I've seen one little girl break down and cry because a man told her girls can't be engineers.

There is a big difference there.

</comment></comment></comment><comment><USER8> Well, putting aside the feminist-programming-language drivel, it's certainly possible for intelligent and honest people to recognize the value of paths that they did not themselves take.

Also, if I made a mistake, I might encourage others not to repeat my mistake.

<comment><USER21> " _Also, if I made a mistake, I might encourage others not to repeat my mistake._ "

Mistake? Obama and the other high-level people in government who advocate STEM seem to have done pretty well for themselves - probably better than they could have done by studying STEM.

I wonder if Obama is encouraging his own daughters to pursue STEM careers, or just other peoples' kids?

</comment></comment><comment><USER21> By the way, there was extensive discussion of that "Feminism and Programming Languages" article on HN yesterday:

[https://news.ycombinator.com/item?id=6893756](https://news.ycombinator.com/item?id=6893756)

</comment><comment><USER22> Because, to hear them talk, there aren't many other options :-)

</comment><comment><USER23> Oh where do I even begin with this...

>> _Why would folks who apparently preferred other subjects suggest that women and particular minority groups be encouraged to study tech subjects that they themselves did not like and ended up not needing?_

What does this person think women & particular minorities like? Can I safely assume this person is still thinking in the stereotype world? "Girls like flowers and talking on the phone!" "Minorities like gangsta rap and basketball!"

 _" did not like and ended up not needing?"_

So if women & particular minorities don't like or need them; I guess that implies only white males and non-particular minorities do. The amount of incorrect assumptions that one must have in the mind to make such a statement in 2013 is... I don't even.....This blog post is just off the charts filled with privileged/sexist/racist mindset. This has to be a troll/flame- bait/prank.

EDIT: WOW!!! Did this article get blown off the HN-frontpage in under 2 mins? This is an example of how tech-scene buries issues about sexism & racism. You have people in Harvard who think like this... I hope the mainstream media picks this up to let anyone else out there quietly holding these views know how wrong they are and to show sexism & racism still exists in places like Harvard and how it contributes to the lack of women & minorities in tech. Holding this kind of attitude will affect how you interact with women & minorities.

EDIT2: And don't think I haven't noticed the bury-team that always tanks my comments on these issues. Probably the same people I'm always talking about here:

Conspiracy theory: [https://news.ycombinator.com/item?id=6441795](https://news.ycombinator.com/item?id=6441795)

      Supporting examples:
      1. https://news.ycombinator.com/item?id=6885123
      2. https://news.ycombinator.com/item?id=6365495
      3. https://news.ycombinator.com/item?id=6448409
      4. https://news.ycombinator.com/item?id=6857739
      5. https://news.ycombinator.com/item?id=6035263 - This is the most obvious one.</comment>


What's the best startup story you ever heard? - <AUTHOR>

doesn't have to be about software <comment><USER2> If you've never read how Kenneth Cole (shoe/fashion company) started out by launching a movie production company, it's a great story: <http://www.kennethcole.com/scripts/aboutus/ourstory.asp>

</comment><comment><AUTHOR> James Dyson's story is one of the most interesting startup stories I know. Trying to sell your technology and everyone ignoring you...

<http://www.bestchoicevacuums.com/dyson-story.html>

</comment><comment><USER3> Once someone told me about a guy who invented the disk brake, he went to a racing team to offer it, but they told him "we're looking for something to speed up our cars, not to slow them down."

At the end, disk brakes helped a lot in racing because drivers could reduce speed in less time which gave them more time to accelerate.

(I don't know if this is a true story or just a joke, but its a great story!)

</comment><comment><USER4> I just read about the 17 year old founder of whateverlife.com yesterday. That is a great story.

</comment><comment><USER5> Gary Dahl, "inventor" of the pet rock.

[http://www.petsdo.com/blog/pet-rock-made-man-multi- millionai...](http://www.petsdo.com/blog/pet-rock-made-man-multi- millionaire-6-months-lives)

<comment><USER6> The guy made a million dollars. You know, I had an idea like that once. A long time ago.

It was a "Jump to Conclusions" mat. You see, it would be this mat that you would put on the floor, and it would have different conclusions written on it that you could jump to.

<comment><USER7> That's the worst idea I've ever heard in my life, Leon.

</comment></comment></comment><comment><USER8> Of all the stories in _Founders at Work_ I think my favorite is Wozniak's. It still amazes me that he made the entire Apple II by himself, both hardware and software.

</comment><comment><USER9> I would say Viaweb and/or Vermeer purely because there is so much information about them.

</comment><comment><USER10> My personal favorite is the story of the Lycos founder in "Founders at Work". The guy just got a call from a VC, saying "we will give you money if you run a company with this great search technology we bought".

</comment><comment><USER11> Epiphyte: [http://zgp.org/pipermail/linux- elitists/1999-December/000074...](http://zgp.org/pipermail/linux- elitists/1999-December/000074.html)

</comment><comment><USER12> I enjoy reading about the early days of Netscape:

<http://www.jwz.org/gruntle/nscpdorm.html>

</comment><comment><USER13> Please help keep all these stories at: <http://startupflames.com/>

<comment><USER14> Oops, looks like a few got out.

</comment></comment><comment><USER15> "The New New Thing" by Michael Lewis</comment>


"Developers Don't Need to Know the Product" - <AUTHOR> http://www.projectsherpa.com/blog/developers-dont-need-to-know-the-product/

<comment><USER2> There are two kinds of programmers with massive productivity benefits to an organization:

1 - Those that can identify what needs to be done at a level deeper than the end users, can communicate very well, and can code reasonably well. (Coding well enough to understand complexity, and can do things on the fly if needed)

2 - Those who appreciate the difficulties that users have, and have an enormous technical toolset to bring to bear on tough problems.

Much performance literature says, "Play to your strengths" but when people in batch 1 already know their end users in and out, it helps to develop technical skills. And people in bucket 2 - when they make the leap to deeply understand their customer's business, they're extremely powerful. This is also why many firms like to hire CS majors for non-CS jobs.

<comment><AUTHOR> 1 - You describe what most Banks and Hedge Funds would call RAD (Rapid Application Developers) Developers (I know redundant like saying "The La Brea Tar Pits...the the tar tar pits ; 0 ). They are those who are good enough with dev, but understand the biz domain well. I've seen some startups where Product Managers can also function in that capacity, prototyping, basic dev.

2 - Couldn't agree more, but ALAS, there aren't enough people graduating with CS degrees, let alone STEM in general. When I tried to do a market analysis, it was a painful experience. My CoFounder (Great Engineer) was able to do in two hours, what would have taken me two days, because of his software and database skills, not to mention that he had more time to interpret the data vs just gathering. I'd be curious to continue the discussion. If you'd like, please send me an email to email@example.com

<comment><USER2> I'll shoot you an email....

</comment></comment></comment><comment><USER3> >"The product side needs to provide a set of requirements, and the development side needs to find out what the client needs, and how to deliver it. The development side has to have enough product knowledge to determine the actual need, not the stated want"

When I've been in "QA-ish" roles and worked with developers like this, I loved them - and told them so - which was the last thing they expected from an extrovert. I was OK with the ones who DIDN'T have the product/business/user knowledge, but were willing to listen to what I had to say - even if I was saying you/we/I need to go back to the product side for clarification; I don't think this is what they really need/want. And I've battled with those developers who neither had nor wanted any business/user/product knowledge AND didn't want to talk to the product side or listen to QA AND still wouldn't listen to QA after QA got clarification from the product side.

Of course, ideally any clarification is received before or - at the latest - during coding, but life ain't ideal.

<comment><USER4> Lost in slashes here.

</comment></comment><comment><USER5> "The product side needs to provide a set of requirements, and the development side needs to find out what the client needs, and how to deliver it. The development side has to have enough product knowledge to determine the actual need, not the stated want"

disagree with that statement.

"The product side needs to find out what the client really needs and build requirements out of it. The development side has to determine how to deliver it."

Fixed that for you.

<comment><USER6> See? Now you're going back to "engineer is a dumb machine who translates other peoples' thoughts into code" land. Reality is more like this:

"The sales side figures out what customers claim they can't live without. The product side figures out how to turn those perceived needs into a product. Development figures out how to make it meet with reality."

<comment><USER7> You're both being far too black-and-white or even _adversarial_ \- the jobs of both the product and development teams is to _talk to each other_ to determine how to realistically make the product that the customers want.

</comment></comment></comment><comment><USER8> > I'm sure that no one has ever said something that stupid out loud

You haven't been around much, have you?

<comment><AUTHOR> I have been fortunate to be surrounded by people who are generally intelligent and progressive that believe engineers should be part of the entire lifecycle.

Would you care to share your experience with us?

<comment><USER6> It's rarely that blatant. Most people use more covert methods to keep engineers out of the lifecycle. It can be frustrating because most of these statements can be valid when uttered under different circumstances.

\- "Only " _power users_ " will use that." Sometimes this one's true, but some people will say this about any idea engineers come up with.

\- "Let's see what someone _in product_ thinks." The key thing you have to pay attention to here is the subtext. If it's "Let's keep product people in the loop", that's good. If it's "Your idea is invalid because you don't have the title 'Product Manager'", then you have a problem.

\- "I understand you don't want to complicate the code, but our customers don't care about that." This one's a minefield. It puts you in a place where you have to either make a poor technical decision, or get accused of not caring about the customer.

But by far the most common tactic is merely excluding engineers from important meetings, and only bringing them in when they need someone to write the code.

<comment><AUTHOR> Hey j_baker thanks for sharing your perspective. The beauty and curse of code is that it's hard to have subtext that isn't explicit, like in your example. Again if "Let's see what product thinks" has the negative connotation you allude to, in my mind that is a horribly run company. We are still very small (6 ppl) so I want everyone to think like product managers and CEOs - as long as they fulfill their core responsibilities. It gets a little harder bc sometimes, engineers will be vetoed, not because they don't have great ideas, but ultimately, there is some negotiation between a great product/experience and something sellable or to work with a time constraint.

I personally think it is ASININE not to involve my engineers in the decision process, bc they might be able to optimize my business process, or even my thoughts as a product owner. I am a sales and marketing guy, that desperately wants to become a good product manager. The only way I can do that is by learning from others' approaches. If you'd like to continue the dialogue feel free to email me at firstname.lastname@example.com

Cheers,

Ben CoFounder ProjectSherpa email@example.com

</comment></comment></comment></comment><comment><USER9> I've had a similar experience in financial services but from the other direction, and particularly as an architect.

I can't tell you how many times I have heard the phrase "I'm a banker, I don't need to understand the technology" from people in very senior positions with very high salaries.

The thing that they fail to understand - apart from routinely missing fundamental banking concepts like "on behalf of" or "product as sold" \- is that banking _is_ technology.

Banks don't store cash any more, they store bits.

<comment><USER10> You have to consider their goals, which define their needs. If they are in very senior positions and have very high salaries already, and don't understand the technology, then it's fairly obvious that _they_ do _not_ need to understand the technology. They got everything they wanted without that ever being a requirement.

Of course, it's better for everybody else if they do. _We_ need them to understand the technology. They don't.

<comment><AUTHOR> Until they are going to be bankers for a tech entrepreneur's M+A deal or IPO. Then we'll see how much they need to know tech ;) The meek shall inherit the earth in some ways was foretelling the rise of the technologists - disclaimer, I am not religious and mean it in it's literal sense.

</comment></comment></comment><comment><USER11> Yes And No. No 1\. Should a developer will knew all business logic around ?Must knew accounting if erp ,must knew mechanical if do mechanical project. Yes 1\. Most developer come from business logic itself and normal CS degree.Some big system(ORACLE E_BUSINESS,SAP and so so on) not even cater for their environment business.Some fell back to Microsoft Excel.So to counter them at lease have business logic also.

</comment><comment><USER6> If there's one thing that grinds my gears, it's people who treat engineers as if they were some kind of underclass who have absolutely _zero_ ability to understand customer needs. It's sometimes like engineers solely exist to translate other peoples' ideas into reality.

<comment><USER12> Large companies that tend to be PM driven come to mind in this particular scenario. It is not universal, but I've met multiple PMs from a couple of companies that referred to engineers as "the devs" and felt their meetings and schmoozing across teams was the most important thing.</comment></comment>


How My First Article Ever Topped the HN Front Page - <AUTHOR> https://medium.com/p/47428be287be

<comment><AUTHOR> Let me know if you have any questions about the article - I'm here :-)</comment>


What, exactly, is a Product Manager? - <AUTHOR> http://mindtheproduct.com/2011/10/what-exactly-is-a-product-manager/ <comment><USER2> Kind of fluffy. I always worry about descriptions of roles that seem more about selling the role than about the stuff the role owns; you worry about aspirants getting the words "product manager" on their b-card and then not doing anything, like what happened with "architects".

Product managers own most, often all, of:

* Customer outreach: The PM is ostensibly the one with routine scheduled calls to all the clients to collect feedback.

* Feature/function/benefit: the PM usually co-owns the roadmap with engineering, and the split is usually that the PM mostly owns the ordering of things on the roadmap, engineering owns the time estimates, PM describes the feature and the business benefits it solves --- both to customers and, when the job is done right, to engineering.

* Pricing and packaging (in a startup, the PM is probably going to own pricing; in a mature company, nobody is going to trust the PM to own the most important business decision about the product).

* Competitive analysis: the PM is who you blame if you get blindsided by a customer dropping your product for a competing offering.

In mature companies the PM role often ends here and is picked up on the other side by Marcom, who is in turn going to outsource the copywriting and design of white papers and sales material and websites. In a startup, you'd expect the PM is going to own the marcom stuff too.

For a startup, most of what Joel writes on Joel on Software, especially the earlier posts, is a record of the job of a small company product manager.

<comment><USER3> Yes, but in startups, being a PM is often very hard, because no one _has_ to listen to you. So you need to bring your own credibility and influence so the product gets done properly.

It's hard, and "fluffy" at the same time :-)

<comment><USER2> Oh, definitely. Sorry, I sounded like I was criticizing the post. I really just want to make the case that PM is _not_ a fluffy role. "Architect", "CTO", "advocate", "community manager", "evangelist", "information design" --- all carry fluffy connotations. PM owns nuts-and-bolts stuff that companies need to be doing, no matter who's doing them.

</comment></comment></comment><comment><USER4> My favourite resource on the topic is "Good Product Manager, Bad Product Manager". [http://benhorowitz.files.wordpress.com/2010/05/good- product-...](http://benhorowitz.files.wordpress.com/2010/05/good-product- manager.pdf)

It's a training document that Ben Horowitz wrote when he was at Netscape. More here: [http://bhorowitz.com/2010/05/14/why-startups-should-train- th...](http://bhorowitz.com/2010/05/14/why-startups-should-train-their- people/)

</comment><comment><USER5> In a Scrum environment the PM often fills the Product Owner role.

[https://secure.wikimedia.org/wikipedia/en/wiki/Scrum_%28deve...](https://secure.wikimedia.org/wikipedia/en/wiki/Scrum_%28development%29#Core_Scrum_roles)

"The Product Owner represents the voice of the customer and is accountable for ensuring that the Team delivers value to the business. The Product Owner writes customer-centric items (typically user stories), prioritizes them, and adds them to the product backlog."

</comment><comment><USER6> So, now I have an answer to what my job is. The problem is finding another job at a company I don't hate.

</comment><comment><USER7> I always view the PM as a mini-CEO.

Rather than evangelizing the product in the community to gain funding with investors, it's about acquiring the resources and good will within the company. You still need all the skills to not necessarily create the product but rather know what it takes.

That being said, it's very safe. It's entrepreneurial just short of being an entrepreneur. I'd like to think it's the best position to gain experience for starting your own venture without actually developing/designing the product.

<comment><USER8> I've been working as a PM for the last 4 months and taken Pragmatic Marketing training as well.

I think the 'mini-CEO' analogy is an extremely flawed one that discounts a large portion of a CEO's job and marginalizes the real and very significant differences between even those parts that are similar. This is particularly the case CEO's of medium to large companies.

This isn't as true for CEO's of start-ups, but that is because the CEO will possibly be fulfilling the PM role as well, not so much that the PM role is like the CEO role.

However, I do agree with looking at it as an entrepreneurial role.

<comment><AUTHOR> I've been at single-digit startups and *500 companies and entrepreneurial role fits the bill. I'd say in some cases they are the CEO of their own business unit with capacity for setting the product direction, selecting the team and establishing/punishing timetables. Usually in that case, they'll have X project managers under them carrying out instructions, but in the case of a small company they do usually sit somewhere between ops/tech/mktg and somehow guide with diplomacy.

</comment></comment></comment><comment><USER9> Being a product manager is a lot like my experience in college. It's easy to do a bad job and get a C but takes a lot of work get an A.

I can't believe it's been over a year since I submitted my article covering the same topic: <http://news.ycombinator.com/item?id=1627668>

I focused a little more on early stage startups, but a lot of the same rings through.

A lot of people have had experiences with bad product managers. From the feedback from my team, I don't think I fall into that camp. Here's why:

* I learn as much as I can about our technology stack. I try to understand what's hard and what's easy to build. I even write code for our app when I have a chance.

* I try to remove blockers so everyone else can do their job better.

* I give anyone on the team the opportunity to comment on the work that I'm doing. Nothing we're building is ever a surprise.

* I make our longer term goals clear and try to show how what we're building this week gets us closer.

I've never worked with bad product managers. I've always been the lone product manager on a team and have taught myself how to do the job well. It's something I enjoy doing, but can be pretty stressful. Ultimately, the buck stops with me and the success or failure of the execution of the product is on my shoulders.

</comment><comment><USER10> Product manager, IMHO, is an owner of a product and therefore responsible for the success of the product. That means the role and responsibility of a product manager touch on many aspects of product development and delivery. I have been a product manager at a social gaming and a web company, so my answers have to do more with such space.

\- Own analytics. Don't trust qualitative stuff, but trust quantitative stuff. Track important metrics and monitor performance. One of the metrics should be revenue generation.

\- Do many experiments on subset or all users. This is our way of finding out what customers want. First is intuition, but verify it with experiments.

\- Own and prioritize specs and stories (in agile dev sense). This is where the cross with business part comes in and kinda obvious. Spec/story priorities should align with business objectives.

\- User acquisition and retention. This part touches on marketing part. How to get new users? How to retain users? Social media? Email campaigns? Contests? Sweepstakes? Partnership?

\- Etc., etc., etc.

But, ultimately, PM is responsible for success of product(s) s/he manages, and thus do whatever is necessary to make it happen.

</comment><comment><USER11> > Sorry, this does mean that you are a suit

Nope, that's not true at every company. In some companies PMs are part of the business unit, at others they're part of the engineering organization, and sometimes they form their own organization that sits in between engineering and business. There's no one right way to do it.

I'd argue that the first PM hire at a startup should report directly to the CEO since it's likely that the PM will act as the proxy for the business (and by extension the customer). At the same time, I'm seeing an increasing trend toward PMs with technical skills -- my guess is that within a few years it will not be possible to succeed in a PM role without at least some hands-on technical experience.

</comment><comment><USER12> As a follow up question:

What do I do to go from Software Engineer to Product Manager?

<comment><USER13> Amongst other things, take a pay cut I would imagine.

<comment><USER14> Not necessarily. This depends on the companies one is leaving and going to. Sure, if you are leaving an engineering position at Facebook or Google, this is probably true. Amongst young but not newborn startups, it could very well be a bump in pay depending on background and experience.

</comment></comment></comment><comment><USER15> _Well-well look. I already told you: I deal with the god damn customers so the engineers don't have to. I have people skills; I am good at dealing with people. Can't you understand that? What the hell is wrong with you people?_

<http://www.youtube.com/watch?v=mGS2tKQhdhY>

</comment><comment><USER16> Product manager: coordinating officer, delegating company divisional chores / From manufacturing to vacuum-wrapping packaging, a model of corporate exacti- ture / He's pre-eminent -- isn't it evident? -- as his title infers / His word is law, yes it's an advantage / if he's managing the product that is yours

</comment><comment><USER17> A favourite article of mine by Ken Norton - how to hire a product manager. <http://www.kennethnorton.com/essays/productmanager.html>

</comment><comment><USER18> This is a good writeup. I get asked the question a lot so now I can point people here. Thanks!

</comment><comment><AUTHOR> I'd love to see a post from someone(s) about "What, exactly, is a great Product Manager?". I've worked with good, bad and ugly but never a great one. Either that or I wouldn't recognize a great one out of my own ignorance.</comment>


Do not protect your website from scraping - <AUTHOR> https://medium.com/@gajus/do-not-protect-your-website-from-scraping-part-1-technology-barriers-b0ced398d16d <comment><AUTHOR> A follow up from [https://news.ycombinator.com/item?id=20429462](https://news.ycombinator.com/item?id=20429462)

</comment><comment><USER2> A cinema could detect your bot and return fake data rather than blocking you outright.</comment>


The Theory of Interstellar Trade, Paul Krugman (1978) - <AUTHOR> http://en.wikipedia.org/wiki/The_Theory_of_Interstellar_Trade

<comment><AUTHOR> The original article (it's listed in the wikipedia references and is a fun read if you're into trade theory and/or spaceships)

<http://www.princeton.edu/~pkrugman/interstellar.pdf>

<comment><USER2> There's a whole collection of these kinds of article at <http://hanson.gmu.edu/econofsf.html>

<comment><AUTHOR> Awesome, thanks; I really want to find that Journal of Portfolio Management paper.

</comment></comment></comment><comment><USER3> I don't know if this what the paper is about, but it seems clear that you just send the goods and have a navigation computer - with no-one aboard. Then it's only the goods that age - which means a long best-before date.

<comment><USER4> This is why you should not comment on articles you have not read, as this is the _exact_ _opposite_ of what the article was about. It was about the idea of putting a human on a long relativistic journey while his money is left on a bank account on earth to let it age (i.e. carry compound interrest) a hundred times faster than its owner, thereby increasing the subjective interrest rate by the same factor.

<comment><USER3> Actually, I had read it. I just said I didn't understand it.</comment></comment></comment>


One in five millennials are lonely and have 'no friends' - <AUTHOR> https://nypost.com/2019/08/02/1-in-5-millennials-are-lonely-and-have-no-friends-survey/ <comment><USER2> > "Here's the bottom line: Using less social media than you normally would > leads to significant decreases in both depression and loneliness," says > study author Melissa Hunt.

Maybe their words were taken out of context, but the study this refers to was done on a group of undergraduates [0] so besides it being, in my opinion, an overly simplistic solution, I'd be hesitant to draw this out to the wider population. This is especially apparent when looking at the YouGov poll stats where there's clearly a lot of different reasons why people feel they cannot make friends. This is not to say that overuse of social media is not problematic.

I'd be interested to see how this varies by country - loneliness is something I've struggled with a lot in my life as I've moved city/country many times and never lived in the US. I've found each place differs a lot in how easy or difficult it is to make friends and acquaintances, although this could be because I'm at different stages in my life when I've moved.

[0] [https://guilfordjournals.com/doi/abs/10.1521/jscp.2018.37.10...](https://guilfordjournals.com/doi/abs/10.1521/jscp.2018.37.10.751?journalCode=jscp&)</comment>


YouTube Says T-Mobile Is Throttling Its Video Traffic - <AUTHOR> http://www.wsj.com/articles/youtube-says-t-mobile-is-throttling-its-video-traffic-1450821730 <comment><USER2> Paywall</comment>


Ask HN: `cron` or `at` for the Cloud? - <AUTHOR> For a live-chat social system, we wanted a feature where users should be able to create events, like "party at 3pm on Sunday". And we'd like their friends to be notified of those events, shortly before they occur.
This isn't super hard to build but I was surprised that there wasn't a generic service for scheduling events to happen in the far future. There's no standard way to (for instance) trigger an AWS Lambda function to run at a particular time in the future, with a particular set of arguments, that might send a notification, or an email, or call another API.
Is there anything like this? Would you find it useful if it was a SaaS or something you could add to your hosted cloud services? <comment><USER2> You should try Pipedream.com. Here are the docs on setting up cronjobs via API - [https://github.com/PipedreamHQ/pipedream/tree/master/interfa...](https://github.com/PipedreamHQ/pipedream/tree/master/interfaces/timer) \- but there are multiple ways to solve your problem on the platform.

<comment><AUTHOR> You or someone else from Pipedream commented on my Twitter thread, the last time I asked about this. Is this a coincidence? How are you monitoring everything?

I did see the Pipedream recipe but I believe the concept was to run a function in the cloud which looped forever until a time had been reached. Doesn't seem that scalable.

<comment><USER2> I monitor HN using a Pipedream workflow of course. Here is the code and you can set it up in about two minutes - [https://github.com/PipedreamHQ/pipedream/blob/master/compone...](https://github.com/PipedreamHQ/pipedream/blob/master/components/hacker- news/readme.md)</comment></comment></comment>


Optimizing C++ Const Objects in LLVM - <AUTHOR> https://docs.google.com/document/d/112O-Q_XrbrU1I4P-oiLCN9u86Qg_BYBdcDsmh7Pn9Nw/mobilebasic <comment><USER2> So it seems 'const' has gone the way of 'register' \- ignored by the compiler.

<comment><USER3> Just the optimizer. The compiler still enforces it as it reads the code.

<comment><USER4> I'd guess that the optimizer can't really count on it because it could get aliased by code the optimizer can't see and then casted away.

<comment><AUTHOR> Yeah. const_cast (and C-style casts) and mutable existing in the language make const pretty useless to the optimizer. But at least they are trying to get some benefit from it in some cases. A C++ variant (compiler flag) that would remove const_cast, mutable and the cast-const-away parts of C-style casts from the language and allow the optimizer to put more value into 'const' could be interresting.

<comment><USER5> ISO Core C++ is trying to do something like this. They have to, in order to count on the properties of "const" for their static safety analysis.

(I have my reservations about whether ISO Core C++ with the lifetime profile really qualifies as C++ anymore due the massively backwards incompatible nature of the changes, but it'll be interesting nonetheless.)

<comment><USER6> Can you link to more information about this? Googling for "c++ core lifetime profile" just takes me to the Core Guidelines.

Is the idea that they'll codify a bunch of static analysis that disallows problematic constructs & patterns? Could implementers then add something like Rust's ownership checks (assuming full source visibility)?

<comment><USER7> My sibling commentators have given you good links, but it's worth noting that these systems and Rust have a lot of differences. For example, they're explicitly not trying to tackle data races, and the way that they work is different.

I'm excited to see this all play out though!</comment></comment></comment></comment></comment></comment></comment>


Who Just Voted to Let the FBI Seize Your Online Search History with Warrant - <AUTHOR> https://gizmodo.com/heres-who-just-voted-to-let-the-f-b-i-seize-your-searc-1843445032 <comment><USER2> _Without_ a warrant... it's kind of an important distinction.

</comment><comment><USER3> For some reason, I read 'Who' as 'WHO'.

Actual headline: Here's Who Just Voted to Let the FBI Seize Your Online Search History Without a Warrant

</comment><comment><USER4> Trick question: No one just voted, it's been standard practise for almost 20 years, both parties and the courts all support it or at least refuse to take even the smallest action to stop it.

</comment><comment><USER5> Important distinction: article headline says "Without"

</comment><comment><USER6> The proposed law would make the FBI require a warrant whereas right now they do not. Clickbaity article but it's still important

</comment><comment><USER7> Here's hoping another amendment can be proposed, with much the same verbiage, so this can be voted down.

</comment><comment><USER8> If the FBI had nothing to hide.

They wouldn't push for warrantless surveillance.</comment>


Secretive Surveillance Firm Is Selling Cops Cameras Hidden in Gravestones - <AUTHOR> https://www.vice.com/en_us/article/qjdp95/this-secretive-surveillance-company-is-selling-cops-cameras-hidden-in-gravestones <comment><USER2> I want to buy one of these. A 200 year old graveyard that sits on my old summer camp is constantly vandalized in the off season. It's pretty much been decimated over the past few decades. Would love this.

Edit: two day battery life wouldn't cut it for my application.

<comment><USER3> One that's activated by motion detection like the ones they use for tracking endangered species?</comment></comment>


MongoDB acquires WiredTiger - <AUTHOR> https://www.mongodb.com/blog/post/welcome-wiredtiger-mongodb

<comment><USER2> Wired Tiger's storage engine implementation quality is _very_ high. The core developers are experts in the field and really know what they are doing; check the codebase on Github.

Integrating that technology in MongoDB will make a big difference in terms of performance and scalability, and I imagine the folks who built it will be able to put use their skills in good use there, further improving MongoDB left and right. A great deal, of great value, for MongoDB.</comment>


Anatomy of a bug - misplaced parenthesis threatens NetBSD's random numbers - <AUTHOR> http://nakedsecurity.sophos.com/2013/04/01/anatomy-of-a-bug-misplaced-parenthesis-in-netbsd/ <comment><USER2> Could you repost this tomorrow if it's not an April Fool's please.</comment>


Eric Schmidt wants to set the record straight - <AUTHOR> http://features.blogs.fortune.cnn.com/2011/01/27/schmidt-on-google-facebook-and-apple/

<comment><USER3> I think people are really waiting to see what Larry Page will have to say in his capacity as CEO. Maybe that will really set the record straight, Schmidt has a habit of saying lots of words without moving the needle.

That's actually a good trait in a publicly traded company, the few times that he said stuff that bit it didn't do google much good.

Facebook, Apple, Google, Yahoo, AOL and every other media or media related company are all in competition with each other to some extent. The arena of choice for now is 'mobile' and whoever hits the ball out of the park will be around for a long long time. For now it looks as though Apple has the lead, Google is playing catch-up, Facebook is still a wannabe but very well positioned, Yahoo and AOL have dropped the ball. Microsoft is - <USER2> enough given their history - in the position of a very distant underdog but I wouldn't count them out.

Time will tell.

<comment><USER4> How is Google playing catch-up? Android is the clear market share leader, and is still accelerating.

According to Google's most recent numbers, Android is shipping 300,000 devices _per day_. While Apple has a lot of mindshare, the reality is that they're in a solid #2 position in the US, and #3 worldwide.

<comment><USER5> iOS is reportedly shiping on 360,000 per day:

[http://www.macrumors.com/2011/01/19/highlights-of- apples-1q-...](http://www.macrumors.com/2011/01/19/highlights-of- apples-1q-2011-conference-call/)

That would be a greater number than 300,000.

If you look at browser traffic share, either iOS has a much larger installed base, or Android users surf the Web a lot less.

</comment></comment></comment><comment><USER6> It's interesting that he downplayed the idea that Google is competing with Apple and Facebook. Does this show that most of the Google/Apple competition is fabricated by the respective fanboys?

<comment><USER7> One major area Google competes with Facebook is for talent.

</comment></comment><comment><USER8> "They managed to build an elegant, scalable, closed system. Google is attempting to do something with a completely different approach."

Surprised he didn't want to clarify that...

<comment><USER9> If you're familiar with both ecosystems, there's nothing to clarify. Both companies make a lot of money, Apple does so with an elegant closed system. Google does so with a janky open system.

People love to argue about whats better; both of these companies win through press and exposure every time that argument happens. They've managed to recruit armies of people willing to go to battle for them at no cost.

</comment></comment><comment><USER10> _Facebook, on the other hand, "has clearly stated they don't want to get into the search business. Facebook users tend to use Google search. Facebook's ads business does not displace our advertising. I'm somewhat perplexed by the obsession because I don't think the facts support it. Things are going great for Google."_

I'm not sure if this means Google still doesn't 'get' social. But I'm very disappointed to hear this...

<comment><USER11> Either they don't get it, or their external message is all you're hearing.

If they're not worried about Facebook, they're silly. If Facebook reinvents search (ie, search+trust-web = social search), Google just became Yahoo.

<comment><USER12> "Social search" is only good for things like business recommendations, and idle time activities (games).

Why would search of informative websites need to be influenced by what friends\family like? Not saying Google doesn't need to vamp that up, but I just don't see where Facebook has an edge on Google in the realm of informative search.

<comment><USER13> Business recommendation is where the money is in search.

Google doesn't make a lot of $ when you're researching for a paper.</comment></comment></comment></comment>


Grsecurity: Potential contributory infringement and breach of contract risk - <AUTHOR> http://perens.com/blog/2017/06/28/warning-grsecurity-potential-contributory-infringement-risk-for-customers/ <comment><USER2> I stopped taking Grsec seriously a long time ago. Grsec makes the kernel more secure by breaking it. The code in their patches does not meet the standards/style of the Linux kernel and has in fact been criticized by third parties for just not being good code. I could make a crappy patch that breaks networking and market it as a security feature because it "prevents intrusion", but it also breaks useful features. They appear to have some kind of internet defense force or something defending them at every turn but it's become more and more apparent lately that grsec is a low-quality code base maintained by programmer(s) with bad attitudes and superiority complexes.

I've been in tech for quite some time and never encountered anyone using grsec patches. They do a really good job of marketing their product on tech forums though.

<comment><AUTHOR> I see grsecurity in the web hosting industry a _lot_. Tons of people have bought their snake oil (and major players in the shared hosting and multi- tenant hosting space are proponents of grsec).

I've always been uncomfortable with it, even though there are a handful of good ideas in there. Why would I trust something that isn't allowed to go through the normal quality vetting process as the rest of the kernel?

<comment><USER3> What about grsecurity do you consider to be snake oil?

A couple of times the grsecurity patch has prevented a machine of mine being exploited - the first time the exploit didn't work at all and the second grsecurity added enough protection that the kernel crashed and rebooted.

I consider both Brad and PaX Team to be very clever people (though you could easily argue I'm biased as I use the grsecurity patch, confirmation bias and all that)

The fact the kernel protection project are trying to take grsecurity and get it implemented into the kernel also suggests to me that it's not snake oil.

So I'm curious as to why you think it is?

<comment><USER4> _A couple of times the grsecurity patch has prevented a machine of mine being exploited - the first time the exploit didn 't work at all and the second grsecurity added enough protection that the kernel crashed and rebooted._

Out of curiosity, how did you determine that someone was trying to exploit you? And that the kernel crash was due to an attack?

<comment><USER3> Both times friends of mine with shell accounts tried the last kiddy exploit. First time they fessed up they'd tried it and said it didn't work, the second time apologised for causing the box to reboot.

<comment><USER5> Since crashes (especially segfaults) are often indications of an exploitable vulnerability causing the kernel to crash isn't exactly a good thing. It prevented one attack, caused a (probably short) denial of service, and may be further exploitable.

<comment><USER6> Grsec doesn't magically make bugs go away, it just makes many of them unexploitable, or at least very hard to exploit.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Bruce Perens answered questions today on Slashdot about his position.

[https://linux.slashdot.org/story/17/07/09/188246/bruce- peren...](https://linux.slashdot.org/story/17/07/09/188246/bruce-perens-warns- grsecurity-breaches-the-linux-kernels-gpl-license)

"It's important to consider the goals of the GPL," he writes at one point. "You get great Free Software, but it's not a gift. It is sharing with rules that must be followed. You are required to keep it Free. And one of the implied purposes of the GPL is to cause more great Free Software to be made. This means that derivative works that are not shared really go against the purpose as well as the wording of the GPL."

</comment><comment><USER8> I've got a question about this whole GPL enforcement issue.

Scenario:

I'm a VPS company, I provide my customers with kernels compiled with GRSec. I provide a number of modules for different protocols, nftables, etc. with the custom kernels i've built for the VMs. Under the GPL I have to provide the patched source of all those modules (and kernel If I provide that image too) to my customer.

Question:

With GRSec's reported threat of no longer being allowed to be a customer of theirs if I provide the legally required source to my customer, does this mean I can no longer reconcile their two licenses and means that I cannot use their kernel patches for my customers?

<comment><AUTHOR> That's a big part of the implication of this post, I think.

Grsecurity heavily markets itself to the multi-tenant hosting industry. Thus, your scenario is a big part of their customer base. So, if these allegations are true, then not only is grsecurity violating the GPL, they're demanding their customers violate the GPL, too.

<comment><USER9> Shouldn't that be simple to test though? Sign up for one of the hosting providers that uses them and ask for the source code too their kernel and see what they reply.

If I were to guess, I think that they'd argue that providing you with an environment on which you can run your software doesn't equate with "distribution" under the GPL.

Keep in mind that the cloud issues (and patents) were what caused GPL v3 to be written in the first place.

<comment><USER8> Yea that's why I specifically mentioned modules in my original comment. It might be possible to argue that you don't get to see the kernel image so it wasn't distributed to you, but if they gave you modules from that kernel that you can load/unload then it'd be a lot harder to make that argument that they weren't distributed to you.

</comment></comment></comment></comment><comment><USER10> To date, all of the discussion over what GRsec has done is about distribution rights, but it appears the GRsec agreement[0] also contains this:

> If the User has received pricing for the stable patches on a specific > product, use of the patches on additional products without the consent of > the Company will result in termination of access to future updates of > grsecurity stable patches and changelogs.

So while the patches are derivative works of the upstream kernel, which is GPL licensed, they're attempting to restrict the _use_ of the patched kernel source as well by requiring "consent" to use the combined work, the bulk of which was not written by the GRsec developers and has been licensed directly from the upstream kernel authors to anyone who receives it.

That directly contradicts freedom 0: the freedom to run the program as you wish, for any purpose.

[0] [https://grsecurity.net/agree/agreement.php](https://grsecurity.net/agree/agreement.php)

[1] [https://www.gnu.org/philosophy/free- sw.en.html](https://www.gnu.org/philosophy/free-sw.en.html)

</comment><comment><USER11> > Currently, Grsecurity is a commercial product and is distributed only to > paying customers. My understanding from several reliable sources is that > customers are verbally or otherwise warned that if they redistribute the > Grsecurity patch, as would be their right under the GPL, that they will be > assessed a penalty: they will no longer be allowed to be customers, and will > not be granted access to any further versions of Grsecurity. GPL version 2 > section 6 explicitly prohibits the addition of terms such as this > redistribution prohibition.

This is a fundamental misunderstanding of the GPL. The GPL merely requires corresponding source to be made available alongside binaries, so if you get a binary from someone you have a right to the corresponding source from that person. It does not require anyone to offer you a binary; it merely says if they did, you can get the corresponding source.

GRSecurity has no obligation to provide you a binary, they can decline to offer you one because you have a silly walk or a 13-character username or you exercised your rights under the GPL. The GPL does not entitle you to product updates or to continue to be a customer of someone who doesn't want you as a customer, it merely entitles you to corresponding source for binaries.

Some would say GRSecurity's practice violates the spirit of the GPL, but the GPL is not a spiritual entity, it's a legal document, and if you want a legal document that produces a different outcome you can write one up.

Also, you should read the fine print from any other Linux vendor – RHEL, Oracle, etc. You don't have to go on "my understanding from several reliable sources", the documents actually state they'll terminate you as a customer if you redistribute their stuff.

<comment><AUTHOR> "Also, you should read the fine print from any other Linux vendor – RHEL, Oracle, etc. You don't have to go on "my understanding from several reliable sources", the documents actually state they'll terminate you as a customer if you redistribute their stuff."

I don't know about Oracle, but I know about Red Hat. They not only do not prohibit one from distributing source code and the patches they apply to it, they distribute it freely themselves, and help maintain a free distribution of RHEL called CentOS built from the same sources they use for RHEL.

There is no reasonable way to compare Red Hat's policies about source distribution and availability to grsecurity.

<comment><USER11> > Red Hat. They not only do not prohibit one from distributing source code and > the patches they apply to it

Of course they prohibit it. e.g. from [1]

> This EULA does not permit you to distribute the Programs or their components > using Red Hat's trademarks, regardless of whether the copy has been > modified. You may make a commercial redistribution of the Programs only if > (a) permitted under a separate written agreement with Red Hat authorizing > such commercial redistribution, or (b) you remove and replace all > occurrences of Red Hat trademarks.

from [2]

> Distributing the Software and Services (or any portion) to a third party > outside the Portal or using the Software and/or Services to support a third > party without paying for each Instance is a material breach of this > Agreement even though the open source license applicable to individual > software packages may give you the right to distribute those packages

from [3]

> Any unauthorized use of the Subscription Services is a material breach of > the Agreement, such as... (d) using Subscription Services in connection with > any redistribution of Software

[1] [https://www.redhat.com/f/pdf/licenses/GLOBAL_EULA_RHEL_Engli...](https://www.redhat.com/f/pdf/licenses/GLOBAL_EULA_RHEL_English_20101110.pdf)

[2] [https://www.redhat.com/licenses/cloud_CSSA/Red_Hat_Cloud_Sof...](https://www.redhat.com/licenses/cloud_CSSA/Red_Hat_Cloud_Software_Subscription_Agreement_for_Microsoft_Azure.pdf)

[3] [https://www.redhat.com/licenses/GLOBAL_Appendix_one_English_...](https://www.redhat.com/licenses/GLOBAL_Appendix_one_English_20160111.pdf)

<comment><AUTHOR> Your first quote covers trademarks. That is unrelated to source code. CentOS ships with a different set of trademarks. If you want to rebuild and redistribute the RH sources, you remove the trademarks. That's well understood and well within the terms of the GPL.

Second refers to binary builds of the software. Also well within the terms of the GPL.

Third refers to the Subscription Service which includes access to binary builds, access to a customer portal with knowledge base, private support tickets, etc.

None of these refer to distribution of source, which is explicitly permitted by Red Hat.

<comment><USER11> > Your first quote covers trademarks. That is unrelated to source code.

Source code contains trademarks, that is why CentOS has to remove them. If you distribute the source code you get from the RHEL subscription area you have violated your RHEL agreement.

You are not in violation of the GPL, but that is precisely my point: everybody does this, and nobody (except OP) believes it is a GPL violation.

<comment><AUTHOR> I'm not interested in re-litigating the trademark discussion here. It's not relevant to the grsecurity conversation, and it's been settled for a decade or so. Trademark law is separate from copyright law and really has no place in a copyright discussion.

Red Hat places branding in their own packages, generally, which is easily replaced by distributions...they do their own re-branding in Fedora and CentOS; the trademarks are built to be removable. Red Hat went out of their way to make it easier to build a from-source RHEL without violating trademarks, despite not really having a legal obligation to do so.

<comment><USER11> My assertion had nothing to do with whether they made it easy or hard to remove their trademarks.

My assertion was that Red Hat customers make agreements with Red Hat in which they agree not to redistribute RHEL. That is directly analogous to the GRSecurity case, except there we are relying on something OP heard thirdhand and in the case of RH we can read the agreements.

<comment><AUTHOR> "My assertion was that Red Hat customers make agreements with Red Hat in which they agree not to redistribute RHEL. That is directly analogous to the GRSecurity case, except there we are relying on something OP heard thirdhand and in the case of RH we can read the agreements."

Then your assertion is a lie. I feel like I'm talking to a wall.

Red Hat very clearly _does not_ prohibit distribution of the source of their kernel, or any other GPL component of RHEL, and in fact they make it available for free in the form of CentOS, and they do not prohibit others from distributing it either. Everything you've quoted above says nothing about what you keep saying it means.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I think it is unfair to attack the grsecurity guys like this. They've been providing their patches free of charge for years only to have their work abused.

I mean, this whole situation seems a lot like the one described in the following articles, and afaik RedHat is still not facing any lawsuits: [https://lwn.net/Articles/432012/](https://lwn.net/Articles/432012/) [http://www.theregister.co.uk/2011/03/04/red_hat_twarts_oracl...](http://www.theregister.co.uk/2011/03/04/red_hat_twarts_oracle_and_novell_with_change_to_source_code_packaging/)

Now RedHat has the benefit that they claim they're "upstream first", but afaik ASLR originated with the grsecurity guys, so there is grsecurity stuff in the vanilla kernel. Is ASLR snake oil?

I don't see how the situation is different between how grsecurity did things and RedHat. Between going out of business and working on the boundary of the GPL, they chose to stay in business.

More importantly, how would you deal with publishing under the GPL and making money off of it? This whole discussion reminds me of this article: [http://widgetsandshit.com/teddziuba/2010/01/i-love-the- gpl-e...](http://widgetsandshit.com/teddziuba/2010/01/i-love-the-gpl-except- when-it.html)

The way things are going, the best direction to take if you want to produce GPL code is to have another job unrelated to programming to earn enough to code in your free time. It's really sad if you think of the megacorps that are making billions off of FOSS.

I'll end up with a quote by Steve Jobs: By the way, what have you done that's so great? Do you create anything, or just criticize others work and belittle their motivations? [http://widgetsandshit.com/teddziuba/2010/05/the-future-of- ap...](http://widgetsandshit.com/teddziuba/2010/05/the-future-of-apples- curated-computing.html)

</comment><comment><USER13> Edit:

I replied too soon and misunderstood the core of Peren's argument.

His claim is that by withdrawing support if a customer redistributes the grsecurity patch (which absolutely _is_ licensed under the GPLv2), that amounts to adding a clause to the GPL due to the penalty this imposes.

At issue is this agreement:

[https://grsecurity.net/agree/agreement.php](https://grsecurity.net/agree/agreement.php)

This clearly represents additional conditions imposed on the software. Seems like a grey area as to whether those conditions at enough to violate the GPL under which the Linux kernel is licensed.

Original comment:

I don't buy it.

Grsecurity isn't distributed as a derivative work of the Linux kernel.

Just because it's useless without the kernel doesn't make it a derivative work. By that logic, Nvidia's closed source driver would qualify as a derivative work and fall under the GPL.

<comment><USER14> "Just because it's useless without the kernel doesn't make it a derivative work. By that logic, Nvidia's closed source driver would qualify as a derivative work and fall under the GPL. " FWIW: This is in fact, the belief of a number of lawyers.

<comment><USER15> Nvidia have a lot of money, so the law is on their side.

</comment></comment></comment><comment><USER16> Can someone explain how the GPL covers Grsecurity at all? It sounds like it's entirely their own code they wrote themselves and have all the rights to. It just happens to be something that their customers are going to use with GPL Linux. They're not distributing any GPL code are they? I can't believe a derivative work can include something that is merely compatible with GPL code but doesn't actually contain any. Or does it? Have they copied and pasted GPL code into the Grsecurity patch? In that case, then it does make sense that it should be GPL'd too.

<comment><USER17> If you open an old version of the patch, you'll find that it adds, removes, and changes lines in the middle of existing Linux functions. If it's not a derivative work, I don't know what is.

<comment><USER16> You mean it contains copies of existing Linux functions which the Grsecurity authors have edited? That makes sense. A lot of the comments here seem to be about how tightly it interfaces with Linux, which is surely a different thing.

<comment><USER17> This is a little snippet of grsecurity:

       static void account_kernel_stack(struct task_struct *tsk, int account)
       {
      -       void *stack = task_stack_page(tsk);
              struct vm_struct *vm = task_stack_vm_area(tsk);

              BUILD_BUG_ON(IS_ENABLED(CONFIG_VMAP_STACK) && PAGE_SIZE % 1024 != 0);
      @@ -303,8 +357,12 @@ static void account_kernel_stack(struct task_struct *tsk, int account)
                       * All stack pages are in the same zone and belong to the
                       * same memcg.
                       */
      +#ifdef CONFIG_GRKERNSEC_KSTACKOVERFLOW
      +               struct page *first_page = virt_to_page(tsk->lowmem_stack);
      +#else
      +               void *stack = task_stack_page(tsk);
                      struct page *first_page = virt_to_page(stack);
      -
      +#endif
                      mod_zone_page_state(page_zone(first_page), NR_KERNEL_STACK_KB,
                                          THREAD_SIZE / 1024 * account);

Grsecurity isn't Linux plus some additional code. It's a modified version of Linux. Saying that a Linux 4.11 kernel patched with grsecurity isn't a derived work of Linux 4.11 is like saying that a Linux 4.11 kernel patched with patch-4.12.patch [1], otherwise known as Linux 4.12, is not a derived work of 4.11

[1] [https://cdn.kernel.org/pub/linux/kernel/v4.x/patch-4.12.xz](https://cdn.kernel.org/pub/linux/kernel/v4.x/patch-4.12.xz)

</comment></comment></comment></comment><comment><USER18> I wonder what is the current status of the Wind River debacle.

</comment><comment><USER19> LOL. Please, just bow out on topics related to security. You are spreading misinformation.

<comment><USER20> Personal attacks will get you banned on HN. Surely you know that? Please don't do this again.

We detached this comment from [https://news.ycombinator.com/item?id=14732721](https://news.ycombinator.com/item?id=14732721) and marked it off-topic.

</comment></comment><comment><USER21> grsecurity is a good effort, if you dont like it dont use it but dont complain about people trying to make a turd less of a turd even if it is of your opinion they fail at it. alot of people sell software that 'only functions on linux', people even sell linux based appliances, they all leave the licence files etc. neatly tucked away somewhere for licence nazis to find >.>. people who critisize grsecurity and praise linux probarbly dont care much about the rootkits in their systems >.>

</comment><comment><USER22> I'm curious why the same argument wouldn't apply to Red Hat Enterprise Linux and all its customers, since they apply the same policy of terminating the license of anyone who redistributes it to their kernel patch set.

<comment><AUTHOR> That's not accurate. Everything Red Hat does is OSS. Their kernel patches are developed in the open, and available to anyone. The only thing they restrict is binary distribution.

<comment> yjftsjthsd-h To belabor the point, it is my understanding that CentOS is literally identical to RHEL minus a couple identifiers (/etc/issue and the like) and a license with a support contract. You can even convert it into RHEL by buying a license and installing a couple packages.

<comment><USER22> CentOS can ship a system that's effectively identical to RHEL because Red Had publish their patched kernel source. What they don't distribute publicly and is only available to customers, under penalty of contract termination if they release it, is the patches that make up their kernel. So non-customers can't easily tell what they've changed, back out patches that break stuff, or cherry-pick patches for non-RHEL use. This is obviously nicer than the gresecuriy approach but there's no obvious reason why it's any more legal.

<comment><USER23> If what you say is true, and I have no doubts you are correct, then how is Red Hat's kernel policy different from Grsecurity? They both alter the kernel and contractually bind the recipient not to distribute the source on pain of contract termination. I'm not asserting bad / good. I'm would like to know the difference.

<comment><AUTHOR> "They both alter the kernel and contractually bind the recipient not to distribute the source on pain of contract termination."

Red Hat does not contractually bind anyone to not distribute source. They just don't. They distribute the source themselves, without contract or cost.

And, Red Hat employs several of the largest contributors to the mainline Linux kernel. Most of the time, if something is in the RHEL kernel, there are people working on pushing it into the mainline kernel either before or after it goes into the RHEL kernel. Red Hat has consistently and for decades worked _with_ the Linux community to build a better kernel.

I'm not trying to be a Red Hat fanatic or anything, but they've been trotted out multiple times in this thread as being "just like grsecurity", and it's just flabbergastingly wrong to compare the two.

<comment><USER23> Ok, so what is Red Hat contractually binding me not to do? Am I misunderstanding what makomk is trying to say?

<comment><USER24> While Red Hats individual kernel patches are not available, they distribute the "squashed" sources under the terms of the GPL.

<comment><USER23> Thanks for the answer. Is the removal of the context of the changes generally considered acceptable? We have a Red Hat license, but frankly, I am more a BSD person and our use of Red Hat is a requirement for specific programs.

<comment><AUTHOR> Yes, it is well-understood to be acceptable. In the past, most commercial Linux distributions were developed behind closed doors in private revision control and pushed out as "complete" source packages. We had these conversations back then (~20 years ago), and the community and the companies involved came to mostly agree about what is and isn't OK. That's opened up a lot in recent years, such that these days "open source" usually means, "we have a public git repository", but it does not have to.

The GPL provides you some basic rights: you can request the source in a usable form, you can change it, you can redistribute it under the same terms.

It does not require access to the process that produced the software.

These days, Red Hat develops almost everything way out in the open. Contrary to all of the talk in this thread where folks (mostly just one guy, actually) keeps implying RH are violating the license or making it hard to get and distribute source, you can see discussions _and_ the actual code being worked on months in advance of what will be in RHEL by following Fedora development. Fedora is developed entirely in public repositories and mailing lists, and it is where much of RHEL development takes place (RHEL trails Fedora by about 12 to 18 months, in terms of versions, and things that will be in RHEL next year are in Fedora today). Red Hat is an excellent OSS company who do damned near everything right, IMHO. Any complaints I might have about some of their practices (like I said elsewhere, I _liked_ having a kernel SRPM that was the mainline kernel plus listed patches, and I miss it being that way) pale in comparison to the good they do for the OSS community.

Just because they make a lot of money doesn't mean they're cheating the community out of anything.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


7,500 Strangers Just Bought a Crumbling French Chateau Together [2017] - <AUTHOR> https://www.npr.org/sections/thetwo-way/2017/12/05/568594889/7-500-strangers-just-bought-a-crumbling-french-chateau-together <comment><USER2> >The real gift, the campaign explains, is that patrons can become investors in a company that will own the castle, and "collectively decide its future."

So they paid for the opportunity to pay... more.

Hopefully this all goes well, I'm kinda suspicious.</comment>