Jack Dorsey does 8 hours at Twitter, 8 hours at Square daily - <AUTHOR> http://thenextweb.com/entrepreneur/2011/11/14/jack-dorsey-does-8-hours-at-twitter-8-hours-at-square-daily/?awesm=tnw.to_1BpLg&utm_campaign=social%20media&utm_medium=Spreadus&utm_source=Facebook&utm_content=Jack%20Dorsey%20does%208%20hours%20at%20Twitter,%208%20hours%20at%20Square%20daily <comment><USER3> Jack Dorsey does 8 hours at Twitter, 8 hours at Square, 0 hours at life, daily.

In other words Jack is free to do whatever he likes, but it is not a good example for most of us. I'll cite a very short poetry by a Sicilian poet called Salvatore Quasimodo:

"Everyone stands alone on the heart of the earth / transfixed by a ray of sunshine / and it is suddenly night"

<comment><USER4> Can anyone from Square or Twitter confirm this work schedule?

<comment><USER5> I'm pretty familiar with Jack's situation. Yes, this is indeed true, now. For a time he was splitting one day on / one day off at each company.

Frankly, Jack has very little time outside of his work, but I wouldn't say that he doesn't have a life. His work is his life and they are closely intertwined. This is great, since it means he's quite passionate about both product sets and the quality of his companies' net output really shines, IMO.

The danger of this obsessive behavior though is that it can begin to warp ones perspective on others' work/life balance. Jack works like a dog because he's excited about what he does, so it seems to baffle him when those around him aren't equally excited and committed to their work as well.

In the case of Square, they've been very quick to fire anyone who isn't putting 80+% percent of their life into Square -- often with little warning or reason.

Dogma is dangerous.

<comment><USER6> Square sounds like a terrible place to work, then. We should stop giving startups free passes for demanding ridiculous hours out of employees in the name of equity, when they usually end up screwing their employees out of it anyway.

<comment><USER5> I think startup politics generally reflects the power structure surrounding it; whether that be founders or investors that hold a relatively big stake in an organization, or the society surrounding it. The US is not always the most meritocratic or egalitarian environment, and it seems that those that latch onto or come into some power tend to hold to it very tightly and don't share with those around them.

Equity, unless you're very lucky or diligent, often doesn't equate to much. I think, too often, folks tend to place too much emphasis on equity. The terms and value of which are not often immediately obvious to the recipient and can get diluted over time. Twitter's on what... round G now?

Ultimately, starting a startup is a big uphill slog. At the end of the day, everyone needs to put in some level of herculean effort from time to time if it's going to work.

The trick is figuring out how to effectively value the things that each contributor is best at. If you're working in an organization that primarily values software engineers, it can be hard to get recognition as a visual designer.

In an organization that primarily (and sometimes only) values and recognizes software engineers that make things you can see or touch, it can even be hard to make it as a systems plumber or kernel hacker.

</comment></comment></comment></comment></comment><comment><USER7> Unfortunately, I think a lot of people may miss the most useful point of this article: blocking out days by themes as a productivity booster.

The big headline is about working 16 hours days, but that headline grabber will distract from the most useful nugget of information: how he does it.

The really cool thing about this article is theme-blocking his days. Has anyone tried that? If so, how has it worked?

<comment><USER8> Because of the tuesday-tuesday nature of the record business, working at a label necessitated this.

Monday->Engineering maintenance for records. Lots of email blasts and such, site maintenance.

Tuesday - Release day, also radio promo meetings. Executive meeting

Wednesday - Marketing meeting. This was when results of the last week's sales were finalized so also reconciling retail with stats and such.

Thursday - typically a big launch day for us.

Friday - clean up, product dev work, department stuff. It was a 0 launch day.

</comment></comment><comment><USER9> Clever guy. First he builds Twitter to make sure all other entrepreneurs are busy checking their tweets. Then he starts another company without any competition.

<comment><USER10> He is _joking_ people. And it is a good one. :-)

<comment><AUTHOR> err.. the two comments below are also jokes! one is not so funny and the other is rather sad

</comment></comment></comment><comment><USER11> I think Jack Dorsey is doing an amazing job and it is extraordinary what he has shown at Twitter and Square.

That being said, what we are seeing here is basically "story telling" and "legend building" in action. The same happened when Jeff Immelt took over GE and The story was "Look at that guy! The hardest working GE employee, putting in 100 hours a week. What a leader!" (you can Google it).

While I believe that Jack didn't craft a master plan for this, somebody is certainly putting some effort into building a coherent story that helps Jack but ultimately also Twitter and Square and therefore its investors.

And once again: it get's us talking as well, so I would say: Mission Accomplished.

<comment><USER12> You're right. It's called hagiography -- a term HNers would do well to learn.

</comment></comment><comment><USER13> Regardless of whether or not he actually works 16 hour days, the Monday through Friday scheduling and focus on specific areas of the business are really interesting. An entire Friday dedicated to the company and culture -- fantastic for building a team that's with you for the long haul.

</comment><comment><USER14> Maybe explains why Twitter is so bad at so many things.

Like making money.

Why don't they offer a customized twitter feeds of all the GOP presidential candidates and sell ads off of that feed?

For example...

I have had a strong suspicion that the upper management at Twitter are not really on top of it, they appear lazy, and content with just going along for the ride, instead of steering the what appears to be rudderless ship.

</comment><comment><USER15> <snark>Poor guy, someday I hope he doesn't have to do that.</snark>

It makes me a little sick to see some people idolize this.

<comment><USER16> Agreed. We all have to remember we're not Jack Dorsey. A year ago I might have actually tried to emulate this. Experience tells me unless it's coming naturally it's a kamikaze mission. I totally respect mr. Dorsey, I just hope to god the naive don't get a hold of this article and start copying the 16 hour work day part.

<comment><USER17> It depends on timespan, if he thinks that doing this for a short time will be a big plus for both companies then it could be an okay trade off.

</comment></comment></comment><comment><USER18> That is simply unbelievable, but Im not sure you can sustain a healthy life with with 16 hour work days

<comment><USER19> I did 80+ hours per week for years in medical school, residency, and fellowship. Many people in medicine make a career of it. It's not as unusual as you think. There is certainly a fair argument to be made that it's not particularly healthy or a good idea, but I can assure you that for some people it's quite sustainable.

<comment><USER20> > I did 80+ hours per week for years in medical school, residency, and > fellowship. Many people in medicine make a career of it. It's not as unusual > as you think.

Possibly a bad example; in most developed countries the medical professions have amongst the highest rates of depression, suicide and divorce.

</comment></comment></comment><comment><USER21> Why is everyone complaining that this isn't a lifestyle to idolize or emulate when the resounding sentiment here is that it isn't a lifestyle to IDOLIZE OR EMULATE?

We get it. I get it. You get it. Everyone gets it. I think plenty of the commenters here do a damn fine job of trivializing other readers' intelligence.

I'm also certain that Jack Dorsey doesn't work 16-hour days for the attention. We didn't know this up until now, and Twitter and Square have been running just fine. That's what matters, and if Dorsey feels like putting in that much time is necessary, so be it. If he burns out, he'll burn out; if he doesn't, good for him.

</comment><comment><USER22> <rant> Four-hour work week? Work smarter, not harder?

I just don't buy those kind of ideologies if you really believe your idea will change the world. If you want a lifestyle business that provides for you and your next of kin, more power to you.

And if that's the route you take, please stop trying to convenience everyone your path to enlightenment is the right way. For awhile, I found that whole movement to be quasi-religious and therefore quite annoying.

When you love what you do, it's not work and therefore there's no reason to want to avoid it. And that's why they win. </rant>

<comment><USER23> IIRC Ferriss arrived at his "four hour" week exactly by not counting work- related activities he enjoyed, as work.

<comment><USER24> Actually, he arrived there by split-testing different names for his book on Google. Four Hour just happened to be the catchiest.

</comment></comment></comment><comment><USER25> pfft... All I see in the article are 8 unproductive hours every day. Research has shown that humans really don't need 8hrs sleep to work at their optimal best and 4-5 hrs of sleep should be more than enough. He could use those extra 4 hrs every to further develop the companies or even better try launch another startup on the side. Also walking 2 blocks every day between the two companies? That seems a waste of time which should be spent working, I know it doesn't sound much but walking two block every day adds up as a ton of wasted time. He should iron that inefficiency out of his schedule by having a common office for both jobs and using skype if he really needs to talk to someone. Also taking weekends off? Don't even get me started on that.

<comment><USER26> _Research has shown that humans really don't need 8hrs sleep to work at their optimal best and 4-5 hrs of sleep should be more than enough._

Citation please? It's my understanding that losing even 1 hour of sleep a night will add up over time and cause all sorts of cognitive problems.

<comment><USER27> _(pssst, andrewpi, I think theshaddow's parent comment is tongue-in-cheek.)_

</comment></comment></comment><comment><USER28> Well the schedule looks like its not really "hard" work. When i do all these things in my startup i feel like i am not really working, i only have the feeling of accomplishment when i write code and improve the product. Marketing and Biz dev sure is very important but personally i dont feel like i get stuff done when doing it, which might be bad. Then again i couldnt put in 16 hours of work everyday, thats insane and i cant believe hes doing that for a very long time. After 10-12 hours of coding and working on technical things, i am done for the day. Some sport in the evening to stay healthy and blow off steam and thats it. And even that leaves me with very little real life during the week, which sometimes is frustrating.

</comment><comment><USER29> Good for him.

Regardless of whether or not it's sustainable, I simply do not want that type of lifestyle. If I'm not as "successful" because of that, so be it.

<comment><USER30> I'd say "success" should be measured in more broad terms... "How much work do I put into my marriage/children/etc", "How much fun am I having?" etc

I'd agree, his lifestyle seems as out of balance as someone who does no work at all.

<comment><USER31> What's interesting is that he could have cashed out after Twitter and led an incredibly entertaining and enjoyable life, but still chooses to push on further for more success, more challenges, etc to the extent that such a huge portion of his waking life is taken by "work" like this.

I could understand it (and put in a lot of hours myself) driving to get that first home run, but less so afterwards. I'd struggle to sit idle and travelling non-stop isn't the holiday everyone thinks it is, but my dream lifestyle definitely wouldn't involve 16 hour days once I had the means to pursue all my interests to a desired extent.

</comment></comment></comment><comment><USER32> I posted this in the other thread about his hours:

Being a manager and accutely aware of legal ramifications of hours worked (boring I know), does anyone have any insight into whether there is something in the US akin to the European Worktime Directive? Over here (UK, but the E.U as a whole) the average working week is 40 hours by law, and the worker must opt in to be eligble to work upto a maximum of 70 hours per week. As well as this 70 hour maximum, 11 hours must be taken between end of work one day and start of work the next, and an entire 24 hour period of non-work must be taken once every 7 days, or alternativley a period of 48 hours of non-work must be taken in a 14 day period.

Any comments?

<comment><USER33> The U.S. has nothing like that for salaried employees.

<comment><USER34> IANAL, but I believe the law is slightly more nuanced than that:

<http://www.dol.gov/compliance/topics/wages-overtime-pay.htm>

Overtime doesn't apply to a number of class of workers (including executive, administration, professional, outside sales, and computer related workers).

And I believe you could read "professional" as "anyone with a college degree working a white-collar job".

Having said that, you're essentially correct...

<comment><USER35> I believe "professional" effectively means "salaried". Salaried employees generally don't get overtime.

Details are in a page linked from the parent (see Learned Professional Exemption):

[http://www.dol.gov/whd/regs/compliance/fairpay/fs17d_profess...](http://www.dol.gov/whd/regs/compliance/fairpay/fs17d_professional.htm)

<comment><USER34> If you're a learned professional (matching _all_ of the three criteria on the page - one of which _is_ salaried), artist/creative, teacher, law/medicine practioner, or are highly compensated (making > $100,000/year) overtime doesn't apply to you.

At least, that's what I got out of the page.

<comment><USER32> The definition of Overtime is actually getting paid, yes? The law I am referring to over in the E.U is actually working, full stop - paid or not. I am at a position where I am not paid any overtime - I'm still not allowed to be present at work for more than 70 hours a week. Does nothing like this exist in the U.S? As in, you could technically work 168 hours with no legal ramifications?

<comment><USER34> From the US Department of Labor, Wage and Hour Division: <http://www.dol.gov/whd/flsa/>

> There is no limit on the number of hours employees 16 years or older may > work in any workweek.

So, disregarding overtime, yes: you could technically work 168 hours a week with no legal ramifications.

</comment></comment></comment></comment></comment></comment></comment><comment><USER36> having just recently finished reading the Jobs biography, this turn of events for Dorsey reminds me of him: ousted from leadership, appointment on the board, heading a new company (Square vs. Pixar), and then serving as head of two companies simultaneously.

</comment><comment><USER37> Note that this means he gives much less to each company than any startup founder I know.

</comment><comment><USER38> I am not surprised or in awe that he is putting in 16 hours a day. Every passionate founder would likely be doing it. I am sure most of us have heard Steve Job's on how building a company is usually a 18x7 work-week.

What I am in awe and admiration is that he is managing two companies and in this case two completely different ones by nature! A rule generally accepted in the startup land is that you don't work on _multiple ideas_ , in order to stay focussed on building one thing well. While twitter is not a startup (any longer) and Square is probably a very big/late-phase startup (if we can qualify it as that), they both definitely need the caring and nurturing of a founder (IMO). Given that, it is remarkable he is able to do the context switch needed to run both the companies. I would love to know how effective his leadership is, in both these companies, given that he isn't there longer than a typical day in either of them.

I am so tempted to try doing more than one thing, but then since I am a coder, I guess its not easy to digress daily as he can.

<comment><USER39> _A rule generally accepted in the startup land is that you don't work on multiple ideas_

Interesting. I have not heard this before. As it stands, I have always worked on multiple projects for as long as I can remember. My current main company started out as a side project, for example.

Is there a canonical reference or blog post that the startup community refers to, to elucidate the reasons for one-project focus?

<comment><USER38> The reference I can quote here is from a recent essay PG wrote: <http://paulgraham.com/stypi.html>. Watch the definition of startup #10 (Avoid Distractions) - <http://www.stypi.com/hacks/13sentences>

The other source again from PG, that I can infer as not doing too many things/working on too many ideas is: <http://www.paulgraham.com/startupmistakes.html> Read the #18 (A Half-hearted attempt)

I am sure there are folks who have juggled more than one Idea and succeeded in all of them. Also, I think the relevance of these posts also probably make sense to someone starting out early (like say during building the product/company) and probably not for someone who already is working on established companies (like in Jack's case). IF you see Jack in fact moved out of twitter to completely focus on Square and only when it had hit the road running, did he embark back on twitter.

</comment></comment></comment><comment><USER40> Crazy. I really would prefer working 4 hours max each day. Or achieving the 4-hour workweek. That and work from home at first, then everywhere. :)

<comment><USER41> I think its just differences in lifestyle. I love working super long days. I just don't like it when life tries to get in the way of work.

<comment><USER40> I totally agree. Work would be relevant if I enjoyed it.

</comment></comment></comment><comment><USER42> Extremely impressive but is it really sustainable in the long run? I personally do not think that working 16hr days is good for you in the long run. It is not healthy.

What use is he if he gets burned out in a year or two? Not much I would wager. Sure one might argue that this pattern of long working hours is crucial in the first few years of a company. The question if he does so much more in 16 hours than he could have done in say ten or twelve? I doubt you can remain very efficient 16 hours per day.

<comment><AUTHOR> Wonder what the bankers would say to that...

<comment><USER43> Many would simply say "I'll do it for 4-5 years and then make some other junior analyst do it for me when I'm a manager".

It's a pump-dump mentality internally you know...

</comment></comment></comment><comment><USER44> I do 16 hours daily at my start-up, only get paid a fraction of the price. I'm doing something wrong.

<comment><USER45> You are. The worst possible thing you can do at a startup is plow ahead and put in hours like crazy. Just like Steve Jobs killed product lines, or an engineer removes thousands of lines of code, you can remove 100 hours from the next month if you think about it carefully for one hour.

<comment><USER46> I'm pretty sure Steve Jobs put in 16 hours a day when Apple was still a startup. I'm not saying you should do that, but it might not be wrong to.

</comment></comment></comment><comment><USER47> And how many hours with his PR agent?

</comment><comment><USER48> Well, kudos for being devoted to his business(es), but how much is he bringing to the table during each of those 8-hour periods?

If I was working 16-hour days every day, I'm almost certain I'd be less productive than if I was working 'normal' or even reduced-hour days.

Maybe he's just _that_ energetic, but my ability to get meaningful work done is not an endless fount. Downtime is important.

</comment><comment><USER49> I can easily do 60-70 hour weeks as long as I use the weekend too, but 16 hour days are ridiculous. I can't believe that the guy is able to give his 100% every day for 5 days a week at both companies. The most a normal person would be able to do is a half-assed job, but perhaps Jack is just an ubermensch.

</comment><comment><USER50> I've worked with startups in varying capacities for 6 years and my schedule is always tight. Jack Dorsey represents the limit, but I wonder whether the topical schedule (Mon: management, Tues: product, etc.) is a good organizational tactic for those of us who wear many hats.

</comment><comment><USER51> "If you work hard, and become successful, it does not necessarily mean you are successful because you worked hard, just as if you are tall with long hair it doesn't mean you would be a midget if you were bald."

</comment><comment><USER52> For some reason, his Foundation interview made me a fan. Cant call it. He just seemed in control

<http://www.youtube.com/watch?v=DQy_HFHOZug>

</comment><comment><USER53> I will never, ever work 16 hour days like this. That said, if I cofounded Twitter and Square (and thus had _that much_ of an effect on the world), I sure as hell would work a lot.

</comment><comment><USER54> Now that is what I call impressive and determined. This is how you get ahead and be successful, off course with a smart mind and the skills Jack has, it makes a difference!

</comment><comment><USER55> So, do one of these companies work at night, or what?

7am to 3pm = 8 hours 4pm to 12am = 8 hours

</comment><comment><USER56> Does this mean 8 hours per day is enough if you're CEO of a single company?

</comment><comment><USER57> How is that even possible given the number of times he speaks at events?

<comment><USER58> Speaking at events is part of his job.

</comment></comment><comment><USER59> which company do you think will produce a bigger return for him? or make him wealthier?

</comment><comment><USER16> This is not something to be idolized. Maybe it works for Jack, or maybe it's really exaggerated but there are going to be people reading this that are going to want to try it. I feel bad for those people. Your first instinct is to think that you can't succeed without killing yourself. Then you figure out that if you're killing yourself youve forgotten why you started to begin with.

<comment><USER60> That's exactly what I was thinking while reading this. The person who wrote this article just sees things at the surface, and lacks any insight/depth into the long term consequences. Jack Dorsey may be a freak, but for most people, working this long leads to mental breakdowns, and health problems. It makes for great journalism, but that's about all.

<comment><USER16> Agreed. I see a lot of articles that scare me lately. They make it sound like business owners should do these things. These stories are the exception, not the rule.

<comment><USER61> Building companies as successful as Twitter and Square are also the exception, not the rule.

<comment><USER62> He didn't _build_ Twitter working this way. He's now managing its current course/growth this way.

<comment><USER61> He's still _building_ Twitter and Square. Jobs never stopped building Apple.

Building companies goes well beyond building apps.

This comes up frequently on HN and seems to polarize people. The more it polarizes people the more on the fence I seem to find myself. I have worked similar hours split between two companies for four years. At times it sucks and at times it's great. Everyone is different.

From what I have learned from others, exceptional results require exceptional work and passion. Working 16 hours days is how it works for Jack. Ben Hogan was reported to work with a similar ethic when he started his golf career and he's now known among many as the greatest ball striker ever.

To me that's admirable, to others it isn't. Both positions are acceptable.

<comment><USER62> Of course it does, but _he_ isn't the only one doing it anymore, and I suspect has a team of people at each company that assists and supports throughout the day, which was likely not the case in the very early days of twitter.

The required mental focus and energy to get one thing "off the ground" - <USER2> bootstrapped startup phase - is considerably different from keeping something going - and even growing - once it's hit an operational level that twitter has. I won't profess to know both sides from direct experience, but can see that they're not in the same place they were operationally/financially as they were 4 years ago.

OT: I was probably downvoted by someone who considers Twitter and Facebook as "startups".

</comment></comment></comment></comment></comment></comment></comment><comment><USER63> That's impressive, but I can't understand how either of these companies are happy with that situation. It's like trying to argue a polygamist can be fully dedicated to both families.

<comment><USER64> How many hours would they expect him to put in normally?

<comment><USER65> I don't think it would be the hours as much as the mental focus. When I get done working for 8 hours, I'm usually with my family about an hour and a half before I can mentally break away from what I've been doing all day, and some nights my mind will always be on my tasks no matter how hard I try to refocus.

Imagine going from 1 high pressure 8 hours job to another with only a 2 block walk between them, maybe lunch. I don't know, it sounds like overload to me.

<comment><USER66> I find it is significantly easier to work two eight hour jobs than it is to work one sixteen hour job. The context switch is refreshing.

Unlike Dorsey, I have never attempted to maintain that schedule over the long haul, but over periods of time at least, it is not as difficult as it sounds.

</comment></comment></comment></comment><comment><USER67> He should maybe buy an island and retire, since both Twitter (less and less used and not used by anyone under 30) and Square (with NFC on the horizon) can basically only go down.</comment>


Every single part of this camera is 3D printed - <AUTHOR> https://techcrunch.com/2016/09/09/every-single-part-of-this-camera-is-3d-printed/ <comment><USER2> > The amazing part is the lens. First Dudley worked out exactly what optical > qualities he'd need, simulating the parts and distances involved in a ray > tracer. Then he actually printed it out using a high-quality transparent > resin and sanded it down with a custom machine. Then a dip in liquid resin > fills in the tiny valleys and flaws

So crafting things is 3D printing now?</comment>


The FastMail Security Mindset - <AUTHOR> https://blog.fastmail.com/2017/12/05/the-fastmail-security-mindset/ <comment><USER2> I was a very happy FastMail customer until a hacker asked them to reset my password. After _incorrectly_ answering a handful of questions asked by the FastMail support, the recovery email address was changed and a password reset link sent. From there, the hacker attempted password resets on other services.

Initially, FastMail was dismissive that this was a simple "mix-up" and didn't disable access to the hacker for 7.5 hours after my report.

To their credit, FastMail gave me a list of the email accessed and the message headers of the messages the hacker sent from my account (and then deleted -- unrecoverable).

Until and unless FastMail addresses the human factor of security, their technical security mindset is of secondary importance.

<comment><USER3> Now to write a more detailed response. If this winds up out of order later, I first posted: [https://news.ycombinator.com/item?id=15856609](https://news.ycombinator.com/item?id=15856609)

Again, ghouse, I'm really really sorry about what happened to your account. It was wrong and we screwed up. As other comments have already noted, it was during the transition to a new security system which was designed precisely to remove the human factor from decision making.

I'm an Australian, and I'm a great fan of our "100 points of ID" system, which is designed to remove the human factor from identifying people.

[https://en.wikipedia.org/wiki/100_point_check](https://en.wikipedia.org/wiki/100_point_check)

While I wasn't aware of your account's issue at the time (and we'll be having some discussions internally about why not!), FastMail management were all aware that we needed to get the human factor out of decision making about account access, particularly since somebody tried to pull a similar swindle on our domains!

[https://blog.fastmail.com/2014/04/10/when-two-factor- authent...](https://blog.fastmail.com/2014/04/10/when-two-factor- authentication-is-not-enough/)

We spent a lot of 2016 and 2017 working on an automated account recovery system which allows recovery of locked accounts via a carefully audited set of automated steps, which includes a 24 hour lockout to allow the owner to notice an attempt on their account.

If this had existed in 2016 then we would have sent you there rather than having a human make a (poor in this case) judgement call!

[https://www.fastmail.com/help/account/icantlogin.html](https://www.fastmail.com/help/account/icantlogin.html)

<comment><USER4> > a 24 hour lockout to allow the owner to notice an attempt on their account.

I've been pretty careful to ensure that I don't lock myself out of my account (multiple U2F keys, strong password saved in password manager with backups)

But if a determined attacker kicks this off just as I'm stepping on a flight from Sydney to London, 24 hours isn't going to be enough.

(I should add also - I'm a mostly happy Fastmail customer)

<comment><USER3> You can't even get to the 24 hour lockout unless you've successfully passed the security checks.

We add the 24 hour lockout as an additional level of protection for 2fa accounts (even though they've given two factors of recovery by then) or if we can't confirm that you are resetting from a computer which has successfully logged in to that account before.

<comment><USER5> It sounds like if I use Fastmail, and I go on vacation (and thus go a day without checking my email), someone can max out the automated system and then get a human being at Fastmail to potentially reset my recovery email. Is this the case?

<comment><USER3> You can't max out the automated system.

Our procedures have to balance the concerns of very different groups of people.

Some people have explicitly directed us to enforce stringent account security requirements by enabling multi factor authentication. For those people, we assume that they have their own security practices and are diligent in maintaining them. Those people are aware of the risk of losing access to their mail if they lose their credentials.

The other, much larger group of our customers, come to use because they want email that has support. Many of these customers forget their passwords and still need to get to their email (which is more common than you might imagine if you are surrounded by a hacker-news demographic!)

Our procedures have to balance between those two sets of needs, and they evolve over time. This incident came up in a period of transition. It should never had happened, and it's a great object lesson to us about how to do better in future transitions.

Having said that, based on this conversation today we are reviewing all our processes around re-establishing access for regular people who haven't requested additional security by enabling second factors. We absolutely can and will do better than we did in 2016.

</comment></comment></comment></comment></comment></comment><comment><USER6> I see the usual comment about Fastmail (comparison to Gmail, ProtonMail, web interface, spam filtering performance, servers in the US, ...) but still nothing about the TOS, which seems more important to me

So here it is again:

\- Fastmail can immediately cancel your account for any reason: "The Service Provider may terminate your access to any part or all of the Service and any related service(s) at any time, with or without cause, with or without notice, effective immediately, for any reason whatsoever, with or without providing any refund of any payments."

\- Fastmail can disclose your info/data if it thinks it's in the interest of the company: "The Service Provider will not monitor, edit, or disclose any personal information about you [...] unless required or allowed by law, or where the Service Provider has a good faith belief that such action is necessary to: [...] (2) protect and defend the rights or property of the Service Provider; [...] (4) act to protect the interests of its members or others [...]

By comparison, mailbox.org TOS are much better.

Also mailbox.org offers GPG encryption, which Fastmail doesn't (AFAIK).

<comment><USER7> > \- Fastmail can immediately cancel your account for any reason: "The Service > Provider may terminate your access to any part or all of the Service and any > related service(s) at any time, with or without cause, with or without > notice, effective immediately, for any reason whatsoever, with or without > providing any refund of any payments."

Other than the last clause about "without providing any refund", I would _expect_ this from any service provider, and I'd certainly never want to run a service that _didn 't_ have this in its terms.

I do agree that the disclosure terms are more permissive than they should be.

<comment><USER6> >> \- Fastmail can immediately cancel your account for any reason: "The Service Provider may terminate your access to any part or all of the Service and any related service(s) at any time, with or without cause, with or without notice, effective immediately, for any reason whatsoever, with or without providing any refund of any payments."

> Other than the last clause about "without providing any refund", I would > expect this from any service provider, and I'd certainly never want to run a > service that didn't have this in its terms.

You expect from any service that they can cancel your account for any reason ?!? We must not have the same set of requirements. Anyway the point is not relevant anymore as they have changed the TOS (it's much better now).

<comment><USER7> > You expect from any service that they can cancel your account for any reason

Yes, absolutely. "We reserve the right to refuse service to anyone." I expect to be able to do that for any service _I_ run, and I expect others to be able to do the same.

I _also_ expect that doing so lightly, without a very well-justified reason, would get reported on and lead to a massive backlash. So, in practice, I expect such a clause to be used as, effectively, 'if you try to find a "creative" way to weasel your way out of our specific terms like "don't be disruptive, don't spam, etc", such that your activity meets the letter of the ToS but not the spirit, we'll kick you off anyway". Personally, if I were writing a ToS, I'd write the relevant term along those lines instead.

</comment></comment></comment></comment><comment><USER8> Wow what a coincidence — I switched from Gmail to Fastmail exactly 1 year ago today.

I couldn't be happier. I mostly use native clients, but the Web client is a joy to use, and everything I've observed about Fastmail gives me confidence in their service.

I never used the Gmail-exclusive features like labels, so switching was pretty easy. I highly recommend it to anyone considering it.

Keep up the good work, guys.

<comment><USER9> I'm considering switching (in fact I just registered for the FastMail trial). I'm especially interested in the ability to use catchall addresses with a custom domain, which would allow me to give out an address like <firstname.lastname@example.com>, and thus determine who shared my email address if I start receiving spam at that address.

This is partly possible with Gmail, as you can use addresses like <email@example.com>, but not all sites support emails with a + in them.

What differences have you noticed in your year since switching? I'm especially interested in any downsides. My biggest worry about Gmail is the lack of privacy from Google.

<comment><USER10> > which would allow me to give out an address like <email@example.com>, > and thus determine who shared my email address if I start receiving spam at > that address.

I've been doing this for over 15 years, but with a much simpler setup: I just forward it to another account, which for the last 10-ish years has been an @gmail address. The mails show up in my Gmail inbox as From: the original sender and To: the custom domain.

As a caution: don't forward a top-level domain. You'll get all kinds of dictionary-style spam attacks and it becomes flooded with noise. Instead, use a sub-domain, so you get for example <*@something.mydomain.tld>.

<comment><USER11> The problem with this is SPF reject domains. Which means your legitimately forwarded email will simply disappear into the void. Hosting your domain at something like fastmail will not have this problem.

<comment><USER10> Hmm... I suppose, but I've never not received anything I was expecting. It's possible I've just not run into anything with SPF reject rules, or that Gmail is allowing them anyway.

I don't disagree it's better if fastmail (or whatever) can receive directly as it saves another MX server in the middle, but it's still doable without the end provider explicitly supporting it.

<comment><USER12> I have the same experience. I'm using a mail-forwarding service, so I can't host it with FastMail. FastMail is my third mail provider I'm forwarding to, and I'm not aware of any missed e-mail with any of them this far. Then again I guess I wouldn't be :)

</comment></comment></comment></comment></comment></comment><comment><USER13> > Just as important as what we do do is what we don't. For example, we don't > do full message encryption (e.g. PGP) in the browser. In theory it means you > "don't have to trust us". However in reality, every time you open your email > you would be trusting the code delivered to your browser. If the server were > compromised, it could easily be made to return code that intercepted and > sent back your password next time you logged in; it could even just do this > for specific users. It is very unlikely that a user would notice.

I don't agree.

I don't want full message encryption because I'm afraid that my email provider is reading my messages, but because I'm storing years worth of emails in my mailbox. With a provider such as ProtonMail that encrypts incoming messages with my personal key I know that if someone manages to get unauthorized access to my mailbox that person would only be able to read new emails, but none of my already archived mails. Of course it's possible that the intruder also manages to change the JS code returned to the client, but that's not the case for all of the possible scenarios where someone gets access to my mailbox. Full message encryption does not provide perfect security, but is able to significantly raise the provided level of security.

<comment><USER14> For most providers, like Protonmail, the decryption password is the same as your login password. I'm curious what scenario you see allowing someone other than the provider to get access to your mailbox but not also your decryption key.

<comment><USER15> The decryption password is _not_ the same as the login password for ProtonMail. Logging in at minimum requires entering your username, your login password, and your mailbox password.

The result is security at rest, which fastmail does not have. ProtonMail's web app is open-source, and can be deployed locally if you wish to remove the chance of an evil app deployment.

If you use the official deployment, an evil update can obtain your mailbox password, in which case the the adversary (that is, the one capable of pushing the update) observe a security level equivalent to if security at rest was not implemented. However, even in this case, the data on the mail-servers is still protected from _everyone else_ , so while a single adversary has observed a security level identical to that of fastmail (i.e. no security at rest), everyone else still observes a secured mailbox.

Not having security at rest is, in my opinion, dangerous.

<comment><USER16> That's wrong. You no longer need a third password in protonmail. All you need to have, in order to login, is the username and a password. If you've 2FA enabled, you need the 2FA code of-course.

<comment><USER15> I think you mean second password rather than third, but as a user of ProtonMail, I need one username, two passwords and one 2FA token to get in, with only login username/password being kept in a password manager (and all password managers get confused by multiple passwords, so I couldn't keep them all even if I changed my mind and wanted to).

ProtonMail may have the option (I am not aware of this) to have login password and mailbox password set the same (and not prompt you twice if this is the case), but they are still separate passwords. You, as user, control whether you want them to be the same or not. If you chose this, the application then has an option for convenience to use the same input for both tasks. This is opposed to a service where they are always the same, so that the password send to the backend is the same used to decrypt your data.

</comment></comment></comment></comment></comment><comment><USER17> Any lawyers care to comment on this claim of theirs?

 _It has been pointed out to us that since we have our servers in the US, we are under US jurisdiction. We do not believe this to be the case._

[https://blog.fastmail.com/2013/10/07/fastmails-servers- are-i...](https://blog.fastmail.com/2013/10/07/fastmails-servers-are-in-the- us-what-this-means-for-you/)

As a non-lawyer I would expect the US to be able to serve their host with a warrant to get whatever data the judge said they could have.

<comment><USER18> You are correct but from lawyer perspective (IANAL btw) it is important they use the word "believe". As I was explained by a friend who is attorney, if you never had experience with certain law, like in this case perhaps never been subpoena for records by US, then you have a right to say you "believe" something is not the case. This is still not deceiving statement. But the moment you have been proven wrong by US Gov for example, your claim would have to be removed.

on FastMail alone I did not like how slow it is. I was testing them and Protonmail at the same time and was very impress how simple it is to setup my multiple domains/users on Proton and how fast encryption/decryption works. And Protonmail "[...] is outside of US and EU jurisdiction, only a court order from the Cantonal Court of Geneva or the Swiss Federal Supreme Court can compel us to release the extremely limited user information we have.[...] [1]

[https://protonmail.com/security-details](https://protonmail.com/security- details)

Full disclosure: I don't work for Proton; I'm just their happy mailer :)

EDIT: Slow I mean their GUI comparing to Proton. It might be more the number of extensions I have to block or limit different shenanigans such as AdBlock etc.. but needless to say, Proton does not have that problem.

<comment><USER19> What do you mean, how slow it is? I've been using FastMail for a few years now and it's always struck me as being very fast.

<comment><USER20> name checks out.

</comment></comment></comment></comment><comment><USER21> This is an entry in FastMail's series of Advent Calendar blog posts that they do every year. I'm glad to see them continue the tradition this year, and it's valuable to get this level of insight into a company that I trust with my mail. If you're interested in seeing more, check this year's first Advent Calendar post which has links to their calendars from 2014, 2015, and 2016, which are all worth reading if you're a FastMail customer or just interested in how running a mail hosting company works: [https://blog.fastmail.com/2017/12/01/fastmail- advent-2017/](https://blog.fastmail.com/2017/12/01/fastmail-advent-2017/)

</comment><comment><USER22> I've had to dump Fastmail. I was getting 10-15 very (sexually) explicit spam emails daily slipping through the filter daily even after 100's of training emails being identified. Queue weird looks at work if I left my mail client visible.

Moving back to G Suite was painful. I had to manually do it after the G Suite 'Migration' tool missed 1000's of messages. But so happy to have decent search back!

</comment><comment><USER23> I use FastMail and love it, but I've noticed that if I use SMTP, it leaks my IP address in the email headers, whereas using the web client does not.

<comment><USER24> That's how RFC2822 defines the email headers. That's not a leak, that's just how email works. When you send from the web app it uses that client as the originator.

<comment><USER25> This would be one of the cases the same text talks about "when users misunderstand the security characteristics". The journalist example can be used, but instead of checking an image sending a reply to the e-mail.

I'm unsure how many journalists know that their replies using an e-mail client will send their ip address, neither if they can understand why there is a difference between the mail client and their web interface.

I only know one organisation using fastmail services today, and I asked if they knew about this today, which of course they didn't. There surely are reasons to not break the RFC as gmail and others did, but the expectations from users need to be addressed somehow

</comment></comment></comment><comment> mike-cardwell They should do PGP on the way in, for people who want it. It's trivial to set up. All they need to do is let people paste in a public PGP key and encrypt all incoming email with that key. Here's how I've been doing it for the last 7 years:

[https://www.grepular.com/Automatically_Encrypting_all_Incomi...](https://www.grepular.com/Automatically_Encrypting_all_Incoming_Email)

<comment><USER26> If it would be "trivial to set up" don't you think they would've already done it and offer it as an option?

<comment> mike-cardwell Well, it is "trivial to set up" as per my link, and they don't offer it as an option, so apparently not.

Perhaps they don't think enough people use PGP to make this a worthwhile option to add. But given the service they are offering, it seems like an obvious feature and quick win to me.

<comment><USER26> "trivial to set up" on your own mail server with you as the only user is slightly easier than rolling it out to thousands of customers, testing it, make sure backups are all working, write documentation for users, collect public keys of users, ...

You can't just add a single line with your perl script to production and hope it works for everyone...

<comment> mike-cardwell If you are already providing complicated features to N customers, then adding one simple feature for those N customers is trivial.

If that isn't true, then all features are non-trivial to add and you've built your systems and processes badly.

</comment></comment></comment></comment></comment><comment><USER27> Another data point: I have had a FastMail account before Gmail before Opera and Kaggle. Why pay for email? when everything was free ...Yahoo, hotmail, etc. Word of mouth. Reputation. Though times were less sophisticated back then along with security; Fastmail kept up. I used my YubiKey with them way before gmail u2f fido support and they fostered my trust over the years keeping it clean and simple. Nothing is foolproof but at least I know their track record and commitments to their users despite dropping the ball in some cases. That said, I'm glad to read about the horror stories, provider alternatives and fastmail responses; hopefully we are all the better for it.

</comment><comment><USER28> I don't know if any Fastmail employees read over this, but thanks for finally adding TOTP to the list of 2FA methods! I had been (uneasily) using SMS and wishing you guys would up your game, and I'm glad to see that you did.

</comment><comment><USER29> I only see FastMail and ProtonMail mentioned on Hacker News, never in real life.

To those who made the switch away from free,conventional mail services like Gmail and Outlook, what was the appeal ? What's your case for making the switch ?

<comment><USER30> I use ProtonMail for the simple reason that there is less of a chance they are selling my data and building up a user profile of me for advertisers to target.

<comment><USER31> I use FastMail for exactly that reason.

And, secondarily, because I set up a GMail account for both of my kids when they were born, and I would occasionally email things to those accounts that I wanted them to have a record of. Nothing earth-shattering, just stuff I thought they might like to read when they were older. Then, one day without warning, Google shut my daughter's account down, for being under-age. I had no ability to retrieve all of those emails, and there was literally no one I could contact. Google has NO customer support, because you aren't the customer. So I decided I would be willing to pay $30 a year just to know that I could get an actual person on the phone.

</comment></comment></comment><comment><USER32> FastMail is tempting. I'm currently moving over to hosting my own E-mail, since Gmail is failing to deliver a significant number of important inbound E-mails to my account, rejecting them as spam (and fails to deliver almost all of my wife's E-mail). I could be convinced to pay for E-mail, but I'm concerned with customer support and the "black box" nature of online services. For something as important as E-mail, I grudgingly feel I finally need to bite the bullet and do it myself.

</comment><comment><USER33> The simple reason I haven't switched email providers: all my online accounts, as well as many offline ones, are tied to my gmail account.

Yes, I can set up forwarding, but that defeats the purpose of switching providers IMO (for me, the purpose would be to move away from Google _completely_ ). I don't want Google to read any of my emails period, so forwarding is not a sufficient solution.

<comment><USER12> I think the only way is to start switching gradually. If you don't want Google to read your email, keeping it as the main accounts isn't really going to help.

If you do change, get a forwarding service or your own domain so that the same mistake doesn't happen again.

</comment></comment><comment><USER34> Love Fastmail - been a happy customer for several years now. Also look forward to the Advent blog posts every year.

</comment><comment><USER35> IMHO, for the best strategy is to roll your own mail. It is pretty trivial.</comment>


Clever (YC S12) Lands $3M, Now In 2000 Schools - <AUTHOR> http://techcrunch.com/2012/10/22/clever-seed/ <comment><USER2> For anyone who has been following the furor over Twitter's moves to control it's network and infrastructure at the expense of the developers who gave it value (and it's logo!), Clever and LearnSprout should be concerning.

The idea is that School's can integrate their SIS system with Clever's network once, and then have "seamless" integrations with whatever tools operate on that network. This is "free of charge" to the schools.

However, the apps/tools that integrate with Clever must pay them.

It should be noted that Clever's data and API aren't based on any existing or proposed industry standard.

Schools are baited with the idea of a "free" integration. They'll end up paying for it in the long run, though, because those costs will be passed on for every application they use.

What's worse, they'll all be locked into this proprietary standard.

On the surface, this all sounds like a "Great Idea". At the end of the day, it's an attempt at a land grab to try and control the market for student data. Is that even a market that should exist in the first place? Are schools making the right long-term choice when they integrate with a tool such as Clever and LearnSprout, it if means being locked into a proprietary standard down the road?

This sounds exactly like what has happened with the "centralized network" problem we have with Twitter, FB, etc.--and it is.

Yes, the existing toolset in K12 is abysmal. Schools and their vendors should be looking to implement standards such as those offered by IMS in Higher Ed, rather than just adding another proprietary mouth in the trough--especially one that doesn't offer any actual learning tools.

If Clever and LearnSprout issued their data formats under an open license through a standards body, I'd be way more interested. That said, I'm glad to see any kind of shake-up in the Ed space.

<comment><USER3> You make a good point numbsafari, though I disagree with your suggestion that schools will end up paying in the long run. Fundamentally, this is true, but I would add that schools will be paying much less than what they are paying now. Integration with 3rd party apps is time consuming and expensive. If a "once and done" option is available, schools will benefit.

The cost savings for developers is also very real. Instead of having to hire full-time integrators to manage each account with variants for each SIS, developers can plug into an API that works with all SISs once and be done.

Finally, we should remember that having access to an API that is not regulated by SIS companies allows for the development of a new generation of edtech that until now, was not possible due to the fact that much of the data is purposely locked away in the SIS. Would Pearson really want parents using something like Edmodo in lieu of their own portal? In the attention economy, it's not in Pearson's interest to enable these types of solutions.

<comment><USER2> Then why not publish your API specs and data formats under an open copyright license?

You don't necessarily have to submit them to a standards body like ECMA or IMS. You can just publish them under an open license that is free to use by everyone involved.

You'd still be able to provide your service and charge for it accordingly.

Pearson already offers an open-standards based integration solutions. Yes, it's convoluted and difficult to implement. But it's out there and it's used by almost all of the real SIS providers. The idea that FTP and CSV are the only options available to schools is false. See <http://sifinfo.org> for an example.

All you are doing is changing which fox is in the hen house. It's a good game, business-wise, but is it really the right move for the K-12 providers and their customers?

<comment><USER4> Typical cost of a SIF integration is well out of the budget for all but the largest districts in the country. From what we've seen it typically takes 6+ months to do a full implementation (faster if you hire some consultants). Clever is free and takes 5 minutes. From that perspective it makes a lot of sense for schools.

From the perspective of a software company, something like SIF adds needless additional costs. Want to plug into SIF? Get certified: <http://www.sifinfo.org/us/sif-certification.asp>. API docs? Support? Good luck finding that.

The reality is that most of the standards you're talking about are free money for high-priced consultants.

<comment><USER2> Well, obviously... otherwise there wouldn't be a place in the market for the solution you are providing.

Many of the SIS providers have failed to make these solutions easy to implement and they've allowed these standards to become overly complex. I've kinda said that in each of my posts.

But that's besides the point. I'm not arguing that Clever and LearnSprout aren't adding some kind of value. Of course they are.

But they are merely letting schools trade out one piece of vendor lock-in for another. And as we see play out in this industry, over and over again, is that vendor-lockin comes back to bite everyone involved.

So, instead of changing the conversation, why not address my question: why not offer the specs for your API and data formats under a free and open copyright regime? Let the market decide what format is best and what providers are best, but let the data be free and open.

With that, you'd even be beating SIF at their own game.

</comment></comment></comment></comment></comment><comment><AUTHOR> Worth mentioning that Clever is now making a few key engineering hires.. if improving education through data sounds exciting, shoot me a note and say hello! Or check out <https://getclever.com/about/jobs>

<comment><USER5> Since you are here, I have been following Clever and think it is a great idea. The only thing missing from the docs, is how do I get access to a school's data? In my use case, I would need to get class roster data for 1-10 teachers that use my product in their school. I communicate directly with the teachers, and from the docs, I have no idea how these teacher communicate with Clever to make this happen.

<comment><USER6> To access actual school data, you'll need an API key. Send us an email (firstname.lastname@example.com) and we'll set you up & show you how a school can opt to share data with your app.

</comment></comment></comment><comment><USER7> It's probably not important to them, as I'm not their target audience but I looked at their home page and their about page and that techcrunch article and still have no idea what they do.

<comment><USER8> Sounds to me like they provide an API for "5-minute SIS Integration for Educational Applications" (from their home page) and that an SIS is an "information system [that] capture[s] and store[s] data on students — from class lists and attendance to grades" (from the TC article).

<comment><USER9> One of the major pains in the butt for a teacher is getting students set up on a learning web app. Either you spend a bunch of your own time making an account for each student (which is time you could spend doing something more important) or you spend a bunch of class time having students sign up for the accounts during your teaching period (which is time you and they could spend doing something more important).

If a web app had a secure API to include all of my class lists automatically, I'd be much more likely to use it.

<comment><USER10> The killer app for SIS is "support for 200-row CSV upload" ?!

</comment></comment></comment></comment><comment><USER11> I'd like to take a moment to point out how fantastically awesome Clever's API documentation[1] is.

Everyone with an API take note: examples in your favorite language of each API request with a demo API key already set up is how you get developers playing with your API. There was almost zero barrier to entry for me to get data from their API into a language I knew how to manipulate JSON objects with and muck around to my heart's content.

Note to Clever: perhaps go all the way to converting the response body to a JSON object in each language?

Edit: also, the "show/hide, collapse, expand" buttons are confusing. You only need two buttons that change their action depending on the current state ("collapse" becomes "expand" if the content is collapsed), and "show/hide" should be up by the `h2`s.

1\. <https://getclever.com/developers/docs>

</comment><comment><USER12> I've played around with some of those proprietary (Pearson) school formats before, and they suck.

This is a world of change for school software development.

<comment><USER13> So many of my teacher friends have showed me the high-priced software that often causes them problems, and I've been frustrated by how many entrenched vendors there are who are slow to innovate in this industry. All the best to Clever in their endeavors!

</comment></comment><comment><USER14> Wait a minute, is this taking private information about minors and, without guardian consent, using a proprietary API to give the information to private industry for-profit corporations?

<comment><AUTHOR> Co-founder of Clever here. Clever is a more efficient and secure way for schools to connect their learning applications with their SIS database. No data is shared otherwise. Clever helps schools stay compliant with FERPA, the federal laws on student privacy.

<comment><USER15> I'm working on an education startup. Where can I find a good comparison between you and LearnSprout?

<comment><USER16> Hey Jeff_29, I work on partnerships at LearnSprout and the best way to get a good look is to just contact both companies. You can reach me at email@example.com.

</comment></comment></comment></comment><comment><USER17> I wonder how some of the aspects of this works around FERPA (e.g. giving developers access to data)

<comment><USER6> Clever helps schools stay FERPA compliant. Our tech gives them fine-grained control over what data they share & where it goes. And all of the data sharing happens in a secure way (vs. the "email an Excel file" status quo).

</comment></comment><comment><USER18> I'm not able to gather a business model for this - who are their customers, how do they get paid?

<comment><USER19> From the article: "its customers are online learning companies that want to integrate software with the wealth of data found in Student Information Systems". The app is free for the schools themselves.

</comment></comment><comment><USER20> Interesting approach. Not sure how you get over $10mm, as there are only so many LMS companies.

They must have a pretty good vision to attract the capital</comment>


Understanding glibc malloc - <AUTHOR> https://sploitfun.wordpress.com/2015/02/10/understanding-glibc-malloc/

<comment><USER2> Doug Lea's dlmalloc implementation is the basis for GCC's ptmalloc, IIRC. His writeup on the topic is a wonderful read; and for the code itself, it is beautifully organised and well commented.

[http://g.oswego.edu/dl/html/malloc.html](http://g.oswego.edu/dl/html/malloc.html)

</comment><comment><USER3> jemalloc is also pretty well-documented, though it's relatively big for a malloc implementation.

BSDcan paper: [http://people.freebsd.org/~jasone/jemalloc/bsdcan2006/jemall...](http://people.freebsd.org/~jasone/jemalloc/bsdcan2006/jemalloc.pdf;) Facebook Engineering post: [https://www.facebook.com/notes/facebook- engineering/scalable...](https://www.facebook.com/notes/facebook- engineering/scalable-memory-allocation-using-jemalloc/480222803919).

The NetBSD version, though probably not the most up to date, is the easiest to understand, being in a single file: [http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/jema...](http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/stdlib/jemalloc.c?rev=1.37&content- type=text/x-cvsweb-markup&only_with_tag=MAIN).

<comment><USER4> The NetBSD is also a great starting point for people who want to port to weird architectures. It's simple and a little old fashioned, but it's in the sweet spot for most bootstrappable C compilers for memory-constrained devices. This or dmalloc are usually the easiest to get up and running on a device where you can't or don't want to trust the system libraries.</comment></comment>


How to Learn: More Humility, Less Video - <AUTHOR> http://thejoeconwayblog.wordpress.com/2012/06/22/advice-on-learning/

<comment><USER2> Nice article. The steps are basically how I approach learning a new language, and I imagine it's the same for most people -that is, if they are serious about making the language one of their 'languages of choice'.

And, while I agree video is terrible for learning a language, it can be excellent for abstract CS concepts. For example, an expert explaining the design and analysis of algorithms.

</comment><comment><USER3> I can't tell you how much IRC has helped me over the years. The communities there can be so extremely helpful and motivating. Sometimes when learning something new, it's hard to know where you're getting stuck and having a community to chat with in real time makes such a huge difference.

</comment><comment><USER4> Does anyone have suggestions for a "guide book" to learn Python? Specifically - best practices, design patterns, rationale for implementations, preferred data structures, even the history of the platform.

<comment><USER5> I recognize the irony of this, given the 'Less Video' portion of the parent article[1]. But my first introduction to using Python in a truly 'Pythonic' way was Peter Norvig's free CS212 class on Udacity. (It will be starting up again June 25th).

Until then, I had just been translating my old habits into Python.

[1] Also, I'm a huge fan of learning languages from 'guide books,' as recommended by the parent article.

<comment><USER6> That was an amazing course and my first experience when video lectures didn't suck. I learned Python without even trying, as a by-product of solving interesting problems.</comment></comment></comment>


Daily Habits of a Successful Remote Manager - <AUTHOR> https://workremote.us/daily-habits-of-a-successful-remote-manager/ <comment><AUTHOR> Any remote managers here? Looking fwd to learning from your daily rituals.</comment>


Most Police Don't Live In The Cities They Serve - <AUTHOR> http://fivethirtyeight.com/datalab/most-police-dont-live-in-the-cities-they-serve/ <comment><USER2> Apart from the racial mismatch in some places does this really mean anything other than suburbs are more attractive for some people and/or some people can't afford to live near their work?

<comment><USER3> A good question. City of Denver had police residency requirements until 10 (?) years ago, as I understand it, mainly because of some 70s-Brown-Power type of pious hope that if the police lived where they policed, there'd be a lot less bad relations and bad enforcement.

I think that police not living where they work is import in a Chomskyite way. From the Logic of Suveillance ([http://www.ianwelsh.net/the-logic-of- surveillance/](http://www.ianwelsh.net/the-logic-of-surveillance/)):

 _This is one of the biggest problems the current elites face: they want the smallest enforcer class possible, so as to spend surplus on other things. The enforcer class is also insular, primarily concerned with itself (see Dorner) and is paid in large part by practical immunity to many laws and a license to abuse ordinary people._

The ability to live in a separate community will only promote that insularity.</comment></comment>


Mighty Rio Grande Now a Trickle Under Siege - <AUTHOR> http://www.nytimes.com/2015/04/13/us/mighty-rio-grande-now-a-trickle-under-siege.html <comment><USER2> Last I was at the Rio Grande, I was surprised that there were many spots where you could simply walk across without really getting your ankles fully wet.

I wonder what the compounding negative effects of these actions will be. With reservoirs and rivers drying up from over-pumping and drought, non- regenerative aquifers are also being depleted being pumped along with the regenerative ones, which only drys and permits greater thermal load of the ground without a method for heat dissipation, which causes even greater net loss evaporation and also prevents cloud formation and rain. It's really kind of a positive feedback loop with a bad outcome.

<comment><USER3> That describes pretty much the entire American Southwest. The Mohave was a grasslands when Columbus arrived.

<comment><USER4> Source for this? I did some quick digging and this seems to indicate that the Mojave desert has been a desert for several thousand years.

[http://pubs.usgs.gov/of/2004/1007/geologic.html](http://pubs.usgs.gov/of/2004/1007/geologic.html)

<comment><USER5> I couldn't find any source for the OP's statement either.

Really wish people would back up their statements with a quick reference when it's proposed as a fact and not an opinion.

<comment><USER3> [http://www.ecoseeds.com/mojave.html](http://www.ecoseeds.com/mojave.html)

</comment></comment></comment></comment></comment><comment><USER6> This scares me a lot, especially living in Colorado. I hate to be one of those "No Vacancy" people, but our aquifers simply can't support any more people here. It seems crazy when you start diverting water from the other side of the continental divide just to keep Denver growing. Same goes for California; just because you want to live there doesn't mean you should, just because you want to farm there doesn't mean it makes any sense and isn't incredibly destructive. The land was never capable of supporting what they're doing out there long term, and when you start diverting water from else where, you need to sit and ask yourself, "am I doing something really stupid?"

For the amount of water and other resources we have in the West, I wonder sometimes if there just are way too many people living out here in general.

</comment><comment><USER7> Wouldn't the cheapest way to move water about just be a big pipe from somewhere with water to spare?

<comment><USER8> This comes up every time there is a drought in the south of the UK compared to the north. It really is hard to mentally comprehend the colossal amounts of water that a river is moving.

<comment><USER9> Just make the pipe colossal. Or multiple smaller pipes that distribute the load. Throw a node.js server behind it and you'll get scale! Don't forget to use Mongo also.

<comment><USER10> That could just work! You could probably serve every tap in the North of England. As long as only one person wants turns their tap on at once.</comment></comment></comment></comment>


Building Firefox's Picture-in-Picture Support - <AUTHOR> https://hacks.mozilla.org/2020/01/how-we-built-picture-in-picture-in-firefox-desktop/ <comment><USER2> At first I didn't even realize this was FF feature (I suspected something like gstreamer, but was lazy to investigate). Now that I know it is indeed FF, I just cannot wrap my head around it...

1) I can pause the video, but cannot navigate it. I guess the navigation would be there if it was technically possible, but from practical standpoint this makes it useless even if it appealed to me in other ways. Popping a video into PiP mode and then go diving for the original tab to seek 10 seconds back to rewatch an interesting moment seems utterly bizarre.

2) I've grown to truly hate this kind-of-PiP thing many websites (news outlets mostly) do: Autoplay a video and then shove it to lower right corner when I try to scroll away. Along with timed "subscribe to newsletter" popup, this is an insta-close for me; Now why would I want to replicate this behavior elsewhere?

3) I'm literally unable to read through even the first words of that blogpost because of that gif. Now, thanks to this PiP feature, I can make any text unreadable by placing a distracting video on my screen.

While I'd welcome features that fight distraction (and not support attention fragmentation), there obviously is (significant part of?) FF userbase that will make use of this feature. Good for them.

Luckily for us grumpy farts, that blue PiP button can be turned off in preferences, we can mutter something about bloat, but generally go on with our lives.

<comment><USER3> I use this all the time to watch Netflix while programming: put Netflix in PiP mode, then put the resulting window in the corner and switch to other applications to work.

<comment><USER4> It blows my mind that you can watch Netflix and program at the same time.

<comment><USER5> Sometimes coding is just mindless typing some boiler plate. It's easy to pay attention to something else. I see it like listening to podcast or something while mindlessly grinding in a game.

</comment></comment></comment></comment><comment><USER6> I have to say I love this feature and have so since the first time I encountered it in my Firefox Nightly installation a few months ago (on Windows).

Glad to also have it available on Linux and Mac now. It's perfect for on-the- side Youtube videos.

<comment><USER7> Yeah, I've been using the picture-in-picture feature regularly since I learned about it recently. Love it for running lectures and presentations on the side.

</comment></comment><comment><USER8> People using tiling window managers like i3 or sway should get friendly with this feature. It allows me to "full window" (note: not screen) netflix/amazon/YouTube videos in a tile which was impossible to do without PIP.

<comment><USER9> Either awesome or i3 used to allow me to fullscreen a video, then pop that fullscreen video out into it's own floating window, that I could then stick on top of all other windows, and make it stay on every workspace. Really cool way to get a hacky picture in picture mode way before firefox did this.

<comment><USER10> VLC has a feature called "float on top". Together with resizing, it allows basically something akin to picture in picture mode. You can use VLC to play YouTube videos by downloading them with youtube-dl. That is what I used before Firefox PiP mode was available in stable.

<comment><USER11> VLC can play YouTube directly―at least if YouTube didn't change the format again. Just 'open' the URL as a network source.

<comment><USER12> They changed the playlist format. It has been failing again.

</comment></comment></comment></comment></comment><comment><USER13> On mac os its mostly unusable, because this PIP window stays on same workspace. My browser is always fullscreen and in safari I can open small youtube window and move to other workspace (code, for example) and window still exists on each of them.

<comment><USER14> This would be one advantage of the system's built-in PiP mode employed by Safari. I don't find the limitations (maximum size, single video) to be hinderances.

<comment><USER15> Can't you trigger that in Firefox also by right clicking on a video (or twice on YouTube) and then choosing PiP?

<comment><USER16> Problem is Firefox PiP don't move other desktops on macOS. It is only available at where your window is.

</comment></comment></comment></comment><comment><USER17> > To work around these problems, we rely on the fact that the web page is > being sent events from the browser engine. At Firefox, we control the > browser engine! Before sending out a mouse event, we can check to see what > sort of DOM nodes are directly underneath the cursor.

This triggered some mental alarm bells when I read it.

I understand what Mozilla is trying to accomplish, but this feels like it could become a serious WTF moment for a developer. "There is absolutely no way in hell this element should be able to receive mouse events right now, what is Firefox doing?"

Is this a problem? Perhaps the web is so far down the hacks/exceptions route that adding one more legitimately won't make a difference?

<comment><USER18> I don't think they are talking about mouse events the website can observe. Firefox needs to figure out where the video is and make it's UI on top of that work, there is no observable interaction with the site DOM or its event handlers.

<comment><USER19> The post says that the video element is told it's being hovered, although it is unclear if that means the rendering context has that element set to hover (thus CSS changes even if pointer events is set to none), or that some internal-to-the-browser state is set to hover for the video.

</comment></comment></comment><comment><USER20> Picture in Picture is great for lectures or follow-along tutorials and I'm glad people are taking it more seriously (initially was using Youtube on Safari purely because of this feature, but later on Chrome had it... albeit a bit wonky, I started using it on Chrome normally).

<comment><USER21> I would love to have an external controller for start/stop/fast forward/rewind when watching tutorials on Youtube. For example a controller [1] people are using to edit videos. Quite often I would like to pause the video for a while, repeat last 30 sec or by-pass some boring segment.

[1] [https://www.amazon.com/Contour-Design-Shuttle-Xpress- Multime...](https://www.amazon.com/Contour-Design-Shuttle-Xpress-Multimedia- Controller/dp/B0001DBEKG)

<comment><USER22> That is an awesome idea. Would be extremely useful for guitar and transcription too, while writing the text in Word.

It typically would be a usecase for the Macbook touch bar, does anyone has one and can tell us whether it has an integration with web videoplayers?

<comment><USER23> Videos and audio in Safari use the touchbar as a scrubber with controls.

</comment></comment></comment></comment><comment><USER24> Everything old is new again it seems. Anyone used Maxthon Browser before? It was multiengine browser, which used both Webkit and Trident under the hood. It has that feature for ages, just for flash content back than.

If only someone would built good email client into Browser like old Opera, that would be godsend. Opera and Maxthon were ages ahead in terms of certain features.

It is little weird for me, they ended up putting video within shadow DOM container.

<comment><USER25> Wow that's a blast from the past! I also used... damn I can't remember. It used Gecko as its engine, implemented mouse gestures for navigation among other nice features Firefox didn't have at the time.

</comment></comment><comment><USER26> With (some) television sets in mind that popularized (for, um, me at least) the picture-in-picture term as one channel of video on top of another channel of video, it feels weird that the term is here used when only a minimum of 1 videos is involved...

<comment><USER11> You're witnessing etymology in work:

\- the mechanism is about the same: the video stays in the corner

\- the term 'picture in picture' is already familiar to people, from TVs

...so the term is generalized. Happens a lot. If the feature gets popular and the term sticks around, decades later people might search the web for 'why is it called PiP when it's not what it does'. We can even imagine that zero videos may be involved by then (though unlikely―there are other terms for that.)

</comment></comment><comment><USER27> Main problem I have is captions from Netflix don't work which is important for me. Would have been nicer if we could have popped out a div instead.

</comment><comment><USER28> To be perfectly honest, I didn't realize this was a Firefox feature. I thought it was just a new part of YouTube.

<comment><USER29> YouTube also recently added a similar feature that's more limited

<comment><USER28> I was aware of that, since it isn't very intuitive within the UI I figured that Youtube was attempting to push it a bit more aggressively.

</comment></comment></comment><comment><USER30> This is honestly one of my favorite features in firefox.

<comment><USER31> fwiw you can get this feature as an extension in Chrome and Safari.

for example, this is published by google: [https://chrome.google.com/webstore/detail/picture-in- picture...](https://chrome.google.com/webstore/detail/picture-in-picture- extens/hkgfoiooedgoejojocmhlaklaeopbecg?hl=en)

</comment></comment><comment><USER32> I've been waiting for this feature for years, and in my eyes, this seals Firefox as the number one browser out there. Previously to that, I was using Opera exclusively for this feature.

</comment><comment><USER33> I wonder if an attacker could leverage this to play twenty-questions with a user.

Video is typically so-and-so dimensions in the bottom right-hand corner. Clicking the video (I assume) pauses it. Pausing a video (I assume) can change the request pattern for what is being streamed. Most sites use a white background (let's say).

So an attacker who controls video content can stream a still image of some site or browser security "statement" with a picture of a button to click if the statement is untrue. If the user clicks the fake button they stop the video and signal to the attacker their response to the statement.

Not super useful given an arbitrary page behind the video. But what if the video's content is about, say, how to change settings on your bank site to get a better APR? I can imagine someone assuming that the video has turned into a small "quiz" from the bank. Maybe even a "click here to proceed" button to get them to unpause the video.

<comment><USER34> the entire concept reminds me too much of iframes, embedded flash and Java applets. i can see many security problems coming with this in the future. especially if they try to make it a real window that can jump tabs and stay pinned, which seems to be what most people here would really want and an obvious next feature.

think about click jacking, address bar spoofing, and similar mosaic style hijacking. that's not even getting into potential CORS and origin spoofing potential.

</comment></comment><comment><USER35> I much rather they would provide video stream hook so I could execute my own player as the external one (VLC, Mplayer, etc). As it is I have a bunch of custom userscripts injecting my own hook into selected websites.

</comment><comment><USER36> This is the Picture-in-Picture API it implements: [https://w3c.github.io/picture-in-picture/](https://w3c.github.io/picture-in- picture/)

I am surprised that the API is modelled to only allow watching videos in PiP, while the old and mature Fullscreen API allows to put any element in full screen. These should be analogous. I don't see a reason why I can run a <video> in a small window, but not a <canvas> a <picture>, etc.

<comment><USER37> As the article mentions, Firefox is not currently implementing the Picture-in- Picture Web API that you linked to. Firefox's implementation is a browser feature only, and not exposed to the web at large.

</comment></comment><comment><USER38> Mozilla's choice to add their own pip button is a massive pain for anyone developing video applications - anywhere over the player can't be considered a safe space to add our own buttons anymore, it really feels like Mozilla didn't talk to any video service developers when deciding how to approach this problem.

Pip needs to be common API driven (as Chrome is) to make building portable video applications possible.

A terrible misstep from Mozilla. (And yes, this has been repeatedly raised on the bug tracker with no answer)

<comment><USER39> > Pip needs to be common API driven (as Chrome is)

Ah yes, Mozilla should follow the steps of Google's web experiments playground, the Chrome browser. Every month we hear about a new self-serving feature implemented by Google/Chrome engineers.

The web is slowly drifting to the IE days again, and of course this move by Mozilla doesn't help it, but let's not forget the bigger culprit.

</comment></comment><comment><USER40> Well it'd be handy if I could PiP another non-video tab.

</comment><comment><USER41> Firefox PiP needs a few additions - first of all show subs, second allow me to change the shortcut position in videos - sometimes next/prev arrows are on top of the element, making it impossible to click :/

</comment><comment><USER42> Really awesome feature! Now I understand why I always see this little blue icon in my Udemy course.

Too bad it is "under" the button to switch to the next video, so I can't actually click it...

<comment><USER43> You can right click to get the menu option, if needed try right clicking two times.

</comment></comment><comment><USER44> Spotify web player has a feature where it shows the album art as a picture in picture. For some reason, it's disabled in Firefox.

</comment><comment><USER45> I've been using PiP in Opera for years, glad to see other browsers starting to implement useful features.

</comment><comment><USER46> I love this feature. I wish it worked with Mixer. At least it work on Twitch!

</comment><comment><USER47> Obligatory comment about Opera: Afaik, the video pop out feature was published in Opera 37, May 2016, a few months before it was added to Safari.

</comment><comment><USER22> > Given that it would be available on any video content, the feature needed to > be discoverable and straight-forward for as many people as possible.

This is the designer's nightmare: Every feature needs to be available to everyone, therefore be visible on the screen. Yet they only cite rare usecases: « Watching sports event while continuing to browse the web ». In the meantime, the blue tone isn't generally consistent with the websites' colors.

I would have supposed moderatelt-used features belongs in the right-click menu like the rest, or they need to find a way to merge it with the video controls (I guess an Apple designer would imagine a new kind of special press to detach the video, which is fine too).

<comment><USER17> I feel like this is the type of feature that should be a browser extension. It could be an officially supported one from Mozilla.

<comment><USER48> Safari implements this natively and it's super handy.

I imagine if you intently watch videos it's not useful, but for multitasking it's great. Or note taking etc.

</comment></comment></comment><comment><USER49> I thought this might have been some Steam tie-in or otherwise not a Firefox built-in feature, never clicked it.. and now I can't even try it as the button's not appearing, it seems pretty unstable. Not that I really want to... This solves a problem I've never had. What's so hard about moving the video to a new window, or if your screen is too small moving the window to a new monitor? In Linux you can also make the window smaller to just have the video visible and then make it "always on top" of whatever else you're doing.

</comment><comment><USER50> For the life of me I can't see why anyone would need picture in picture for browsers. More features most people don't need. Please come down to earth Mozilla. You have lost your way. Please revisit NCSA Mosaic and witness your roots.

<comment><USER51> I use PIP a lot in Chrome while browsing Reddit. If I see a video link, I can play the video while continuing to scroll through Reddit comments.

(YouTube PIP is kind of difficult to discover; you have to right-click, move the mouse off the menu, and right-click again to get the native right-click menu, which is where the PIP button is.)

<comment><USER52> Why not just open it in another tab?

<comment><USER18> You mean open in another window, arrange and resize that window to not get in the way while making the video visible, hoping that the website layout doesn't make that close to impossible, and still not easily being able to have it stay on top of the window you interact with... instead of a single click that does the right thing?</comment></comment></comment></comment>


Liu Xiaobo, Chinese Dissident Who Won Nobel While Jailed, Dies at 61 - <AUTHOR> https://www.nytimes.com/2017/07/13/world/asia/liu-xiaobo-dead.html <comment><USER2> Previous flamewar-filled discussion:

[https://news.ycombinator.com/item?id=14761686](https://news.ycombinator.com/item?id=14761686)

<comment><AUTHOR> I think the NYT's writing is good here but there's no need for two topics -- mods deleting mine seems a good idea.</comment></comment>


HN: Top Links - <AUTHOR> https://news.ycombinator.com/best <comment><AUTHOR> Not sure if this is old/new/a-b test. Does not normally show up for me in the menu.

<comment><USER2> It's been around for a couple of years at least. I also have a bookmark on [http://hn.premii.com/#/f/weekTop10](http://hn.premii.com/#/f/weekTop10)</comment></comment>


Big and bad - <AUTHOR> http://www.gladwell.com/2004/2004_01_12_a_suv.html

<comment><USER2> Seems like this would be more appropriate a few years ago. Sales of the Trailblazer are down 73% (last year this month to current year) and sales of other SUV lines have dropped similarly.

Source: [http://www.dailytimes.com.pk/default.asp?page=2008%5C05%5C03...](http://www.dailytimes.com.pk/default.asp?page=2008%5C05%5C03%5Cstory_3-5-2008_pg5_41)

The lesson for startups out of this are (1) don't chase fads, and (2) consumers really do care about total cost of ownership.

<comment><USER3> I don't understand that industry although I've been a C&D subscriber forever. I picked up this month issue, and again: every single new car they previewed gained inches and pounds. Every freaking time, every month, every new car. How many more inches of wheelbase and cubic inches of trunk space do we need?

Sure, SUV sales are down, but overall the total mass that today's consumers demand to be riding on, keeps increasing. Look at a freaking "mid-size" Camry or Accord parked next to 10 year old Explorer or 4Runner - they're nearly equal in size. 4-cylinder engines have all surpassed 2L displacement mark, and anything less than 220hp is considered "inadequate".

The auto industry needs their own Steve Jobs, someone who's capable of telling these fat idiots what to like, as opposed to blindly following their reptilian instincts.

<comment><USER4> According to the studies that keep track of such details, the size of car owners also keeps increasing. Perhaps the auto manufacturers are simply trying to ensure their vehicles can comfortably accommodate such trends.

</comment></comment></comment><comment><USER5> _Jettas are safe because they make their drivers feel unsafe. S.U.V.s are unsafe because they make their drivers feel safe. That feeling of safety isn't the solution; it's the problem._

So much wisdom in so few words.

</comment><comment><USER6> I'm reminded of the fact that the Ferrari Enzo is one of the fastest but also safest cars in existence:

 _"The Enzo is one of the safest cars to be in a crash because it's designed to come apart at high speeds, similar to a Formula 1 car."_ [http://www.motorauthority.com/cars/ferrari/another-enzo- bite...](http://www.motorauthority.com/cars/ferrari/another-enzo-bites-the- dust/)

</comment><comment><USER7> Clotaire Rapaille's (he is mentioned in the article) book "The Culture Code" is a pretty insightful read. It is hard to come up with a gist of what is in there, but if I were to attempt summarizing it, I would say that the thesis is that cultural has a surprisingly sizable impact on most decisions, and consumers are never accurate when supposedly describing their feelings.

</comment><comment><USER8> Interesting how people want to feel safe, instead of actually being safe. If people act irrationally, doesn't economics theory break down?

Also I think the article ignores the possibility that drivers of quick and nimble cars could be (on average) more skilled than drivers of large SUVs. This could have caused the difference in safety statistics.

</comment><comment><USER9> In the GE transportation systems twin diesel-electric locomotive vs. Boxster crash tests, the locomotive came out ahead a remarkable 100 percent of the time. Of course, it's MPG is somewhat less than the boxster, but the soccer moms involved said that nothing was too good for their respective munchkins.

</comment><comment><USER10> <http://www.theautochannel.com/news/2005/03/15/sr4003.pdf>

Looks like SUVs are actually a little safer than typical 4 dr or 2 dr sedans.

<comment><USER11> Interesting. The evidence doesn't seem to support his claim that small and agile is better than big and bulky:

      Important characteristics of vehicles that influence their
      driver death rates are type, body style, size, and weight.
      Within virtually every group of vehicles, the smaller and
      lighter models have the higher rates...

      Among cars, for example, the smallest twodoor models had
      the highest death rate at 190 per million vehicle years.
      This rate is more than twice as high as the average for
      all vehicles included in the study...

      The vehicle group with the lowest driver death rate was
      large luxury cars with 37 deaths per million vehicle years.
      The next lowest rate was in large minivans and station
      wagons with 42 deaths per million.

<comment><USER4> Unfortunately I think the soccer moms are not so far off the mark. Small contemporary 2 door economy vehicles get smushed and crumpled immediately upon impact with a larger, sturdier vehicle. I used to drive a grotesque, gigantic luxury vehicle from the 1980s and was rear ended twice. Both times the other cars (GEO metro, some sort of Hyundai) were totaled (from a fender bender!) and I merely ended up with additional dents on my bumper.

<comment><USER6> The argument is that you are less likely _to_ crash when piloting a smaller vehicle, not that a smaller vehicle fares better in a crash of similar nature.

<comment><USER11> Sure, but the evidence I cited above does not seem to support that.

</comment></comment></comment></comment></comment><comment><USER10> He leaves out that 3 of the top 5 cars (all of which are absent from his chart) in terms of fewest deaths per million are SUVs. The one I drive (Lexus RX) has only about half of the fatalities that the Avalon does.

Also in terms of handling, it's grossly unfair to compare a Traiblazer (built for shlepping kids and groceries around) to a Boxster. I'd be interested in knowing how a Cayenne ran the course. Or how much better than a Traiblazer a similarly priced GM sedan would.

<comment><USER12> I just can't resist...

I love how you happen to mention that you drive a Lexus.

"According to Bradsher, internal industry market research concluded that S.U.V.s tend to be bought by people who are insecure, vain, self-centered, and self-absorbed, who are frequently nervous about their marriages, and who lack confidence in their driving skills."

<comment><USER10> I'll grant you vain, self-centered, and self-absorbed, but not the rest.</comment></comment></comment>