Bypassing Browser Security Warnings with Pseudo Password Fields - <AUTHOR> https://www.troyhunt.com/bypassing-browser-security-warnings-with-pseudo-password-fields/ <comment><USER2> If only we had these kinds of strong warnings in the VOIP industry. Nearly every provider barebacks the internet, throwing unencrypted signaling data (phone number dialed, keys pressed during the call, codec to use) and call media over the internet raw, just hoping that no one eavesdrops or alters their data.

HIPPA compliance? Nah bruh, unencrypted UDP is just fine! PCI-DSS says we can't take credit cards over this wholly insecure connection? Who cares! Just don't let the auditor near our PBX.

Sadly, the HTTPS and IPv6 anti-vaxxer crowd is strong in the VOIP community, if it isn't severely painful to the VOIP company themselves, they aren't going to secure it. Not that they'd secure it properly anyway, even if their livelihoods depended on it...

<comment><USER3> What are VOIP systems used for these days? Private enthusiasts or some company call centers? I've no idea, as I haven't seen one for at least half a decade now -- even all conference calls are always over Skype or Hangouts.

<comment><USER2> The largest VOIP companies in America today are the cable companies, ACN (pyramid scheme with a few million VOIP customers), Vonage (a first mover) then a few dozen minor players that are near the half million customer mark. IMO its a big (but unsurprising) marketing failure.

VOIP as a product never really made it into the home, despite all its features and enhancements. Instead, it is limited to the realm of businesses, where it is in most hospitals, medical facilities, chain stores, call centers, and so on.

<comment><USER4> All landline phone connections sold by Telekom in germany are VOIP, it's just mostly hidden from the subscriber. The technology is doing perfectly fine.

<comment><USER5> VOIP and specifically SIP in its least secure form became the replacement for old tandem circuits. Sadly, rather than pushing SIP hardware out to the endpoints, most lamdline carriers chose to just provide twisted pair service.

VoLTE is as close as most consumers will get to proper VOIP service.

<comment><USER6> Giving everyone SIP phones is expensive, and forcing your subscribers to purchase SIP phones will ensure a number of them flee to the competition. Putting the VOIP hardware in the modem makes much more sense, because you have to provide that to your subscribers anyway.

<comment><USER4> I actually have my own Cisco Phone adapter to connect my old analog phone/answering machine. I'd assume that a true SIP phone would work as well. What's questionable is whether I could authenticate from a different network than my home network.

I know, however, that both Vodafone and Telekom in Germany offer products that allow connecting VOIP phones from anywhere to a virtual phone appliance.

<comment><USER6> That's interesting. In the Netherlands, all the telcos (with the notable exception of XS4ALL) lock down the modems and don't give you the settings and logins to use your own equipment (although the Consumer and Market Authority is still researching whether this is actually legal).

<comment><USER4> Locking the connection to a provided modem is not legal in Germany since 2016-08-01 by law (FTEG, replaced by FuAG in 2017) The provider is obliged to hand you the required credentials to connect your own hardware, though getting the actual required configuration may require some puzzle work, but most providers give config examples for at least the most common hardware. My setup for example consists of a draytek modem with unifi network hardware and above mentioned Cisco phone adapter. I don't even have a piece of Telekom-provided hardware here. Took a bit of googling to get IPTv working, but other than that it's a perfectly stable and capable setup. Many people use Fritz boxes which are a bit less capable but easier to set up.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> "I've been speaking with the owner about SSL before I invest in becoming a member, but she's been told by the dev of the platform (it's a franchise system called ShopCity.com) that SSL is more about Google's monopolizing visibility of content, and less to do with security"

This is an interesting observation of how Google's technical crusades often align with its profit interests.

The main threat that HTTPS everywhere secures against is preventing your ISP from analyzing your traffic in order to build and sell an advertising profile on you.

Now, obviously that is something I don't want, so I am all for HTTPS everywhere, but Google already has that profile, so for them HTTPS everywhere is eliminating the competition.

<comment><USER8> > The main threat that HTTPS everywhere secures against is preventing your ISP > from analyzing your traffic in order to build and sell an advertising > profile on you.

That is not true. The main threat it protects against is MitM (man in the middle attacks) that allow someone to redirect all traffic to a website through their machine and thus see all the data including your password.

HTTPS when combined with root certificate trust is very effective at preventing these kind of attacks. Without it, using any shared internet at all (such as a company, school, or coffee shop) to log into any website or enter your credit card would be trivially easy to hack.

Seriously, I can boot up Wireshark, go to my coffee shop and easily see every non-HTTPS communication going over the network. IM messages, emails, and in cases like this post suggests... passwords too.

Edit: As a side note... I do this all the time to reverse engineer the wireless protocol for IOT devices since most of them do not use HTTPS yet. I use it for personal use but it could be used for harm as well. For instance, if the security cameras are IP cameras over HTTP I could probably intercept the password and use it to remotely turn off the cameras.

<comment><USER9> MitM is blown out of proportion. Afaik, only dns poisoning attacks will result in MitM as effective as phishing or botnets, and poisoning can be mostly- solved with better resolvers. No criminal anywhere cares about your password going over the wire in a coffee shop.

<comment><USER10> Which is true exactly up to the point where some criminal decides it's an attack worth automating, as with every other attack.

The one thing that reduces the likelihood of that happening is to minimize the amount of credentials you could get your hands on using that attack.

</comment></comment></comment></comment><comment><USER11> Nice trick. Can it be used to stop password managers? Our system works over HTTPS and saving the password to login is okay of course, password managers are great and they must obey the user, not the page. But on sone pages of the system one has to enter credentials for other systems using password fields. Chrome always wants to remember these and prefills it with the login data to our system. Can this be stopped? Maybe by using this font

<comment><USER12> Have you tried adding:

autocomplete="new-password"

to the field? This is supposed to stop Chrome autofilling the value

</comment></comment><comment><USER13> No need for the JS, just change the font if the input isn't empty, right?

<comment><USER14> yeah. The :empty() pseudoclass should do the trick.

<comment><USER15> :empty is for elements with no children, not empty value.

<comment><USER16> You could potentially use the validation rules, and set a min length of 1.

<comment><USER17> You'd need [required] instead of [minlength] for :valid to work. The other option is :placeholder-shown, to style no-input normally, but it's newer and not as supported.

<comment><USER15> I wonder if the good old input[value=""] would work. Probably not if you have jQuery.

<comment><USER18> No, because that matches on the HTML attribute (aka the defaultValue property in JS), not on the current value of the input.

</comment></comment></comment></comment></comment></comment></comment><comment><AUTHOR> It's kind of clever, but also bloody stupid at the same time.

</comment><comment><USER19> I'm kind of happy that developers responsible for this type of stuff get exposed - if they can't get HTTPS then in my mind there's a high chance that other parts of their setup are following weak security practices. Now I know where NOT to signup!

</comment><comment><USER20> This hack is exactly what I needed 2 days ago while working on a browser-based terminal app. My site will be secured with SSL/TLS, but I needed a way to make a content-editable span mask input like a password field. I already implemented it with a password input, but it doesn't wrap inline like a span does. It will be much cleaner to just add a class that masks the font.

<comment><USER8> Most terminal apps I use when you type in a password area nothing shows at all in the terminal (not even a mask). Though admittedly, that is not the best user experience for providing feedback.

<comment><USER21> The terminal has a feature called "local echo".

When you type something, it goes to the application (almost always its stdin file descriptor, but it can open /dev/tty and read that too).

When local echo is enabled, the terminal also prints what you type.

Applications that prompt for passwords simply (temporarily) disable local echo.

</comment></comment></comment><comment><USER8> Edit: Ignore this. It seems most of the posts I was talking about were either deleted or edited. Keeping my original message here for completeness sake.

\---

The number of people saying that this is a clever workaround and agreeing with the people putting in the bug reports is very disheartening to see on HN. If a highly technical crowd such as HN can't get why HTTPS is important than what hope does everyone else have?

Troy hunt is a security researcher. The examples of the bug reports and quotes were meant to terrify and it worked on me. If I was a customer of any of these examples I would be pissed. If you're not upset and/or frightened please for everyone's sake take an infosec course or read up on the subject.

<comment><USER22> > The number of people saying that this is a clever workaround and agreeing > with the people putting in the bug reports is very disheartening to see on > HN

Huh? I've been through this entire thread and I haven't seen anyone suggest that this is acceptable behavior; even in the heavily-downvoted comments. It's mostly just people laughing at the lengths this site went to to shoot itself in the foot.

<comment><USER8> Wow... looking at it now I don't either. I don't know if they got flagged or deleted or editor of what. One of the comments in particular I can see was clearly edited to be more clear that they thought it was a bad idea.

</comment></comment></comment><comment><USER23> Surely it would be easier to just get a cert.

What's preventing these types from doing so?

<comment><USER24> What's easier for a dev: inserting a few lines of code, or getting access to the production server, setting up letsencrypt (or getting a budget approval for the $10/year certificate)?

<comment><USER25> Code is rarely the same as "inserting a few lines of code" though. They presumably had to think about how to work around the problem, look for an appropriate font, etc. All for the purpose of hiding a symptom of an underlying problem.

<comment><USER26> Yes, exactly - there's a framework in place, which allows for the bullchit. :/

</comment></comment></comment></comment><comment><USER27> Can someone give a precise idea about this entire subject?

<comment><USER22> Huh? I don't understand your question.

</comment></comment><comment><USER9> I just realized: This site was never over HTTPS. It was an HTTP site, and the browser had a regression that broke the site's user functionality.

Troy Hunt is attempting to claim this is a _feature_ and not a bug, and that their workaround is "being deceptive", when they _never claimed it was secure to begin with_.

The browser is literally pushing an idealistic philosophy down websites' throats and basically doing damage to businesses and brands without an attempt to help them, and any attempts to simply keep old functionality are being vilified as "anti-vaxers". This is not an honest narrative.

Yes, Oil and Gas International had an insecure site, and yes, their reaction and demand to the browser vendor was inappropriate. But the point of it is still valid: as a vendor, you don't embarrass and damage business reputations in order to force them to comply with the way you would _like_ them to run their sites.

Troy writes in the article that browser vendors are trying to use a "lever" to "force organizations to go secure". I don't care who you are, it's wrong to force anyone to do anything they don't want to do, and on your timeline instead of theirs, and with absolutely no help given to them before this deadline.

Imagine if Microsoft changed their OS to flag every single application as "insecure" if it doesn't implement a new primitive, and they pushed this out today. All of a sudden, you receive a barrage of calls from upset users. You didn't know they were going to push that out (certainly Microsoft never sent you an e-mail), and you now have to hit the ground running trying to figure out how to add those primitives to your code, test them, and release them, none of which could possibly happen immediately, and may take weeks of development. Meanwhile, your reputation with your users is damaged, and users themselves go through emotional stress and fear. And Microsoft's response? "Too bad. You should have been secure already."

This is fucked up. And if Google does this knowing it's going to damage businesses, they could face a class-action lawsuit.

The only way they get away with it is because they have the biggest market share. If Chrome had a smaller user base, businesses would simply shut off access to Chrome browsers and tell them their browsers were faulty and to switch to IE. This is impressively tyrannical behavior for a software vendor, and Google is indeed being a bully.

<comment><USER18> The key thing to realize here is that the browser is the "user agent": it is supposed to represent the interests of the user.

Now users have pretty diverse interests, so browsers don't always get this entirely right, which is one reason it's important to have a variety of browsers so users can pick one that does represent their interests.

What's happening in this case is that the site is doing something that pretty much everyone who understands the issue agrees is harmful to users: having them type their password into an insecure page. Browsers and security professionals spent 10+ years trying to convince web sites to stop doing that. Then browsers spent a few years telling websites that they will start warning users about this behavior and giving specific timelines for when this would happen. Then they started showing those warnings they promised they would show.

To go back to your analogy, it's as if Microsoft had told developers for a long time that some specific API is deprecated due to being "insecure". Then they gave a timeline for the API being removed. Then they removed it. Can there still be applications who didn't move away from that API? Sure. Is it entirely Microsoft's fault that they are now getting lots of support calls? That's a hard case to make. Note that this sort of deprecation is something that Microsoft and Apple have in fact done.

> The only way they get away with it is because they have the biggest market > share.

Firefox is showing the same warnings, no?

> businesses would simply shut off access to Chrome browsers and tell them > their browsers were faulty

Sure, just like in the Microsoft case businesses tell their users to not install the OS security update, etc. You're right that if Chrome and Firefox had smaller marketshare businesses _could_ threaten to do this or actually do this. But at that point it's not entirely clear who the real "bully" is... In either case there's an exercise of market power to get your way against the (possibly reasonable) objections of others.

Disclaimer: I work for Mozilla, on Firefox.

<comment><USER9> > the browser is the "user agent": it is supposed to represent the interests > of the user

> it's important to have a variety of browsers so users can pick one that does > represent their interests

First of all, I'm now terrified of Mozilla/Firefox, because this comment reflects the idea that browsers should be developed as independent ethical entities that represent different groups, in the way special interest groups lobby on behalf of specific people, ignoring the concerns of everyone else.

Second, it's dangerous to put the onus of security on everyone _but_ the user. I'm sure you've seen the wall of sheep: it's more than just http passwords. Users are stupid, and they get security wrong, and they need to be helped to get it right. But one thing that won't help them is absolving them of any thought whatsoever into investing in their own security.

Where this will end is a marketing campaign that sounds a lot like "Mozilla Firefox: The Secure Browser". All they need to do is download your program and just assume everything is fine. Which will of course be a lie, but one that everyone will accept, because they want it to be true.

The browser should not become a political toy. It should be simply a tool, and it should be up to those who wield that tool to decide how it is used. If I make an axe, I don't come to your farm and tell you how to swing it.

This could have been trivially handled by simply asking users how much concern they want to have over their security, or providing some mechanism for organizations to easily transition into technology changes at a pace that works for them. Instead it seems like browser makers are too fond of themselves as white knights to provide reasonable compromises.

Browsers are completely at fault for handling security so poorly in the first place. They continue to have the most asinine user experiences in the world when it comes to understanding what is actually going on when a user browses the web. They continue to support standards which can be easily subverted. They continue to build hack after hack into something that was supposed to just _navigate documents_ and is now an entire fucking application platform. Browsers are a mess, and it's their designers that are at fault for that mess. Now it's clear that a mentality of moral superiority and special interests is the cause.

 _And while I 'm ranting_, what is wrong with browsers that they can't simply build a working secure authentication framework into the protocol and back it with a halfway usable UI? How is it a 20 year old tool used to access backend servers has a more effective authentication and authorization system than the most commonly used program in the entire world? It's not like this stuff was some mystery that the poor lowly browser devs couldn't understand. We don't need to be relying on shitty web forms to send plaintext passwords - we didn't need to be doing that in the year 2000!!!! How the hell is it that this piece of software, which is somehow more complex than my entire operating system, can't seem to perform the basic functions i've been doing with other programs for half my life? And yet have the balls to claim they're working in service to the user?

You know what would have been great for the users? A secure protocol which didn't degrade its own security. A URI convention that refuses to communicate with insecure sites. A button that rejects all connections not destined for the domain in the address bar, and functions that control the browser or access to its data without the user expressly allowing it. _Simple things_ that could have actually completely ensured users' safety, without ridiculous complicated kludges that only do half of what they're supposed to do. And these should not be considered controversial - it's not like I'm suggesting they implement security policies before they add buggy features to brand new releases.

You are right, though. Browsers did take 10+ years to enforce a policy that is as unnecessary as it is sudden. I'm sure users will thank the browser vendors now for how much safer they are from black hat hackers in coffee shops. Oh, wait - they are still insecure. It's just now they know it and are unhappy about it, and other organizations can now capitalize on this.

<comment><USER18> > because this comment reflects the idea that browsers should be developed as > independent ethical entities that represent different groups

I'm not sure where "ethical" came into that.

Some users want to have features that allow them to read websites in their preferred fonts. Other users don't care about fonts, but _really_ care about the colors and want high contrast. Still others want to have strong privacy safeguards (think Tor), while a fourth set care about privacy a bit less than that, and a fifth set don't care about privacy at all. These diverse needs might best be served by multiple different browsers that focus on different aspects of the user experience.

I see no reason why a browser that explicitly tries to make the web more usable for people who are red/green colorblind, say, should be a problem, though it seems to me that you do....

> it's dangerous to put the onus of security on everyone but the user

No one is suggesting that. However the reality is that there are maybe at most double-digit numbers of different browsers, maybe hundreds of millions of websites, if you're very generous, and billions of users. You ideally want to enforce security at chokepoints, which is why the browsers do most of the lifting here, then websites, then users.

There have been tons of user education campaigns in the history of the internet. To some extent they've even worked.

> The browser should not become a political toy. It should be simply a tool

Sure, and no one suggested it should be a "political toy". But maybe one user wants a flathead screwdriver and another wants a phillips head. And a third one wants a hammer, or hex wrench.

> This could have been trivially handled by simply asking users how much > concern they want to have over their security

Been done, via surveys. The answer is "a lot". And yes, we could just say that if they care then they should be constantly vigilant. But constant vigilance is something people are really bad at (on a hardware level!), compared to computers. So any time we can design systems that don't require constant vigilance from people we probably should. I would go so far as to claim that requiring constant vigilance from people when we don't have to, and then blaming or punishing them when they cannot comply, is simply unethical.

> or providing some mechanism for organizations to easily transition into > technology changes at a pace that works for them

This is why browsers have been cooperating at creating things like Lets Encrypt, precisely to provide such a mechanism. The question of timeframes is a complicated one, of course.

> Browsers are completely at fault for handling security so poorly in the > first place.

No argument there. This is something browsers have been trying to do better.

> Now it's clear that a mentality of moral superiority and special interests > is the cause.

I think you're reading things into what I said that were simply not there.

</comment></comment></comment></comment><comment><USER26> LOL, I love the guys filing that bug report with Mozilla... Had to have cost some overtime for their network admins. xD

The way I see it, this - along with most of things - when you place the mechanisms there, people will use them and abuse them.

20 years ago, a browser had 3 MB and today they're 30 and 60 MB large, with _much_ better compression of the installer.

Why do we need this-and-that service integration within the browser, to "follow trends" of the likes of Adobe, Microsoft?..

I don't think so. Cut it all out. Someone wants to watch a video: install a codec. Their service uses different coding? Tough luck, get with the (popular, useful) standard(s), or gtfo.

What the hell do I care about your corporate policy of "creating new jobs" and "advancing development", all you're doing -anyway- is peddling your products. In my browser. On my hardware, which I paid for, meh. Introducing 1000&1 vulnerabilities, where there should be none.

Right, wrong? Know what I mean?

<comment><USER24> >Someone wants to watch a video: install a codec. [...] Introducing 1000&1 vulnerabilities, where there should be none

I'd rather use a codec maintained and updated by Mozilla every 6 weeks than some "community maintained" codec that I installed years ago and has to be manually updated.

<comment><USER28> YMMV, but I'd rather prefer browser vendor to work on a browser, rather than try to become an operating system, with its own libraries and update channels.

A web browser shouldn't normally bundle image decoders, audio or video codecs, on-screen keyboards or printer and video card drivers.

Obvious exceptions apply, of course - e.g. if OS doesn't have built-in image decoder for a specific format it totally makes sense to bundle one.

But this is really getting off-topic.</comment></comment></comment>


Ask HN: Are sites like Elance and Upwork worthwhile? - <AUTHOR> It's been quite a while since I first checked them out, and the last I knew it seemed like a bit of a race to the bottom. People competing for $2/hour made it seem like a waste of time.<p>Is there actually a market for highly skilled developers earning decent wages now, or is it still the same? <comment><USER2> The only success I've had on any of these freelance sites was by treating them as a marketing sales channel. Didn't lower my prices at all and landed a small project at my normal rate. This served as the start of a more permanent relationship. After the small-time project we got into contact outside the freelancer site and collaborated on larger projects.

The main problem with these sites is not that there's developers bidding at the lowest dollar; those devs are always around, and you're competing against them even when not using the freelance sites. The problem is letting these sites own and monetize your business relationships.

<comment><USER3> I agree with this, there is the secondary problem whereby people advertising work really don't understand how to price that work. The majority of it that I see is probably budgeted around half of what I would charge.

I think for Junior - Mid / Good exchange rate countries it is a great way to get a toe in the door for future work directly, for anything senior I think you are going to struggle.

</comment></comment><comment><USER4> I have hired from Upwork and Reddit at both low and high prices. Giving a view from the other side, I think one can command high prices as long as they also do the work upfront to show that they can deliver. As someone trying to get my work done with good quality, the quality crowd tends to thin out pretty quickly. I am always surprised that even after looking at 20 promising profiles, only 1-2 stand out.

Biggest way to stand out IMO is to demonstrate polished previous work, with working links. Most developers have screenshots of old de-funct stuff. They do a half assed job of convincing that they have done good work before. IMHO, if you don't have a personal polished website, demonstrating amazing work, you don't deserve to command good prices. Show, don't tell.

</comment><comment><USER5> If these sites are so bad, I wonder why isn't anyone stepping in to fill the void? There is tons of work, tons of money to be made if someone can make it work. Most of these platforms take hefty commission (20% at upwork and fiverr, for example) and yet do not provide a good service

<comment><USER6> Can you tell me what how a better platform would function?

I used to freelance on Upwork but I can't think of a better system.

</comment></comment><comment><USER7> It certainly is a race to the bottom. A marketplace provides more opportunities at the cost of greater competition.

You're also taxed 20% of your income by Upwork. Some find that egregious but I'd say that's the cost of the network.

If the network gets stronger, it makes sense for them to charge a larger amount.

</comment><comment><USER8> Upwork has different projects with low and high prices. It's a lottery to win a project.

Here is a list with 100 Marketplaces and Job Boards to find a remote or freelance job [https://docs.google.com/spreadsheets/d/1RrCjKx03515Hm523uUvD...](https://docs.google.com/spreadsheets/d/1RrCjKx03515Hm523uUvD1i3FmKWaDheqaWuElbiS94I/edit?usp=sharing)

You can check them and find what you need. I'm sure that freelancers with the high rate find projects. BTW, This service [https://periodix.net/](https://periodix.net/) aggregates projects related to your budget expectations. That's why you don't waste your time competing with $2hour freelancers.

</comment><comment><USER9> I started playing with one of those sites recently. I advertise myself at my real rates and in my pitch I mention my relevant career background, include my CV and a link to LinkedIn where they can see all my recommendations and then end explaining how it's actually cheaper to hire me as I require way less time to deliver high quality projects, so they end up paying the same or less for a better job.

So far it worked once and the customer is so happy that has kept the contract opened for now to request more things, but I've been applying for just a couple of days.

</comment><comment><USER10> It's a global market, to some degree.

I say to some degree because many buyers from wealthier markets are shying away from hiring in certain developing markets.

If you consider yourself highly skilled and you live in a relatively developed country, then no, it probably isn't worth your time trying to compete.

Furthermore, it's a seller's market so if you genuinely are highly skilled, you shouldn't be short of work.</comment>


Here's What A Facebook Response To A User Data Subpoena Looks Like - <AUTHOR> http://techcrunch.com/2012/04/06/heres-what-a-facebook-response-to-a-user-data-subpoena-looks-like/

<comment><USER2> The piece I find most interesting about this is what isn't there.

For example, what pages or friends did the user look at, without posting or sending messages to?

That there isn't the entire 'browsing' history is either a sign that Facebook didn't hand over as much as they actually have or that they aren't tracking it.

My bet would be on the former, so kudos to Facebook?

</comment><comment><USER3> I guess i need to start doing my online drug deals through a less obvious source...

I was surprised that there seemed to be no mention of chat transcripts, or no relationship history. Perhaps these things are not retained centrally?

</comment><comment><USER4> Aside, but WOW the TechCrunch iPhone version is annoying. It's automatically paginated in the middle of sentences and (cardinal sin) there's no way to opt out and get access to the desktop version.

<comment><USER5> tcfast in the "news.yc" style is my favorite.

</comment></comment><comment><USER6> Serious privacy fail, Facebook. You should not provide information on the friends unless their accounts are also subpoenaed as well (as John/Jane Doe if necessary). Without that, your response should be redacted so friends are listed only with non-identifying strings. IANAL, but this is common sense.

<comment><USER7> How so? It sounds like this is a case where the police had a demonstrable need to find out who he had communicated with, and presumably they also had access to his cell phone records. I don't see how names are any more worthy of protection than phone numbers. Especially since the name is really metadata associated with a Facebook ID, which is exactly like a phone number.

<comment><USER8> Because fishing expedition, and the law of unintended consequences.</comment></comment></comment>


CertiKOS: A breakthrough toward hacker-resistant operating systems - <AUTHOR> http://news.yale.edu/2016/11/14/certikos-breakthrough-toward-hacker-resistant-operating-systems <comment><USER2> I found the linked news piece as impenetrable as this project claims to be. Something just feels wrong about the organization of ideas.

The conference paper (in pdf format) is located here:

[https://www.usenix.org/system/files/conference/osdi16/osdi16...](https://www.usenix.org/system/files/conference/osdi16/osdi16-gu.pdf)

Section 2 of the paper seems to be a thorough and mostly readable overview of the project and was much more enlightening than the YaleNews piece. I didn't end up reading the remainder of the paper.

<comment><USER3> That's a prettier version of the Yale paper.[1]

Key points:

\- It's a hypervisor. It usually needs a guest OS on top, which is, inevitably, Linux. Code size of the hypervisor is about 6500 lines. The OS itself is written in some subset of C and in assembler. Both are formally verified against a specification, written in a formal specification language.

\- The big advance over L4 is that this kernel does concurrency. The verified version of L4 can't do that, and has one big kernel lock, because their proof system can't deal with concurrency. This is why L4 avoids passing long messages; it locks up the system.

\- I've been trying to find more about the specification language and the subset of C. There are some very simple examples here.[2] But in the examples, the spec is so close to the code that it's not interesting. I did some work on formal specification of an OS years ago (the KSOS referenced in the paper here), so I'm curious to see how they addressed this.

\- They haven't done a file system yet. (That's a good problem for formal specification, because the abstract semantics of a file system are simple; it's an efficient implementation that's hard.)

[1] [http://flint.cs.yale.edu/certikos/publications/certikos.pdf](http://flint.cs.yale.edu/certikos/publications/certikos.pdf) [2] [http://flint.cs.yale.edu/flint/publications/dscal- talk.pdf](http://flint.cs.yale.edu/flint/publications/dscal-talk.pdf)

<comment><USER4> There have already been two file system verification projects, this year's OSDI best paper is the most recent example, [http://locore.cs.washington.edu/papers/sigurbjarnarson- yggdr...](http://locore.cs.washington.edu/papers/sigurbjarnarson- yggdrasil.pdf), and last year as SOSP FSCQ: [http://sigops.org/sosp/sosp15/current/2015-Monterey/013-chen...](http://sigops.org/sosp/sosp15/current/2015-Monterey/013-chen- online.pdf)

<comment><USER5> Holy crap! That some great improvements together with the COGENT paper I posted in this sub-thread. I'd love to see them try to overlap in their strong suits. Push-button is hard to argue with, though. Thanks for the links. :)

</comment></comment></comment></comment><comment><USER6> Formal verification (what this seems to be about) can be a nice tool to verify something adheres to a specification or that it has no e.g. buffer overflows.

But I think that is not really the big problem we have. I think it is operating system interfaces. By default a process is in its own address space and cannot do anything dangerous. It is only with the operating system API (which is the syscalls or an C API that uses syscalls) that it can do dangerous things like writing in the filesystem. Posix defines such an API which allows every program to do the same as the user running it. Windows does the same. This would be fine in a world where we can trust each program we run to not be malicious and to not be exploitable. Now we are trying to make those inherently unsafe APIs safe via sandboxing, but I guess that it is much easier to create a new API that is safe from the beginning.

<comment><USER7> This is orthogonal. But first, there are still buffer overflows, null pointer accesses & segmentation faults, etc. in the kernel happening. And this is a big problem!

But lets assume this is solved. Then a API can be checked for certain properties. You can specify what it means that something is read-only in an environment etc. And ensure that it is enforced by the operating system.

As example: the verification of seL4 not only guarantees avoidance of classical security holes (buffer overflows etc.) but also certain non- interference properties.

</comment></comment><comment><USER8> What's the difference with this [https://sel4.systems/](https://sel4.systems/)?

<comment><USER5> The main difference is the verification/design method. seL4 does the abstract machine in Haskell, model in HOL, and final code in C. Both Haskell and C are shown equivalent. It took a ton of work. They also have to use these two tools for expressing all kinds of solutions they're not ideal for.

CertiKOS is using a DSL approach if it's same as paper I'm remembering. They design languages or proving techniques ideal to the type of thing they're working on: memory management, I/O, etc. They prove each individual component as easily as they can. Then they have some way of modeling the system as a whole and/or integrating those. Too early to judge but they seem more productive than L4 project was due to tooling benefits.

<comment><USER9> According to one of the talks I watched, they are moving towards using more domain-specific languages.

<comment><USER5> That's ambiguous. Are you talking about seL4 or CertiKOS people?

<comment><USER9> The seL4 team, they have taken this approach with their drivers and ext2 implementation. Apparently it is part of a more general strategy [0].

[0] [https://archive.fosdem.org/2015/schedule/event/sel4/](https://archive.fosdem.org/2015/schedule/event/sel4/)

<comment><USER5> Ok. Good they're doubling down on it.

</comment></comment></comment></comment></comment></comment><comment><USER10> > One of the main breakthroughs of CertiKOS is that it supports concurrency, > meaning that it can simultaneously run multiple threads (small sequences of > programmed instructions) on multiple central processing unit (CPU) cores.

Isn't this parallelism?

<comment><USER11> [https://www.youtube.com/watch?v=cN_DpYBzKso](https://www.youtube.com/watch?v=cN_DpYBzKso)

Rob Pike's talk on why 'Concurrency Is Not Parallelism'

<comment><USER11> Oops, that may not have been your question.

</comment></comment></comment><comment><USER12> Ok, now we can run a verified OS on multiple cores. Now, what value has verified software which runs on buggy or (theoretically) compromised hardware?

In my opinion safe computing requires verified software AND verified hardware. Since proprietary SW/HW cannot be trusted in general truly safe computing vitally depend on open software and open hardware.

<comment><USER13> > Now, what value has verified software which runs on buggy or (theoretically) > compromised hardware?

The vast majority of bugs and vulnerabilities are due to software, not hardware. There's tremendous value in pushing that boundary back to the hardware layer.

<comment><USER14> When hardware comes with multiple levels of firmware, there is hardly any difference.

<comment><USER13> A search for "linux" in NVD returned over 4,500 entries. "firmware" has barely 900. So I'd say there's definitely a meaningful difference, and operating system kernels have been used in firmware (Linux and L4 have at least), so formally verifying kernels can eliminate firmware vulnerabilities too.

</comment></comment></comment></comment><comment><USER15> Is this real software or some academic thing?

<comment><USER16> Just glancing at their site, I suspect it's real, however, I doubt it's interesting to us except as an academic example:

Only open source code I could find (and it's not linked from their site that I could find) is here, it's tooling: [https://github.com/CertiKOS](https://github.com/CertiKOS)

For Coq, which is the proof system they use, but also for extending the CompCert verified C compiler, which requires a commercial licence if you use it beyond "evaluation, research and education purposes". And given the domain, and of course you have to talk to a salesman, I'm sure it's not cheap, 6 figures a seat in USD would not be out of the question if not likely, I'm sure it's 5 figures at minimum.

This is in part because this sort of software is inherently more expensive, and for the people who _really_ need to use these sorts of tools, like those building airplanes, it's cheap at the price. But by basing it on CompCert, they've got what's likely to be a very high floor for playing the game they've not (yet) invited us to.

By comparison, seL4 is now totally free (well, GPLed, but that's not a problem for software like it), and part of that is because they actually tried CompCert, but there was an impedance mismatch in connecting it to their higher level stuff, so they went with Magnus Myreen and his approach of analyzing (GCC produced in this case) binary code and connecting that to the higher level proofs.

</comment></comment><comment><USER17> Does this mean no more jailbreaking for iOS and Android?

:(</comment>


I would have hired Doug, but... - <AUTHOR> http://liveblog.co/users/davewiner/2015/05/06/iWouldHaveHiredDougBut.html <comment><USER2> I am 55 and have been programming computers since 1975 when I was 15 years old. Do the math, I have been programming now for 40 years. Recently, I had a conversation with someone else about this topic and I told them that I have never been so excited about my career, the field of computer science, and most importantly the opportunities that exist today in the field of technology. The excitement surrounding too many topics to list is amazing. I only hope and wish that I am able to stay healthy and continue programming to the day I die.

<comment><USER3> well, it is good that you like the things you do. at your age, we youngsters tend to expect you to be in the management level, not at individual contributor level.

from time to time, i would see our team hiring engineer with gray hair and requiring special mechanical keyboard, and we all thought "mm.. interesting."

<comment><USER4> >requiring special mechanical keyboard

Well youngster, you seem to be falling behind the latest trends. Maybe you're not as young as you think. Don't you know all the fashionable programmers/gamers are using mechanical keyboards?

<comment><USER5> All that clickety-clack must be so satisfying. And annoying to everyone else.

<comment><USER6> Not all mechanical keyboards are loud or clicky. I use one with Cherry Browns and mostly type without bottoming out the keys, and it's no louder than cheap keyboards.

<comment><USER7> I love the browns! But Blues are a lot more fun (and loud!) to program on ;)

<comment><USER8> Because loudness equates to competence?

<comment><USER9> Just a feeling of productivity, from producing so much noise. But it really is satisfying, if you haven't tried it.

And I've found that you start wanting to type faster, to create even more noise. So it might actually make you more productive, in a weird way.

<comment><USER10> Ugh, it's so much noise for your neighbor though. I worked next to someone with an old IBM keyboard for a year and was grumpy the entire time. Couldn't find headphones strong enough to cancel out what sounded like someone shooting an automatic weapon in the office.

<comment><USER9> I think there's a happy medium with the quieter cherry switches. But yeah, I don't use a mechanical keyboard in settings where I'm right next to other people.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> When I was a young man, a slightly older associate told me that "programming is a trap". What he meant is that if you are relatively smart, you can get a CS degree, get good at it, and go earn a fantastic income right out of school. I heard the words. I understood the words. I agreed with the words. Even now, 30 years later, I keep asking "is this a trap that I choose to remain in?" I still love programming, but it is a trap in that I've not, for a long time, seriously tried doing anything else. So for me it has been 30 years of regular retooling, and likely another 20 years of the same. Unless I decide to open the trap and leave.

<comment><USER12> You should quit now, and try working a multitude of other jobs. Come back to us and see if your definition of 'trap' has changed, or expanded.

Software engineering is such an entitled world, it is ridiculous. As someone who has seen the world of menial work, I will never, ever leave it. I feel blessed. You should too. You just don't know it.

<comment><USER13> I guess what I read into that is similar to how you can consider television a "trap". It's easy to get sucked into and not think about anything else. I know that I spend a lot of time thinking about different software related stuff, I love it, but I would suspect (and i could be wrong) that the cashier working at burger king doesn't think about how they can ring things up faster, move between the pickup window and the fries more efficiently while they're playing with their kids, _I suspect_ they go home and thing about their family, not their job, and i think it's _easy_ to fall into the trap of thinking about work much easier when your job is a "thought" job per se.... again I could be crazy though.... good luck if I am.

<comment><USER14> They may not actually be going home. They may be going to a second job or school, seeing their kids for an hour in the evening, and then going to bed worried about paying bills.

Low-wage jobs are their own cyclical trap, which can lead to not enough resources to improve your situation and apathy towards your day-to-day life. You can easily get stuck in a rut.

<comment><USER15> The low-wage thing was an example...

I don't think that neither the lawer nor the physician when they get home keep thinking about what their job...

For us coders is different, there was a question like: "What you think while you are coding ?" the majority of the answer was "nothing", the most part of my job is done when I am away from the keyboard, when I walk, dream, read, talk with other people...

I love it, but I am also scared that I am missing a whole word just because I am too focus on computer for a not even too long while...

<comment><USER14> Your view of the tech field sounds a little pompous. Medical and law are well known life-consuming professions.

I think any dedicated professional will have issues at some point unplugging themselves from their profession to pursue other facets of life.

</comment></comment></comment></comment></comment></comment><comment><USER16> As someone who started programming during the mid 80's:

\- Everything I've learned may be applied to most languages. Meaning that writing testable code generally translates from BASIC to Javascript.

\- Programming should always make you feel stupid. Feeling comfortable with something means that you stopped learning new things.

\- Experience != Knowledge. My biggest issue with some older programmers is that they tend to confuse experience with a language, codebase, or framework with knowledge. The more you learn the less experience you will have. Think about it. You start learning Javascript after years of working with C#. What does that experience work for now? You will surely have an understanding of all the basics. But you have not yet been bitten by the == and === operators. You have to get that new experience. As time passes you will realize that it becomes a game of knowing enough versus being experienced enough.

\- New technologies are exciting. A lot of people are scared by them. They feel they will be replaced. Their comfy jobs taken away. I'm not scared of this. Change is exciting because it means that I will have the chance to learn something.

\- New languages might be rehashed versions of older ones. But they contain something different: Somebody else did it. That's reason enough to give it a try. Javascript might not be the most universally praised language, and it doesn't really bring much new to the scene. Its still someones interpretation of how a given problem should be solved. You might not agree with it, but that wont stop people from writing lots of JS code.

\- Nostalgia is fine. Don't let it get you. Sure, I miss typing BASIC into my old C64, but its no longer relevant. I could pick up demo'ing as a hobby and learn lots of stuff about old chips and memory management tricks. It wont really help me to stay employed much.

\- All these new devices are scary! I grew up programming for one kind of device. Now I have to take into account tablets, phones, tvs, and whatnot. Embrace it. Mobile is here to stay. It will keep morphing and completely remove desktop computing as we know it. The same way desktop computers removed mainframes and terminals. It is scary. Try and get excited. There is nothing more mind blowing than watching a several months old child tap on a tablet to play a game.

/old guy rant

<comment><USER17> With all due respect, how would mobile devices replace/match the computing experience I have now with my 27" computer?

How would be that possible?

Good spirit and even better understanding of the Zeitgeist :)

<comment><USER18> Mobile devices will presumably jack in to large monitors or head mounted displays of some kind, plus a good keyboard of some kind, and pointing device(track pad). Thanks to Moores law you should be able to have the equivalent of a desktop experience driven by a mobile device soon.

The one problem is being slave to Apple and Google having absolute control of the OS, software and apps you can run. The only plus is their hegemony does help with security but neither one of them is even remotely trustable with the keys to every personal computer on the planet. There is irony that the creator of the big brother commercial in 1984 is increasingly, you know, big brother.

P.S.

Not sure how Daves self promotion blogging rose so far on hacker news. It actually has almost nothing to do with Doug Engelbart. He was just name dropping, something he often does, before doing what he usually does, self promotion. Yes there is that age discrimination angle which plays well with some old programmers, but not me.

People who spend their time complaining about discrimination should spend more time doing something that people will value regardless of your age, sex or gender. At that point your age, sex and gender become irrelevent especially on the Internet which tends to be blind to these things until you wear them on your sleeve. Dave likes to use his age to promote a martyr complex angle.

Ive looked at most of Daves recent projects and none of them are particularly interesting.

</comment></comment></comment><comment><USER19> "Unlike Engelbart, I have re-tooled. I now work in JavaScript in the browser and on the server. I had to walk away from the codebase that I loved. I understood that the price of relevance is to give up fighting at some point and settle for a partial victory. I think I was right in the development environment I created. But right doesn't mean the world uses what you created."

Yep. That's the key to staying relevant: change with the times.

<comment><USER20> For me, the thing that gets a bit discouraging at times is the feeling of riding a slow-motion merry-go-round. Every 10 years or so you see the same ideas start to come around again, only with some new paint and landscaping.

I have found myself more than once thinking that learning about some new trendy buzzword is just ultimately a waste of time, since I will barely have mastered it before it's been replaced by the next new/old thing.

On the other hand, it gets easier since none of the concepts are new anymore, and I tell myself, "hey, if you want to pay me to build a client-server app in the browser like it was 1995 (substitute Powerbuilder for Firefox/Chrome), great, happy to take your money."

<comment><USER21> As a young person my biggest concern with hiring old people is that exact attitude: this is just like $IRRELEVANT_OLD_TECH.

Yeah on the surface. $IRRELEVANT_OLD_TECH didn't catch on or it wouldn't be irrelevant but _why_ didn't it catch on? Powerbuilder failed, but was it because you couldn't write a good enough program that way on 1995s hardware? Or because it was ultimately a stupid idea?

Somebody like me who has never heard of Powerbuilder would have to look into the technology, which would take longer but it would prevent me from just dismissing it because "this has been done before".

Remember it isn't what you don't know that gets you, it is what you know for damn sure that just isn't so.

I am not saying this is the case for all old developers, but it would be my concern.

<comment> vezzy-fnord _...this is just like $IRRELEVANT_OLD_TECH.

Yeah on the surface. $IRRELEVANT_OLD_TECH didn't catch on or it wouldn't be irrelevant but _why_ didn't it catch on?..._

I'm a young person, too. Lipstick on a pig doesn't make a cow, you know.

Arguments like "It's only similar on the surface" I've found tend to give too much credence to incidental properties - this runs on X, it's widespread unlike previous solutions, it's better at specific Y use case, etc. Yet regardless of underlying platform, the concepts do not tend to evolve quickly, and it is all too often the case that their limitations have been discovered either in academia or engineering practice. These limitations will eventually be uncovered again, and no one learns from their failures or successes. Where languages and platforms shift, architecture will always bite you.

As for the reasons why, that's another fallacy. It assumes the status quo always maintains an equilibrium of what is inherently technical superior, and that popularity implies great technical qualities. The reasons can be plentiful, often it's unfortunate historical circumstances.

It's comforting to think we're on to something truly new, but this is rarely the case: [http://www.dwheeler.com/innovation/innovation.html](http://www.dwheeler.com/innovation/innovation.html)

<comment><USER22> Amen when I was looking at hadoop it suddenly dawned on me that I had been doing map reduce back in the early 80's for British Telecom.

</comment></comment></comment></comment></comment><comment><USER23> "We Make Shitty Software... With Bugs!", [0]

best slogan ever

[0] [https://en.wikipedia.org/wiki/Living_Videotext](https://en.wikipedia.org/wiki/Living_Videotext)

</comment><comment><USER24> Is this the old people thread?

I'm 37. I think ageism is a very real problem and I hope people will consider doing more suing even if they don't have to. Some people need to be sued. We need some class actions.

Right from the top down of Silicon Valley ageism is rampant and in your face. For example, Sam Altman has publicly made explicitly agist remarks.

You kids may not think its a big deal now but give it ten years or so. You will see.

Of course in 10-15 years everyone will be in the same boat, being completely ignored by the ASIs.

<comment><USER25> "Of course in 10-15 years everyone will be in the same boat, being completely ignored by the ASIs"

Exactly, so why give them any credence now?? You only give these people power if you do. That's great that's what Sam Altman thinks; he's "young", but ya know, when he's 50, then what? He'll probably say "oh, that's obviously not how I see things now". Or Zuck. He's ancient to a 19yr old and the only reason he doesn't care about this is because he's rich and runs Facebook.

I'm older than you and have been through enough startups and honestly I've dealt with ageism enough to the point that it doesn't even phase me anymore - I've moved past it. But this is because I've _made_ it that way. If people don't want to work with me, np, there are plenty of other opportunities out there.

Sure, you might not get hired at the hot startup you just interviewed at. But honestly, if that's the case, who cares? Make your own way, your own rules and then you can decide to hire young or older people or not.

</comment></comment><comment><USER26> Anyone interested in Doug Engelbart and his pioneering work at Stanford Research Institute (or computers in general) should check out What the Dormouse Said: How the Sixties Counterculture Shaped the Personal Computer Industry [0]. It goes back much further than Xerox or Apple to tell the tale of Engelbart's visionary Augment project and how his ideas led to the birth of the PC and the internet.

If you're not interested in purchasing the book, he gave an incredible hour and a half long demonstration of his system at the Fall Joint Computer Conference. Dubbed The Mother of All Demos [1], he displayed (for the first time in the world) remote video conferencing, hypertext, text editing, and a graphical windowing system. In 1968. Definitely worth a watch.

[0] [http://www.amazon.com/What-Dormouse-Said-Counterculture- Pers...](http://www.amazon.com/What-Dormouse-Said-Counterculture- Personal/dp/0143036769)

[1] [http://en.wikipedia.org/wiki/The_Mother_of_All_Demos](http://en.wikipedia.org/wiki/The_Mother_of_All_Demos)

</comment><comment><USER27> Interesting, I just hired someone in mid 50's for a programming role. We've seen at least a dozen candidates and he did by far the best on the phone and code test. Now I'm happy to have him on the team. In a industry with a shortage of people that are good I'm surprised anyone can afford to discriminate good candidates based on their age. I think the key is being good and getting along with people. I've interviewed some older guys that were not only bad but were coming with an attitude that they were going to teach everyone here.

</comment><comment><USER28> I was looking at some of the code for one of his projects that is a little node http server. I don't really know JS or node at all, but can someone explain this to me:

         function secondsSince (when) {
    	var now = new Date ();
    	when = new Date (when);
    	return ((now - when) / 1000);
    	}

I'm assuming now returns seconds since some fixed point in time ( epoch ) when when someone passes in the 'when' argument, it must already be formatted a certain way, or node/js somehow managed to figure out the input? How would it deal with 5/8/2015 vs 8/5/2015

Or this is just a very case specific function and the input is already sanitized in a way that is prepared for this function?

github is here: [https://github.com/scripting/pagepark/blob/master/lib/utils....](https://github.com/scripting/pagepark/blob/master/lib/utils.js)

<comment><USER13> I'm not 100% sure what he's doing here, however I know when I have used new Date().getTime() it returns something like milliseconds, and thus I had to divide by 1000 to result in seconds, so it _appears_ that he's subtracting milliseconds and getting seconds after the division by 1000.

Typically I believe new Date() is current time/date ([http://www.w3schools.com/js/tryit.asp?filename=tryjs_date_ne...](http://www.w3schools.com/js/tryit.asp?filename=tryjs_date_new)) in my experience.

As far as your question how to deal with 5/8/2015, and 8/5/2015, to be honest I don't know that answer.

<comment><USER13> Also assuming I can read, it doesn't look like that function is used, (I searched second in the same file, and in the higher level folder, and couldn't find that function called anywhere)

</comment></comment></comment><comment><USER29> The more interesting post was the link to Phil G's blog post about the MIT reunion: "The medical doctor was at the peak of his career and in no danger of being fired. The university professor had the security of tenure and was looking forward to a defined benefit pension starting six years from now. The corporate attorney was finishing up a prosperous career. The engineers who'd chosen to work in industry, however, were a varied lot. A woman who'd taken a job at a defense contractor was still there, 30 years later. The super-wizard Lisp Machine programmer was now in a senior technical, but non-supervisory role, at a multi-billion dollar dotcom (not necessarily getting paid more than a competent 30-year-old, however). About half of the engineers, however, talked about being pushed into a financially uncomfortable early retirement and/or not being able to find work."

</comment><comment><USER30> So far, it looks like nobody is commenting on Dave Winer's own work.

Everybody has been influenced by Engelbart, but nobody uses NLS. Merely the ideas went into all the computers that we use today. Engelbart was so frustrated because he had more great ideas, but they were difficult to develop and he couldn't get funding.

Winer specifically mentions Userland Frontier. It was a useful tool, which I'm sure helped with the development of RSS, just as NeXT Project Builder helped with the development of WWW. The problem with the Engelbart comparison is that there are countless other development environments, many of them free and/or not in a dialect of C and/or available via git, while the Mother of All Demos was unique.

I think the open-sourcing of Frontier was too little, too late. Frontier is an impressive achievement, but I don't see why it should be interesting to me.

</comment><comment><USER31> I play a lot of music with folks older than me... I'm 37, and the drummer in a blues band I play with is 73 (he's a neat guy- he was in the 13th Floor Elevators).

I've played with folks in their late 80s, and most of the folks I play with weekly in a large jazz band are between 50 and 70. I also play bi-weekly with an orchestra with members ranging from 12-82.

Maybe I lack the same perspective I lacked when I was younger (and thought that 45 was pretty old), but I absolutely don't see how 60 is old. 80 is old, maybe, but 60 just isn't that old, and I don't mean that in the attitude sense, as with:

"The ones that love me say I'm really young, and I appreciate that. I think they mean my thinking is flexible, and I'm excited about the future, like a young person might be."

<comment><USER32> Am I the only one who noticed "he was in 13th Floor Elevators"? Whoa! That's rad! And props on making music the priority, not worrying about age.

<comment><USER33> No you're not. I'm listening to "You're Gonna Miss Me" right now.

So is he in touch with Roky?

<comment><USER31> They are actually playing next weekend:

[http://www.austinpsychfest.com/portfolio-item/the-13th- floor...](http://www.austinpsychfest.com/portfolio-item/the-13th-floor- elevators/)

It's kind of funny... I just thought he was some random (occasionally iffy, somewhat nutty) drummer.

</comment></comment></comment></comment><comment><USER34> You wonder why people aren't curious?? I'm 28 and I would pay money to spend a day talking about coding with you - I'm "senior level" at my company but that just means I don't have very many people around to mentor me. If you're near the Seattle area I'd love to buy you coffee.

</comment><comment><USER35> This is a great thread. What I have appreciated most is seeing the long-term vision that older programmers have - thinking in terms of change over decades, not years.

Working in the web industry, the second-hardest thing I find (after pace of change/fascination with "New! Shiny!") is the vision of people can be measured in months to 3-4 years. Applications are not built with the thought they will be running in a decade; it's assumed they'll be rewritten in New Language X with New Architecture Y long before that.

To older programmers: if you work in the web field, how do you handle/deal with this?

</comment><comment><USER36> Not that I condone treachery, but growing up my father used to have a famous line "Old age and treachery will beat out youth and enthusiasm any day". And although he wasn't a programmer, but rather an investigative thinker, his subtle manner of obtaining voluntary compliance seemed to win the day. Whilst not treachery in the blatant sense, there was allot to learn from this wisdom which is only gained from life experience. Would I have hired Doug, probably, but I think maybe I would have been better self-served being HIRED by Doug. My age - 43 and irrelevant IMO.

</comment><comment><USER37> Part of the problem, at least in America is one that people don't want to talk about. The industry has globalized greatly over the last couple decades, and many companies hire in areas that have no labor standards. Companies are operating under US labor standards but are hiring people in greater numbers in China and India, some to work in the US. In those places discrimination by age is commonplace. Additionally, there are a large number of foreign managers working in the US who don't understand why they can't just openly discriminate by whatever standard they want. and it makes sense they are confused if you're allowed to discriminate in some cases but not others at the same company. No one regulates US based corporations hiring people in overseas markets for US jobs. The problem is so bad that many resumes that US managers in US companies have sitting on their desk contain things like age, birthplace, country of origin, family members, and even blood type. It blatantly violates US law.

</comment><comment><USER38> "The processes I use, investing in good tools and underpinnings, and paying attention to good features of other people's software, makes it easy and quick to try out new ideas. Some of them are really worth it."

What processes is he using? What tools and underpinnings that allow him to quickly try out new ideas?

</comment><comment><USER39> Those who do not know who Douglas Engelbart is should see [http://en.wikipedia.org/wiki/The_Mother_of_All_Demos](http://en.wikipedia.org/wiki/The_Mother_of_All_Demos). If you have time, watch the demo to see the state of the art in 1968.

</comment><comment><USER40> I read an article recently that said something to the effect that most people stop listening to new music at age 33. I kinda feel the same about programming. There are a lot of people still doing it, but not as many that are truly excited about learning new things.

When we bring on young people they have a ton of energy and are excited to try every new thing which, don't get me wrong, is awesome. But they do occasionally criticize me for moving too cautiously, even though I am plenty excited about trying new things. I always think to myself, call me back in about 15 years and we'll see whether you evolve into the rockstar that you envision yourself to be, or else if you stagnate, burn out, move onto something else, etc. I always hope they do become the rockstar.

<comment><USER41> I am 45 and I almost only listen to new music. I have almost a 1000 CDs from the 90s and early 00s (all ripped to FLAC), but I find myself listening to new music because there is so much fantastic new music out there and it is so easy to access. For a music fan it really is the golden age (not so much for the musicians).

As for learning new programming skills I still enjoy it, but I think this is because for me languages/frameworks/algorithms are just tools. The real fun is in using the right tool to solve a complex problem.

<comment><USER40> Same here. I basically get bored with most music fairly quickly so I'm always looking for something new. Most of my high-school friends are still listening to the same music from the 80's and 90's though!

</comment></comment></comment><comment><USER42> I'm 18 years old and I just got my first significant programming job building android applications for a medical device company. I must say its inspiring to read something like this. I've heard stories from mentors and professors about what it takes to stay relevent in the field computer science. It's odd to think that the technologies I've devoted my time and energy could be all but useless by the time I turn 30. Maybe it's wrong, but I dream of a post Moore's Law era where development tools can finally mature and the best programmers are the ones with 40 years of experience.

</comment><comment><USER43> I can imagine a time in my distant future where I will feel unappreciated and/or unable to keep up with technology the way I can today (though admittedly even today it's not an easy task given the trajectory. I'm pretty certain we're on an exponential curve).

What is the gift that will keep on giving? Write about what you know. Write about your experiences and insights. Even thousands of years from now people may come across your work and given the advances they will be living amongst will almost certainly be interested in what you had to say.

</comment><comment><USER44> Well remember: 74 is the new 24, [https://www.youtube.com/watch?v=7u5c-Qndqio](https://www.youtube.com/watch?v=7u5c-Qndqio)

(The artist that did that music video is 74)

<comment><USER45> Note that he did the music, not the video itself, which is taken from the demo "Spin"[1] by Andromeda Software Development.

1\. [https://www.youtube.com/watch?v=nFqMnVDIuvc](https://www.youtube.com/watch?v=nFqMnVDIuvc)

</comment></comment><comment><USER46> I'm 30 and a senior programmer. What should I be doing to ensure I have career options at 50? Is management inevitable with individual contribution primarily reserved for scrappy youngsters?

<comment><USER25> I think this goes without saying: never stop learning.

The people that are resourceful will always find a way. Sometimes this may mean on your own, sometimes with a group. But as long as you can keep learning and just 'do things', you will be light years ahead of those that don't know what to do and look to other people to tell them.

From Steve Jobs:

"Everything around you that you call life was made up by people that were no smarter than you and you can change it, you can influence it, you can build your own things that other people can use."

It's hard sometimes (a lot of the time??) to get over that bit where 'no one is smarter than you'. (I'm not as smart as a Google PhD, am I??..) Once you can and you chart your own course because you are resourceful and confident and someone who can _do things_ , then you won't need to ask the question you asked. :)

Good Luck! (I'm still on this journey)

</comment></comment><comment> guard-of-terra I'm 30 now (from time to time I feel that I've already lived enough and am mostly done), the idea of expecting at least 30 productive years ahead of me is intriguing.

<comment><USER47> What have you done that makes you feel satisfied with your life? Just curious. I'm 37 and feel like I'm just getting started. Keep in mind that I have wasted very little time. Always working on some project here or there. Right now I'm planning my next fourty years. So it really makes me wonder how you can feel you are done.

<comment> guard-of-terra Maybe it is exactly because I've "wasted" a lot of time on leisure activities so I have quite some fond memories.

Did some nice things professionally, too.

<comment><USER48> I am right there with you. I am a little over half way through my 30th year of life. I have "wasted" a lot by having a ton of fun and enjoying myself, while also getting plenty done professionally. I am excited about the future, and also intrigued with this concept of another 30-50 years of productivity, but like you, sometimes I can accept a fate of being 'finished'. It's weird, but not in a morbid way, more like a, "I'm so blessed to have been able to do all this amazing stuff" kind of way.

</comment></comment></comment></comment><comment><USER49> Recently I saw a conference presentation from an 80 year old who had just created a new CPU on an FPGA and ported a graphical operating system onto it :-) [https://twitter.com/lukego/status/436558489910255616](https://twitter.com/lukego/status/436558489910255616)

</comment><comment><USER50> I'm only 35 (in hex, ha, ha!) and I've been programming professionally since 1985 when the earth's crust was still cooling. It's still a blast.

</comment><comment><USER51> One of my mentors is in his 60s (I think). He's an extremely successful architect/consultant who still does plenty of coding. His enthusiasm is what energizes me (just turned 30).

I'm not saying that people don't get tired/slower as they get older (I struggle with it), but I don't think it's inevitable.</comment>


HN: How many support requests do you get per day? - <AUTHOR>

On average, please give an estimate based on the total number of users you have.
Also, it would be nice if you could break it down into two categories: - Pre-sales Inquiries - Existing customer support requests of all kinds.
Trying to get an idea as to what to plan for.
Thanks.
P.S. I know that it will vary according to app and release events (e.g. a major feature release/UI makeover might make support requests spike), but I mean as a general rule on a regular day. <comment><USER2> Bingo Card Creator has over 200k users (4k paid) and, in a typical week, gets about 2k new trials. (New trial users dominate support requests.)

I average about 2 pre-sales inquiries and below one support request per day (call it 5 a week maybe). This is after several years of optimization to kill things prior to them getting in my inbox: if you extrapolated from my 2007 numbers, I'd be dealing with hundreds of emails a day.

Appointment Reminder is not nearly as mature, and sales is higher touch than BCC. As a result I end up writing orders of magnitude more email per customer than I do with BCC. The total burden in terms of emails is lower, the time burden is higher because most issues are novel (I haven't had a novel BCC issue in, hmm, months?)

I do not use macroed-up responses to CS issues, but I honestly should.

<comment><AUTHOR> Thanks as always patio.

At least now I have, what I would consider a 'fringe' case. Not in a bad way, but a case that shows me the possibility of having a few K paid users with very light touch daily customer support.

Look forward to hearing others.

</comment></comment><comment><USER3> DNSimple has been in business since June 2010 and has just over 300 paying subscribers. I usually average 1 to 2 support requests per day. I may only get 1 to 2 pre-sales inquiries per week - most sales occur via self-service. I hand craft each response for support emails.

HTH.

<comment><AUTHOR> Thanks for sharing aeden. How many non-paying users do you guys have (if you have any) ? How many support requests come from those ?

<comment><USER3> We don't have non-paying users. :-)</comment></comment></comment>


The West Is Becoming More Like China - <AUTHOR> https://asia.nikkei.com/Opinion/How-China-reversed-the-new-Great-Game-of-strategic-competition <comment><USER2> Countries envy what China has become? Maybe those countries should be reminded they had all this in 1933, with a catchy theme song, and all the spätzle they could eat. They didn't seem so envious then, spent something like 17 trillion (adjusted) to be less like China.

</comment><comment><USER3> _" Whatever the price of the Chinese Revolution, it has obviously succeeded not only in producing more efficient and dedicated administration, but also in fostering high morale and community of purpose. The social experiment in China under Chairman Mao's leadership is one of the most important and successful in human history." _

-D. Rockefeller

<comment><USER4> This is not at all what the article is about? I do not think the Chinese are as unified as they are made out to be.

I think it's a joke to pretend that China is some ideal to aspire to, but sadly, I think the West will have to use similar tactics to continue to compete.

I believe a big part of China's current strength is by actively exploiting the weaknesses of Capitalism. For a long time, they've exploited the race-to-the- bottom of pricing, and they've gotten rich from it, partially through the sacrifice of their people.

Now that China has that new-found wealth (the country and the people), they are using that wealth to exploit Capitalism in a different way. Since Capitalism is inherently less directed and "top-down", now they're able to manipulate industries by being a big buyer instead. This is inherently part of Capitalism, but since the Chinese government has a more direct control of their economy, they're able to leverage a huge amount of economic power in a more directed fashion.

You want to sell that product here? Well, you're going to have to do it our way. Western governments will have to do the same, putting restrictions on what compromises Western companies are allowed to make, and putting restrictions on Chinese products as well.

<comment><USER5> Exploiting the weakness of capitalism sounds like a joke, because capitalism is the ideal American claims to be persuing but somehow if China wins, it's exploiting the weakness of capitalism, and if America wins it's another victory of our democracy.

<comment><USER4> I'm not sure what you're trying to say here. It sounds like you're saying that I'm somehow framing my opinion in a dishonest way, but I'm not sure in what way you're claiming it is dishonest.

Is it because my comment isn't pro-authoritarian/totalitarian?

</comment></comment></comment></comment><comment><USER6> Some have observed that the average family income of dictatorships tends to plateau at about half that of mature democracies, regardless of the economic system used. Things inside may start to get edgy when they hit that ceiling after everyone being used to growth. (Due to China's sheer size, half is still a big chunk of economic power.)

</comment><comment><USER7> I've written this multiple times on HN: democracy is a weird and temporary quirk, the natural state of mankind is totalitarism.

For the short period of time (1.5 century) we were in this state where masses were educated well enough to demand political rights for themselves, and elittes didn't have the means to fully control them, so the compromise called "democracy" was made.

Nowadays, with technical advances in many areas, like online banking, smartphones, social media, AI it again becomes possible for elittes to excercise total control over average citizen, therefore mankind will soon revert to it's natural, totalitarian state.

<comment><USER8> China isn't totalitarian. I'm a little tired of the impoverished discourse around non-democratic governments. China is an autocratic country, which is to say it's a completely depoliticised society, whereas the defining feature of totalitarian societies is mass mobilisation. China aims to be like Singapore, as Gibson called it "Disneyland with the death penalty", rather than a totalitarian state.

In contrast to historical elite government or totalitarian states the party in China is very much accountable to the population and its well-being. The justification for their continued existence is rising the standards of living and successfully managing society, which renders comparisons to pre-democratic times moot.

<comment><USER9> > justification for their continued existence is rising the standards of > living

It is a "justification" but since failing to do it does not come with any penalties there is no actual accountability. Mao starved 50 million of his comrades by mismanaging society and outright killed a few million more being paranoid -- and they didn't kick him and his cronies to the curb, instead they venerate him like a god and give his friends' grandchildren sinecures.

The fact that China lagging decades behind South Korea or Taiwan for 50 years didn't get the CCP ousted tells you how thin the veneer of "accountability for rising living standards" is, and how much the party actually rules with an iron fist.

<comment><USER8> This is too myopic and one-sided. The cultural revolution created carnage but China also saw unification, the biggest increase in life expectancy and literacy in modern history, and essentially the development of what is now modern China.

And yes, the CCP is effectively unoustable but the CCP _is the government_ , not just a Western style party, it's a complex governing body. For factions and individuals within the party there absolutely is an incentive to perform, and the party had countless of purges due to unrest.

Don't forget that Xi himself was sent to the countryside under the program of the same name after his father was thrown into prison. The party isn't going to go away, but the authorities in it absolutely are subject to scrutiny. Also Taiwan of course was subject to one party rule until the 90s and not a democratic nation either, and neither was South Korea under Park Chung Hee. Economic development in all three countries did not take place under democratic government.

</comment></comment></comment></comment><comment><USER10> non-paywalled link: [http://archive.today/j83zb](http://archive.today/j83zb)

</comment><comment><USER11> But let's continue to worry about Russia Russia Russia.

<comment> blaser-waffle The Russians have a literal "Manchurian Candidate" in the White House, who is openly murmuring about a 3rd term and displaying openly totalitarian tendencies.

A report released by the Senate Intelligence Committee that just came out today clearly demonstrated that Trump received extensive and unprecedented levels of help from the Russians to get into office.

The Chinese are walking, talking examples of the book 1984 -- but that doesn't mean Russia shouldn't be focused on either.</comment></comment>