"The government does not have access to Google servers" - <AUTHOR> https://plus.google.com/+google/posts/TMh6gUVrwMq

<comment><USER2> The government has done irreparable harm to these companies, because even if they are telling the truth, they will never be able to prove it (like Obama could never prove he wasn't born in Kenya) Each new bit of evidence supporting their position will be met with just more questions. That's the problem with government spooks, their capabilities are boundless, anything the mind can imagine, and there's simply not way to erase doubt. Can the NSA break public key encryption? No? Are you 100% sure? Does the NSA have a fibre-tap on all cables? Are they running continuous keyword searches on transcribed conversations of every American, in real time? Can you prove they don't have some secret new $30 billion data center, paid for by the $60 billion in Iraq money that went "missing"?

10 years from now, people will still be talking about this.

We need to roll back the Patriot Act, period.

<comment><USER3> They can prove it. Comprehensive independent security audits managed by well known privacy and human rights organizations. Considering the scale of Google they should have number of people auditing them all the time.

</comment></comment><comment><USER4> People are merging two different mechanisms here, and its important to distinguish between the two.

1) Access to users when provided with a "warrant" or someother legal instrument. This is where for example a divorce court orders the message history of a person from facebook to confirm/deny infidelity. This is your "Facebook secure room/portal" business. You don't want any tom dick and harry having access to this as its a massive security hole. 2) Snooping. This is where apparatus is placed between the public and a company which allows the interception of all data.

These are two very different mechanisms, 1) is a precision tool for getting information on a small amount of users. 2) is a blunt tool that allow people to stuff themselves full of information, it is also inherently very expensive(both in time, resources and analysis).

both method 1 & 2 have been going on for many years. Its also been fairly well known for many years (schneier and crytptome have been saying this for a very very long time)

So why did the NSA ask verizon (and most likley all the big players) for this list of who phoned whom, if they have all this information kicking around? two reasons: Its dirt cheap, and accurate.

Instead of having to infer who was on what IP at what time, you have the canonical proof.

</comment><comment><USER5> The President himself acknowledged existence of the program, so that is no longer in dispute. I am, however, starting to think that perhaps the leadership of these companies truly didn't know that this has been going on.

I'm curious if these orders can be served directly to mere employees that have access to install the monitoring software/hardware, with confidentiality obligations barring them from telling their employer. Another explanation may be that NSA agents simply obtained jobs at each company, and those agents installed the monitoring software/hardware without the knowledge of the companies. This would explain the dismay, and the clear embarrassment of the NSA.

</comment><comment><USER6> The problem with all the denials is that journalists say "Google is doing X" and Google responds "We aren't doing Y" and everyone debates whether Y = X, Y is a subset of X, or Y is something completely different.

I feel as if so much could be cleared up if they would simply respond line by line to the stories by the NYTimes and Washington Post.

<comment><USER7> [http://www.theonion.com/articles/the-onion-urges-barack- obam...](http://www.theonion.com/articles/the-onion-urges-barack-obama-to- come-clean-about-t,32466)

<comment><USER6> Weird, somehow extra characters are being added to the end of that url. Removing the trailing / fixes it.

[http://www.theonion.com/articles/the-onion-urges-barack- obam...](http://www.theonion.com/articles/the-onion-urges-barack-obama-to- come-clean-about-t,32466)

<comment><USER7> a'a

Thanks, fixed. Looks like HN is over-escaping some values -- click the 'link' link to this post and see how the first line is over-escaped in the title bar?

</comment></comment></comment></comment><comment><USER8> This denial is fairly categorical. Any objection that centres on the idea that they're only saying this because they have to is in conspiracy theory territory. Nothing that Google says could possibly disprove that claim.

<comment><USER9> "According to the law" actually means "yes, we give the Government all access". Read this:

[http://techcrunch.com/2013/06/07/doublespeak-denials-and- bro...](http://techcrunch.com/2013/06/07/doublespeak-denials-and-broken- hearts&#x2F);

<comment><USER10> how can you possibly think that a terrible techcrunch post poorly hashing together parts of this story is a good argument here? ugh.

If you're actually interested: the only source of facts on that whole page is the NYTimes piece they link to: [http://www.nytimes.com/2013/06/08/technology/tech- companies-...](http://www.nytimes.com/2013/06/08/technology/tech-companies- bristling-concede-to-government-surveillance-efforts.html)

</comment></comment></comment><comment><USER11> I will go on record as standing with Google and its denials, even if that's an unpopular position right now.

Here are a few facts:

1\. The New York Times article did not specifically cite PRISM, it only cited FISA, which was already largely known by the public. It is true that this could be because PRISM is allegedly _justified_ under Section 702 of FISA, but they _are not the same thing._ [1] It would be most appropriate to say that one encompasses the other, but they have two separate protocols, and as of right now, only one was discussed by the Times.

2\. Let's say the NYTimes article _is_ about PRISM, and they simply didn't mention that acronym for whatever reason. If that is the case, the information leaked therein also makes it very clear that it is _entirely possible for CEOs, chief officers, and other high ranking employees to be completely in the dark about it._ The only people allowed to know about the requests for information are those who receive and analyze the requests. That's not a conspiracy theory - it's leaked right along with the rest of the information.[2] Mark Zuckerberg, Larry Page, Dave Drummond, Yonaton Zunger, etc. might literally _not know_ the extent of how far the government reaches in their companies.

3\. It is unreasonable and unrealistic to expect the leaders of these named companies to stand together in righteous technological might against The Man. Nothing practical would be achieved by having Mark Zuckerberg or Larry Page penalized for what they said on record, in public against a government agency. Nothing would benefit the American people by having them put on trial or their companies sued for violating national security. The NSA designed a Catch-22 gag order that prevents those involved from even acknowledging the existence of government involvement or letter agencies, let alone detailing specific protocols or history.

I've said it before and I'll say it again. _Stop_ getting distracted from the real problem here. The threat to privacy is the NSA. The threat is _our_ government(s). We have the power to fight it _if_ we consolidate our focus with precision. We may feel wronged by the apparent lies of public figures but they had no choice, if they were even in the wrong. We cannot know what pressures were put upon them at this point in time.

Lay down your pitchforks and direct your anger and incredulity to your government, who ordered this - the public entity that made this legal and hidden and nearly impossible to speak out against. That is your real enemy.

[1]: [http://www.theverge.com/2013/6/7/4407782/phone-spying-and- pr...](http://www.theverge.com/2013/6/7/4407782/phone-spying-and-prism- internet-surveillance-whats-the-difference)

[2]: [http://www.nytimes.com/2013/06/08/technology/tech- companies-...](http://www.nytimes.com/2013/06/08/technology/tech-companies- bristling-concede-to-government-surveillance-efforts.html)

<comment><USER9> > _Lay down your pitchforks and direct your anger and incredulity to your > government, who ordered this_

It's also important to raise the awareness that our data isn't safe in Google's hands.

<comment><USER12> If you're going to say your data not safe in Google's hands, then your data just isn't safe on the internet which I think is a needlessly extreme position to take. The OP is right, just focus your dissatisfaction on the government. It's not about is your data safe with Google; it's about your data safe with the government. If you can't trust your government, it doesn't matter where/who/what has your data. Yesterday it was Yahoo & myspace, today Google & Facebook, tomorrow who knows... the only constant is an abusive government. Fix that, then it won't matter what currently trendy company has your data.

<comment><USER13> > If you're going to say your data not safe in Google's hands, then your data > just isn't safe on the internet which I think is a needlessly extreme > position to take.

Google isn't the internet.

Dump gmail, FB and other spy holes. Use public key crypto. Take your own network back.

Or continue on as usual. Our choice.

<comment><USER12> So basically communicating online only with people that will use pubkey- crypto? I think that's a needless extreme. Also, what happens when everyone does that and the government makes crypto illegal? You're back to the original problem, the abusive government. That being said, I did just suggest encryption in an earlier post today... but that was before I started getting the feeling this problem goes deeper into the government than just a small gov-agency & some cellphone companies.

<comment><USER9> The problem with PGP is that friction is in every message you send. For every email you have to make the decision about encrypting the message and entering your passphrase. It's a hassle.

The reason I recommend Bitmessage is because after overcoming the friction of installing it, it's frictionless. You don't have to remember passphrases or anything. It also has advantages over PGP-encrypted email like deniability, built-in spam minimization, broadcast messages (like Twitter), chan boards, etc.

</comment></comment></comment></comment></comment></comment><comment><USER14> I'd love to see someone check the Takeout logs and look for anything which seems out of place. Requests for user data which aren't correlated with normal user activity would seem mighty suspicious to me.

Go on, someone, make it so. Then leak it. Let's do this thing.

</comment><comment><USER15> There is a big issue with as-need-bases systems. It requires security clearance on their google counterpart side.

Every time NSA, FBI requests user's private info from google they'll [the government] be divulging the identity of a suspect or a potential suspect. This leads to potential leaks or potential reputation damage. Imagine if a congressman or famous CEO is under investigation. So the person/people inside google ought to have the same clearance OR google would need to give a back door access to the government. Which is why I don't believe google.

If google is sincere about their position, they should setup their systems so that no one but the user(owner) would ever be able to access their private data.

</comment><comment><USER16> If we assume that everyone is telling the truth and that there is no back door or drop box, couldn't they simply get the data with man-in-the-middle type software? Getting data from Google, Facebook, Yahoo, and co is nice because it comes to you in a structure way but that wouldn't stop me from trying to get information in many others way, including working with the internet providers to put servers that copy data and direct them to my data center.

</comment><comment><USER17> I missed the article/story behind PRISM and who unveiled it. Too much noise right now to find it.

But what makes the person who unveiled the PRISM more credible than all of the Tech companies?

Also, I don't think they are playing with words or intending to do so. They are making it quite clear in my opinion.

</comment><comment><USER18> Wild speculation, but what about TLS key misappropriation? In other words, NSA has access not through official channels but somehow got private keys through hook and crook?

(I have to admit I do not fully understand PFS and the implications here.)

</comment><comment><USER19> According to the NY Times

>employees whose job it is to comply with FISA requests are not allowed to discuss the details even with others at the company

So it is possible that executives are not allowed to know what data their companies are supplying to the government.

</comment><comment><USER20> So I checked out some of the user profile of people who are flat out proposing that google is colluding with the government and is lying right now to the users and they don't believe any official word coming out from google.

Not only are their google+ profile very active, I am going to assume they are still using and most likely will be using google products (or products from other companies who has been implicated) months from now even if nothing changes.

The question is, lets say you are absolutely sure beyond any doubt that all these companies willfully (or unwillingly but now lying to you) shared data with the government. What do you do now?

Do you accept it as it is and carry on? Do you stop using their service? Or do you campaign to stop these companies and government from doing this (seems highly unlikely to be effective or verify)?

<comment><USER21> I'm likely going to use their services in a reduced capacity whether they were complicit or not, simply because this incident has highlighted the risk of companies who store massive amounts of personal information consolidated together in one place. Even if their only reason for doing so is advertising, I'm less interested in participating in systems that collect and store so much information on me. This probably should've been obvious before (people have certainly been saying similar things for a while), but recent revelations have made me more prone to agree.

The problem, of course, is that some Google services are nearly irreplaceable, especially search. There are alternative search engines, but they simply aren't as good for the technical type searches that a programmer needs. Duck Duck Go is better than some older alternatives have been, but when using it I frequently find myself having to return to Google to actually find what I'm looking for. I wish them luck and hope very much they keep improving, as I'd like to use them, but so far I can't really.

</comment></comment><comment><USER22> "and if the government DID have access to Google servers, we would be sworn to secrecy under penalty of prison and fine"

</comment><comment><USER23> Even if it did, imagine how awfully damaging that would be for Google's image _worldwide_. So I could see why their immediate knee jerk reaction about it is to hide it as much as possible.

If he is telling the truth, at least about this _very specific thing_ (not having access to "Google's servers"), then it's still possible they are giving them easy access in some other way, such as copying the data to other servers that are "not Google's servers".

So worse case scenario, he's blatantly lying about it. Probably best case scenario, they're still giving them the data wholesale in some way, and he's playing word games and semantics.

I have a very hard time believing none of this is happening, at this point. I hope I'm wrong though, but even then, the NSA probably has direct pipes into the carriers and ISP's, and at the very least have access to all the data going through US pipes that is unencrypted (and the encrypted data is stored for later - i.e. the 5 billion terrabyte Utah data center).

<comment><USER24> > Probably best case scenario, they're still giving them the data wholesale in > some way, and he's playing word games and semantics.

No, the best case scenario is he's telling the truth and Google only gives specific data in response to specific court orders that have been reviewed by their lawyers.

Normally I love reading the comments on HN, but I've just despaired over the last couple of days. People are assuming that out-of-context fragments from a Powerpoint presentation are 100% correct and when every single company gives a _flat-out denial_ , then the companies must be lying or misleading or slippery.

The law does _not_ require these companies to issue denials.

<comment><USER25> Just a reminder: we are not all US citizens. There is no American court order or warrant that makes it legal for Google Ireland to hand over data about EU customers to the US government. They have admitted to doing this already[1] years ago. It's likely illegal under data protection laws for EU businesses to use Google services (or any other US based web service) to store customer data.

 _Google has sent us a statement that reads: "As a law abiding company, we comply with valid legal process, and that - as for any US based company - means the data stored outside of the U.S. may be subject to lawful access by the U.S. government."_

[1] [http://news.softpedia.com/news/Google-Admits-Handing-over- Eu...](http://news.softpedia.com/news/Google-Admits-Handing-over-European- User-Data-to-US-Intelligence-Agencies-215740.shtml)

</comment></comment></comment><comment><USER26> "The government does not have access to Google servers"

No they just have Google's SSL private keys- perhaps...

</comment><comment><USER27> It's getting to the point that there is no the business case for Google to stay in the US.

</comment><comment><USER28> The real question clamoring for a clear statement is far more complex:

Does any government, US or otherwise, their agents, representatives, contractors or NGO's have access, directly or indirectly, through any means, to <insert company name here> DATA, FILES, COMMUNICATIONS, LOGS or any other information having any relationship whatsoever to <insert company name here> users?

This could be, and probably should be, refined, IANAL.

The point is simple: We don't care about "direct access to servers". We care about access to data. And this can be provided through many channels, direct and indirect. It can even be provided via daily tape backup dumps. Of course, it can be provided to organizations peripherally working for or with a government yet not directly to a government agency. And, finally, it could be provided to another government that, in turn, can pipe it back to US governnment agencies or collaborators.

The rabbit hole can be very deep.

</comment><comment><USER29> "cause the servers belong to the NSA,not Google!" ;)

<comment><USER30> It's possible. No mention of access to collected data.

</comment></comment><comment><USER31> The government would never need access to Google's servers; it would never need a back door. A front door API would work just fine.

Some people have correctly pointed out that if Prism is considered 'law' (falling under any number of national security laws), then all Google is doing is complying with the law.

And in that case, what Drummond just said in no way actually denies participation in Prism or a similar program.

<comment><USER32> Except that he straight out said that they have received no bulk requests at all? Seriously...

<comment><USER31> Are you qualifying a real time feed as a bulk request?

<comment><USER32> I'd consider "give us every piece of data you ever get" a bulk/blanket request - yep.

</comment></comment></comment></comment><comment><USER33> This is modern doublespeak in action, the actual inversion of meanings. Translation: "Government has all access to our servers."

The message is loud and clear from Google that we need to know doublespeak when we hear it. Class is in session!</comment>


GNU/Parallel changed my life - <AUTHOR> http://unethicalblogger.com/posts/2010/11/gnuparallel_changed_my_life

<comment><USER2> _"Unlike xargs however, Parallel lets me make use of the many cores that I have access to [...]"_

 _Unlike_ xargs? That's just plain wrong, see xargs' -P flag.

<comment><USER3> xargs can't distribute tasks to remote CPUs though.

</comment></comment><comment><USER4> Oh man ! I wish someone had told me this before. Back when i did research for my BSc thesis, I had an 24 core machine and wrote a script to create 24 bash scripts to split up my task which i would than run in parallel.

Sometimes I have the felling that I am wasting time when I check HN too often, but stuff like this makes me think otherwise.

<comment><USER5> You could have also used "make -j", depending on your specific task.

<comment><USER6> This is sometimes true.

I think that Parallel is more interesting as an instant server-farm for "taco bell programmers" -- q.v. <http://teddziuba.com/2010/10/taco-bell- programming.html> and <http://news.ycombinator.com/item?id=1818816> for the HN discussion -- as per Mr. Dziuba's definition.

Like, async spidering with parallel is a one-liner, but comparatively, have you seen how much absurdly syntaxed pycurl boilerplate you need? It's crazy. I for one will take the simpler method any day.

</comment></comment></comment><comment><USER5> Previous discussion on GNU parallel:

<http://news.ycombinator.com/item?id=1801186>

</comment><comment><USER7> "Changed my life," a bit dramatic methinks.

</comment><comment><USER8> That is just going to thrash hell out of your disk unless it's executing on distinct machines with data well spread over a shared filesystem.</comment>


IPhone voted one of the world's best inventions (8th out of 100) - <AUTHOR> http://newslite.tv/2010/05/18/iphone-voted-one-of-the-worlds.html <comment><USER2> The iPhone a better invention then the compass or the combustion engine? That's laughable. Merely shows how much thought the voters put into their answers.</comment>


Activation Energy for Startups: Lowering the Barrier to Launch - <AUTHOR> http://blog.marksweep.com/post/12061778083/activation-energy-for-startups-lowering-the-barrier-to

<comment><USER2> Gotta respect anyone using a graph of entropy in a chemical reaction on a business post. Nice!</comment>


Microsoft President Brad Smith Acknowledges They Were Wrong on Open-Source - <AUTHOR> https://www.phoronix.com/scan.php?page=news_item&px=Microsoft-Pres-On-Open-Source <comment><USER2> I'll believe Microsoft has changed when they finally stop demanding royalties from various companies for their opaque list of patents that they claim Linux violates.

"Once a Microsoft, always a Microsoft". A leopard doesn't change its spots.

Beware of Microsofties bearing gifts. It's phase one: "EMBRACE".

</comment><comment><USER3> Very minimal article, not the kind I usually like to see because it's all of 250 words or so...

But in this case, Brad's quote is amazing and demonstrated real humility.

> Microsoft was on the wrong side of history when open-source exploded at the > beginning of the century and I can say that about me personally. The good > news is that, if life is long enough, you can learn...that you need to > change. Today, Microsoft is the single largest contributor to open-source > projects in the world when it comes to businesses. When we look at GitHub, > we see it as the home for open-source development, and we see our > responsibility as its steward to make it a secure, productive home for > [developers].</comment>


Global Fishing Watch – Technology to Illuminate Global Fishing Activity - <AUTHOR> http://www.globalfishingwatch.org/

<comment><USER2> "Global Fishing Watch is the product of a technology partnership between SkyTruth, Oceana, and Google that is designed to show all of the trackable fishing activity in the ocean."

</comment><comment><USER3> This is huge. People don't understand how close we are to the 'point of no return' in regards to fish species and the ocean's ability to sustain life.

Asian countries are a key source of that problem. Guess which one...</comment>


Ask HN: Prisoners Not Allowed to Study Programming? - <AUTHOR> I have a friend in federal prison (he developed a drug addiction and got arrested for theft).  Not a bad person or anything, just had some problems.  Anyways, he's always been interested in my job (software engineering) and has wanted to learn.  I told him I'd send him some books to learn engineering, especially since he has a lot more free time to read now.  I sent an introductory book on programming and it was not allowed to be given to him because it the prison said it posed a threat to order and security.  I believe this is because they have access to a computer in the library where they can send some very basic messages, and they're afraid they'll figure out how to "hack" this computer.
Considering that software engineering is the perfect job for an antisocial person, I feel this is a huge mistake by the prison system.  If someone has the aptitude for software engineering, this should be encouraged as a path to reintegration with society.
I was wondering what other people's thoughts were on this, do you think an introduction to Ruby On Rails, PHP or JQuery is dangerous to teach an inmate?  Should this policy be changed? <comment><USER2> I think you have the situation wrong.

Federal bureau of prisons will not let you mail books on any subject to inmates unless directly from the publisher. Did you buy the books new from Amazon shipped direct? That's pretty much the only way they get the books.

Imagine the number of steel files tucked in the spines or hollowed-out pages, and LSD-soaked paper they'd have to deal with.

<comment><USER3> > Federal bureau of prisons will not let you mail books on any subject to > inmates unless directly from the publisher.

That's not precisely true. BOP allows _softcover_ books at minimum and low security facilities from any source, but hardcover books or any books at medium and higher security facilities must be shipped directly from "the publisher, from a book club, or from a bookstore." (And exceptions can be made, though it requires a special request, if the book is no longer available from those sources.) But shipping from Amazon direct, as was reported elsewhere in the thread to be the case here, would seem to be okay.

Software engineering would not categorically seem to fall into any of the explicitly listed (but expressly not exhaustive) problem categories (unless you perversely misread "written in code", which seems clearly intended to refer to encyphered/encrypted content), but the threat to order justification is fairly elastic (though a warden's decision on this can be appealed by the inmate or an independent review may be requested by the sender or publisher.)

[https://www.bop.gov/policy/progstat/5266_011.pdf](https://www.bop.gov/policy/progstat/5266_011.pdf)

<comment><USER4> Every prison mailroom is different, I usually just ignore what the bop or state website claims and phone the prison mailroom directly to ask. In general, all books must come from a store/publisher, and have an invoice. I use Books A Million for prison deliveries because they always include an invoice and Amazon often doesn't.

Anybody wondering some good books for prison are the Little Schemer series of books, since they can be done with pencil & paper. The Schemer's Guide is another pencil & paper boook if you can find it. Kernighan also has a good book for this but it contains a chapter on cryptography which some prisons may not allow but I haven't had any problems yet "Understanding the Digital World: What You Need to Know about Computers, the Internet, Privacy, and Security" or get the older paperback version "D is for Digital". They give an intro to programming. Code by Charles Petzold, a really good intro book, may not get in either just because of the title.

</comment></comment></comment><comment><USER5> I have sent friends who were incarcerated (Texas prison system) programming books; I haven't had the same experience. With most issues in the prison, there's a lot of subjective judgment, often by lower paid employees without much training or experience. Your best bet is to contact the prison's office and ask to discuss the issue with someone at the major or warden level.

<comment><USER6> That sounds like a good avenue, promote it as learning a skill to get a job and re-integrate. Maybe also explain that it takes a fair bit of effort and study to master so it would focus the prisoner's time on something productive.

</comment></comment><comment><USER7> In my CS major, continuous math, discrete math, graph theory, probability and statistics, linear algebra etc. were prerequisites to other courses. So see if those books are blocked as a "threat to order".

If those get through and he reads through them, try sending things like "An Introduction to Formal Languages and Automata", "A First Course in Combinatorial Optimization" and this sort of thing.

There are also prison reform groups like FAMM that you can talk to.

</comment><comment><USER8> I teach a programming course at my local jail, so there are institutions that allow it. In my experience, the jail prefers if the books come straight from Amazon or other known companies, so you might want to try that.

<comment><USER9> This would be a wonderful topic for a blog post or article, if you're ever interested!

<comment><USER8> Feel free to email me! I am happy to answer any questions.

</comment></comment></comment><comment><USER10> The stereotype of SW engineers is that we are asocial, as in socially inept, but antisocial (as in breaking the rules of society) AFAIK we are not, if anything the stereotype is the opposite, we are seen as tranquil calm persons (even shy) respecting the laws around us.

<comment><USER11> Software engineers aren't thugs, you're right that they're often soft-spoken and polite -- but they also do not have a history of respecting tradition and laws they view burdensome.

For example, look at the startups, Uber and AirBnb started by explicitly violating laws. Uber has even demonstrated, again and again, contempt for the law.

Then look at the founder-types: Thiel, Gates, Zuckerberg, Jobs, Ellison, etc... They're often anti-social and on the asperger's spectrum. They disregard convention. Violate laws as need be. And can be ruthlessly individualistic/libertarian. Read Thiel's book "Zero to One" or watch the documentary "all watched over by machines of loving grace" for more on this topic.

Look at the stories and discussions posted on this site -- they're often against the grain. There seems to be a keen interest in drugs: psychedelics, MDMA, Ketamine ("as a treatment for depression"), and nootropics ("productivity!"). The libertarians here relish in cryptocurrencies. And there's a prevailing anti-union, anti-socialist, and even anti-SJW attitude: the population here seems to be bright, if isolated, individualistic and perhaps mildly autistic males.

Paul Graham's essays aren't conventional. And other leaders in this domain, such as Naval Ravikant, rail against the "overton window".

<comment><USER12> Uber etc is not so much software engineers breaking laws as enterpreneurs and managers doing that.

Also, people are too quick to see autism where mere arrogance would be sufficent to explain the same behavior.

Yet also, Zuckerberg did not worked as engineer for long. These are all primary managers with some engineering background rather then engineers earning money from being engineers.

<comment><USER11> I'm pointing out a curious trait of the tech industry as a whole -- the ethos of the community.

Whether or not the names listed currently work as software engineers, or whether or not they all have autism, is inconsequential.

<comment><USER12> You said: > Thiel, Gates, Zuckerberg, Jobs, Ellison, etc... They're often anti-social and on the asperger's spectrum.

So yes, it does matter whether they are autistic or not.

> Software engineers aren't thugs, you're right that they're often soft-spoken > and polite -- but they also do not have a history of respecting tradition > and laws they view burdensome.

You are talking about software engineers in general, so it does matter whether people you have in mind are software engeneers or good representants of average software engineer.

> I'm pointing out a curious trait of the tech industry as a whole -- the > ethos of the community.

What community? HN and startup crowd represents very specific subset of the industry. Business and management represents business and management, not sofware engineers.

<comment><USER11> Written language works a little different than programming: the references can be a little looser, a little more imprecise -- particularly if the vehicle is a written comment on a message board.

I was attempting to quickly outline an attitude, and orientation, that affects the tech industry as a whole. This attitude is not limited to currently employed software engineers, founders of tech companies, or people with accounts on Hacker News. And no, this attitude is not so pervasive that it affects everyone in the tech industry. But yes, this attitude is probably more common amongst software engineers than say people in marketing within the same industry.

My observation isn't even novel: we can find echoes of it all over as I briefly tried to point out.

<comment><USER12> This has nothing to do with language vs programming. This is about your want to use loose definitions so that you can generalize non engineers behavior and combine them with engineers stereotypes so that you can blame engineers for actions of non engineers in same industry you dislike.

So you had used language to build image of autistic charismatic rule breaker. So I will add that you don't know what autism is and interacted with such person enough to know.

You still did not managed to cite a single engineer. You did not even demostrated knowledge of engineering culture beyond what is found on few cool sites frequented by ... enterpreneurs and many non engineers.

Afaik, if you claim that marketing is more orderly and more rules following and engineers, you should have used an example of typical marketing person action and typical engineer action. For some reason, you went with high management and enterpreneurs.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> First off, that sucks for your friend. I would hope they would be able to learn programming. I think the policy should be changed, but I'm also not even sure if it's a policy, or if different prisons get to make those decisions.

I think one of the logistical issues is I'm not sure prisoners have great internet access, in terms of either time, size of things downloaded, or having a persistent space to store their own data, if it's on a public computer. I'm not sure for example if they are allowed a laptop in their cell, or something like that. Probably not?

Makes me wonder if there's a way to compile resources on a USB drive that would have the software required, and the books / knowledge, without necessarily accessing the internet, and a place to store files on. Kind of like a class on a stick.

<comment><USER5> Most prison systems will not give the inmate access to a computer to write code, and definitely will not let them keep a USB drive, etc. The books you'd want to send would need to be those that could be followed without access to a computer. (A friend I sent Hartl's Rails tutorial in print was frustrated by errors in the print version that weren't in the online version)

</comment></comment><comment><USER14> If you believe prison is for "punishment" and that prisoners are "fundamentally bad" then the answer is no - don't let them do anything that could improve their lives. However, if you believe prison is for "rehabilitation" and that "people can change" then exposure to current tech, within reason, would be good thing. I vote for the latter, mainly because almost everyone who goes in comes out.

And now for the off-the-rails part of my answer... maybe we could limit prisoners to outdated technology - they might end up with decent jobs maintaining old mainframes or Cobol or Fortran - somebody is going to have to do it and a lot of the old school guys are retiring.

<comment><AUTHOR> That was actually kind of my thinking. There's a huge demand for these technologies at lower salaries than your tech hot spots, so most younger talent won't be interested in learning. Yet a 60K a year job would be AMAZING to the average felon.

<comment><USER15> Uh, this is unrealistic. I came out of prison with programming knowledge and not a single company would consider me because of my record. Its why I have a shed manufacturing business now.

<comment><AUTHOR> I think a program like this would have to work to build relationships with organizations, and it would be an uphill battle.

Perhaps focusing on very specific skills, like test coverage and documentation would be more amenable to an organization than DB Admin.

<comment><USER15> Its a security risk. Allowing a felon access to the company network is irresponsible.

</comment></comment></comment></comment></comment><comment><USER16> Seems obvious everyone here will agree with you. Question is how to create the change needed.

<comment><AUTHOR> yeah, I'm hoping for some recommendations, maybe should have indicated that.

</comment></comment><comment><USER3> > Should this policy be changed?

The policy you have inferred from this single rejection does not appear to formally exist, so asking if it should be changed may be premature.

</comment><comment><USER17> I would have amazon send the books again, or another title on the same subject. Chances are some new B.O.P. employee was heavy handed based on an ignorant assumption.

<comment><USER3> > Chances are some new B.O.P. employee was heavy handed based on an ignorant > assumption.

"Only the Warden may reject an incoming publication. In the Warden's absence, only the Acting Warden may perform this function."

[https://www.bop.gov/policy/progstat/5266_011.pdf](https://www.bop.gov/policy/progstat/5266_011.pdf) (p. 3)

</comment></comment><comment><USER18> >Should this policy be changed?

Absolutely. But I have a question, is this US specific, or could we expect every prisoner around the world not be able to learn programming?

<comment><AUTHOR> I think it's prison to prison.</comment></comment>


GitHub is now free for teams - <AUTHOR> https://github.blog/2020-04-14-github-is-now-free-for-teams/ <comment><USER2> Hi HN, I'm the CEO of GitHub. Everyone at GitHub is really excited about this announcement, and I'm happy to answer any questions.

We've wanted to make this change for the last 18 months, but needed our Enterprise business to be big enough to enable the free use of GitHub by the rest of the world. I'm happy to say that it's grown dramatically in the last year, and so we're able to make GitHub free for teams that don't need Enterprise features.

We also retained our Team pricing plan for people who need email support (and a couple of other features like code owners).

In general we think that every developer on earth should be able to use GitHub for their work, and so it is great to remove price as a barrier.

<comment><USER3> This is a great change! One request: I wish that SAML was not an enterprise feature. SAML ought be a basic security feature like 2FA—it's especially valuable for open source teams who might use a mixture of services, and an easily accessible and cheap SSO solution would go a long way in raising the security bar for all teams, not just open source teams.

<comment><USER4> SAML (and 2FA to a lesser extent) comes with some serious support burdens on the companies offering it. There's a long tail of more or less broken SAML implementations on both the service and identity provider sides, provisioning issues, configuration issues, "Sally can't login on Tuesdays" issues, duplicated slightly-inconsistent data in IdP and Service side records issues...

If you as a SaaS provider outsource your SAML integration to a third party provider like Okta or Auth0, the auth provider pricing is immediately on a "call us" tier, with a per-federation pricing in the low _four figures for each company connecting via SAML_. Let me just state that again, to have company X connect to my SaaS via SAML, I as the SaaS provider have to pay my auth provider $X,000 per year for the privilege, not counting the base enterprise tier pricing for the auth.

<comment><USER5> This doesn't make sense. Login of any kind can be a tricky problem, you need to handle passwords, rate limits, email verification, password resets, etc. In most popular web frameworks there are libraries you can drop-in that handle all of this for you (like Devise in rails). There are drop-in libraries like OmniAuth (again for ruby/rails) to make handling multiple types of Oauth login simple.

The same could clearly be done for SAML (and I've even implemented SAML and SCIM auth and user management for Okta before in an app, it's not difficult).

The problem is that the only organizations that would make this single issue of SSO support a deal-breaker are bigger companies who can afford to be upsold, so everyone treats this as an up-sell feature. This comes at the expense of the smaller companies, who can't afford to care as much about security. The industry should be making things secure by default as much as possible, and there's a big gap here in what basically every SAAS company is doing.

<comment><USER4> Passwords, rate limits, resets, etc. are the same for everyone, and so are the problems and the solutions to those.

SAML on the other hand is different for each organization. Providers pay Auth0 and the like to have developers on staff who know the pitfalls and quirks of ADFS 3.0 on Windows Server 2012 R2, so they don't have to. Dealing with a single Okta as IdP integration is like the absolute best-case scenario there is. There is also zero consistency in what actual data IdPs returns out of the box to the SPs, so now you're walking the customer's admin through setting up the proper attribute mappings, etc.

I also very much disagree that SAML is a net security benefit, at least directly. It's for convenience, top-down visibility and control into what people are using, de-provisioning services, onboarding and offboarding users at scale etc. e.g. problems that only big companies have. Many SAML implementations are just as likely to add truck-sized security holes to the service provider when done poorly, and a lot of them are done poorly.

<comment><USER6> It's a little odd to say something is not a "net security benefit" and, in the next sentence, make a powerful case for it as a net security benefit. SSO is probably the most important organization security tool there is, and a survey of tech company CSOs will average it in the top 3, if not the top 2 technology acquisitions most would make at a new firm (this is a question I've actually surveyed).

<comment><USER4> SSO is a great benefit to the customers, with real tangible security and management benefits.

I'm however speaking from the point of view of the _service provider_ (the SaaS app) and about _SAML_ in particular. I feel that the addition of SAML into a given service is a net-negative from that service's security point of view. It's a large additional complex attack surface, many open source SAML libraries that I've reviewed have a history (and in some cases open issues right now) of "pants on head" type of security errors. A popular library in use right now, has a known race condition where it gets confused if there are concurrent SAML requests happening.

And that's just the libraries. Then you have to use them correctly. The libraries do the absolute minimum checking since they don't have the context, you have to add a laundry list of your own checks to them. Just recently there was a HN article about taking SAML assertions posted to provider A and re- using them on provider B, where clearly the most basic of checks aren't in place at all. There's all kinds of confused-deputy type of problems I believe most service providers don't think about at all. And that was an easily offline checked attribute, I believe if you'd start to check how many services correctly implement even the basic "inResponseTo" check on SP-initiated flows (which requires a distributed cache on the service provider side), you'd find they don't.

<comment><USER6> I'm a security researcher with a minor focus in SSO libraries, working on OIDC and SAML right now. I've discovered and reported some of the kinds of issues you're referring to. Both OIDC and SAML are fraught in implementation, but so are all login features.

Meanwhile: we're discussing Github, not a random cat-sharing startup. Github has one of the larger security teams in the industry. The parties implicated in Github SAML are Github, Okta, and Github customers, who do not actually have to implement SAML. Github SAML is not in fact a net-negative for security.

<comment><USER4> 100% agreed, GitHub SAML is unequivocally good. I'm in the "cat sharing startup", so my view and comments are colored by that perspective. Our options are to pay $$$ for a competent auth provider, or take on a much larger and complex security responsibility than it would seem at first, that might end up compromising our entire service.

I have a theory that one reason we don't see many your-SAML-implementation-is- completely-broken reports is precisely because it's a gated enterprise feature, so few independent security researchers have the access or ability to poke and prod at them outside of private penetration tests.

<comment><USER6> The riskiest components in SSO deployments are SP-side libraries, and those are all open source. If you want to use Okta to drive those libraries, the trial account you need is free.

The worst bugs here are indeed mostly private, but that's because they're feature bugs inside of people's random products; they're like every other bug in that regard. But people do find and report bugs in the SP libraries.

I agree that SAML is risky to implement; since we agree that Github SAML is an unalloyed good thing, we'd be searching for reasons to disagree at this point.

<comment><USER7> I'm surprised you'd say SP-side libraries are open source. In my experience, it's always been mostly custom and close source in every company I've seen and done.

You take some open source pieces you can (saml, xml, oidc, ssl, jwt) but permissions, groups, user attributes, keys are always per company then the whole thing together has to be supported into end-user applications running on language and frameworks of the day with their own restrictions, so custom.

<comment><USER6> What's the closed-source SAML library you're thinking of? Every SAML integration I've seen has been done with an open-source library.

<comment><USER7> I mean the company is writing it's own code for a significant part. Let's say one has to integrate SAML/OIDC into a Java app of some sort.

One can find an open source library to handle part of the SAML or XML in Java, but it doesn't take the right settings or import user attributes as needed or handle URL redirections properly. So the company has to write a ton of authentication code to make it work. It may start from an open-source library but the result is either separate code on top or an outright fork.

<comment><USER6> One _will_ find a library to do the SAML. That library will almost certainly do the XML (most likely with xmlsec1). The library will have a call for the ACS endpoint, for the SSO login endpoint, and maybe for the SLO endpoint; it won't implement the endpoints itself, but it'll implement all the logic of the endpoint.

The company will end up writing a ton of authentication and authorization code --- it'll do that no matter what, because the application will have its own security logic, like all applications do.

(OIDC doesn't use XML. But the story is the same, with different endpoints.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Great news for everyone bar startups competing with them as it looks like Microsoft is turning their multi-billion acquisition of GitHub into a loss leader to get as many devs using their platform as possible, no doubt to flex seamless integrations into Azure which looks like they're executing exceptionally well with their acquisitions & new feature giveaways.

From the side-lines it looks like they're slowly becoming an unstoppable dominant force, what's surprising to me is AWS's / GCP's inaction, they're either asleep at the wheel or they don't see Microsoft's dev mindshare grab as a threat.

<comment><USER9> So far Microsoft isn't taking customers away from AWS. They're just expanding the total market.

But I do wonder if AWS will try to buy gitlab.

<comment><USER10> Gitlab states it wants to go public this year

[https://about.gitlab.com/handbook/being-a-public- company/](https://about.gitlab.com/handbook/being-a-public-company/)

<comment><USER11> Even before, but moreso after this and the current economic climate, Gitlab is not going public.

Even GitHub was never in a position to go public, that seems to be mere postering to drive valuation or attract M&A offers.

</comment></comment></comment></comment><comment><USER12> This is an awesome change! In case anyone else was wondering, here's what you lose by cancelling:

        You are downgrading to GitHub Free
        After April 15, 2020, ... features and limits will change:

        Protected branches in private repos
        Draft PRs in private repos
        GitHub Pages in private repos (using 1)
        Wikis in private repos
        Code owners in private repos
        Multiple issue assignees in private repos
        Multiple PR assignees in private repos
        Code review automatic assignment in private repos
        Scheduled reminders in private repos
        Standard support
        2,000 minutes for GitHub Actions (currently 3,000)
        500MB of storage for packages (currently 2GB)

<comment><USER13> It's not clear to me whether this is possible under any configuration, but: can you enforce a two-person rule? I'd like all users to be able to merge accepted PRs, but no one should be able to push directly to master (unless an admin specifically elevates permissions to do that).

The only way I can think of is to have a bot be the only one with commit access, and to interact with the bot to do merging. But that seems pretty roundabout.

<comment><USER14> This sounds like how my previous company had GitHub configured.

We couldn't push to master, but we could merge accepted PRs. Not sure if this was done with GitHub or with Git itself.

<comment><USER15> Generally speaking that's what Github's "protected branches" are, and it looks like you lose those for private repos when you switch to the free plan.

</comment></comment></comment></comment><comment><USER16> Well, this is amazing! I never would have thought the Microsoft acquisition would have these kinds of results! Congrats to Nat and the GitHub team (and by extension Microsoft) for making this possible!

I wonder whether this is a result of market conditions, or whether GitHub sees this is a first-to-market play of some sort, or whether it's something else. I hate to be a cynic given how much good Microsoft + GitHub have been doing lately, but what prevents this change from being rolled back?

Congrats again! I love using GitHub and look forward to many happy years shipping code on the platform.

<comment><USER17> I feel like anyone who lived through the 90s could have expected "these kinds of results".

Git is open source and widely supported, which doesn't benefit Microsoft. By causing GitHub-specific features to be an essential part of a "modern" or "industry standard" git workflow, they can capture more marketshare/attention, and cause alternatives to be sidelined. This requires removing all friction to entering the proprietary ecosystem, including purchasing. This, along with the acquisition of NPM, is the "embrace" part.

The next will be an expansion of GitHub and NPM's featuresets in ways that are only accessible via branded, first party tools (i.e. not git/ssh/yarn). GitHub has already made some inroads there prior to the Microsoft acquisition with of course the ubiquitous PRs as well as GitHub Issues and Actions. I imagine the ability to check out GitHub wikis as git repos will probably eventually go away to further this.

The last part ("extinguish") is turning off support for non-firstparty tools like git-via-ssh, .patch URL support, issue collaboration via email, yarn, et c. By the time they do this, few people will notice, having acclimated to the entirely-proprietary ecosystem they've been incrementally subjected to.

The goal, as always: a Microsoft editor (VS Code or Atom), editing code in a Microsoft language (TypeScript/.NET/whatever), signed off via Microsoft review software (GitHub mobile), publishing to a Microsoft website (GitHub/npm), running CI on a Microsoft VM (GitHub Actions), pushing code to a Microsoft datacenter (Azure).

It's simply a moat to prevent open, unfettered competition in any intersection of the vertical. Any weak spots (such as GitHub signup friction) are to be subsidized as they will yield benefits when later used as a cohesive whole in an anticompetitive fashion.

<comment><USER18> Luckily history has shown that competitors still exist in a world where Microsoft tried hard to "extinguish". macOS and Linux still exist, Chrome is the most popular browser (not IE), and most people who use Windows are fairly happy with it. You can try to point to Microsoft's past behavior as proof that the future of GitHub is dystopic, but I don't think their past behavior was particularly effective at snuffing out all competition and forcing people into their ecosystem. I suppose this is a matter of opinion, but I think being scared of GitHub sliding into terribleness does seem to be in the realm of paranoid conspiracy theories. Even if it does happen, git will always exist and there will always be alternatives.

<comment><USER17> > _I don't think their past behavior was particularly effective at snuffing > out all competition and forcing people into their ecosystem_

I still buy a Windows license to play video games. I don't want to use Windows or buy a Windows license.

Of course, I could always choose to not play video games, so technically you're correct that I wasn't "forced" into their ecosystem. But I'm still there and I don't want to be. This is a direct result and present day residual benefit of their anticompetitive practices over twenty years ago. These are very long games that they play; you don't make hundreds of billions of dollars by accident.

<comment><USER19> Maybe that's true, but I'd like to think Windows is the current market leader because their desktop OS was the only one on the market at the time that was user-friendly and ran on any hardware (unlike OS X).

</comment></comment></comment></comment></comment><comment><USER20> By and far the main difference between 'Team' ($4/person/month) and 'Enterprise' ($21/person/month) is SSO/LDAP [0]. The SSO tax is real [1].

[0]: [https://github.com/pricing](https://github.com/pricing)

[1]: [https://sso.tax/](https://sso.tax/)

<comment><USER21> On sso.tax, it states that "Single sign-on (SSO) is a mechanism for outsourcing the authentication for your website (or other product) to a third party identity provider, such as Google, Facebook, Okta, PingFederate, etc."

Isn't this the definition of Federation, rather than SSO?

<comment><USER22> As I understand it, federation enables two separate instances of some particular service to interact. They can still use single sign-on independently for their own authentication needs.

</comment></comment></comment><comment><USER23> Seems like Github is feeling heat from GitLab/BitBucket.

I guess the calculation here is that the enterprise contracts are where all the money is, and keeping smaller customers on GitHub is worth the price cut?

<comment><USER24> Personally, I have been favoring Gitlab over Github because Gitlab allows private repos on the free tier.

<comment><USER25> I have been favoring Gitlab over Github because their CI is the best CI I've ever used. It just works, whereas every other CI found a way to make things hard for me.

You can even spin up postgres and redis instances for tests by just specifying that you want them. It's amazing.

<comment><USER26> Couldn't agree more. Gitlab's CI is what made me finally fall in love with CI as a concept. Obviously it was needed before, but it always felt like an ugly chore. With Gitlab, it's one of the first things I do when setting up a new project.

<comment><USER27> And that's exactly how "sprint 0" should be :)

</comment></comment></comment></comment></comment><comment><USER28> Google haven't built up too much of a user base for GCP's Cloud Source Repositories service yet (my speculation), so I wonder if they're viewing Gitlab as an acquisition target.

TBQH, I don't see Gitlab lasting too much longer without an acquisition event of some sort, when facing up against this sort of Microsoft-backed feature funding. And I say this as a bigger user of Gitlab than Github (primarily because of the free private repositories and organisations).

<comment><USER29> Gitlab need only wait before GH starts adding Azure-first and Azure-only features, as they are wont to do. At that point they can just offer "the same but for any other cloud provider". Amazon, Google, or IBM, might even throw them a bone.

<comment><USER30> It seems like in the medium term, staying independent could be a huge boon to Gitlab- like you said, it'd allow them to make high quality integrations with all cloud provider utilities.

In the long term we'd probably see the cloud providers create their own social revision control projects, and then fuck around with private APIs so the quality of the integration between their cloud service and their source control leads you to stay locked in.

Even in that scenario it could make sense for there to be a 'neutral' party like gitlab, though.

I acknowledge this is my own imagination and I've no claim to know the future! :)

</comment></comment></comment><comment><USER31> For those wondering "what makes it worth paying now?", GitHub briefly addresses that:

 _Teams who need advanced features (like code owners), enterprise features (like SAML), or personalized support can upgrade to one of our paid plans._

<comment><USER32> Along with the expected limit bumps on Action execution time and package storage.

<comment><USER33> And, unfortunately, 'required reviews' (which IMO are a critical feature).

<comment><USER34> can you elaborate on what you mean by this?

because if you're referring to requiring review approvals before a PR can be merged, that's available in the free plan (under branch protection rules).

<comment><USER33> That's odd, [https://github.com/pricing](https://github.com/pricing) mentions it as a paid option.

<comment><USER35> A feature that's available for free on public repos isn't necessarily free for private repos, it seems. The wording on the pricing page isn't very clear about this, though.

If they mean that they're now removing required reviewers for public repos in the free plan, that's definitely a big step backward I think.

</comment></comment></comment></comment></comment></comment><comment><USER36> Very few companies can make me feel like part of their journey like Github (Cloudflare also)

They understand their target audience more than most of the companies out there. When they are making moves such as this, they explain what was behind it. I find it authentic.

<comment><USER37> Me too! Microsoft has done a really great job of managing the acquisition without ruining GitHub. GitHub already had a great understanding of their audience and a pulse on the community prior to being bought, so I'm really glad that they haven't lost that now that they're a Microsoft subsidiary.

<comment><USER38> > a really great job of managing the acquisition

I mean, if they hadn't done a thing it would have been a great job, too. Pumping in cash to fund previously paid features for free sure goes a long way, too, but the changes they've made so far I'd hardly call managing and more not touching it aside from making paid things free.

</comment></comment></comment><comment><USER39> I think GitHub are doing well, but one cannot deny that GitLab has carved out a fantastic niche (on-prem, private instances, OSS, etc) that GitHub doesn't compete in. So while I agree GitHub are "the" company to beat, I think GitLab is doing a good job of contrasting.

PS - No affiliation with anyone.

<comment><USER40> > "PS - No affiliation with anyone."

Sure, that's why the throwaway account.

<comment><USER41> " _Please respond to the strongest plausible interpretation of what someone says, not a weaker one that 's easier to criticize. Assume good faith._"

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER42> I hope developers still default to making their personal repos public after this change. One of the fringe benefits of GitHub is the ability to search across the entire site for uses of obscure, poorly-documented APIs. Defaulting to most repos becoming private would greatly hinder this.

<comment><USER43> I agree that's a potential concern, but you're worrying about it a year too late. Individual developers have been able to make repos private on the free plan since January 2019: [https://github.blog/2019-01-07-new-year-new- github/](https://github.blog/2019-01-07-new-year-new-github/). This announcement only affects the cost of private repos for teams of collaborators.

</comment></comment><comment><USER44> I've not been a big fan of GitHub historically, but the pace of innovation since the MS acquisition is really impressive. I wonder how much of that is MS influence vs just MS funding.

<comment><USER38> That's odd, it's the opposite for me. I did like GitHub, but then setup a Gitea and made sure to figure out how to move things over (even if I haven't done it since they haven't really given me a reason) after Microsoft acquired it. Now I watch every move with a weary eye, though truth be told so far it's going fine (mostly by being hands-off, of course).

I do assume a lot of this is their own money, but with the financial security that Microsoft offers you just can't do much wrong. Even without actual money actually moving, it might still be MS funding that makes the difference.

</comment></comment><comment><USER45> Bit disappointed that this isn't an "Everyone Wins" pricing change.

The new plan is a downgrade from the old one. For example, it will only include 3000 Github Action minutes. The old plan included 10000. The next plan up would be > 2 * old price.

Source: [https://github.com/pricing](https://github.com/pricing) vs [http://web.archive.org/web/20200406010552/https://github.com...](http://web.archive.org/web/20200406010552/https://github.com/pricing)

<comment><USER46> It depends how many users you had. [https://github.com/features/actions#pricing- details](https://github.com/features/actions#pricing-details) shows that if you have 12 members you can buy the difference in Linux Github Actions and still get ahead. The price on Mac is prohibitive though and yeah you definitely lose out there as I don't think many people on that plan have 120 people.

</comment></comment><comment><USER47> > We're happy to announce we're making private repositories with unlimited > collaborators available to all GitHub accounts.

Huh, I thought github made private repos available to free github accounts a while ago?

Looking for historical announcement, aha, it was not with "unlimited collaborators" before.

From Jan 2019:

> GitHub Free now includes unlimited private repositories. For the first time, > developers can use GitHub for their private projects with up to three > collaborators per repository for free.

[https://github.blog/2019-01-07-new-year-new- github/](https://github.blog/2019-01-07-new-year-new-github/)

So what's new is dropping the 3-collaborators-per-repo restriction.

I hadn't actually realized this restriction was there, apparently I've never used a private github repo in a free account! And the messaging from a year ago stuck in my head as "private repos are free on github now", I thought they had already done what they did today, oops.

Above natfriedman writes:

> We've wanted to make this change for the last 18 months,

So apparently they had wanted to do this even in Jan 2019 when they did something less than this...

</comment><comment><USER48> What safe guards are in place to prevent Microsoft from using GitHub to glean competitive intelligence?

Just like Facebook used Onavo.

[https://www.wsj.com/articles/facebooks-onavo-gives-social- me...](https://www.wsj.com/articles/facebooks-onavo-gives-social-media-firm- inside-peek-at-rivals-users-1502622003)

<comment><USER49> The same safeguards that are in place on Azure (which is used by 99% of Fortune 500s for either Office 365 or cloud stuff), which is to say, ethics, and the fact that if they tried it once most of those companies would reduce their spend with Microsoft immediately. Not to mention the government contracts.

<comment><USER48> Followup:

[https://www.wsj.com/articles/amazon-scooped-up-data-from- its...](https://www.wsj.com/articles/amazon-scooped-up-data-from-its-own- sellers-to-launch-competing-products-11587650015)

Surely they wouldn't also spy on their own cloud customers.

</comment></comment></comment><comment><USER50> This is pretty cool. Anyone have thoughts as to _why_ they're making this move?

<comment><USER51> GitHub has significant vendor lock-in, so it makes sense to make it free to capture the market before a competitor gets traction.

[Speculation:]

Perhaps they've run the numbers and can figure out that they make enough money from enterprise clients and will make enough more money from the 'marketplace' being a channel for selling github integrations and addons to cover this cost of not trying to monetize through supporting teams.

It also moves a large base from 'customer' with needed support to free users which don't need the same level of support.

<comment><USER52> > GitHub has significant vendor lock-in

Do they? Unless you're on GitHub Enterprise, migrating is just moving your repos over the weekend, setting up new webhooks, emailing everyone a command to switch their upstream URL, and hoping the new workflow works for you. For teams of <100, this it one of the easier transitions to make.

<comment><USER53> How are you gonna migrate issues and actions?

<comment><USER54> I'm not sure about actions, but GitLab[1] and BitBucket[2] have the ability to import issues.

[1]: [https://docs.gitlab.com/ee/user/project/import/github.html](https://docs.gitlab.com/ee/user/project/import/github.html)

[2]: [https://confluence.atlassian.com/get-started-with- bitbucket/...](https://confluence.atlassian.com/get-started-with- bitbucket/import-a-repository-861178561.html)

<comment><USER55> Thanks for sharing this, I'm a GitLab community advocate, and wanted to see if you'd like to join our #GitChallenge - You share a review of GitLab vs GitHub (whether positive/negative/neutral), and we send you some swag. More info if you're interested: [https://about.gitlab.com/blog/2020/04/14/github-free-for- tea...](https://about.gitlab.com/blog/2020/04/14/github-free-for-teams/)

</comment></comment></comment></comment></comment></comment><comment><USER56> Can you please prioritize stability of your SaaS offering for paying customers? Our dev team and infra gets impacted seemingly every week with github outages, and it especially seems to correlate with delivery of new features. Thanks!

</comment><comment><USER57> Here's a little quiz, which of the three phases are we in now?

a) Embrace

b) Extend

c) Extinguish

</comment><comment><USER58> One thing to note is I had 3 members, it did not automatically downgrade my seats from 5. So in order to get it down to $12 a month I had to go downgrade my seats from 5 to 3.

</comment><comment><USER59> This is great and I will most likely take advantage of this new offering, but I cant help but wonder why.

"everyone deserves GitHub" is marketing, not a corporate strategy.

How does GitHub stand to benefit from this change? How does more non-paying users help the company?

I am not trying to be a tinfoil hat jerk here. Life in the age of information has taught us all that (again) "nothing is free". So what am I paying here?

</comment><comment><USER60> Bitbucket is in trouble now. With no more paying customer for Git and no support for Mercurial what are they going to do?

<comment><USER61> Continue selling Jira plans.

<comment><USER62> Yeah, I just see BitBucket as a value-add to sell Jira and Confluence licenses. Some people really like having all that stuff integrated.

Our team doesn't really see the value when it's just fine to have links to PRs or commit hashes but hey, to each their own.

</comment></comment></comment><comment><USER63> The pricing change appears to fall right in line with Gitlab's pricing (Free, $4/user/month, ~$20/user/month, and super expensive). I haven't managed to compare their feature matrices to see if the tiers are closely aligned, but from a glance they look similar.

</comment><comment><USER64> The way I read the title and heading, it sounded like teams was now free.

This messaging is very confusing. Teams is not being made free, you need to pay $4 per user. A better message would be: "we're reducing your price to $4pp, and giving you access to more features."

<comment><USER41> Normally we'd change the title to be less confusing, but in this case it's a bit tricky, for reasons I've explained here: [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20moderate%20less%20not%20more%20yc&sort=byDate&type=comment)

</comment></comment><comment><USER4> Hmm, literally the only paid feature left on the Teams plan we're using is Draft PRs. I am worried that as it looks like I won't need to pay for this service, that I, my team and my code will become the product to monetize at some point in the future.

<comment><USER65> Elsewhere in the thread they say that their big customers earn them enough to keep the lights on.

I'm much happier with a sliding scale model than ad or spyware based models. The problem there is that my experiences have been that a lot of expensive scaling work that you might otherwise have deferred gets done for your biggest customers, and we don't often get the revenue right to absorb that hit. More than once our biggest customers have ended up having the lowest margins, if you de-fuzz the math.

</comment></comment><comment><USER66> Hi Nat, finally MS responded to the Gitlab threat. Recently Gitlab has announced that they would be making a bunch of products free.

"We're open sourcing rich functionality across Plan, Create, Verify, Package, Release, Configure, and Defend."

[https://about.gitlab.com/blog/2020/03/30/new-features-to- cor...](https://about.gitlab.com/blog/2020/03/30/new-features-to-core/)

It's good to see that MS has joined the party.

Are there any plans to make GitHub itself available for self-hosting? I am not sure but the go-to place for open source software cannot be closed source.

Cheers,

Tarun

</comment><comment><USER67> Thank in large part to GitLab for pushing the market forward on affordable collaborative development.

We moved across when GH did their pricing changed. Free CI/CD well before "actions". Never looked back.

<comment><USER68> Bitbucket offered free repos before Gitlab, but Gitlab did an amazing job making it affordable and as good as githubs offerings.

It's always pleasantly surprisingly to go to Gitlab and see how much they continue to improve.

<comment><USER67> Bitbucket was certainly more generous than GitHub at the time. I used them too. Their problem was the pricing structure. The break between "free" and " _all_ your money, please" felt pretty harsh. They always appeared to be pushing very industrial companion tooling (eg Jira) which might have suited enterprise customers but wasn't very helpful to a freelancer. That's pretty common in SaaS. Enterprise is easier than volume.

By contrast GitLab's tiers are... Cheap. And it's perfectly feasible to do professional, modern CI flows on their free tier.

It'll be interesting to see what happens next.

</comment></comment></comment><comment><USER69> Microsoft could run all of Github free and still make money by integrating with Github and Azure so tightly that it is so easy to run code in Azure if you use Github

But it's probably just completion in the space

</comment><comment><USER70> My legacy silver org plan (20 private repos) only shows a migration plan to teams at $4/user, is there something I'm missing? The new free tier seems effectively the same or better.

</comment><comment><USER71> This isn't really surprising. Microsoft has had a free equivalent for years with Azure Devops (formerly known as Visual Studio Team Service). Azure Devops has hosted build and deployment orchestration with either hosted build servers or local build servers using local agents. It also has private Nuget repositories, project planning, bug tracking etc.

Azure Devops deployment tools are (were? It's been a couple of years) just as good for deploying to _AWS_ as AWS's own tools.

</comment><comment><USER72> That's awesome, I feel like many companies increase prices over time trying to squeeze more revenue, but that usually requires monopoly power.

I remember from economics that in an idealized, efficient, large market, the price of a product should tend towards the marginal cost of production. In the case of SaaS, that's almost $0 (server costs being fairly low), so SaaS products ideally should all get cheaper over time. Good to see theory matching real-world here.

</comment><comment><USER73> If you're like us and your entire Github usecase now fits within this free tier, it seems like you'll have to manually downgrade for it to take effect.

> We're also reducing the price of our paid Team plan from $9 per user/month > to $4 per user/month, effective immediately. Existing customers will have > their bills automatically reduced going forward.

I don't mind this - we'll likely stay on the paid plan anyways at that price point. But there you are.

</comment><comment><USER74> Would it be fair to explain this move as a "user retention" tactic. Perhaps it becomes a more difficult decision for teams to close out their paid accounts, even amidst an economic downturn, when the fees are removed.

One could argue some MSFT acquisitions have been focused on acquiring large swaths of exisiting users moreso than acquiring revenue streams or work product. Github could have been one such acquisition.

<comment><USER75> Maybe GitLab is starting to seem like more and more competition so they're having to add more free features to compete for users.

</comment></comment><comment><USER76> I'm confused about the "Collaborators for private repositories" feature. The Free plan shows an "unlimited" number of collaborators but each of the paid plans show "Up to org size". What does "Up to org size" mean? Which organization are you talking about? Does this mean that the free plans have more functionality?

</comment><comment><USER77> Sounds like Microsoft is creating a new branch attempting to replicate the Atlassian business model. First get developers hooked on GitHub, then build GitHub integrations into enterprise software, then let developers make the sale to their own employers (primarily because developers like the little green activity boxes).

</comment><comment><USER78> Compare this with Microsoft's other notable purchase of recent years, LinkedIn.

At LinkedIn they are tightening all of the screws and extracting cash from all comers.

What is different about GitHub?

My guess is GitLab.

This is an old strategy for Microsoft. They used to call it Embrace, Extend, Extinguish.

<comment><USER79> Linkedin was always a predatory organization, and now they are empowered to do what they actually wanted to do without the risk of going bankrupt if they miscalculate. Github is also empowered to do what they actually wanted to do without the risk of going bankrupt if they miscalculate. This is what you end up. You can't fundamentally change an organization by acquisition without destroying it. For example, Skype was destroyed like that. Github and Linkedin were not, and you are seeing them acting with fewer constraints. Linkedin is using their newfound power for evil, Github much less so.

</comment></comment><comment><USER80> I'd much rather they threw in more LFS storage on my $7 plan. But I suppose they know that already if they're moving towards a more "freemium" model. First hit is free, and then pay through the nose for LFS.

</comment><comment><USER81> This is great news! I've always had my repositories spread across GitHub, gitlab, and bitbucket depending on what size group or features I needed but this helps centralize everything to GitHub. That is probably their goal!

<comment><USER82> > this helps centralize everything to GitHub.

Oh dear. That doesn't really sound like a good idea in the long term.

So once you place all your projects/repositories on a third party git service like Github and it goes down, what can you do to push that critical change? Might be no big deal for personal projects but unacceptable for big business and open source orgs.

You might as well call the CEO of GitHub for support. A better way is to self- host...

<comment><USER35> > A better way is to self-host...

Even ignoring the higher cost to set up, are you sure your self-hosted solution will have better uptime? Are you sure you'll be able to get things up and running faster when it does go down than GitHub will when GitHub goes down?

<comment><USER82> Short answer: Absolutely yes. If you can setup a website using Docker, you can do the same with a Git server on-premise. Many companies have done this without Github for years.

Why you ask? You have total control over the stack, CI, etc and some orgs have in-house sys-admins or IT department to do all the work independent of a third party like GitHub. Maybe you should ask the Linux Kernel Project, WebKit, OpenBSD, Mozilla Firefox and even RedoxOS maintainers about why they self-host their projects which some even have mirrors on GitHub.

On another note I keep seeing this over on some repositories and now because it is 'private' I don't even think it remotely makes sense or is a good idea to even use GitHub to backup private keys even if the repository is 'private'. As long as it is on someone else's server, you're not in control.

</comment></comment></comment></comment><comment><USER83> However, looks like the Actions minutes included in the Team plan have dropped from 10K to 3K, so if you're currently paying for a team plan and using Actions your costs might not decrease, or might increase a bit

</comment><comment><USER84> Ouch. Just paid for a yearly pro license at the end of March.

<comment><USER85> They're refunding pro-rata.

<comment><USER84> Nice! Lot's of issues relating to pricing and plans right now so it is not clear that was happening.

</comment></comment></comment><comment><USER86> Note: the minimum of 5 seats is removed so if you're using less than that then you'll have to manually remove those seats to avoid being billed.

</comment><comment><USER87> This is great news. I can now move some of my projects from BitBucket to GitHub.

However, I wish GitHub supported GitHub Pages for private repositories for free as well.

</comment><comment><USER88> Actions, Packages, Sponsors, free unlimited private repos, this...Microsoft's GitHub acquisition has turned out really great so far in my view.

<comment><USER89> Embrace, extend, and extinguish.

Microsoft is still a company, that called linux a cancer. No trust at all.

</comment></comment><comment><USER90> Great to hear that! One last thing that would make Github a better alternative to Gitlab for teams is the self-hosted runners for organizations IMO.

<comment><USER91> [https://help.github.com/en/actions/hosting-your-own- runners/...](https://help.github.com/en/actions/hosting-your-own- runners/about-self-hosted-runners)

<comment><USER90> > Note: Currently, you can add a self-hosted runner to a single repository. > The ability to add and manage self-hosted runners for an entire organization > will come in a future release.

Still waiting for it for the last few months. :)

</comment></comment></comment><comment><USER92> Is it 4$/user on top of the minimum 20$ (which includes 5 users) ? Because my billing still says 20$/month and I have less than 5 users.

<comment><USER93> You have to go in and reduce your seat count on the billing page

<comment><USER92> Thanks, there is indeed a "Remove Seats" option now (there used to be only "Downgrade to Free"), exactly what I was looking for.

</comment></comment></comment><comment><USER94> Does "for teams" also apply to paid personal accounts?

<comment><USER95> If you have a personal paid account ("Pro"), the pricing page now says "Continue with Team". It looks like "Pro" has been renamed to "Team".

</comment></comment><comment><USER96> This is really great news. I've been happy paying for GitHub for years and it was already great value but this makes it even better.

</comment><comment><USER97> Well, hosting "open-source" software on a commercial platform does create something of a cognitive dissonance, doesn't it?

</comment><comment><USER98> I wonder if this will lead to more closed source software being written. I don't mean by MS specifically, but overall.

<comment><USER38> Same. I liked that GitHub really nudged you to be open unless you were willing to pay to keep it closed (well, sure, you can go ahead and setup your own server or find a competitor you like, but in the base form, if you want to be part of the ecosystem, be open) and am wondering just how many student projects are now staying behind locked doors because GitHub wants to catch bigger fish.

Not saying they're a philanthropic organisation that should promote open source to the kids or anything, just agreeing about an almost certain side effect.

</comment></comment><comment><USER99> This announce is not clear to me, as to what really changed. Can I have protected branch in my private repository now?

<comment><USER100> No, it looks like protected branches are not part of the "Free" tier. It's introduced in the Teams pricing and up.

<comment><USER99> So basically they removed restriction of 3 collaborators from free tier and that's it. Well, pretty useful for a lot of teams, I guess.

</comment></comment></comment><comment><USER101> Are you grandfathered into the 10,000 free Action minutes for paid Teams? 10k -> 3k drop is pretty substantial.

</comment><comment><USER102> I just realized I've been paying for Github pro for like a year for absolutely no reason at all.

<comment><USER72> Ask for a refund of all the charges, people don't realize that a lot of companies do that these days. You should be upset if they refuse (assuming you genuinely weren't using their premium features).

</comment></comment><comment><USER103> Thanks. I'm not surprised by this. I know this isn't a "mainstream" opinion, but I was fairly happy when MS brought GitHub. I think that the Nadella MS is much more streamlined than the old "Enemy of the State" version that got our undies in a bunch, back in the last century.

</comment><comment><USER104> Yeah, I just checked my email, and I remember reading this. This is pretty cool.

</comment><comment><USER105> They are commoditizing their complement. So what's their core business?

<comment><USER106> Core business is Azure. Actions, hosting, pushing the C# stack.

</comment></comment><comment><USER107> First you win the developers.

Then you get the apps.

Then you win the consumers.

How long to the next Microsoft Phone?

Wouldn't want to be Google.

<comment><USER72> All the places Microsoft has shipped awesome products and won the market didn't have as strong monopoly (or duopoly) effects as in the mobile space. I don't think we'll see a MS phone any time soon unfortunately.

</comment></comment><comment><USER108> Does anyone remember the arbitrary actions GitHub has taken in the past few months and all the "maybe it's time to start leaving GitHub if you want to avoid getting your repositories permanently deleted?"

Or is HN just as susceptible to the narrow news horizon?

<comment><USER109> Or maybe different people have different needs and HN isn't a single cohesive hive mind

<comment><USER108> Fair enough... Hence also why Google have plenty of Apps users etc even though they have a long track record of dropping even popular products at their whim.

Thanks for reminding me that it really is to each their own, and good luck to you on your path.

</comment></comment></comment><comment><USER110> Nice, now you can share all your secrets with Microsoft, for free.

</comment><comment><USER111> What do you think will be the response of GitLab?

<comment><USER112> [https://about.gitlab.com/blog/2020/04/14/github-free-for- tea...](https://about.gitlab.com/blog/2020/04/14/github-free-for- teams/?utm_medium=social&utm_source=responses&utm_campaign=gitchallenge&utm_content=blog)

</comment></comment><comment><USER113> Many comments are saying that Microsoft is doing this move to help cross- selling Azure. I don't see many users of free tier willing to spend money on Azure.

</comment><comment><USER114> Good on MS / Github for doing this.

</comment><comment><USER115> Finally & thank you, I oughta say!

</comment><comment><USER116> what is the font for the text in the upper left that says "The GitHub Blog"? Looks cool.

<comment><USER35> Looks like it's one of these:

      .alt-mono-font {
          font-family: SFMono-Regular,Consolas,Liberation Mono,Menlo,Courier,monospace;
      }

If you find yourself wondering this a lot, [https://chrome.google.com/webstore/detail/whatfont/jabopobgc...](https://chrome.google.com/webstore/detail/whatfont/jabopobgcpjmedljpbcaablpmlmfcogm?hl=en) is a fun extnesion.

<comment><USER117> If anyone from GitHub's around in this thread, would you mind putting "ui- monospace" at the front of that list? SFMono-Regular no longer works in Safari because of fingerprinting concerns.

</comment></comment></comment><comment><USER118> What's the catch?

</comment><comment><USER119> Amazing - thank you!

</comment><comment><USER120> I am very thankful to have GitHub on this planet

</comment><comment><USER121> wtf i love microsoft, now.

</comment><comment><USER122> yeet

</comment><comment><USER123> 437 comments, 6 from Nat Friedman. That seems a little weird for an AMA discussion.

<comment><USER117> I don't think this was really supposed to be an AMA.

</comment></comment><comment><USER124> So it will be free until the competition dies, and then it will be expensive?

Like... everything MSFT and GOOG have ever done?

Great.

<comment><USER35> When has GOOG made something expensive once the competition died?

I guess for that matter... also when has MSFT? I buy they have, but not aware of any examples of the top of my head.

<comment><USER124> Um, AdWords.

<comment><USER125> That's auction driven, not a set price.

</comment></comment></comment></comment><comment><USER126> Probably not very smart to use this feature, since your so-called "private" repository is an exploit or a leaking employee away from becoming public.

Instead, use a self-hosted Gitlab instance or similar, preferably with an external firewall preventing outbound and non-team inbound connections if feasible.

<comment><USER125> How would that solve the "leaking employee" case?

<comment><USER126> Sorry, I meant "leaking employee of GitHub", not "leaking employee of your organization".

</comment></comment></comment><comment><USER127> To think that John Mayer predicted this in his song _Daughters_ 17 years ago:

[Individuals] become [small teams] who turn into [big enterprises] / So [GitHub] be good to your [individuals], too</comment>


Noteleaf (YC W11) texts you quick info on the person you're about to meet with - <AUTHOR> http://venturebeat.com/2011/03/17/noteleaf-scrapes-together-contact-info-ahead-of-a-meeting/

<comment><USER2> I'm glad it uses info published by the person themselves and not from something like Rapleaf, which was the name I immediately thought of based on the headline.

</comment><comment><USER3> This needs to be integrated with Foursquare or some other location-based service and then built into a pair of eyeglasses.

</comment><comment><USER4> Hmm am I the only one who doesn't want to have any random company get my info just because somebody signed up for it?

<comment><USER5> It sounds like the info it sends is all publicly available--and not from some sketchy stalker service but from LinkedIn, twitter, etc. In other words, it's not sending anyone anything they couldn't find out themselves in a few minutes.

</comment></comment><comment><USER6> After reading about how it took 6 tries for iamwil to get into YC, it makes you realize how awesome of an achievement it is to be really living the dream: <http://news.ycombinator.com/item?id=2345664>

Nice job guys!

</comment><comment><USER7> I actually had an idea similar to this and wanted to implement it sometime in the future.

</comment><comment><USER8> Love it!</comment>


How I'm exporting my highlights from iBooks and Kindle - <AUTHOR> https://medium.com/@sawyerh/how-i-m-exporting-my-highlights-from-the-grasps-of-ibooks-and-kindle-ce6a6031b298 <comment><USER2> The Calibre client exports Kindle notes and highlights to a flat "My Clippings.txt" for all kinds of file-formats (not purely Amazon-purchased), wouldn't using that file be easier than fighting with JSON and an apparently forgotten Amazon page?

Edit: Turns out, this exists: [https://www.clippings.io/](https://www.clippings.io/)

</comment><comment><USER3> You should turn it into a service. I'd subscribe to it!</comment>