As McKinsey Sells Advice, Its Hedge Fund May Have a Stake in the Outcome - <AUTHOR> https://www.nytimes.com/2019/02/19/business/mckinsey-hedge-fund.html <comment><USER2> Seems highly unlikely that there's any actual secretive insider trading happening here. It would be a HUGE risk for practically no gain, distributed across many individuals, committed by primarily people who wouldn't stand to benefit. The firm should probably switch to vanguard or whatever... but the existence of this hedge fund does not mean the firm is using its insider knowledge maliciously. Most consultants won't even know what other people on their team is working on, and most are in and out after 2 years.

The article buried the mitigating factor in the middle of the article. Hedge fund managers don't coordinate with consultants, and 90% of MIO's capital is managed by outside funds, including this one the article is about.

The problem mckinsey faces is that they consult for everyone.

<comment><USER3> > a HUGE risk for practically no gain

Eh? A few dropped words during a social dinner, or even a knowing glance, you call that a huge risk? And a hedge fund getting (even only 1 bit of) information from some well-informed people, allowing them to adjust their position on a firm, can lead to substantial gains, obviously.

> Most consultants won't even know what other people on their team is working > on, and most are in and out after 2 years.

This is not about junior guys.

> Hedge fund managers don't coordinate with consultants.

Well, yeah, officially, of course. But that's precisely what the article is about.

<comment><USER4> > a HUGE risk for practically no gain

The same thing happened in the Libor scandal, those involved took a very big risk for not such a big gain and look what that caused: a market worth hundreds of billions of dollars (if not more) being manipulated in exchange for stuff like Champaigne bottles and some fancy dinners out (all of the latter worth at most $10,000).

<comment><USER5> The LIBOR scandal was predicated on them using online chat rooms, instead of just the kind of proven "wink and a nod over drinks" that's being alleged here. In essence, they took an even bigger risk than what is being described in this article, and as you say, for lesser rewards.

<comment><USER6> Things have changed _a lot_ since 2012. Of course, we don't have information that we are not privy to, but I still think it's unlikely. I'm saying this as a finance professional, but of course, I really don't know what other people would do, but I know that my firm wouldn't traffic in something so high risk. Not because of some moral opposition of course, but just because the potential fines could potentially be an extinction event for the firm.

<comment><USER5> I hope you're right, but the skeptic in me says that people who commit crimes tend to do so thinking they won't get caught. It's the problem with the death penalty or any harsh regime of sentencing; the deterrence effect is nonexistent.

</comment></comment></comment></comment></comment></comment><comment><USER7> From Matt Levine of Bloomberg:

 _Here is a New York Times story about the "McKinsey Investment Office, or MIO Partners," the in-house hedge fund of consulting firm McKinsey & Co., which invests employee money, including in companies that McKinsey advises. "That web of relationships underscores the unusual nature of McKinsey's hedge fund, and the potential for undisclosed conflicts of interest between the fund's investments and the advice the firm sells to clients," says the Times, and I suppose there are some shady elements: When McKinsey advises on a bankruptcy, for instance, and its hedge fund owns one or another slice of the capital structure, then there's a clear potential for conflicts of interest.

Mostly, though, it's hard to get too worked up about this. For one thing, most of the fund's money seems to be run by outside advisers, and even the stuff run by McKinsey employees seems to be mostly walled off from the consulting business. For another thing, the incentives are mostly good: McKinsey's consultants are trying to make the company better, and its hedge fund is invested in the company and wants the company to get better, so there is no problem here. "The firm's partners stood to profit from their own advice," says the Times about McKinsey's indirect investments in Valeant Pharmaceuticals, but why would that be bad? If they do stuff to make the stock go up, then they make money, but that is also what the company wants. (In the event, Valeant's stock went down, which was bad for both Valeant and McKinsey.) Really companies ought to demand that their consultants buy some of their stock, so they have some skin in the game with their advice.

Of course, what would really be scandalous is if McKinsey's hedge fund shorted companies that the firm advised, and then the consultants tried to give those companies ruinous advice. You couldn't advertise that strategy, but much of the Times story is about how secretive MIO is, and if you can be secretive enough then maybe you could pull off this trade._

<comment><USER8> The idea that there is no problem because both McKinsey and the company want to make money seems... ludicrous to me, and completely misunderstands insider trading.

The problems would be:

1) McKinsey learns about non-public good things on the inside, and so buys even more stock than they otherwise would (pretty much the definition of insider trading) and/or sells competitors' stock

2) McKinsey learns about non-public bad things on the inside, and so sells stock they otherwise would have held and/or buys competitors' stock

I don't see how Matt Levine can possibly just brush that aside?

<comment><USER9> Insider trading would be bad and illegal. But absent evidence that it's happening, I think his point is that merely having a stake by holding securities isn't inherently problematic.

<comment><USER10> Well then McKinsey should just say which firms they have positions in, and everyone can be satisfied that there's no problem?

<comment><USER11> McKinsey should do nothing because responding to a non-story is terrible PR.

</comment></comment></comment></comment></comment><comment><USER12> I am a beneficiary of this hedge fund so I may be biased, but I feel pretty confident that there is not much conflict of interest going on. As has been attested to by multiple people on this, and other, threads, there is very little proprietary information sharing between teams at McKinsey. In fact, once you work for certain clients, you are automatically barred from working for others. I was once privy to a situation where a consultant working with a different client, unknowingly, shared some proprietary information with the team I was working on. I saw the extent to which the partners freaked out and tried to correct the situation. Of course, there are examples of people violating this trust (people will be people) but there have not been any examples of structural violations (ie the firm designed processes that encouraged or tolerated unethical practices)

It does McKinsey, as a firm, very little good if their clients' business goes down in flames. They, obviously, cannot bet against their clients (it would be catastrophic to their core business if this was ever publicly disclosed) and so they can only bet with their clients, even if they (unethically and possibly illegally) used their clients proprietary information to trade.

It feels to me that there are some corporations that newspapers can just bash confident that most of their readers will nod along without applying much critical thinking. I understand the skepticism. I used to share it before I got to see the inner workings of organizations like this. There is much to criticize about organizations like McKinsey but violating clients' trust is not one of them.

One last argument against the insider trading inference, the results I have seen, while good, are not indicative of what is possible if smart people were truly trying to take advantage of their knowledge of the inner workings of the largest corporations in the world.

</comment><comment><AUTHOR> As giving and receiving advice is fundamentally based on trust, it strikes me as odd why anyone wants to do business with the likes of McKinsey or Goldman Sachs who have repeatedly shown a pattern of screwing over their clients.

This is not a generic "all I-banks or management consultants are evil" \- there are still plenty of specialized firms out there without these anti- patterns.

<comment><USER13> Hiring these firms is a major "cover your ass" move. If you're a CEO and you hire McKinsey, your board is going to likely approve as they are from the same East Coast/West Coast Ivy League fraternity as McKinsey consultants. And because they only hire people from those schools or recruit former executives from their clients, there is a strong signaling mechanism that you're hiring "the best and the brightest."

Then if things ever go wrong, you always have the out of "I hired the best, what did you want me to do?"

<comment><USER14> 100% of my experience with McKinsey has been trash. Just started working with new company and they wanted us to talk with these guys. We are reviewing some database systems and this guy is a literal joker. His suggestion to speeding up our database "well we can use REDIS, REDIS is fast because it's in-memory". So we want to put how many TB of data into REDIS? We are talking about tons of historic data that never changes. And we are going to load it ALL into REDIS because it's fast. These McKinsey folks spend months talking about the data lake and it turns out data lake just means a bunch of shit on s3.

It's like if you paid someone $50,000 to help you find a good car. Client wants a fast car. Oh you want a fast car? Buy a ferrari they have big engines and can generate tons of horsepower. Job done, can i collect my 50k now?

Mind you this guys linkedIn and resume read like a CEO wet dream. AI and machine learning data science all over...

We spent months dilly dallying with different tech before they just left cold turkey , havent heard from em since. And our 20% complete projects experimenting with all kinds of DB tech have done nothing.

<comment><USER15> Somewhat related: as I've been interviewing candidates for SWE jobs, I've found that many will talk about their recent machine learning projects. And the way they can talk about that problem has no bearing on how well they do on a simple programming question I give them later. You've gotta view big data/ML/AI expertise with extreme scrutiny given how hot that stuff is. Best to just ignore the candidate's assertions.

</comment></comment></comment></comment><comment><USER16> I always get the feeling that the whole white collar capital game is all about skirting conflicts of interest and doing it in a legal way. It's like pretty much what the entire industry is abput

</comment><comment><USER17> Maybe someone familiar with securities law can chime in here.

Isn't this something similar to insider trading?

They provide a service that is supposed to improve some aspect of a business, then they can internally do predictions on how successful they think their services will benefit/harm the firm and then make a bet either for or against that firm.

<comment><USER18> Securities attorney who worked for a hedge fund here. MIO (the fund adviser) would have to implement "ethical screens" to prevent the fund from acting or appearing to act on information from McKinsey consultants. There are a few major problems with how ethical screens work in practice:

\- It's based almost entirely on self-reporting. If a MIO employee has access to material non-public information (whether from a McKinsey consultant or elsewhere) MIO's compliance department has virtually no way of knowing that investment needs to be restricted unless the employee tells them.

\- Insider Trading is one of the most difficult allegations to defend against. You're innocent until you can prove otherwise. How do you prove you _didn 't_ do something? Typically through records outlining the rationale for your investment decision. The quality of the notes, and investment decisions for that matter, of Portfolio Managers varies significantly from PM to PM.

Rather than simply rely on policies and procedures it seems MIO has contracted most of the investment responsibilities out to sub-advisers and/or has some sort of fund-of-funds structure to their investments. Whether that's to make sure the transactions are _actually_ untainted by inside information or whether that's to obscure transactions that _are_ tainted by inside information is anyone's guess. It seems most of the issues outlined in the article stem from McKinsey failing to disclose their ultimate beneficial ownership of securities (by looking through to the fund's holdings) rather than anyone being able to demonstrate (yet) MIO has acted on insider information.

I also did a brief stint as an accountant at a big four firm. There's a reason accountants aren't permitted to invest in their corporate clients. Not only is there potential for insider trading but it could cloud their professional judgment. As the lines between the big accounting firms, law firms, and consulting firms blur it no longer makes sense that they operate under vastly different regulatory and ethical obligations.

Edit: Others might also be interested to know that while McKinsey's setup is apparently unusual for the consulting world, there are many large law firms who are also SEC-Registered Investment Advisers and deal with the same conflicts of interest. The potential for insider trading in those cases might be even higher as the law firms are often filing disclosure documents with the SEC on their clients' behalf.

</comment></comment><comment><USER19> This is interesting because McKinsey alumni and consultants at Nielsen seemed to be shopping an insider trading scheme around the time that they got involved with Equifax. The partnership was leaked way before it went public and the stock subsequently popped. This was pre data breach.

</comment><comment><USER20> Former investment banker here with lots of experience consulting for professional investors.

The substance of the article strikes me as, "potentially really bad, but no obvious smoking gun".

MIO is a special situations hedge fund, meaning that it looks for companies that desperately need capital for one reason or another, and who have been poorly served by the market for capital because some aspect of their story is messy and/or tough to understand, and provides them capital on terms that give MIO a lot of upside if the company gets back into good shape.

An important thing to understand about special situations investing is that it's usually very active relative to other types. That is to say, I can run a successful long-short equity fund and literally never once interact with any of the leadership of any of the companies in which I take positions; I can, for example, go long Verizon and short T-Mobile and never have to deal with either of those companies' management teams. For special situations on the other hand, the entire value proposition of the fund manager is what they can deliver through their active involvement with the portfolio company that takes the fund's money. So, you'll see special situations funds get super involved in issues like renegotiating long-term leases, or investing in sales teams, or reconfiguring operations to run on a single ERP system, etc -- activities which are right in the wheelhouse of former Big 3 consultants, whose work consists of bouncing from tough problem to tough problem at high-paying clients.

So it's not hard to understand why McK made the decision to found MIO. It kills multiple birds with one stone:

\- Makes partners more money through an asset class that tends to post good returns

\- Helps their recruiting pipeline because it makes it easier to capture aspiring buy side bigwigs out of college (perennially McK's Achilles heel vs. i-banking)

\- Provides outgoing partners with something to do in semi-retirement; MIO employs a shit-ton of semi-retired McK partners to do deep dives on various topics. This importantly has the positive effect on McK's culture of helping clear out the top of the pyramid so young partners don't feel like their career is going nowhere

Anyway, much of what's in the article sounds concerning. For example, the still-serving head of McK's bankruptcy practice was on the board of MIO when it was considering an investment in a coal company that was going bankrupt. On the one hand, this raises hackles; on the other, it's really only a PROBLEM problem if McK was advising that coal company, or had advised them recently prior to the MIO investment. And that might have been the case, but the article does not say whether it was.

The description of the McK's interactions with Guo Wengui is....I'm not sure what point they're trying to make? And similarly, with Valeant, the NYT's gripe is that another fund in which MIO invested went long Valeant at the same time that McKinsey was advising Valeant to increase the price of certain medications.

If I had to guess I'd say that McK has advised 90% of the F500 at one point or another and is actively advising about 30 or 40% of the F500 on something at any point in time. So, I really don't think that McK giving Valeant pricing advice through a consulting project at the same time that a fund MIO invested in was buying Valeant -- with both parties expressly prohibited from communicating with each other and no evidence they did -- as incriminating, though a multiple-hundred percent increase on pricing for any drug is obviously icky.

Anyway, there could be other shoes to drop here, and they could be really bad (e.g. if there were secret backchannel communications regarding the coal company). But I don't see anything in this article that's incriminating on its face.

And the attempt to make Guernsey look like some shady nefarious offshore destination that confers fishiness on anyone whose business dealings go through that jurisdiction? GIVE. ME. A. BREAK. Probably almost half of the hedge funds in Europe are domiciled there, it's like the Caymans or Delaware, talk about a red herring.

</comment><comment><USER3> > Tom Peters, the management guru and co-author of "In Search of Excellence," > said that during his time as a McKinsey partner in the late 1970s, managers > rejected the notion of having financial stakes in their clients.

> "You can't be advising people and have a fiduciary interest in the people > you're advising," Mr. Peters said in an interview.

That's weird, though, in a sense. Wouldn't you want the people consulting you to have a stake in your company? Wouldn't that "align incentives"? Shouldn't you pay the consultants in shares that vest over the next 5 years?

</comment><comment><USER21> Well I guess this beats the time that a McKinsey partner gave insider tips to his hedge fund buddy, but frankly not by much.

</comment><comment><USER22> I made some decent profits by looking into investments of Bain Capital and following some. You could look up who was buying and selling shares here: [http://www.fatpitch.biz](http://www.fatpitch.biz)

Unfortunately the site seems dysfunctional now.

</comment><comment><USER23> I don't know that their clients really care. The real motivation for bringing in these firms is having a credible scapegoat if things don't pan out for your project.

</comment><comment><USER24> Duh, this is the goldman sachs model.

<comment><USER25> Yeah, I was under the impression that widespread double-dealing was basically an open secret in finance.

</comment></comment><comment><USER26> The New York Times has been running a whole series now on McKinsey with a new article about once a month or so highlighting example after example of alleged serious ethical lapses at the firm. Have things really gone downhill or do some journalists just have an ax to grind with McKinsey?

<comment><USER27> I talked with one ex-McKinsey person who went from a true believer to questioning recently, starting with when McKinsey held a corporate retreat a mile away from a Chinese internment camp [https://www.businessinsider.com/mckinsey-china-uighur- corpor...](https://www.businessinsider.com/mckinsey-china-uighur-corporate- retreat-china2018-12)

<comment><USER28> The New York Times should get credit for doing that reporting, not BI (who just summarized NYT):

[https://www.nytimes.com/2018/12/15/world/asia/mckinsey- china...](https://www.nytimes.com/2018/12/15/world/asia/mckinsey-china- russia.html?module=inline)

</comment></comment></comment><comment><USER29> Man, the NYT really has it out for McKinsey. Anyone know why?

<comment><USER14> all of my experience with McKinsey has been an utter waste. Worked with multiple contractors on multiple backend database projects. They work like a walking ad for AWS services but dont actually know shit. We have a 10+TB dataset (growing by gigs each day) that is spread across a few postgres servers. These servers are decent but foreseen as bottle neck in coming years.

This guys suggestion is to put our data in redis b/c it's fast and in memory. Looking up hosted REDIS solutions, (redislabs, we use for other smaller cache redis things). To put 1 TB of data in standard redis server would be ~50k/month :p

<comment><USER30> Former McK here. You asked the wrong folks to come in...I'm not sure I would ask b-school grads (my former colleagues - love them to death) to talk technical stuff.

<comment><USER31> Nobody with any technical competence is inviting a place like McKinsey in the first place. Because of course not. Unfortunately McKinsey is quite happy to talk a big game and sell sub-par technical services to their customers who are either too dumb or too craven to see through the charade. Same goes for big-4 technical consulting in my experience, but less extreme.

</comment></comment></comment></comment><comment><USER32> Isn't that normal? How strange would it be for me to tell my friends "this stock is going to skyrocket, buy some!" without owning any myself? Anything otherwise would come across as extremely disingenuous.

This is a non-issue.

<comment><USER33> No it isn't. Pump and dump is another well established scam for one. And an advisor who indirectly makes money from a recommendation is one in a really untrustworthy position which is way worse than one detached. The later may feel less of a need for confidence but the previous essentially gets rewarded for doing what they are regardless of if it is a good idea. Lack of skin in the game is a lesser evil than conflict of interest.

</comment></comment><comment><USER34> Could something like this be considered racketeering?

</comment><comment><USER6> I highly doubt that there's any impropriety going on besides the lack of disclosure. Investment banks have been dealing with conflicts like this for a long time and the market has never cared.

<comment><USER35> There is something known as a "Chinese wall" that prevents that in banking. I am not sure if there is one in consulting.

> A Chinese wall is an ethical barrier that prevents communication between > members of an organization that might lead to conflicts of interest. For > example, a Chinese wall could exist between departments where the exchange > of information could unfairly influence trades. The "wall" is figuratively > erected to safeguard insider information and protect private data that could > create negative implications and legal consequences if improperly shared.

BREAKING DOWN Chinese Wall > Protecting client data and confidential information is critical to any business but is especially important to companies with diversified services, such as insurance companies, banks, and other financial services firms.

> The Gramm-Leach-Bliley Act (GLBA) of 1999 repealed the Glass-Steagall Act > that prohibited banks, insurance companies, and financial services companies > from acting as combined firms, such as banks offering insurance products. > The Gramm-Leach-Bliley Act resulted in a surge of mergers and increased > diversification of services, as well as an increase in fears and public > scrutiny. One concern was the protection and sharing of confidential > information and personal consumer data with those of contrary interests. In > response to growing concerns, many companies adopted the Chinese Wall > concept.

([https://www.investopedia.com/terms/c/chinesewall.asp](https://www.investopedia.com/terms/c/chinesewall.asp))

<comment><USER6> That's a good point. And you're right, I don't believe there is anything like a Chinese Wall in consulting. But I still don't think that they would risk their reputation on _very_ risky collusion.

If there were evidence that there was insider trading on behalf of the hedge fund, it would probably result in one of the largest SEC fine in recent years. It would be a massive blow to their reputation. I tend to believe (maybe naively) that firms act in their own best interest and that McKinsey wouldn't dare do something as egregious as collude with their hedge fund.

I know I probably have more faith in the financial services industry than most of HN, but McKinsey is a reputable firm with good people and I don't believe that in a million years (will that might be an overstatement) they would do anything like what the NYT is suggesting.

</comment></comment></comment><comment><USER36> Goldman Sachs did the same thing. They told their client to buy subprime loans while shorting it on the other side.

</comment><comment><USER37> A few years ago I think the classic example of an embarrassing company to have on your resume was Yahoo.

Now it's McKinsey.

Yahoo source: [http://mobile.nytimes.com/2013/03/06/technology/yahoos-in- of...](http://mobile.nytimes.com/2013/03/06/technology/yahoos-in-office- policy-aims-to-bolster-morale.html)

<comment><USER38> I'm completely out of the loop. Why?

<comment><USER39> The New York Times has been running a series of hit pieces on McKinsey over the last few months.

see: [https://www.nytimes.com/by/michael-forsythe#latest- panel](https://www.nytimes.com/by/michael-forsythe#latest-panel)

<comment><USER40> I don't think that actually answers the question... or is really that accurate.</comment></comment></comment></comment>


This Could Be the End of Facebook - <AUTHOR> https://www.vanityfair.com/news/2017/10/this-could-be-the-end-of-facebook-hive-podcast <comment><USER2> I don't go a bundle on articles like this but really, there are some excellent points made here.

This quote alone is worth the read. "The damage done to organizations in crises isn't the crisis itself — it's how you handle the crisis,". While it sounds like the distillation of countless racks of airport bookshop self-help and management books, do read it closely -- it's saying the damage occurs as a result of actions taken by the organization itself. In my experience, this is forgotten all-too-often.

"There's only one thing you have to remember: you have to overcorrect." Decisive execution silents many critics and impresses the rest. Regular readers of HN will recall the times when big-name sites on the web have had multi-hour outages, and have journaled their progress in real-time for people to view, and this transparency has been applauded.

</comment><comment><USER3> The problem with Facebook is that _it_ has taken the major role in deciding what people get to see. It has taken the responsibility of "curating" everyone's experiences on Facebook.

So now the company can't really turn around and say "hey, we aren't responsible for what people post or read on our platform."

I actually don't think private companies should be having a role in showing people the "truth" on user-generated content platforms. What I'm saying is that _they_ decided that this was their role a long time ago, but now that they got in trouble for not doing a great job at that, they pretend that was never their role in the first place.

</comment><comment><USER4> I did listen to the podcast. Galloway's view is IMO pretty much the old media perspective: If only the media had banded together, Google and FB would have been forced to pay for the content and old media would have been saved. He completely ignores the perspective that the supply of free content has grown exponentially over the last decade, while my time to consume media has pretty much stayed constant. I might pay (and do) for SOME old media content, but the days of them being the gatekeepers are long over.

</comment><comment><USER5> I'm not sure I see the causal relationship pointed out by the article. J&J's products, on paper, killed 3 people and no one in their right mind was going to risk being killed just because they had a headache. They recognized immediately that by not solving this issue for the consumer they risked tremendous losses. James Burke took a huge step and not only squashed the potential risk of his products but actually made them even safer.

What lives did FB put at risk here? If there's even an analogy to J&J it's that a few claims on the bottles label weren't true for _some_ of the consumer base.

<comment><USER6> I suppose it could be argued that losing democracy often results in significant loss of life and a reduction in everyone's quality of life.

<comment><USER7> Blaming Facebook for "loss of democracy" would be ridiculous.

Democracy is being lost when you start having low turnouts. When citizens lose interest in the matter of the state. When certain positions essentially always stay in the same family(ies). When there is zero confidence in the ability of the politicians to run the country. When it does not matter who you would vote, because the end result (for you) will always be the same.

Loss of democracy is a process, not an event.

<comment><USER6> What about when a mass media service that is pushing propaganda? Does that not subvert democracy?

<comment><USER7> Isn't pushing propaganda what mass media do all the time? So are we looking at the pot (the "old school" mass media) calling the kettle (facebook&co) black? Paladins of freedom (if you ignore the obvious conflict of interest) and democracy (if their ideas are your ideas or somewhat similar), indeed.

At least Facebook, differently from "old school" mass media (granting for the sake of the argument that facebook is a mass media "entity") had no _actual_ intent to push propaganda. It sold ads. To the wrong people? Maybe (granting for the sake of the argument that its selling ads to those people moved votes).

Democracy has been decaying from the start. It's decaying even faster now, but people putting the blame on facebook and the crazy guy that got elected president in the last round make me laugh. Sorry. :)

</comment></comment></comment></comment></comment><comment><USER8> Deleted my FB account years ago. 0 regrets.

<comment><USER9> For people so resistant to social media, those who aren't on Facebook appear remarkably content to brag about it in the comments sections of other sites.

This may of course just be confirmation bias (it often is) as I'd never notice those who aren't on Fb and don't mention it.

<comment><AUTHOR> I think that is the logical consequence. If one stops using Facebook, one somewhat is an outsider in a world which is highly rel on Facebook. Bragging a) offers a certain type of status (let's be honest about this), but b) also is an attempt to make others to join, which offers the outlook of a world which is not so reliant on Facebook anymore.

<comment><USER10> I don't think the world is 'highly rel[iant] on Facebook', not by a long stretch. Facebook has made its way into pockets of the world and established a firm hold there which makes it look like this to those within those pockets. For those outside - mostly consisting of people who never joined the 'social media' craze - the thought of something like Facebook being essential in some way is alien, their continued existence without any sense of marginalisation being proof of the validity of their stance. For recent Facebook (et al) survivors this is probably harder, they'll need to convince themselves they did the right thing in leaving the bubble.

If you subject the concept of Facebook to some critical thought it does become clear that those outside of the bubble have the most logical attitude: Facebook has the potential to turn its users' lives into real live "Truman shows" [1] with each user playing the role of "Truman" in their own right while their contacts - who also get to be "Truman" in turn - play the role of the supporting actors.

[1] [https://en.wikipedia.org/wiki/The_Truman_Show](https://en.wikipedia.org/wiki/The_Truman_Show)

</comment></comment></comment></comment><comment><USER11> The only way this ends Facebook if a class action lawsuit where all citizens are the class is filed, and the damages are loss of democratic election. I don't see it happening, facebook will be fine.

</comment><comment><USER12> Not sure I agree with the hypothesis about the impact on Facebook, but it's an interesting theory to consider.

<comment><USER13> One could even go as far as calling the title clickbait.

</comment></comment><comment><USER14> Tamper evident, not tamper proof. Meh.

</comment><comment><USER15> What about the companies they own. Watsapp, insta ect ?

Is the stock still worth the price?</comment>


Ask HN: If Facebook was written today, what language would you recommend? - <AUTHOR> Note: Not the fb with millions of LOC but the initial one with a few thousands that started it all. <comment><USER2> Whatever you are best at writing. Scale doesn't matter much compared to traction early on.

<comment><USER3> By far the best comment about programming. It really doesn't matter until you get into the millions of users. And the chances of that are slim. So focus on traction before scale.

</comment></comment><comment><USER4> I agree with taprun, whatever you are proficient in. I would build it with Node.JS probably or a VueJS front-end with a Go backend.

</comment><comment><USER5> Typescript, react?</comment>


Venture capitalists circa 2032 - <AUTHOR> https://medium.com/@bethanymarz/venture-capitalists-circa-2032-810e47fb4ca4 <comment><AUTHOR> "Great," I'd reply. "So as a venture capital firm, I could give you $1 million to start your sneaker company. And maybe, in 10 years, your company grows so big that Nike wants to buy you for $10 million. Once that happens, you would make $8 million for selling your company, and we would make $2 million for helping you start it. Make sense?"

<comment><AUTHOR> Imagine how great VC would be if the numbers worked out that way.

Instead of once you've worked out most of the kinks and started hiring an awesome team we come in and give $1m, then dilute your position continually until you own about 18% so you need to create a $1B company to make the numbers work. Because unfortunately it works out only about 1 out 500 times and most of the time you end up broke.

Kid: Oh so you run a lottery.</comment></comment>


In space, no one can hear you kernel panic - <AUTHOR> https://increment.com/software-architecture/in-space-no-one-can-hear-you-kernel-panic/ <comment><USER2> > _" The Orion spacecraft, designed to carry astronauts to the moon in a > future crewed mission, will carry four computers, each with two processors > working in parallel, the results of which have to agree."_

Wow, that's _octuple_ redundancy? Nice!

Also, is it true, I once heard that in space they still use 486s, since these aren't suspect to cosmic radiation?

<comment><USER3> Older silicon simply had larger circuit elements (less integrated) so could more easily survive a cosmic ray that scattered 1000 electrons across the circuit.</comment></comment>


Ramblings about Klein - <AUTHOR> http://blog.selflanguage.org/2009/06/01/ramblings-about-klein/

<comment><USER2> Klein has the potential to be really special - applying the immediacy of Smalltalkish systems like Self to VM design.</comment>


On Tokens 1.0 vs. Tokens 2.0 and Fundamental Blockchain Innovations - <AUTHOR> http://startupmanagement.org/2017/11/11/on-tokens-1-0-vs-tokens-2-0-and-fundamental-blockchain-innovations/ <comment><USER2> Fundamentally a token is good for helping to bootstrap a network effect. In my opinion Token 2.0 models should work as follows. Initial token distribution which seeds the initial network user base, and provides funding for development of the network. Then the token inflation rate should be proportional to network usage rate, where those that add value to the network get a portion of the generated tokens. This is a very general concept, but more concretely works in a model like STEEM as mentioned in the article. Content creation earns you tokens, but I believe the inflation rate is fixed as opposed to proportional to network activity.

The biggest fundamental which I think most people agree on is that Token Value is Proportional to Network Usage Rate. The minting of new tokens needs to reflect this value</comment>


AMD's 5nm CPUs could be monsters - <AUTHOR> https://www.pcgamer.com/amds-5nm-cpus-could-be-monsters-if-tsmcs-transistor-numbers-are-right/ <comment><USER2> As someone who hasn't followed this space too closely, is there a good tl;dr explanation of how intel lost their lead? It doesn't seem like an "innovator's dilemma" situation since they seem to be getting beat at their core competency of laptop, desktop and server cpus.

<comment><USER3> They blew an incredible amount of effort and money on new processes that didn't pan out. The failure rate was too high for production. AMD doesnt fab their own chips so they can piggyback on the progress unlocked by the fabs that build for cellphones (TSMC in this case).

Also, transistor density is a better measure than 5nm/7nm/10nm. That feature detail in nanometers is more or less pure marketing term and doesn't compare accurately. Intels transistor density is still better than the latest Ryzen but it looks like they will be matched or surpassed by the next gen AMD.

<comment><USER4> Intel is at 14nm and amd is at 7nm, yet the transistor densities are higher on the Intel side?

Do you have any source to back this claim? I know that node sizes are mostly meaningless at this point, but still this is invalidating 3 generations of node jumps on the TSMC/AMD side vs none on the intel side, surely it can't be that meaningless of a number?

<comment><USER5> Wikipedia claims MTr/mm^2s of:

      Intel 14: 37.5
      Intel 10: 100.8
      TSMC 16/14/12: 28.88
      TSMC 10: 52.51
      TSMC 7: 96.5 to 113.9, depending on iteration.
      TSMC 5: 173

<comment><USER6> It really shows you how good Intel's IP is that they can even make competitive CPUs on a generation old process.

<comment><USER7> No, it's just that they use a different scale for vanity metric number. Intel's chips aren't competitive for the price; they just have customer inertia.

<comment><USER6> Even on a transistors per mm measure the 14nm++++ they are using is vastly inferior to TSMC's 7nm.

Its only Intel 10nm that is equivalent and we don't have desktop CPUs on that process yet (if we will at all).</comment></comment></comment></comment></comment></comment></comment>


AT&T previews lawsuit it plans to file against FCC - <AUTHOR> http://arstechnica.com/tech-policy/2015/02/att-previews-lawsuit-it-plans-to-file-against-fcc-over-net-neutrality/ <comment><USER2> The Economist's recent article on net neutrality and common carriage is fascinating and related: [http://www.economist.com/news/leaders/21641201-why- network-n...](http://www.economist.com/news/leaders/21641201-why-network- neutrality-such-intractable-problemand-how-solve-it-gordian-net)

Part of the interesting piece is the history of "common carriage": "The idea that certain businesses are so essential that they must not discriminate between customers is as old as ferries. With only one vessel in town, a boatman was generally not allowed to charge a butcher more than a carpenter to move goods. This concept, called 'common carriage', has served the world well, most recently on the internet."

I've never doubted my support for net neutrality, and the legal history of "common carriage" makes this even more obvious.

<comment><USER3> The Economist article is written with the presumption that there are are problems that need non-neutrality in order to be solved and that there is thus a tradeoff of some sort to be made. They cite better network management, and give as examples latency-sensitive applications that suffer from the lack of guaranteed latency.

Those are fallacies. The lack of guaranteed latency is fundamentally no bigger of a problem than the lack of guaranteed bandwidth. Non-neutral traffic shaping is not necessary to maintain good performance, and in practice a best- effort network can achieve acceptable latency for things like VoIP _without_ having to explicitly identify, classify, and prioritize VoIP protocols. ISPs may be accustomed to using such explicit techniques, but neutral alternatives exist and work better for general purpose connections, so we shouldn't carve out any exceptions here.

The Economist also points out the difficulty of determining when traffic is or should be illegal and blockable. It is not at all apparent to me that ISPs have a need to be involved in subjective decisions like that in order for us to have a functional Internet. Is erring on the side of allowing traffic and prosecuting later _really_ going to cause serious problems, or can we come up with an objective set of guidelines for what constitutes a DoS worth blocking?

<comment><USER4> People keep using DoS as the canonical example of the need for this, but in that case one of the endpoints is requesting that the traffic be dropped. The ISP isn't making the decision for anybody.

<comment><USER3> Except that there isn't actually a real and usable protocol for pushing drop rules up to your ISP, so in practice you can't authorize your ISP to block a DoS on your behalf without getting humans involved.

<comment><USER4> Which is why you pretty much always get humans involved.

How is the ISP even supposed to know it's a DoS otherwise? Maybe you just made the front page of HN and you want the traffic.

</comment></comment></comment></comment></comment><comment><USER5> Is AT&T trying to muddle the concept of an ISP as something that delivers content and an ISP as something that hosts content? That's all I can figure, here.

Especially when writing about the ability to decline service to customers. I'm not sure how net neutrality relates to AT&T having freedom to pick and choose its customers. (Surely the folks that just want their content delivered -- Hacker News, for example -- don't consider themselves AT&T customers.)

<comment><USER6> They are. If they just deliver packets then they are clearly Title II. Last time the FCC did this (2004/5), the ISPs claimed that their homepages and email service and DNS made them not "telecommunications".

Well, Gmail, OpenDNS, Google DNS and Facebook (new homepage), make those arguments less useful. So "caching" is the new DNS.

Not sure how they'll deal with the rise of VPNs and HTTPS though. VPNs and non-cacheable are the most clear argument that people pay broadband ISPs just to deliver their packets.

</comment></comment><comment><USER7> Instead of wasting money on courts AT&T should upgrade all their DSL lines to fiber optics, lower prices on their plans and increase bandwidth. But of course they'd rather just whine about how their monopoly is threatened by Title II. I hope they'll lose big deal.

Though it wouldn't help anything of the above anyway, since even with Title II AT&T won't be facing much competition. They'd be just more limited in ways they can abuse their monopoly.

<comment><USER8> Why should they do that when the FCC is making their product less profitable?

<comment><USER7> You mean less able to rip off undeserved profits?

</comment></comment></comment><comment><USER9> AT&T's argument appears to be that since they are already shaping traffic and abusing their customer's trust, they aren't actually an Internet service provider anyway, so they can't be regulated as one.

</comment><comment><USER10> I stopped having any sympathy for AT&T after the Auernheimer case. If they wanted to garner public support for any reason, a move like this is likely to kill it for a lot of people. Myself included.

(I know Auernheimer's not well-liked, and I don't agree with his politics, but he deserved to win that case on appeal.)

<comment><USER11> I read the indictment [1]. Auernheimer wasn't a white hat security researcher --he intentionally went after AT&T with intent to damage them and reap rewards from it. He's not exactly a martyr for the cause of freedom.

[1] [http://www.scribd.com/doc/113664772/46-Indictment](http://www.scribd.com/doc/113664772/46-Indictment)

<comment><USER12> An indictment is a deliberately biased, one-sided document.

</comment></comment></comment><comment><USER13> _" I have no illusions that any of this will change what happens on February 26," when the FCC is expected to vote, AT&T Federal Regulatory VP Hank Hultquist wrote in a blog post yesterday. "But when the FCC has to defend reclassification before an appellate court, it will have to grapple with these and other arguments. "_

I might be misreading something, but is he not saying "We know this is useless but we want to waste the FCC's time and resources anyways" ?

I'm not familiar with how lawsuits for these kinds of cases work, but wouldn't this be enough for a judge to throw away any lawsuit they file? If they clearly state t hey have no intention other than to get in the way, it doesn't seem like a valid lawsuit to me.

<comment><USER14> > I might be misreading something, but is he not saying "We know this is > useless but we want to waste the FCC's time and resources anyways" ?

No, he's simply saying this prior release is not going to influence the FCC vote in any way, shape or form on Feb 26th.

However, a court battle after-wards might (as it did previously with the FCC National Broadband Act and the courts ultimately ruled the FCC had no authority to do what they proposed).

<comment><USER13> Ah, alright, thanks for the clarification, I guess I did misread it.

</comment></comment></comment><comment><USER15> I hope the FCC has the balls to say, "So sue me."

</comment><comment><USER16> In other words, this will have to be settled in court.

<comment><USER6> This is largely political saber rattling. AT&T's best arguments are going to be procedural.

If FCC gets past arguments it didn't dot the i's, then this will go to the Supreme Court where AT&T and Verizon will get walloped. I can explain why, but basically there are 9 votes lined up against the ISPs on reclassification.

<comment><USER17> I'd love to hear why you think there are 9 votes for reclassification, btw.

</comment></comment></comment><comment><USER18> While I don't like Internet providers creating different classes of traffic, the idea of the government getting involved should terrify anyone who values innovation and freedom.

Soon, we'll end up with a monopoly guided by regulations from lobbyists and using laws as a weapon against competition. That's hardly better than the problem we seek to resolve.

<comment><USER19> Genuinely curious, how would you resolve the problem differently?

<comment><USER20> The lack of provider competition isn't a natural monopoly. It's a government- created monopoly/duopoly in a given market. Instead of regulating the one or two providers in a market, we could try a different model that improves competition.

One way is to do city-owned and maintained layer 1, like Chattanooga ([http://money.cnn.com/2014/05/20/technology/innovation/chatta...](http://money.cnn.com/2014/05/20/technology/innovation/chattanooga- internet/)), and sell access to as many ISPs want it.

The other way is to break the city franchise model. Cities generally grant franchise rights to cable and phone companies, excluding other providers for a promise of universal coverage and a few percent of the revenue.

The latter is what Google Fiber is asking for from the cities it goes into:

\- It wants blanket access to all of the telephone poles and other right-of- ways, without having to do per-pole applications, application fees, and approval process that can take weeks/months each.

\- It wants to not have to do universal access, but rather only roll into neighborhoods with a high enough density to be profitable.

\- It won't pay the city a percentage of revenue. Instead, it agrees to build out free internet access to schools, public spaces, etc.

Google Fiber's model has the advantage of not relying on a city to properly maintain a fiber network, but the disadvantage of leaving poor communities un- served.</comment></comment></comment>


GoPro on a lobster - <AUTHOR> https://www.youtube.com/watch?v=6lwOmomzLbM&feature=youtu.be

<comment><USER2> If you are interested in seeing more of fishing from the perspective of a fish, I highly recommend Leviathan [1]. It provides a very interesting look at the industry

[1] [http://en.wikipedia.org/wiki/Leviathan_(2012_film)](http://en.wikipedia.org/wiki/Leviathan_\(2012_film\))

</comment><comment><USER3> Yay! Lets strap a camera to an animal while we boil it alive. It's really like 'arse-sum', man!</comment>


Should I buy this house or wait for a better one – a handy calculator and model - <AUTHOR> https://medium.com/@ilyaberger/should-i-buy-this-house-or-wait-for-a-better-one-solved-with-a-risk-preference-model-b6d06f22bad7 <comment><USER2> When the score of "yes" is 0.51 and of "no" 0.49, do I really get an answer?

<comment><AUTHOR> Great question and thanks for asking! Actually how far the scores are apart from each other does not matter in this model. Perhaps a better way to frame that question is: what is my confidence level that this prediction is correct? In this formulation, there would be an upper and lower bound for the scores based on a chosen confidence level</comment></comment>


Ask HN: Open Source Task API Spec - <AUTHOR>

After the demise of Astrid, I've been thinking about open source task formats. Todo.TXT seems like a good start but is missing a lot of features. Do people think that a REST API standard for tasks that clients could integrate and developers could build is a good idea? Features I would want to include are duration, repetition, scheduled date, due date, subtasks, following, commenting, projects, tags and sign on with persona. <comment><USER2> Do not undersell yourself on this idea. Every business has some form of task/project management. It is a booming field.

I am assuming duration is 'expected time to complete task.'

If I am assigned a task, I generally report how much time I spent on the task. A duration works in some situations, but time spent is usually what I am interested in when it comes to business oriented tasks. Each month-end I have to do certain activities, remind me and let me easily document that January took 1 hour, February took 30 minutes, and March took 6 hours (probably an issue in quarter-end processing!).

Merge the idea of task manager and time manager to result in a project manager! There are huge profits in this business.

Multiple users on the same task, gathering metrics, making graphs, segmenting tasks (verb1, verb2, verb3), showing cost center distribution, etc.

<comment><AUTHOR> So you think it would be better to be a business? I feel like Asana does a lot of that very well.</comment></comment>


Dropbox TOS Includes Broad Copyright License - <AUTHOR> http://hardware.slashdot.org/story/11/07/02/0515218/Dropbox-TOS-Includes-Broad-Copyright-License?utm_source=slashdot&utm_medium=twitter

<comment><USER4> Let me clarify ....

TL;DR - it's hyperbole. answer the negative. if they didn't get this permission from you - you could sue them for copyright infringement. every service does it. don't freak.

Long Version:

The key to the text is "non-exclusive" - generally this grants the nonexclusive rights to display the material on a Web site. It also allows the licensee (ala DropBox) let their company use, manage, display [etc] your files.

It's a fairly standard contractual term now days - for example see

<http://www.youtube.com/t/terms> at 6 C OR even your Gmail Terms ... [<http://www.google.com/accounts/TOS?hl=en> at 11.]

Youtube - "For clarity, you retain all of your ownership rights in your Content. However, by submitting Content to YouTube, you hereby grant YouTube a worldwide, non-exclusive, royalty-free, sublicenseable and transferable license to use, reproduce, distribute, prepare derivative works of, display, publish, adapt, make available online or electronically transmit, and perform the Content in connection with the Service ...."

Gmail - "By submitting, posting or displaying the content you give Google a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services. This license is for the sole purpose of enabling Google to display, distribute and promote the Services and may be revoked for certain Services as defined in the Additional Terms of those Services."

Generally, the language uses "non-exclusive" in its context which is OK. It basically allows internet services to be internet services

i.e. if they didn't have a non-exclusive licence, how could they use your files - which contain copyright content you own - in their services ? - <USER2> couldn't :) By asking for a non-exclusive licence, it means you are permitting DropBox to use it for the purposes of

"worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent we think it necessary for the Service."

If you're uncomfortable with this term, then unfortunately you'll be uncomfortable using any service on the Internet as it's generally required to provide a service :) The terms agreement incorporates their Privacy Agreement - thus meaning they still owe you the obligations outlined in their privacy clause. They cannot distribute your content without your permission.

"But, but, but .... they should have to identify copyright not me"

Again, you are giving them to non-exclusive right. If you have MP3 music [legally obtained for example] - you have ownership for that file. You are provided with the right to store that file for personal use just as you have the right to share that file with your friends. The rights associated with this file are governed by the terms of service when you purchased that file [i.e. iTunes]. Go and read your rights regarding MP3 Music purchased from iTunes.

You are providing DropBox with a non-exclusive right - not an "exclusive right" which would be just that "exclusive" and therefore you have licensed it only to DropBox per see - to be able to storage, transform ... etc that file. The Privacy policy is incorporated within the Terms agreement - <USER3> inferring they cannot "distribute your content without your consent".

Dropbox do NOT "know" where you purchased the file or the terms surrounding every single file they store on your behalf [how could they?] - it's your responsibility - not theirs - hence the point of the term.

"You must ensure you have the rights you need to grant us that permission."

Dropbox is fine. Use it. Or stop using Gmail and most other services ....

<comment><USER5> Non-exclusive just means that Dropbox isn't the only licensee. I've never once seen a consumer-facing TOS that purported to be exclusive. That's really not the issue here.

The issue is whether the scope of Dropbox's license is overly-broad, given the service that they're providing.

Under the Google TOS, Google says:

"This license is for the sole purpose of enabling Google to display, distribute and promote the Services."

Now, take a look at Dropbox's new TOS:

"...to the extent reasonably necessary for the Service. This license is solely to enable us to technically administer, display, and operate the Services."

Dropbox's license is actually MORE limited in scope than Google's. I don't really understand why people are freaking out about this particular issue.

IMO, the security issue and their handling of that is more important.

(The post is informational only, not intended to be legal advice or to create an attorney-client privilege).

<comment><USER6> Except that _wasn't_ the new TOS at the time the articles went up. They changed it _after_ the world exploded. See the bottom of their blog entry: <http://blog.dropbox.com/?p=846>

<comment><USER5> Oh, I missed that. Thanks!

</comment></comment></comment></comment><comment><USER7> When the new TOS were announced I think a lot of balked at reading those statements. The examples given in the TOS (e.g. "to convert your files") all seem reasonable, but as Indyan pointed out, it sure leaves the door open to some fuzzy interpretations.

Quick question, if AT&T suddenly bought Dropbox, would you all feel as passive about the new TOS or be quick to get your files out of there?

What about Facebook? Microsoft? or Silver Lake Partners?

I understand it's easier for Dropbox to be vague in their TOS so they don't have to spell out the service or future features that might require expanded agreements.... but given the nature of the service and the previous fiascos Dropbox has had already this year, it sure seems like they are cutting themselves some undeserved slack with regards to specificity.

I appreciate that they rewrote the terms to be more human readable, but why not spell out "You agree to let us duplicate, read and write your files in the case where you share, copy, publish or convert your files via the web or client software interface" -- or something following that.

I don't have a company with 200 million users though, so maybe the logistics of being that specific are an impossibility. I'd also be a lot more forgiving of this broad language if Dropbox has never had any hickups, so my personal nervousness is mixed in there.

<comment><USER8> You are missing the point.

Those companies _do_ have similar terms in their agreements! Any service that accepts user content should. It's in everyone's benefit to make it clear that you own your content, but you're giving the service a license to copy it, display it, etc.

AT&T: "while you retain any and all of your lawfully owned rights in such Content, you grant AT&T a royalty-free, perpetual, irrevocable, non-exclusive and fully sublicensable right and license to use, reproduce, modify, adapt, publish, translate, create derivative works from, distribute, perform and display..."

Facebook: "you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook"

<comment><USER5> Actually, I think you're missing the point.

1\. People seem to want to use Dropbox to store sensitive, private data. Most sensible people don't trust AT&T, Facebook, Microsoft, etc. for this purpose anymore because of their past gaffes.

2\. Dropbox makes numerous "marketing" statements all over their site purporting to be safe for confidential, private information.

3\. The licenses that companies need in their TOS can be scoped appropriately to what's strictly necessary for them to provide you the service you signed up for. Companies that reserve rights in their users' stuff beyond what's necessary do so for a reason – and it's not likely to be in the user's interest.

<comment><USER9> You've evaded this person's comment, possibly because it doesn't fit a point you want to make.

The comment you're responding to says, "Legally, any service that does the basic things we expect Dropbox to do for us probably needs to have these terms in place. The point raised about not trusting Dropbox after an AT&T acquisition is irrelevant; every large company already has those terms, because they have to."

You can _want_ to trust Dropbox more than Microsoft, but that doesn't change the legal landscape.

Your third point comes closest to actually addressing the discussion here, but _how_ do they scope their ToS narrowly enough to satisfy you? And how do they then do that without having to then announce ToS changes every time they add a new feature?

<comment><USER5> I don't think I've evaded the comment at all.

1\. The issue is the scope of the license.

2\. The overly-broad scope chosen by Dropbox (and many others) is a valid reason to question their trustworthiness as a custodian of sensitive private information.

3\. In the case of AT&T, Facebook, etc., we have a history of actual disclosure incidents to draw from, adding some context to their trustworthiness. In fact, Dropbox itself has joined that club, with their recent security gaffe and their handling of it, and statements surrounding it.

4\. As I say in a few places around this thread, I think the correct scope of the license would be strictly what's required to carry out the user's instructions. At the very least, it should be limited to uses that are in the user's interest, not the interest of Dropbox or a third party.

EDIT: I said "overly-broad scope chosen by Dropbox" above in error. In fact, I think the Dropbox TOS is dead-on in terms of the scope of the license. As far as I can tell, it's limited to what they need in order to "do what you ask us to do with your stuff (for example, hosting, making public, or sharing your files)".

(This post is information only, is not intended as legal advice or to create an attorney-client relationship.)

<comment><USER9> This reads like a smokescreen. If providers need these licensing terms to safely provide this service, then they either need to post them or get out of this business. "Actual history of disclosure incidents" and "trustworthiness" simply don't have anything to do with it.

If you're a lawyer, it would be helpful if you could just straight-up answer the question, which I'll restate for you: what are specific things Dropbox could do to their ToS to scope it down without making the ToS so narrow they can't introduce new features without constantly revising it?

<comment><USER5> I'm not sure why you're being so cranky about this. I'm doing my best to be as clear as possible.

1\. The Dropbox license is scoped correctly, IMO. It's as narrow as it should be, and not so narrow that it would impair their ability to provide the service.

2\. All commercial relationships come down to trust. Contracts only take you so far. If a provider offers acceptable contract terms, but has also shown signs of incompetence or untrustworthiness, I would avoid them. After all, how likely are you to enforce the contract terms against them?

HTH – and again – this is not intended to be legal advice or to create an attorney-client relationship.

<comment><USER9> I'm confused. Upthread, you said (paraphrased) "companies that reserve rights beyond what's absolutely necessary tend not to be doing this in their users best interests". You didn't then qualify this with "but of course that's not what Dropbox is doing".

Maybe we just agree about Dropbox --- that this latest ToS karfluffle is just a banal legal/administrative thing, not evidence of any cavalier attitude at Dropbox about user data.

<comment><USER5> We do agree. I also agree that my comment above was a little misleading. That's because the OP's article quotes a version of the Dropbox TOS that isn't the current version anymore, apparently.

Sorry for the confusion!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> This is exactly like the broadly misunderstood TOS for Facebook, Etsy and other services.

They _need_ a license to your work in order to distribute it, and display it to others or perhaps even you.

These clauses have been in TOSs for years and years, and only now people have taken notice. The average person doesn't know much about IP though, and probably couldn't tell you the difference between a copyright and a patent.

Companies sometimes do overreach in this step though, conveniently claiming rights to use your images royalty-free in advertisements for the service and around their site without you being involved. It's important for people to know what they're signing over, and perhaps it is more than necessary or intended in some cases. However, the mere notice that you are extending a copyright license to a company to whom you are uploading media is not in itself suspicious, unusual or an attempt to take rights from you.

<comment><USER11> Just because it is standard doesn't mean it is acceptable.

<comment><USER12> It is standard because there is no other choice if you want to provide services of this nature. Blame the law, not the service providers.

<comment><USER13> Could it be worded in such a way that makes the rights granted to Dropbox only usable for making Dropbox functional?

<comment><USER14> That's why the sentence ends _… to the extent we think it necessary for the Service._

</comment></comment></comment></comment></comment><comment><USER15> It specifically states that you the rights you grant them are limited "to the extent we think it necessary for the Service."

The "we think" might be a little ambiguous, but given that Dropbox is a tool for sharing files (with yourself or others), it seems reasonable that you grant them rights to do so.

<comment><USER5> IMO, the right way to express this would have been "to the extent required for us to provide the Services that you use".

Dropbox definitely does not understand the confidentiality requirements that (some of) their customers have. By reserving themselves so much leeway, Dropbox is driving away business users who need assurances of confidentiality.

IAAL, and I can't use Dropbox today because I can't trust them with my clients' data.

(This post is informational only, not intended as legal advice or to create an attorney-client relationship.)

<comment><USER16> "... to the extent _required_ ..." would leave them open to liability related to the methods they use to implement the system; if it can be established that the service could have been implemented in any way that did not require them to expose, transform, etc., the information in question the way they did at a particular stage, they are suddenly in violation of copyright license.

<comment><USER5> Indeed. That's the point I want to make!

<comment><USER16> No, it isn't -- trust me. An approach that seems to be the only way to do things at point A, an approach that was arrived at that was the product of somebody's best thinking, but later turns out to have only _seemed_ so at the time it was implemented (everybody has blind spots), is _still_ a good-faith effort. The word _required_ means that good faith (in the legal sense) and the limits of technological knowledge at any given period in time are insufficient defense for for actions brought on the basis of knowledge that did not exist at the time of the alleged infringement. That is an unreasonable and onerous burden; the service (or any similar service) could not be provided under those terms.

</comment></comment></comment></comment></comment><comment><USER17> If my assumption of dropbox's intent is correct, I prefer facebook's approach to this problem. Instead of wording terms exclusively in their favor they could have extended an olive branch...

"For content that is covered by intellectual property rights, like photos and videos ("IP content"), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non- exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook ("IP License"). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it."

(from <https://www.facebook.com/terms.php>)

facebook's license to share the picture of your cat terminates after you delete it from your profile. Had dropbox used similar strategy while drafting their terms, this would not be news...

(Disclaimer: I am not a lawyer and do not pretend to be one on TV.)

<comment><USER5> There are two factors that matter:

1\. When the license ends.

2\. What uses are permitted while the license is in effect. This is the part that is currently way too broad. It should be limited to what's necessary to carry out the user's instructions. In other words, Dropbox should only be able to use your content in your own interest, not in theirs or any third party's.

(This post is informational only, not intended to be legal advice or to create an attorney-client relationship.)

</comment></comment><comment><USER18> hi all, we've been reading all the feedback carefully and made a change to licensing section to clarify what we meant.

the change is highlighted on our blog: <http://blog.dropbox.com/?p=846>

<comment><USER19> Thanks for that.

</comment></comment><comment><USER20> "We sometimes need your permission to do what you ask us to do with your stuff"... " or publicly display that stuff to the extent we think it necessary for the Service."

So, they need to cover themselves legally if you put something in your public folder, or share it with someone else.

Besides, if you encrypt everything then it's not like they can do anything with it.

It's just a cya clause.

</comment><comment><USER21> It's often good to look at how other companies do things to see if it's out of the ordinary. Turns out this line is extremely common. Google, for example:

        You retain copyright and any other rights you already hold in
        Content which you submit, post or display on or through, the Services.
        By submitting, posting or displaying the content you give Google a
        perpetual, irrevocable, worldwide, royalty-free, and non-exclusive
        license to reproduce, adapt, modify, translate, publish, publicly
        perform, publicly display and distribute any Content which you submit,
        post or display on or through, the Services. This license is for the
        sole purpose of enabling Google to display, distribute and promote the
        Services and may be revoked for certain Services as defined in the
        Additional.

<http://www.google.com/accounts/TOS>

Also, Drew and Arash just posted an update to the blog with clarified language: <http://blog.dropbox.com/?p=846>

</comment><comment><USER22> I only use dropbox for backup of my computer and do not want Dropbox to share or otherwise access my files for any reason other than to preserve them for my use. I do not want Dropbox to make them available to anyone else without my explicit authorization. The revised TOS seems to stress the file sharing aspect which makes me very uncomfortable continuing to use Dropbox.

Here is what I wrote back to email@example.com (interesting that the default reply-to was email@example.com which doesn't make it seem like they are really interested in feedback)

       Please consider splitting the service into file sharing and backup and
       having a different agreement for each.
       I cannot and do not accept these new terms for your backup service
       and will have to look for an alternate supplier if you cannot amend
       your new approach: these are not the terms I agreed to when I signed up
       for the service. In addition, two weeks notice strikes me as a very
       short window for such a significant change: please consider
       extending the notice period.

</comment><comment><USER23> TL;DR - this is no different from almost every other site that many of us already participate in that includes an aspect of uploading/sharing content and in no way does this imply ownwership.

</comment><comment><USER24> Account deleted, problem solved.

Can't believe i recommended this service to my friends.

<comment><USER25> This certainly isn't a reason to suddenly delete your Dropbox account. Based on the previous actions of Dropbox regarding their TOS, I'm sure they will come out and clearly explain to users exactly why this change was instated and what it means for users, and I honestly doubt it's anything too serious for us to worry about.

<comment><USER24> They accumulated enough, this was just the one that got me to do it. For these purposes i did use Dropbox i need a service i can trust.

</comment></comment></comment><comment><AUTHOR> I am no lawyer, and most legalese is absolute greek to me, but that clause genuinely freaks me out. However, commonsense also tells me that Dropbox will never do something like sharing/profiting out of other's files. That will drive them to the ground. I am not really sure what to make out of this. Is this some clause that Dropbox had to put in to save their butt, or is there a sinister motive behind this?

<comment><USER26> Given how copyright law works, you need to grant Dropbox (and any similar services) those rights, otherwise they can't provide their service with your files.

 _worldwide_

= For the whole internet

 _non-exclusive_

= You can still license your stuff to others

 _royalty-free_

= Dropbox doesn't have to pay you for this license

 _sublicenseable_

= The license you grant Dropbox can be transferred to other companies, in the event of a company merger or similar

 _rights to use_

= Doesn't mean anything

 _copy_

= So they can copy your files between their internal servers

 _distribute_

= So that they can distribute your public files to other users

 _prepare derivative works of_

= So they can create thumbnails, extracts, previews etc

 _perform_

= Doesn't mean anything

 _or publicly display_

= List your public files to others

<comment><USER27> I'm curious what could happen if they did not include this clause? Who would sue who and for what?

<comment><USER28> Drop box is making a copy of your files every time they back up one of their servers. That might be a copyright violation without your explicit permission. This license fixes that problem.

</comment></comment></comment></comment><comment><USER29> Another reminder on not to use "the cloud" for anything critical or confidential, at least without encryption. Dropbox I used for synchronizing meeting notes, which may or may not be something I'm comfortable sharing. For example GitHub is completely different, as all my code is anyway open.

So, Dropbox account now removed. Won't be going back.

</comment><comment><USER30> As soon as I get time to investigate it properly, I'm going to be replacing Dropbox with Fuse + S3FS + EncFS. I recommended Dropbox to a lot of people and invited a lot of people to it, but assuming the above combination works I'll certainly be recommending it to techy friends in the future, and if I continue to mention Dropbox to non-tech folks (my parents etc) it'll be with a lot more qualifiers than previously.

I'd like to be sure that if all my data is exposed to someone it's as a result of my own cock-ups, not anyone else's. I don't think Dropbox are evil but I'm not feeling too confident about keeping sensitive data there any more. Their recent errors have probably only highlighted things I should have thought of previously - lesson learned there.

</comment><comment><USER31> I use Dropbox for everything as I use several different computers (the computer lab at university, work, Windows 7 on my laptop, Ubuntu on my laptop). I cannot see myself without this service...but this is ridiculous. I am seriously considering deleting my account.

</comment><comment><USER32> If you are technologically savvy (as one may assume, since you are here after all) and you feel uncomfortable with this change (as I do), I would suggest looking in to some of the other projects around that offer somewhat similar (albeit not as feature complete) self-hosted solutions: <https://github.com/philcryer/lipsync> <http://sparkleshare.org/>

</comment><comment><USER8> Well, of course you're granting them a license to your files. Otherwise you could sue them for copying your files to their server.

<comment><USER27> Could you? Would you win? Has anyone ever sued? Successfully?

<comment><USER8> Certainly you could sue. I don't think you would win. IANAL.

</comment></comment></comment><comment><USER33> I'm curious as to how long would it take some open-source enthusiast to come up with an open-source version of Dropbox-like software that you can install on your VPS and sync files through your own server. I mean, that would be awesome, but not too profitable.

</comment><comment><USER34> This reminds me of Jason Scott's classic: "Fuck the cloud" <http://ascii.textfiles.com/archives/1717>

</comment><comment><USER35> disappointing bit of CYA, after they failed to notify ALL of their customers that authentication had been temporarily, accidentally disabled for a few hours.

</comment><comment><USER36> Flagged for the FUD title chosen by the submitter.

</comment><comment><USER37> Please advise as to simple alternatives.

</comment><comment><USER38> What Dropbox TOS could have been

1\. We, Dropbox, copy your files in order to enable sharing and retrieving said files. Those copies of files we use still carry the sharing permissions you enable and your copyrights fully intact.

</comment><comment><USER39> "to the extent we think it necessary for the Service."

Does this include if they think its necessary for them to turn off paswords for several hours? I am curious that about the timing:

      * Fuck up security[0]
      * Get hit with class action suit[1]
      * Change TOS

[0]<http://news.ycombinator.com/item?id=2678576> [1][http://www.consumeraffairs.com/news04/2011/06/cloud-site- dro...](http://www.consumeraffairs.com/news04/2011/06/cloud-site-dropbox- drops-the-ball.html)</comment>


AWS CodeBuild – Build and test code with continuous scaling - <AUTHOR> https://aws.amazon.com/codebuild/ <comment> St-Clock I'm trying to find if they offer or plan to offer these features:

1\. Caching. CircleCI and Travis cache intermediate build artifacts (e.g., virtualenv in python) to reduce build time.

2\. Github pull request integration (red cross on pull requests if the build fails).

3\. Chat integration. Sending a message to slack or hipchat when the build fails.

4\. SSH into build container. Very handy for rare but difficult to locally reproduce build bugs.

Interesting offer though. We found that we would pay less than 5$ a month for our build needs and they would run concurrently.

<comment><USER2> The Github PR integration is the most important part for me. It's a necessity for us to be able to use it. We use our own install of Drone on a fairly sizable EC2 instance and not having to manage that anymore would be wonderful.

<comment><USER3> Github does expose an API for this: [https://developer.github.com/v3/repos/statuses/](https://developer.github.com/v3/repos/statuses/)

I mean integration is one less thing to build & manage, but you can sling together support in a pinch

</comment></comment></comment><comment><USER4> How many different CI workflow tools are on AWS these days? How do I know which one to pick? I really wish Amazon would spend some time building comparison guides for their services. Each one feels very silo'd off from each other and the crossover in functionality seems very high.

<comment><USER5> Cloudformation is for when you have a team of ops or a workflow where you have a lot of repeated resource recreation; Beanstalk is for when you have no ops, and you're happy for someone else to handle the environment; CodeDeploy is just yuck; and don't know about this one yet.

        Cloudformation: infrastructure-as-code (but has sharp edges) (doesn't touch your app/code directly)
        Opsworks: wizard-style 'drop your app here' kind of thing (less flexibility and control)
        Beanstalk: a simpler version of OpsWorks? (never tried it)
        CodeDeploy: install an agent, it pulls code/artifacts (janky workflow)
        CodeBuild: no idea, just been released
        Just Using The Web Console: convenient, but manual process (labour-intensive, prone to manual errors)

On the CI thing - from my experience at one of the places I work, there are a thousand CI systems out there, but very few CD systems. Pretty much anything can schedule and track builds, but few things schedule and track deploys (which gets suprisingly tricky suprisingly quickly). CD is the 'last mile'...

EDIT: missed some that I've never looked at. It is getting crazy...

        CodeCommit: looks like it might be a 'github'?
        CodePipeline: No idea. Perhaps a spruced-up version of CodeDeploy?

<comment><USER4> I appreciate the breakdown. It would be awesome if there was someone with the know-how to go more in depth on each of these.

I recently inherited an app that uses OpsWorks. The deploy process is actually really nice, but I notice that it doesn't receive a lot of updates from AWS. Since OpsWorks came out when Chef was hot, and now Chef seems to be less popular than Ansible and/or docker. I wonder what the future holds for me if Chef continues to decline in popularity.

</comment></comment></comment><comment><USER6> I'm excited about what this means for Lambda. Building Lambda packages has always been a pain because much of the time it needs to be built on Amazon Linux to work, meaning most (all?) CI SaaS solutions are out the window. I assume CodeBuild will run Amazon Linux and CodePipeline integrates with Lambda, so this should make setting up continuous deployment with Lambda much easier.

<comment><USER7> AWS now provides a container image for Amazon Linux which might also be an option, depending on the CI SaaS: [https://aws.amazon.com/blogs/aws/new- amazon-linux-container-...](https://aws.amazon.com/blogs/aws/new-amazon-linux- container-image-for-cloud-and-on-premises-workloads/)

</comment></comment><comment><USER8> When I saw this I got super excited because I thought it was going to be "per- minute low-latency distcc hosts" which was probably set up by having a ton of common toolchains ready to go at all times, and my big questions were "did they bother to support MinGW (easy)" and "do they have a reasonable story for iOS (though I can't imagine they have armv6 working right)", but while they got my hopes up when they said one could even upload custom toolchains I realized that didn't make much sense and a few paragraphs later I got the disappointing news that this is just some extremely thin wrapper over ECS that is limited to doing builds on single computers which max out at 8 vCPU (why?!). I mean, I guess this makes CI slightly more accessible to some people, but it isn't anything terribly exciting and is mostly going to help people with extremely small projects: this isn't going to scale up to the kinds of builds where you'd expect a service billing itself on scalability to be most valuable.

...Except for this part: _CloudBuild has per-minute billing_!! This is one of the major complaints people have about EC2 (and all the services Amazon builds over it), and is one of the major downsides of using it over Google's Compute Engine. If you have any kind of task that can possibly be thought of as a "build"\--one which can be expressed as a container of software configured to access some external asset as input and which generates a concrete output "artifact" (and maybe even not, right? to support some silly things people do in their builds like "check out code from npm", you likely get network access, and your build output could always be an empty file)--this now seems like a depressingly hilarious way to trick Amazon's infrastructure into giving you per-minute billing for random tasks which take less than 20 minutes to run (important limit, as they are charging a 3x overhead vs the on demand price for an equivalent instance: for 8 vCPU / 15 GB instance, a c4.2xlarge costs $0.419 per hour and a build.general1.large costs $.02 per minute, which would be $1.20 per hour).

In other words: I will argue that this service really can and maybe should just be looked at as a different pricing model for ECS, to support any "small" task (not just building code): if it takes less than 20 minutes and doesn't require a massive computer, CodeBuild is not only cheaper but probably easier to use (as it already models the problem in terms of a task queue, so you don't have to do that part either).

</comment><comment><USER9> This is really exciting. The lack of a build service has been apparent for a while: [https://convox.com/blog/aws-missing-build- service/](https://convox.com/blog/aws-missing-build-service/)

I wrote up how we plan to use this in the Convox platform here: [https://convox.com/blog/codebuild/](https://convox.com/blog/codebuild/)

Practically speaking, we're working through PCI compliance. Getting builds off of production services and root-enabled docker daemons is a huge win.

</comment><comment><USER10> As someone who has had to shop around and try out a bunch of continuous integration services (Travis, CircleCI, Snap, Solano, to name a few), this looks pretty interesting! We've stayed away from managing our own CI infrastructure but this could be a good (and cheaper) solution. It doesn't seem to actually be available yet, but it'll be worth a look.

</comment><comment><USER11> As it sounds like it's running inside Docker itself, I'd like to know if this supports "Docker in Docker". My requirement is not strictly DinD however I run multiple containers during CI (Postgres, node, test containers, etc). Possible via different approaches in CircleCI, Shippable and SemaphoreCI. I don't actually build any containers to save.

<comment><USER12> This is actually how Codeship's Docker infrastructure works by default, builds up containers and executes all commands in them natively. DinD still possibly but somewhat yet useful with that approach.

</comment></comment><comment><USER13> What's frustrating is if you go to the aws reinvent page they tell you a lot except the dates of the conference!!! [https://reinvent.awsevents.com/](https://reinvent.awsevents.com/) I was wondering why all these aws announcements were here.

<comment><USER14> They used to have the date but maybe they pulled it when the conference sold out.

</comment></comment><comment><USER14> At any time someone can show up to eat your lunch but if you're developing software for operations or developers it seems like a scary space to be in. AWS has a huge advantage by being able to simply add a service to their existing catalog.

<comment><USER15> I feel like none of the AWS developer offerings (the Code* services) are compelling enough.

Kind of like a lot of Microsoft tools, they are all lacking but, hey, the have deep integration with each other, so easier gluing.

</comment></comment><comment><USER16> [https://aws.amazon.com/blogs/aws/aws-codebuild-fully- managed...](https://aws.amazon.com/blogs/aws/aws-codebuild-fully-managed- build-service/)

<comment><USER10> Hmm this blog post says it is available but there seems to be no way to get to it and it is not showing up in the console.

<comment><USER17> the url works

[https://console.aws.amazon.com/codebuild](https://console.aws.amazon.com/codebuild)

</comment></comment></comment><comment><USER18> Gave it a try, seems to be kinda slow building docker images. An image that take 2 minutes in my machine is taking around 10 minutes in CodeBuild. The build seems to freeze a little between docker build steps :

\--- Example 1 ---

[Container] 2016/12/01 22:39:59 Step 9 : EXPOSE 3000

[Container] 2016/12/01 22:40:31 ---> Running in 1c6e3a4dbec8

[Container] 2016/12/01 22:40:45 ---> 602aa4bc97ac

\</comment><comment></comment><comment>-----

\--- Example 2 ---

[Container] 2016/12/01 22:36:00 Step 4 : WORKDIR /src

[Container] 2016/12/01 22:36:32 ---> Running in 98800352e6c2

[Container] 2016/12/01 22:36:45 ---> b437afe2a1c5

\</comment><comment></comment><comment>-----

Not sure if this caused by the fact its a docker inside docker implementation.

</comment><comment><USER19> This sounds a bit like BuildKite which has worked out pretty well for us! They provide an elastic AWS CI environment that you run in your own AWS account, and scales up/down as builds are queued up.

</comment><comment><USER20> I really wish AWS CodeBuild supported .net\C# as a preconfigured environment. Hopefully .net is not too far down on their priority list...right now we are using Jenkins.

<comment><USER21> I'm pretty certain someone will make a Docker image for Core CLR apps soon. There's one for Bitbucket Pipelines already.

</comment></comment><comment><USER22> Seems pretty nice. A few things I'd like to see:

1\. We should be able to configure this for a few/all branches (including PRs) and have conditional build tasks based on branch.

2\. We need be able to access resources inside a VPC.

3\. Turnkey chat integrations would be nice, but it's not a big deal to just curl.

4\. We need a way to execute actions on failure.

<comment><USER23> > 4\. We need a way to execute actions on failure.

I am curious to know what kind of actions would they be other than notifying via chat/email?

<comment><USER24> For one, hitting the Github API to put failed build markers against commits and PRs. CodeBuild doesn't appear to have the same Github integration that most other CIs do out of the box.

</comment></comment></comment><comment><USER25> FAQ says this. Is there any examples on setting it up? It isn't obvious from inside CodePipeline.

Yes. The CodePipeline Plugin for Jenkins can be used to integrate CodeBuild into Jenkins jobs. The build jobs are sent to CodeBuild, eliminating the need for provisioning and managing the Jenkins worker nodes.

</comment><comment><USER26> Still no way to build iOS applications.

<comment><USER27> Hi you can build iOS applications using Distelli and your own build servers - [https://www.distelli.com/docs/kb/using-your-own-build- server](https://www.distelli.com/docs/kb/using-your-own-build-server)

disclaimer: I'm the founder at distelli

</comment></comment><comment><USER28> This is AWS FatLambda. You provide a full container image instead of just a zip file.

</comment><comment><USER29> Does it support parallel builds?

<comment><USER30> You can set up parallelism manually, yes.

</comment></comment><comment><USER31> How does this compare with Amazon CodeDeploy?

<comment><USER32> It works side-by-side with CodeDeploy.

Using CodePipelines and CodeCommit you can create a workflow where a git commit to a CodeCommit repo can get picked up by pipelines and sent to the build service (i.e. CodeBuild or Jenkins). Then CodeBuild will push the resulting artifact to S3. CodeDeploy (and Elastic Beanstalk, CloudFormation and OpsWorks) can be configured to deploy the built artifacts to your application fleet.

It's the last piece in AWS's solution for continuous deployment.</comment></comment>


Linux 3.11's feature set now confirmed - <AUTHOR> http://www.h-online.com/open/news/item/Linux-for-Workgroups-Linux-3-11-s-feature-set-now-confirmed-1917712.html

<comment><USER2> [http://en.wikipedia.org/wiki/Windows_3.1x#Windows_for_Workgr...](http://en.wikipedia.org/wiki/Windows_3.1x#Windows_for_Workgroups_3.11) if you don't get the reference... Well played, Sir Linus.

</comment><comment><USER3> Compressed swap looks interesting

<comment><USER4> I'm all for options, but isn't swap slow enough as it is already without adding additional overhead?

Even on tiny embedded devices, storage is cheaper than cycles IMO.

<comment><USER5> As others have pointed out, the point of zswap is to "swap" in and out of RAM.

I'd like to add that your premise is faulty anyway: since compressed objects are smaller doing I/O on them is faster. As long as cost of the I/O you saved is less than the cost of doing the compression, it's faster not slower. Transparently compressed I/O usually uses high-speed algorithms (LZ4, LZO, etc) to take advantage of this effect.

Also, when a machine is swapping you'll usually find that the CPU is near idle since useful work is blocked on the swap I/O. Spending a little CPU time to speed up that I/O is a win.

<comment><USER4> An enlightening response. Thank you.

</comment></comment></comment></comment><comment><USER4> Not sure about the new icon, but the name is winning.

</comment><comment><USER6> That website looks like it was designed right around Windows 3.11's release. Yikes.</comment>