Apple's Supply Chain Secret - <AUTHOR> http://www.businessweek.com/magazine/apples-supplychain-secret-hoard-lasers-11032011.html <comment><USER2> OK...I cheer to so many things Apple does regarding operations. But when I read

Apple [..] sometimes doesn't pay until as long as 90 days after it uses a part [...]

I think only "lame". With $80B and 40% margin, company with that reputation...

Manufacturing is hard. And very expensive. Organize processes, buy machines and raw materials, pay the labor. And then comes Apple and gives itself a loan (basically, it's a loan) from a manufacturer.

No, sorry. It's lame.

PS - Just as a perspective: I help part time in a company my father and brother own (retail and manufacturing company). Even thou other businesses in the industry and the country do the same thing as Apple, they don't. I'm disgusted by that practice here...so, why not be disgusted by it when Apple does it?

<comment><USER3> Weigh that with times that they pay in advance. It's a case by case bases and I'm sure they're not late with payments. If they wait as long as 90 days, I bet it's because that was part of the business agreement they made with the manufacturer.

<comment><USER4> I would bet that 90 day payment was a one off. You notice NO ONE quoted in the article was willing to have their name used so it might have been a friend of a friend story. The suppliers who talked gave details about turning down a $1 Billion pre-payment!

<comment><USER5> I disagree for 2 reasons. First, Apple is notorious with NDAs. Second, many large retailers are quite willing to cancel contracts with any supplier that gets uppity enough to complain in public. Walmart is so notorious for cancelling suppliers that most Walmart suppliers will refuse to allow any company representative speak on the record.

</comment></comment></comment></comment><comment><USER6> I think Apple's supply chain management is a greater competitive advantage than their product design.

There are many factors beyond the quality of product that go into a purchasing decision - things like hype, accessibility, and most importantly, price.

Apple never had much a problem with great design or building hype, but the real reason for their success over the last 15 years has been their ability to provide customers better access to their products and to provide them at more competitive prices.

The iPhone is ( by most accounts ) a superior product to the Blackberry. However, no one was going to buy an iPhone for $900, and without this impressive supply chain, Apple wouldn't be able to get the profit margins they want at $600 ( or $200 subsidized, which is also supply chain management ).

Product is important, and as a culture that builds things, HNers tend to focus on that ( the green light conversation in these comments being proof of that ), but all the logistics of how a product is delivered are just as important as the product itself - and maybe more so - in building a successful company.

<comment><USER7> The same ethos provides similar results on the customer service side. For example, letting users go to the website and schedule a 15-minute window of time in which Apple calls them is _huge_. Letting users go to the website and schedule an appointment to go talk to a real live human is _huge_. And making them walk all the way through a retail outlet full of your products to get there doesn't hurt, either.

Every other company in their space is still stuck on figuring out how to distribute tech support resources to customers by asking them to wait on hold for an hour. That's an hour worth of time doing absolutely nothing productive that shows up on the 800 number's bill. That's a bunch more call center hardware to maintain in order to manage the queue of people on hold. That's less productivity per operator, because customers who are pissed off about being on hold for an hour are harder to work with, and because dealing with that for 8 hours a day is an excellent way to lose your own motivation. Let alone that a bad support experience is a good way to make sure a customer doesn't become a repeat customer.

<comment><USER6> +1. This should become the standard in customer support. If it's cheaper to provide in addition to being a better user experience, everyone should be moving this way.

</comment></comment></comment><comment><USER8> > Most of Apple's customers have probably never given that green light a > second thought

Most, I'm sure. But personally the first time I saw light shining through my metal laptop, I was amazed, a little delighted, and slightly confused about how they were doing it (because, as the article mentions, the holes are too small to see).

<comment><USER9> The first time I saw it I pulled out a triplet magnifier to see what was going on. I've got a few great shots of the laser pattern if anyone is interested.

<comment><USER9> Here is a recent shot: <http://i.imgur.com/Rl35X.jpg>

I'm still looking for the old shots (from around 08) which had a few nice shots of the unlit holes (the holes are much smaller than they appear here.)

</comment></comment></comment><comment><USER10> > When the iPad 2 debuted, the finished devices were packed in plain boxes and > Apple employees monitored every handoff point—loading dock, airport, truck > depot, and distribution center —to make sure each unit was accounted for.

When I went to WWDC10, I was struck by the small detail of the conference security wearing black polos with the Apple logo and "Security" under the logo. At most conferences, the security is wearing jackets straight out of action movie central casting (e.g. "SECURITY"). I thought that was a nice small detail - to attire the rent-a-cops in Apple gear. But, now, reading this, I think they may have been full time Apple security staff. Security is paramount.

<comment><USER11> They do have a full time security department: <https://ssl.apple.com/support/security/>

And believe me, they take every aspect of security into account.

</comment></comment><comment><USER12> Seems to me to be an extension of the 'People who are really serious about software should make their own hardware.'.

Say 'People who are really serious about making and selling a product should make their own production, supply and store chains' or 'People who are serious about their product should take ownership of all stages of that product.'

</comment><comment><USER13> What is argued in this article was argued much earlier this year on Quora.

[http://www.quora.com/Apple-Inc-2/What-would-be-a-good-use- of...](http://www.quora.com/Apple-Inc-2/What-would-be-a-good-use-of- Apples-86-85+-billion-in-cash/answers/612608)

</comment><comment><USER14> This is a great proof of the strategic advantages of totally controlling your operations. In the start you are at disadvantage, but if you manage to gain steam you end up with a competitive advantage that is almost unfair.

In Apples case this strong position is not only visible in the supply chain management but it is clearly present in all their stack. Another example is their supremacy in software.

I think that this is one of the great lessons from Steve Jobs, takin your time to control and develop everything internally it is feasible competitive approach.

<comment><USER15> Apple do a nice combination of controlling operation, with open(relatively) ecosystem.

They use the rapid response of a huge open ecosystem of software developers, while still having a lot of control.They do it this way because in software , time to market is very important.

For the hardware part, which normally changes less often(slower phone buying cycle,phones are integrated and not modular like PC's, relatively long time before new electronic components become mass market) and time to market is less important(relative to software) , they use a closed ecosystem, in order to extract most of the profit.

</comment></comment><comment><USER16> I _very highly_ recommend listening to a couple of episodes of Critical path if you care about Apple's supply chain strategy. I was amazed at the level of detail in which this was discussed (and going through this article I couldn't help but think that part of the information in it is due to the analysis on that podcast):

<http://5by5.tv/criticalpath/10> and <http://5by5.tv/criticalpath/11>

</comment><comment><USER17> Interesting parallel to walmart.

<comment><USER18> What's Walmart's supply chain like?

<comment><USER19> They've often been considered one of the best supply chain operations in the world, and aggressively drive their suppliers to lower prices and increase volume.

One classic anecdote is that leading up to a hurricane, Walmart did some data mining and found that poptarts sold like crazy when hurricane watches were declared. Within hours they had dozens of trucks heading to the Florida coast filled with poptarts and they made a lot of money that way.

Unless you have a fast, flexible logistics system and the analytical smarts to back it up, you can't exploit changing circumstances like that.

Edit. Source of Walmart anecdote is here: [http://www.nytimes.com/2004/11/14/business/yourmoney/14wal.h...](http://www.nytimes.com/2004/11/14/business/yourmoney/14wal.html)

<comment><USER20> I agree that exploit is the right word here, but probably not for the reason you chose it.

<comment><USER21> There's plenty to dislike about Wal-Mart, but there is absolutely nothing wrong with predicting a sudden shortage of a product in a particular area, and trucking in a bunch.

If they'd doubled the price, that would be another matter, but that's not what they did.

</comment></comment></comment></comment></comment><comment><USER22> "This operational edge is what enables Apple to handle massive product launches without having to maintain large, profit-sapping inventories."

Could someone explain what that means more specifically? That they don't have to have a large stock?

Doesn't this controvert the earlier statement: "Because of its volume ... Apple gets big discounts on parts, manufacturing capacity, and air freight."

<comment><USER23> Nope. Apple agrees to buy 1 to 5 million ipod screens from a supplier, at a $10 per screen (totally made-up figure). They say they want boxes of 100,000 units, delivered within 1 week of whenever they feel like asking for them. So Apple doesn't need a warehouse, they get their supplier to pay for that.

They also have an identical deal with another supplier, so they can play them off against each other if they need to renegotiate. Most companies would just go with whichever supplier was cheapest, but Apple may find it cheaper (in the long run) to keep the competition going.

<comment><USER24> To answer GP's question, "in stock" is a buffer between manufacturing and consumer. Apple has an algorithm to keep that buffer small but flowing.

</comment></comment></comment><comment><USER25> These kinds of articles were novel 10 years ago when Apple was coming back and was doing so while beating Dell at supply chain optimization and that was, justifiably, a huge story. Ironically, I read them in BusinessWeek back then, too.

Now, the ODM/OEMs have become brands and the folks who once were the main participants in Apple's supply chain are now directly competing with Apple. Breathless articles aside, are we really sure that Apple's supply chain is much shorter/faster than those of Lenovo, Dell, HTC, Sony or, holy hell, Samsung?

I also have a hard time seeing how $25M worth of lasers is a supply chain innovation; most other manufacturers would probably prefer to make the laptop for $6 (amortization) less. I have a ThinkPad T520 [with Linux] because it's rugged, comfortable (no wrist razor), has a TrackPoint (I know, I know, but I love it) and about $1200-$1500 less than a comparable Macbook Pro. Clearly, the majority of hackers disagree with me, so I'm convinced that 90% of Apple's incredibleness is their marketing (not ads, but understanding how to design and build excellent products which are very well targeted at their audiences).

<comment><USER26> >I also have a hard time seeing how $25M worth of lasers is a supply chain innovation; most other manufacturers would probably prefer to make the laptop for $6 (amortization) less

It looks like Apple's supply logistics chain is similar to WalMart's supply chain. WalMart has deep connections with their suppliers, requiring suppliers to hand over financial records, dictating factory processes, and demanding yearly cost reduction.

The difference (and it is the major difference) is that Apple focuses their relationships with suppliers on quality of process and availability by locking up supply years ahead of time. WalMart just focuses on cost reduction.

The innovation is that Apple willing to pay high upfront costs years in advance to design efficient manufacturing processes so that later it would be able to get both cheaper component rates and a guaranteed supply. Jonathan Ive has said that most of his time is spent designing processes rather than products. Check out this excerpt from the [Objectified](<http://en.wikipedia.org/wiki/Objectified>) documentary: [Youtube]([http://www.youtube.com/watch?feature=player_detailpage&v...](http://www.youtube.com/watch?feature=player_detailpage&v=t0fe800C2CU#t=149s))

</comment></comment><comment><USER27> Speaking as a contractor, I have a bias/tendency to eventually "fire" any client that takes too long or is too sketchy about paying me. Too much risk on my part. I work, I get paid. With all bullshit set aside, it should only take on OOM of about 1 minute to write a check, put in envelope, put stamp on it, and put in outbound mailbox. Anything longer than that is self-imposed bureaucracy, not physics.

</comment><comment><USER28> And yet we have to wait 2 months to get MBAs here in Slovenia (due to supply shortage) ...

<comment><USER29> That sounded like a really quick education, until I realized you were talking about a laptop.

</comment></comment><comment><USER30> They also don't have to pay for storage costs which eats up money for their competitors!

<comment><USER31> Dell and probably many others had this long before Apple.

</comment></comment><comment><USER32> _> According to Martin, the logistics executive, Cook uses a catchphrase to hammer home the need for efficiency: "Nobody wants to buy sour milk."_

That's a bit of a floppy ending for an otherwise excellent article.

</comment><comment><USER33> Interesting article, but this quote is absolutely sickening:

> Because of its volume—and its occasional ruthlessness—Apple gets big > discounts on parts, manufacturing capacity, and air freight. "Operations > expertise is as big an asset for Apple as product innovation or marketing," > says Mike Fawkes, the former supply-chain chief at Hewlett-Packard (HPQ) and > now a venture capitalist with VantagePoint Capital Partners. "They've taken > operational excellence to a level never seen before."

Crediting a company that until _very recently_ employed slave labour with "occasional ruthlessness" and "taking operational excellence to a new level" is just disgusting.

There is still no excuse for that. They should be grovelling on the ground begging for forgiveness, not being commended for it!!

At least thanks to this article we know how that situation came to being... Just a little harmless "occasional ruthlessness".

<comment><USER34> Slave labour? Really? Since Apple products are made my Foxconn, which also make products for a number of other manufacturers, aren't they then complicit too? How about Foxconn?</comment></comment>


[Dupe]Found in translation: More accurate, fluent sentences in Google Translate - <AUTHOR> https://www.blog.google/products/translate/found-translation-more-accurate-fluent-sentences-google-translate/ <comment><AUTHOR> Original blog post and report (September)

[https://research.googleblog.com/2016/09/a-neural-network- for...](https://research.googleblog.com/2016/09/a-neural-network-for- machine.html)

[https://arxiv.org/abs/1609.08144](https://arxiv.org/abs/1609.08144)

</comment><comment><USER2> Dupe: [https://news.ycombinator.com/item?id=12963231](https://news.ycombinator.com/item?id=12963231)

<comment><AUTHOR> Didn't look beyond the first page. Not sure how to delete the story now.</comment></comment>


Attack-driven defense - <AUTHOR> http://www.slideshare.net/zanelackey/attackdriven-defense <comment><USER2> A couple of points:

a) "Java is not secure in the browser" \-- I think that this is disingenuous. There is a lot of high-grade corporate software being written in Java for the browser _without_ any security issues (IBM does this a lot). I don't think Java is inherently any more insecure than something like Javascript XSS or plain-old HTML injection attacks. As a matter of fact, Java tends to jump through many annoying hoops (see security policies[0]) that further remedy this problem. I'm not saying you should be using Java in web-apps, but that singling out (Java == insecure) is simply not true from a pragmatic point of view.

b) Phishing not really covered enough[1]. I think that this is one of the major (MAJOR) problems that larger companies have security-wise. It's not that the IT guys aren't setting up firewalls properly, but rather that some marketing ding-dong is voluntarily giving away his passwords.

c) This is related to (b), but social engineering, much like phishing, is a bigger problem than "iterating attack patterns" (yawn). The run-of-the mill non-techie people need to be educated and trained into how to be vigilant and security-conscious. You can do all the drills you want, if Bob from accounting simply hands over his credentials to bad guy X, it's all for naught.

I really do like the anomaly awareness idea though. I think that might even be a great start-up idea. Have a service that logs "anomalies" \-- it simply does statistical analysis on various information (like login patterns), and when something "weird" happens (i.e. exceeding some set deviation), it alerts the security people.

[0]: [http://pic.dhe.ibm.com/infocenter/wasinfo/v6r1/index.jsp?top...](http://pic.dhe.ibm.com/infocenter/wasinfo/v6r1/index.jsp?topic=%2Fcom.ibm.websphere.express.doc%2Finfo%2Fexp%2Fae%2Ftsec_dynamic.html)

[1]: [http://slashdot.org/topic/bi/brute-force-and-social- engineer...](http://slashdot.org/topic/bi/brute-force-and-social-engineering- data-breaches-in-2012/)

<comment><USER3> Aside from security, users hate (including myself) if a webapp requires Java on the client side. That's just obsolete, inconvenient, slow, and problematic. but that's off topic...

<comment><USER4> Agreed. Java could be secured, but since it's generally disliked and unnecessary these days, it's easier to get rid of the legacy stuff that still uses it.

<comment><USER5> > but since it's generally disliked and unnecessary these days,

Maybe its disliked by start ups running the latest and greatest flavor of X, but enterprise isn't letting up any time soon on Java. Especially if there already using Oracle and its not easy to get rid of legacy stuff that costs money to rebuild. There are also people who adamantly protect the legacy stuff because that is where there job security lies.

</comment></comment></comment></comment><comment><USER6> In this slidedeck there is a interesting reference to another one from the FB Sec Team in case you missed it. [http://www.slideshare.net/mimeframe/ruxcon-2012-15195589](http://www.slideshare.net/mimeframe/ruxcon-2012-15195589)

</comment><comment><USER7> There's a section on "running effective attack simulations" starting on slide 104. Where are you supposed to find the (simulated) attackers, within your own organization ? External contractors ?

<comment><USER8> My guess would be the same professional pentesters as usual but give them different marching orders rather than "See what you can break".

</comment></comment><comment><USER9> An interesting point is their recomendation of putting ad-blockers on all corporate user machines as a security precaution - since a common malware entrypoint is users clicking on misleading links/popups provided by ads.</comment>


How I got XSS'd by my ad network - <AUTHOR> http://www.troyhunt.com/2015/07/how-i-got-xssd-by-my-ad-network.html <comment><USER2> "When you allow third parties to run script on your site, you're entirely beholden to them; they can run anything they like in the context of your site"

I've seen a fair few Internet banking web sites pulling scripts from over a dozen third parties, mostly for tracking and advertising, but even for trivial things like social media. On their customer login pages. It's beyond me how they can consider this to be an acceptable risk.

<comment><USER3> I wonder how many websites' users would be compromised if code.jquery.com got hacked.

<comment><USER4> I've been saying this for years. It's not even just security: you're also potentially leaking all your visitor stats to a third party (IP, user agent, the pages they visit (via the Referer)), and effectively giving jquery.com a third party supercookie over thousands of domains.

I surf with third party cookies and referers (via RefControl) disabled, and these should be the defaults

<comment><USER5> I've been called an idiot (even here on HN) for being paranoid about loading scripts from all over the web. I think it's a losing battle and my side is going the way of the dinosaurs.

<comment><USER6> As tools like uBlock and uMatrix get widespread adoption more and more people are realizing how much extraneous junk is being loaded by webpages. I think your side is slowly but surely gaining followers.

<comment><USER7> I use uMatrix, and I have already whitelisted loading scripts from common CDNs as global rules. They're everywhere and I found myself just constantly whitelisting them anyway.

The trend for a long time was to cite using a CDN as a best practice, but no one ever calls out the downsides when making such statements. In this case, you lose control of the code and allow third-party access to your users' browsers.

<comment><USER4> To be fair, it has some positives: like said CDN being able to patch somelib.js to fix a security issue and thereby protect thousands of sites at once.

At the moment though, proposed solutions to trusting third parties with your Javascript, like the W3C proposal to put cryptographic hashes in to your <script> tags etc, don't even consider these potential positives. So we're likely going to end up with the worst of both worlds.

If anything this is just enough facet of the weakness of the web as an app platform (Real solution: all sites serving client side libs should use package management, scripts should be digitally signed by the authors). As it stands it's far too common for people to just unzip WordPress or whatever in to their docroot, and so server-side code doesn't even get updated, let alone client- side code.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> If you're going to put adverts on your site, always put them within an iframe, pointed at a separate "adverts" only domain. This will ensure they can't execute javascript within your own website context.

<comment><USER9> Unfortunately it looks like you aren't supposed to do that with Google AdSense: [https://support.google.com/adsense/answer/3394713](https://support.google.com/adsense/answer/3394713)

> _Is it violating program policy if I place ads on iframe webpages in my > software?_

> _Yes, it does violate our policies. Firstly, you're not allowed to place ads > in a frame within another page. Exceptions to our policies are permitted > only with authorization from Google for the valid use of iframes. Secondly, > you're not allowed to put ads in your software, e.g., if you control both a > website with ads and an app that loads that website, we will take action > against it._

<comment><USER8> Yeah adsense is amongst the most restrictive products out there, and the one without any support etc. Wouldn't recommend it.

Talking of which, where are the startups challenging adsense's dominance?

</comment></comment></comment><comment> jon-wood The throw away comment on how ad networks are a cesspit at the end of that article really spoke to me - if it weren't for the abundance of "Recommended Stories" and "From elsewhere on the web" crap selling weight loss pills and click bait I'd be far less inclined to run with an ad blocker.

The fact that these ads disguise themselves as content that the site owner is recommending is particularly insidious, since it will likely encourage people to click through thinking that they can trust the content.

</comment><comment><USER10> In retrospect it seems he could have saved himself a Fiddler session if he just opened console debugger in browser and used `?"-(function(){debugger}())-"` in URL instead of `?"-prompt()-"`. (I would not have guessed this either, but may come handy next time.)

<comment><USER11> Well, that's handy.

</comment></comment><comment><USER12> This is why browsers should have an option "Block third party javascript" similar to "Block third party cookies".

With http2, relevant javascript files will be increasingly hosted on the same domain anyway and that option would become increasingly relevant.

<comment> micro-ram Blocking third party JS does not help me offload the libraries to a CDN (ex. cdnjs.com) to save server bandwidth.

<comment><USER13> It's 2015, though, not 1996. If you seriously can't afford to send your visitor a few-dozen-kilobyte file once in a blue moon (because you _do_ have far-future expire dates, right?), you've got bigger problems than CDN'ing your jQuery is going to solve.

If you're serving megabytes of JS such that that is enough to matter... no, it's still true, if that's not sustainable you've got bigger problems than a CDN is going to solve. Even on _very_ JS-heavy sites, the amount of your bandwidth taken up by JS shouldn't be that large on a properly-configured site. (Yes, I can construct some rare exceptions... you've got a demo site for WebGL and your average viewer hits you once with no cache, grabs megabytes of JS and textures, then moves on never to return. But they are _rare_ , even if you can construct them in your head.)

</comment></comment></comment><comment><USER14> I've resisted using an ad-blocker for years because I'm happy for the sites I visit daily to earn revenue that way, and for many it's the only way they can. I limited myself to running Privacy badger and blocking Facebook/Twitter tracking cookies, that kinda thing.

But this is the straw that's broken my camel's back and it spoils things for those of us who don't mind a few ads here and there. uBlock now installed, sod the ad networks.

<comment><USER5> Wouldn't it be better to disable third-party scripts?

<comment><USER15> In this particular case, Ghostery would be suitable over uBlock.

(I run both)

</comment></comment></comment><comment><USER16> Whenever I talk to people who work for ad networks or similar companies, I'm, without fail, impressed by how little technical knowledge they possess. If you work for a company that sells internet services, you should at least have some basic understanding of how the internet works.

</comment><comment><USER17> What a shame he didn't actually pull the plug on the ad network :(

</comment><comment><USER18> as far as i can tell, adsafeprotected isn't actually for your or your visitors' protection, but for the advertisers (it seems to run a huge gob of incredibly slow scripts to "ensure" visibility, that there is actually an eyeball on the ad and that it's not hidden or collapsed or something)

</comment><comment><USER19> What alternatives are there anyway?

I wonder what could be done to serve 3rd-party ads, making sure they can't hinder the experience of the users of the webpage.

Is this just laziness from those ad networks, or do we currently have the tools to counter this?

</comment><comment><USER20> That's called Malvertising :P</comment>


An Alternative Approach to Rate Limiting - <AUTHOR> https://medium.com/figma-design/an-alternative-approach-to-rate-limiting-f8a06cf7c94c <comment><USER2> There's a fixed memory solution that doesn't suffer from the boundary condition that allows you to double the rate. It's pretty straightforward, so I'll describe it in prose, since it's 6am and I'd rather not get the code wrong. :)

The approach uses a ring buffer. If you're not familiar with them, they are a fix-sized array or linked list that you iterate through monotonically, wrapping around to the beginning when you are at the limit. Our ring buffer will hold timestamps and should be initialized to hold 0's -- ensuring that only someone with a time machine could be rate limited before they send any requests. The size of the buffer is the rate limit's value, expressed in whatever time unit you find convenient.

As each request comes in, you fetch the value from the buffer at the current position and compare it to current time. If the value from the buffer is more than the current time minus the rate limit interval you're using, then you return a 420 to the client and are done. If not, their request is ok and you should serve it normally, but first you store the current time stamp in the buffer and then advance the counter/index.

<comment><USER3> The article describes solutions that use Redis so that multiple app servers can share rate limits. The article's second solution is basically what you're describing, except adapted to work with Redis.

Also, what do you mean by "fixed" memory? Sure, the memory doesn't grow over time, but neither does the memory of the other solutions. Of the solutions listed in the article, this is the most memory-hungry.

<comment><USER2> The other fixed memory solution that is specifically mentioned suffers from a defect that allows you to go up to 2X past the rate limit by sending 1X on both sides of an aggregation boundary. I thought readers might appreciate an alternative that is also fixed memory but that doesn't suffer from this defect. And sure, the fixed value is larger than other solutions (probably not larger than the Redis solution) but it's likely optimal if you care about being sure the rate limit is never exceeded within your given time interval. YMMV, I am making no claims about universal applicability.

Finally, yes, it's not Redis -- but it could be exposed as a service if you wanted that pretty easily. Operational complexity will exist regardless and depending on your organization different solutions will be appealing for different reasons.

</comment></comment></comment><comment><USER4> _In response, we implemented a shadow ban: On the surface, the attackers continued to receive a 200 HTTP response code, but behind the scenes we simply stopped sending document invitations after they exceeded the rate limit._

And right there they broke the service for legitimate users. Totally unacceptable collateral damage IMHO.

<comment><USER5> Without shadow ban, you're just telling the spammers how to be effective and stay just under the limit.

<comment><USER6> So? Users playing by the rules of the service get to use the service unhindered. A much better approach to shadow banning would be to make better rules and enforce them. Spammers don't want to jump through hoops, so if you implement rules based on bounces and spam reports you'll get the same result (less spammers) but without screwing over legitimate users.

This is how Mailgun and their ilk operate, and while it's annoying to get bitten by their rules (we forgot to warm up a mailing list once and got a temporary suspension as our bounce rate was too high) they treated us like adults, told us _why_ our service had been suspended and proceeded to help us clean up the mailing list. If they had pulled some shadow banning BS we'd have just left the service as we wouldn't be able to trust that they're not messing us (and our clients) around.

Shadow banning works just fine for online forums and the like. It's a pretty terrible method of rate limiting though.

<comment><USER7> _This is how Mailgun and their ilk operate_

That's because their business model is to facilitate the level of spamming that sits right below the threshold of anti-spam measures.

Of course they're going to help you send out as many messages as possible. That's what you pay them for.

Without saying that OPs approach was the most appropriate solution to their problem, I'll point out that Figma's bottom line isn't directly connected to how many document invite emails they shoot out. That's just a collaboration feature of a larger product.

</comment></comment></comment></comment><comment><USER8> I would think if you have a consumer application that can't handle double what is set as the rate limit during a very small corner case (start and end of the the minute barrier) you have bigger problems. As you're still effectively enforcing your rate limit over time with that approach. This just sounds like micro-optimization at its worst.

<comment><USER9> Yeah, I was also thinking how meaningful ~20MB of memory use really would be in this context. Or how badly would racy token bucket perform in the real world. Still, enjoyed the read.

<comment><USER10> I think this is an important point. Trying to store all of these in RAM means you can only have so many. Which is why I really like something that can use a backing store of a more cost efficient DB. Once you start thinking about what you could do if you could have 1000s of rate limits per user you end up thinking of lots of interesting ways to use them. Like limiting how often you log/track-usage to 1/hr per event per user. That's saved me a ton of money.

Second thought: token buckets have a nice property of being really cacheable once they expire. You can push down a "won't refill until timestamp" and then clients can skip checking altogether.

</comment></comment></comment><comment><USER11> You know you can implement a token bucket that doesn't share state between your API servers, in about 10 lines of code, using just a in memory map.

Your incoming requests should be balanced across all of the servers so you just derive the allowed throughput and divide by the number front ends....

<comment><USER12> This only works if your bucket size is much larger than your number of servers.

In the degenerate case, imagine a rate limit of 2 total requests per minute load balanced across 2 servers with enough traffic that my request is basically hitting a random server. In this case, 50% of the time my second request will be rate limited incorrectly because each server has a bucket of 1 and my second request went to the same server as my first.

I'm sure someone smarter than me (and better at probability) could come up with an equation where you input your rate limit & number of servers and it tells you the probability of a false positive for a user.

<comment><USER11> That's valid, if the distribution of work is not fair, this won't work.

In practice, when you are receiving enough traffic to make throttling practical you aren't usually throttling at 2 RPM across 2 servers.

<comment><USER13> Even if you have more servers, you'll still very easily hit the case of rate limiting someone too early. And that's really bad, because it means your clients, who are aware of the rate limit and structure their code to stay under it, will start getting failures they shouldn't get, and they have no way to handle it besides intentionally staying significantly under the advertised rate limit.

So if you're really set on doing something like this, you need to set the actual rate limit to be significantly higher than the advertised rate limit, such that it's extremely unlikely for a client to be rate limited too fast.

</comment></comment></comment></comment><comment><USER14> I think rate limiting is the wrong idea. Say for example, a client wants to re-fetch everything that it has cached, it may send a burst of requests in a short amount of time, and some of those requests may be wrongly rejected due to rate limits. This is what happens when a browser refreshes a page for example.

A better approach I think is delaying request handling based on resource allocation. If one client is disproportionately using up more time than others, then processing that clients' request will be queued up to process later, while well behaving clients will get their requests handled quickly. I think this is a more realistic approach and imposes less arbitrary restrictions.

<comment><USER15> Once you start getting into quality-of-service, basic rate limiting like the discussed is not enough. I think Stripe did a better job of covering such concerns in their rate limiter post. They specifically talk about being lenient to "bursty" traffic, as that was a legitimate use-case for clients.

[https://stripe.com/blog/rate-limiters](https://stripe.com/blog/rate-limiters)

[https://news.ycombinator.com/item?id=13997029](https://news.ycombinator.com/item?id=13997029)

<comment><USER16> Yes, this is why you want to use a token bucket rate limiter (which for some reason was considered and rejected by the original post). We wrote it up here and have an open-source impl on github that's in production serving hundreds of millions of rate limits: [https://medium.com/smyte/rate-limiter- df3408325846](https://medium.com/smyte/rate-limiter-df3408325846)

</comment></comment></comment><comment><USER17> This is why I like HackerNews comments. As a primarily front-end dev building a SaaS, I'd already bookmarked this post and was planning implementing it. But it seems like the comments here are pointing me in a better direction.

</comment><comment><USER18> Sounds like a lot of work to avoid writing 20 lines of Lua.

<comment><USER10> agreed. I was a bit leery of diving into Lua as I was building [http://ratelim.it](http://ratelim.it) but it really expands Redis's capabilities dramatically and was easy enough to add.

My apps all write the lua into redis and store the hash when they boot up. Duplicative, but means everybody is on the same page and it's easy to store the lua in the main codebase.

<comment><USER19> Hey buddy!

Reading all the design and discussion I was. Rey curious how you structured things at a brass tacks storage level.

<comment><USER10> yoo! [https://www.slideshare.net/jdwyah/diy-heroku-using-amazon- ec...](https://www.slideshare.net/jdwyah/diy-heroku-using-amazon-ecs-and- terraform) does have a bit of a pretty picture, but the basic idea is:

For each rate limit you can choose to be in one of two modes: 1) Redis with a backing store of DynamoDB aka BestEffort since there are failure modes where you could lose an update. In this mode everything expects to happen in Redis, but if we don't find your limit there we check Dynamo. Writes are asynchronously persisted to Dynamo.

2) Token Buckets straight in DynamoDB. This is our Bombproof mode.

(details in [https://www.ratelim.it/documentation/safety](https://www.ratelim.it/documentation/safety))

It's worth noting that with either of these you can cache aggressively in the clients whenever the limits have gone over. Both the clients [https://github.com/jdwyah/ratelimit- ruby](https://github.com/jdwyah/ratelimit-ruby) [https://github.com/jdwyah/ratelimit- java](https://github.com/jdwyah/ratelimit-java) do that for you.

</comment></comment></comment></comment><comment><USER20> It's a nice post with a lot of detail and nice imagery... With that said, how would a simple, slightly modified, exponential backoff work any worse?

<comment><USER3> What? These are different things.

This article is about the server deciding which requests to reject. Exponential backoff is a strategy clients use deciding when to retry after their request is rejected. (Plus, the article is about malicious clients; they're not going to follow your preferred backoff strategy.)

More concretely, how would exponential backoff ensure that you don't allow more than 10 requests/second per user?

</comment></comment><comment><USER21> It's good practice to rate limit endpoints for a variety of reasons, but in particular any endpoint that exposes user authentication should be rate limited.

So this should be a tool that every service at scale has access to.

IIRC the lack of rate limiting burned Apple relatively recently.

Is this yet another area where we all reinvent the wheel? I've yet to see a recommendation for an off the shelf solution

</comment><comment><USER22> Thanks for referencing my earlier post in the article! We use the "sliding window log" you described at ClassDojo, but your more memory-efficient approach looks great.

[https://engineering.classdojo.com/blog/2015/02/06/rolling- ra...](https://engineering.classdojo.com/blog/2015/02/06/rolling-rate- limiter/)

</comment><comment><USER23> Was wondering what would be the best way to rate limit API requests that are in the order of thousands per minute, am guessing not any of the methods suggested in this write up helps?! Help pls.

<comment><USER10> why not? 1000s/min should be NBD.

<comment><USER23> Really ? In our product, an average user can send request of upto 4000/minute and we have about 1000 users now. Do you think would it be possible to scale ? Suppose, if maintained a list in redis with sorted time stamp, then for every incoming request i will have to make get query to redis for count of requests in last one minute, one hour, one day (3 calls) and then insert a timestamp for this current request. So, totally 4 requests. Apart from this suppose if concurrency handling (number of concurrent connections allowed by a particular user) is also built then that will also include additional redis calls. Do i make sense to you ?

</comment></comment></comment><comment><USER24> Zooming out a little, the fundamental problem here is broadly recognized as a modern protocol design challenge. To phrase the consideration roughly: the response to a request should not require more resources than the client has already spent to request it, either in terms of bandwidth or processing (including memory, storage IO bandwidth, etc.).

Obviously, in some cases such design is not possible. The classic case is HTTP, where the entire purpose is to supply some (arbitrarily large) volume of data in response to a small request, and therefore there is a bandwidth challenge.

Conventional defense strategies tend to utilize the fact that TCP requires a three-way handshake to instantiate, thus validating the peer's IP address (unlike UDP), and include:

(1) An authenticated session, eg. using a session key derived from a separate API call.

(2) Rate limiting per authenticated user, either based upon data over time or request frequency. ( _This alone is the subject of the article_ )

(3) Segregating read-only, cacheable data (even if it expires within seconds) on separate infrastructure such as CDNs or memory-based caches.

(4) Aggressive use of HTTP caching.

(5) Careful tuning of HTTP session length related configuration to suit the application profile.

A newer strategy is the use of captcha, however this is not viable in automated (ie. API) use cases. Another relatively 'new' (for HTTP) strategy is the use of websockets or other mechanisms for real time 'push', to avoid the latency and processing overheads of the conventionally enforced HTTP request- response model.

Additional options would include segregating clients to speak to different servers (ideally in different data centers, on different links) such that overhead may be scaled across different infrastructure. Thus even if a single server is targeted by an attacker damage is limited in scope.

Another architectural defense would be the enforcement of a gateway/proxy layer (internal or third party) obscuring real datacenter netblocks from attackers, however this comes at the cost of latency where data cannot be cached.

Cloudflare basically provide all of the above (plus additional features) as a service.

Finally, in native mobile application development where an API is the primary interface with some central system, another simple step that can be taken (with appropriate care regarding peer authentication and cache invalidation) is the use of a cached set of IP addresses within the client as a means to identify servers. In this way, attacks against DNS infrastructure will also be nullified, and you can focus the demands of segments of your user base on different infrastructure. (Here in China, DNS is often hijacked or broken, though this is much less of a concern in typical western environments. It will also reduce startup latency on slow mobile links the world over.)</comment>


TinySeed (bootstrap accelerator) applications are live - <AUTHOR> https://tinyseed.com/ <comment><USER2> I created this unofficial Google Doc with all of the questions if you're like me and prefer drafting outside your web browser. (File > Make a copy.) [https://docs.google.com/document/d/11ZoPzFFxQ_e_Eytwm3hqdcP1...](https://docs.google.com/document/d/11ZoPzFFxQ_e_Eytwm3hqdcP1BS1Dix70d3SwdDIGxyU/edit?usp=sharing)

</comment><comment><USER3> > 8~15% Equity + Dividends.

Can anyone comment on how favorable those are?

<comment><USER4> Disclaimer: I haven't taken any funding, and I'm outside of the SV sphere so probably I am wrong, but I do run a SaaS making sub $10k MRR so I am thinking of applying....

I think "It depends". If you have an unproven product, a $120k investment + mentorship in exchange for 15% sounds pretty good to me.

My situation makes the monetary investment a lot less important. For me the value would mostly be in how applicable the mentorship would be in my situation. Is 8% worth it? Maybe, maybe not. I think I'll end up waiting on the next round before applying. (and try to fix my obvious defects in the meantime)</comment></comment>


Is-postive – The most pointless NPM repository - <AUTHOR> https://github.com/kevva/is-positive

<comment><USER2> How Is 0 not positive?

<comment><AUTHOR> Maybe it was! [https://github.com/kevva/is- positive/commit/3db0639fb52c463f...](https://github.com/kevva/is- positive/commit/3db0639fb52c463fe92e8acedf292a7b0582b602)</comment></comment>


Apply HN: Fix Research Paywalls and Donate Directly to Research Projects/Groups - <AUTHOR> Expected Outcome (TL;DR):
- More money goes towards research, less money goes to bureaucracy
- The public gets more access to research and is guided by the public interest
- Users get most of their donations back in tax write-off
The Problem:
Research in the U.S. has two glaring issues:
1. Accessing research is usually behind a paywall or obfuscated with complex language
2. Research isn't guided by public interest - i.e. we don't control where the money goes (with our donations or taxes).
[1] http://www.cancer.org/research/infographicgallery/where-does...
[2] http://www.cancer.org/research/applyforaresearchgrant/
The Solution:
A website that allows users to donate directly to a research groups or projects. In return, research groups share their research with funders in a legible/non-obfuscated format.
Users can view individual projects they wish to fund or select a "Tag" or "Category" they wish to fund (i.e. breast cancer). This money will be provided via grants, similar to what the American Cancer Society does it.
To ensure the research groups are valid, we will inspect all paperwork, personal, and potentially facility.
Profitability:
With all business ideas, we need to make money. Rather than taking 26%+[1] of donations for administrative costs, we plan to have a different payment structure. Users will pay a guesstimated $100 yearly fee to cover administrative costs, plus a percentage (estimated 5%) to cover transaction fees.
The goal is to have users donate monthly, to the limit (or above) what you can write off on your taxes yearly. Meaning it doesn't cost users money, they get a receipt at the end of the year to write off on their taxes. <comment><USER2> And you will take some cut? How does this make money?</comment>


Use unique IP addresses for sharded asset hosts - <AUTHOR> http://statichtml.com/2010/use-unique-ips-for-sharded-asset-hosts.html

<comment><USER2> I use Amazon Cloudfront to host assets, and this problem is taken care of for me. I created an S3 container to store all of the files (in this case thousands of images). Then I created a Cloudfront distribution to serve them over a CDN. Cloudfront lets you create multiple CNAMEs per distribution so I created a CNAME for images1.domain.com through images10.domain.com to my distribution. In my app I created a simple hashing algorithm to assign the right subdomain (basically it takes an MD5 of the filename, looks at the second character, converts hex to dec and that is the number of the subdomain). That way any given image gets served from the same subdomain to take advantage of caching. And the bonus is that Cloudfront assigns each of the CNAMEs a different IP address.</comment>


Code Reviews should be the universal rule of serious Software Development - <AUTHOR> http://blog.manishchhabra.com/2012/12/code-reviews-should-be-the-universal-rule-of-serious-software-development/

<comment><USER2> Reviews are undeniably important. I've spent a far above average time on this problem when I was on the dev team for CodeCollaborator so I feel qualified to suggest:

a) its a code review, not an author review

b) be respectful of your reviewer's time:

1\. 200 lines is a big review obligation, 500 lines should be a hard maximum. Remember that boilerplate code does have meaning, and it counts. If you can't make time for reviews, then don't rubber stamp, just don't review.

2\. Run whatever automation and analysis is available to you before submitting for review, and fix what it tells you to fix or note the trigger and document why its a false alarm.

3\. You may count unit test code at 1/3 the normal rate, and even get 50 lines totally free. This relieves the burden of mentally running your code, and makes it easy to request additional test cases, which will be easier on your ego than bugs.

All the big problems people have with code reviews are about checking your ego, respecting your peers, and clear communication.

</comment><comment><USER3> I've had a lot of trouble with this at my current job. There's a strict policy that requires a review before anything makes it in to a deliverable branch, but there's also a culture of emergency fire fighting where they will expect problems fixed quickly, often outside of working hours when a code review isn't really possible. So far our team's done full blown reviews for all new components, but we've waived reviews for small bug fixes. One big hurdle is that we are using proprietary source control software that does not play nice with any of the established review tools (another battle I am trying to fight.).</comment>


How to tag incoming email automatically? - <AUTHOR>

I have tried using Taqilla or "Tag the Bird" (which doesn't work for Shredder).I am looking for a way to tag incoming emails based on the content of the email. This should make it easier to sort the emails given the huge volume of mailing lists that I get.<p>Any solutions? <comment><USER2> What OS? Client side, or server side?

There's a billion ways to tag email, but which of these are available highly depends on your setup.</comment>


How the Pomodoro Technique changed my workday - <AUTHOR> http://www.fastcompany.com/3053036/how-to-be-a-success-at-everything/the-simple-technique-to-fit-a-40-hour-work-week-into-167-h <comment><USER2> Personally, what kills my productivity is when it takes more than 5secs to compile/load/whatever. I don't have ADHD in real life, but when I'm hacking, I can't wait that long, so I'll alt-tab and look at HN or whatever for "5-10secs". Problem is I find an interesting article and then come back 5minutes later.

So, I know it's not the best solution, but I keep compiling/loading time REALLY fast. I.e. hot reloading is a good example of small thing that boost productivity insanely. But even in C++, I'd just work on a separate project and stub everything so that it compiles in a few ms. I know that if I need to recompile the whole codebase everytime I'm making a change I won't get any work done.

It's also because I tend to do the code/test really fast. I know some people who code for a few minutes, then test it.. so it's less of a problem for them.

Anyway, back to my hacking.. see, that sucker took more than 5 seconds to run :-)

<comment><USER3>
      what kills my productivity is when it takes more than 5secs to compile/load/whatever.

Sigh. These kids today have _no_ idea what it was like to dial in to work at midnight so you could fire off another build that could finish by morning, if you were lucky. Or, to be limited to off-hours for running builds at all.

<comment><USER4> Yeah but you didn't have internet to waste your time back then. I fucking hate internet at times. It has conditioned me to read everything in little digestible tidbits. Before I spent much more time reading actual books, staying concentrated on reading one topic for you know at least 1 hour at a time.

<comment><USER3> Sure we did. I was very active in several Usenet newsgroups from 1987 on.

Of course, at that time, few companies were connected 24x7. My employer, for example, dialed in for mail and Usenet traffic exchanges a handful of times a day.

The debates over the first ANSI C spec in comp.lang.c were most entertaining.

</comment></comment></comment></comment><comment><USER5> _One day I'd had enough. Truth be told, I'd had way more than enough. I stopped and reevaluated my life, trying to figure out what was important to me, and what wasn't._

This self-reflection and whatever series of events led to it are more valuable than any particular time management technique. I'm surprised the author did not discuss this in more depth, though I suspect this is because these realizations tend to arise largely by happenstance.

When we notice ourselves failing to direct our energy toward matters of immediate concern, this is a fine occasion to evaluate what we are doing and why. If it is procrastination, perhaps this is a result of fearing failure, or perfectionism, or low energy. Perhaps we are distracted by a thought with which we have too closely identified ourselves, thus failing to notice that we are even thinking. There are many competing forces at play in the mind, and we are seldom if ever aware of all of them at once. I think that generally the cause of low productivity is, as someone once put it, "a failure to think about thinking." Perhaps the boon of these techniques is that they direct our attention to the content of our minds by creating a sense of urgency.

</comment><comment><USER6> I really like that the author describes work as fitting into two categories: the really focused stuff he uses the Pomodoro technique for, and all the peripheral stuff. I think it's a very important distinction and I'm keenly aware of it in my daily work.

I've found there are two advantages of Pomodoro that are under-appreciated:

1\. At the end of your day you have an integer number of "Pomodoros" done. An integer number is very easy to grasp and compare with other days. So you have a very strong sense for how well you did with your day, or how well you are doing so far in the day. It's a powerful thing and it keeps you honest.

2\. After you have used the technique for a while, the timer you use not only serves as a timer, but its start mechanism/button/gesture/whatever actually serves as some sort of psychological "switch" that puts your mind in work mode. On mornings when I am lacking a little motivation, I can just start the timer and I'll get into gear. It's not magic, but when I need a little extra kick the timer does it very well.

<comment><USER7> 3\. You get great at estimating work in 25-minute chunks. Being able to exert that level of control is cool. 4\. It directly taps into several other productivity systems like the X Method.

<comment><USER6> 5\. Sometimes when you have just 30 seconds left on your Pomodoro you start blasting away on your keyboard like you're one of those hackers in the movies. It makes you realize how much you can do in 30 seconds.

<comment><USER8> I've actually started to do 5 minute pomodoros. It's insane, but also a lot of fun. Especially when pair programming it's great because you can start discussing an issue and suddenly you look at your timer and think, "Woah... 30 seconds just went by. Let's just try it one way. We can change it later if we want". I also write down what I've done at the end of the 5 minute pomodoro. If it is "nothing", then it's a good flag to say that I have a problem.

</comment></comment></comment></comment><comment><USER9> While I respect the Pomodoro technique, I found that its focus on 25-minute chunks is largely incompatible with the way I (and many others) program. When it takes 10-15 minutes to load everything up in your brain, that only leaves you a few minutes to actually work before you take a break.

It remind me of the "This Is Why You Shouldn't Interrupt a Programmer" comic: [http://heeris.id.au/2013/this-is-why-you-shouldnt- interrupt-...](http://heeris.id.au/2013/this-is-why-you-shouldnt-interrupt-a- programmer/), except in this case, you're interrupting yourself.

These days, I use SelfControl to disable access to my distractions all day long to get a ton of stuff done.

<comment><USER7> Then start your next pomodoro immediately. That's what I do. If you can do that and not get burned out, that's ideal, especially if you're in the zone. It's also better than increasing your pomodoro time IMO. Since I don't take a break 2-3 sessions at a time sometimes, looking at 10 minutes to go is spurring; when I experimented with 40-minute sessions I hated looking at 35 minutes left on the clock.

<comment><USER10> I do a variation of this. Ten minute timers, instead of 25, and then I make sure that whatever task I set for myself is something I can do in 10 minutes. For programming tasks this is often "Finish writing method foo", or "Debug the problem with method bar".

<comment><USER11> How long are your breaks?

<comment><USER10> I don't take a break after every session. I usually try to break for 5-10 minutes once per hour.

</comment></comment></comment></comment></comment><comment><USER12> Pelko Method is more effective: [http://doublestealth.blogspot.co.uk/2014/07/the-pelko- method...](http://doublestealth.blogspot.co.uk/2014/07/the-pelko-method.html)

<comment><USER13> I like him making fun of us Italians, although we're not actually having any afternoon naps, unless you're over 70 or are a farmer :(

<comment><USER14> You're missing out then. Taking a 20-30min nap has been the best sustainable productivity hack + lifestyle change that I've done.

<comment><USER15> How much do you sleep per night and how much caffeine do you drink?

I used to nap like that too, until I reduced my caffeine (one cup of coffee in the morning now) and started consistently getting 8-10 hours of sleep per night. I'm much happier and more productive than I ever was when I felt like I was constantly battling exhaustion with afternoon naps and coffees.

<comment><USER14> Thanks, I'll have to experiment with that. I drink plenty of coffee and sleep about 7 hours.

</comment></comment></comment></comment></comment><comment><USER16> The last paragraph pretty much sums up the entire article:

Click here to get access to my free 32-page guide that explains my simple system in detail and includes worksheets, tools, and resources that you can print out and use. Save 23.3 hours each week and get more accomplished!

<comment><USER5> Yes, that bit of self-promotion and the hyperbolic claim negated his credibility. Then again, HN readers must already be familiar with the ways of 'fastcompany' writers given the sheer number of articles we see from them.

</comment></comment><comment><USER17> The basic 5 step technique is useful with teenagers at revision time. Light weight, easy to remember, they seem to like the kitchen timers (I use 'pound shop' clockwork ones except you can't get them in pound shops any more).

[1] [http://g.fastcompany.net/multisite_files/fastcompany/imageca...](http://g.fastcompany.net/multisite_files/fastcompany/imagecache/inline- large/inline/2015/11/3053036-inline-buffer2.jpg)

</comment><comment><USER18> _Right now, you're probably thinking, "Twenty-five minutes of work? That's nothing! This is gonna be easy!"_

Actually as someone who mostly formed my study/focus skills during the age of distraction (Facebook, SMS, YouTube), I don't think this is trivial at all.

If I were to go all in on the Pomodoro Technique, I'm pretty sure have to start training myself from just 10 minute undistracted work sessions.

<comment><USER19> I find the 25 mins difficult at times too; partially because of distractions, and partially because I let myself be distracted by them.

If I can't do a full one, I cut the next one down by 5-10 mins and try the shorter time period. If I CAN get that one done, I add 5 mins. Repeat until I'm down to 5 minute tasks or 25 min pomo's.

</comment></comment><comment><USER20> Trello + Pomello is a quite powerful combo. Not only I use it for focusing, but also tracking time that I spend on freelancing (down to specific Trello tickets).

Pomello: [https://chrome.google.com/webstore/detail/pomello/ahjnfakocp...](https://chrome.google.com/webstore/detail/pomello/ahjnfakocpfoocnncbgmondnnnlfjide?hl=en)

<comment><USER21> Are there any similar timer solutions that link to github or bitbucket issues?

<comment><USER22> Check out Toggl, their Chrome extension will add a "Start Timer" button to a ton of popular services:

[https://chrome.google.com/webstore/detail/toggl- button/oejgc...](https://chrome.google.com/webstore/detail/toggl- button/oejgccbfbmkkpaidnkphaiaecficdnfn?hl=en)

</comment></comment></comment><comment><USER23> Note that this fits in well with recommendations of ergonomics experts to take a short break every 20 to 30 minutes to get up and move around [1].

[1] [http://ergo.human.cornell.edu/CUESitStand.html](http://ergo.human.cornell.edu/CUESitStand.html)

</comment><comment><USER24> I tried the Pomodoro Technique to avoid distractions and to stay more focused when I started freelancing. I was also trying to track my work time, so I built Tomatoes, a simple web app to do both.

The app is open source, you can download the code at [http://github.com/potomak/tomatoes](http://github.com/potomak/tomatoes), or you can use the version running at [http://tomato.es](http://tomato.es).

</comment><comment><USER25> Using the pomodoro technique, I managed to write a 50k novel in eight days.

Taking a 5 minute break for every 25 mins of uninterrupted work seems to preserve 'flow state', dramatically increasing my productivity :)

</comment><comment><USER26> I've always wondered, what's the point of those "FREE EBOOKS!" that require you to give your email? Does the author get a cut because s/he sells your email to advertisers? I always use a disposable email anyway.

<comment><USER27> In my experience these are usually just for the author to spam you. Remember that RSS is dead. In its place, we have spam.

<comment><USER28> I was turned off by the ebook offer as well, but I went ahead and downloaded it anyway. Even though it says 32 pages, it's incredibly short because the pages are small, the font is large, and there are lots of illustrations. It took me longer to read the article than the ebook.

</comment></comment></comment><comment><USER29> Here's a Chrome extension that is useful for enforcing the Pomodoro technique. It allows you to blacklist websites and customize the work/break lengths.

[https://chrome.google.com/webstore/detail/strict- workflow/cg...](https://chrome.google.com/webstore/detail/strict- workflow/cgmnfnmlficgeijcalkgnnkigkefkbhd?hl=en)

<comment><USER30> Thanks, but no way to stop a timer except removing the extension, by design? O-kay. That may have been the shortest-lived extension I've added and removed.

<comment><USER31> Out of curiousity, why do you want to stop the timer? To me the point seems to commit to lay out a specific segment of time to be productive and holding to the commitment helps. I imagine you have a different perspective on this though.

<comment><USER32> In pomodoro if you get interrupted to the point where you need to stop what you are working on you are supposed to stop the timer and start over when you can.

It forces you to make sure interruptions are actually worth dealing with vs putting them off till after the timer is up.

<comment><USER31> Good point, but by itself restarting the timer isn't much of a deterrent (at least to me). It makes me wonder if a better incentive might exist so that you can pause the timer but with a weightier tradeoff.

</comment></comment></comment></comment></comment><comment><USER33> I'm curious on what type of 5-minute breaks fellow HN readers take.

I've noticed that time really distorts when you open a new tab for a "quick HN browse" or similar.

<comment><USER7> Walk around. If you have a floor that lets you slide around while socked, do a few hallway sprint-slides to get your circulation going. Or my favourite: 60-second plank to start every break. Pomodoro six-pack plugin.

</comment></comment><comment><USER22> I love the Pomodoro Technique, and use the Tomighty app specificaly for it's simplicity and that it's native so I don't need to keep a pinned browser tab open just for it - love simple things like this that just sit in my system- tray.

I pair it up with Toggl, a time tracking service online to keep reports of _what_ I'm working on, and I find it a huge boon to my productivity and ability to justify the time I spend working on things.

</comment><comment><USER34> I used a different version in college for weekend studying. Study for 2 hrs, break 10 min. Study 1.5 hrs, break 20 min. Study 45-60 min, by then it's usually lunch time or dinner.

</comment><comment><USER35> You know, someone has to say it. Working in 25 minute intervals with a 5 minute break is hardly a technique. It doesn't need a name, and it doesn't need an entire page to explain. A to-the-point definition followed by anecdotal commentary would have been far less insulting than the format of this blog post, which basically reads like a diet pill ad.

<comment><USER36> Pomodoro saved my butt in college one time, when simply "working hard with breaks" wouldn't have. I had to read a 200 page monograph in a single night and then write a book report on it.

With Pomodoro, I assigned each chapter one "pomodoro" (25-minute time period). At the end of that time, the chapter was done, whether I'd finished it or not. As the timer ticked down, I'd see it out of the corner of my eye and read faster, eventually just skimming the first sentence of each paragraph and maybe soaking in one or two details every couple paragraphs. When each chapter was done, I'd have a rough idea of what the main thrust was, and a fistful of details as well. I'm pretty sure I got a B+ on that book report, but I was just amazed I got it in on time at all.

So in this case, I found it useful as a way to complete a large, boring, segmented task in a quick-and-dirty-but-effective way. I wouldn't recommned it as a cure-all, but it's a good tool to have in your belt for certain kinds of tasks.

<comment><USER37> I find it baffling that you had to do this in the absolute last minute? At best it shows poor planning? At worst a 'I-am-heroic-startup-1-person-army' which burns out so many poor souls. Pardon me if this is incorrect.

<comment><USER38> That kind of hypothetical analysis is irrelevant in the moment though (similar to sunk costs). Regardless of how you end up finding yourself in a situation where you need to complete a herculean task in a single day, you still need to do it. It doesn't help to place blame at that moment, though of course you should do a post-mortem afterwards and figure out what you can do in the future to prevent it from recurring.

I too ended up in a similar situation in university where I needed to complete a large programming project in a single night, and I did it. Now granted, that was a fault of bad time management on my part, but using disciplined programming I was at least able to recover from it and complete the project. And I have had a few instances in the business world that had similar tight and tough deadlines that were NOT a result of time management failure on my part.</comment></comment></comment></comment>


Leaving The New York Times - <AUTHOR> https://medium.com/@harrisj/leaving-the-new-york-times-bb3e73adc61f

<comment><USER2> Jake is one of the most forward-thinkingc and creative of the technologists in the entire news industry...his essays on the potential and limitations of data and digital applications are must-reads for anyone; one of his best: Distrust Your Data [https://source.opennews.org/en-US/learning/distrust-your- dat...](https://source.opennews.org/en-US/learning/distrust-your-data/)

This would be a huge loss for the future of journalism, if it wasn't equally balanced by a huge gain in forward-thinkingness that Jake will bring to the future of government transparency.

</comment><comment><USER3> Would love to read more about the inside of paper like this, from the perspective of the technologists. What is the interaction like between product developers and journalists/editors? How does the back-and-forth go? Does the editorial process for interactive components match (in rigour) that of the written-side?

<comment><USER4> Have a look at [https://source.opennews.org](https://source.opennews.org) \- it's basically the watercooler for 'news nerds' (general term for newsroom developers/javascript journalists/dataviz people and so on). Not updated that frequently but often worth a read

</comment></comment><comment><USER5> I'd quit if I had to carry around an ugly ID like that one.</comment>


Show HN: Squawkr – Blogging on Twitter - <AUTHOR> http://squawkr.me

<comment><USER2> Looks like it works by posting an image-of-text on Twitter.

Example: [https://twitter.com/HammeIAm/status/556617997255966720](https://twitter.com/HammeIAm/status/556617997255966720)

<comment><AUTHOR> Yes indeed! It also pulls out any @mentions or #hashtags that you happen to include in your post. I decided to make this after I wanted to live-blog while I was building another project, but realized that I only had followers on Twitter.</comment></comment>


Need a Creative Boost? Find the Blue Room. - <AUTHOR> http://www.nytimes.com/2009/02/06/science/06color.html?hp

<comment><USER2> The only sentence in the article* that quantifies the magnitude of a color dependent effect is:

 _And while red guests reported feeling hungry and thirsty, yellow guests ate twice as much._

This is a pattern in science journalism:

1) scientists show statistically significant effect (sometimes minuscule in magnitude)

2) science writers describe the sign of the result without magnitude, and get some 'experts' to pontificate

3) public worries/speculates/exclaims about some new factor to think about in daily life

Yadda yadda.

[edit: *only sentence I saw after skimming ]

<comment><USER3> It worked! I worried/speculated/exclaimed, "I guess thats why McDs is all reds and yellows."

</comment></comment><comment><USER4> I'm currently in a blue room, however I don't necessarily feel anymore creative than usual. I used to write in a red room and I notice no appreciable difference in attention span, creativity or anything. In fact my best concentration (how efficiently I completed a project) was best when I was actually in a yellow room.

I do use a program called darkroom for typing, it allows you to change background color and font color easily. I usually use the old school neon- green on black, however I think I might try the equally old white on blue before a white on red and see if there's actually an effect.

I do prefer the green on black. However, the white on blue feels quite comforting when I look at it and white on red gives me a strange tingling at my forehead, which kind of disconcerts me for staring into it for hours on end.

</comment><comment><USER5> Speaking of paint.

Yellow pigment is not the same as yellow light; nor is red pigment the same as red light; nor is blue pigment the same as blue light. :)

The light-oriented color names are fancier. (cyan, magenta, etc.)

Probably one of the most valuable things I learned as a physics student in high school!

<comment><USER6> You've got the pigments and light wavelengths swapped.

(cyan, magenta, yellow, black) form a set of additive (pigment) colors.

</comment></comment><comment><USER7> Here's a copy of the actual report. I think the authors actually describe the color significance in the report.

<http://www.sciencemag.org/cgi/content/abstract/1169144></comment>


Options Pricing in Excel with QuantLib - <AUTHOR> https://datanitro.com/blog/2012/08/13/QuantLib/

<comment><USER2> This reminds me that compiling QuantLib is such a pain in the ass. I love QuantLib though - I use it via C# and there is an Excel plugin already available in the source code.

As regards your example:

(a) single-name options usually have an American exercise-type.

(b) the main difficulty (and the thing one would actually pay for) is getting and maintaining a vol-surface for pricing these things - using flat vol to price this is quite inaccurate and risky.

<comment><AUTHOR> I've played around with QuantLib's Excel plugin, and I don't find it easy to use - the hybrid system they set up to merge Excel with the C++ structure of QuantLib is unintuitive. I've had better luck just pulling the functions into Python and going from there.

<comment><USER2> I agree. It's quite messy. That's why I use the C# swig bindings instead and if I had to use Excel as a UI, I'd build my own plugins in C# rather than use the ones they provide - in a similar fashion as you've done with Python.

<comment><USER3> I had a hard time getting the swig bindings to work for me. Would you be willing to make a nuget package of that?

<comment><USER2> Well, it requires an unmanaged dll (NQuantLibc) to be compiled which would be pinvoked by the managed bindings dll (NQuantLib). The unmanaged dll will not be platform independent (I don't know if you'd be using x86/x64). It also needs to be copied over to the same directory in which your output binaries would reside.

Anyways, I've uploaded an x86 version:

PM> Install-Package NQuantLib (<https://www.nuget.org/packages/NQuantLib>)

<comment><USER3> Nice! Thanks man.

<comment><USER2> You're welcome (I'm pretty sure I've set some sort of a bad precedent here :) )

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> Perhaps someone can help me with a related capability. I am looking for a tool to administer and query the price of structured products (options, securities, indices, etc)

On the administration side: Manage which clients, have been sold which products, value of the product (notional/sold value) and maturity date. On the valuation side: link to treasury and banking systems, and various price feeds to determine current value of structured product.

Is there anything off-the shelf that any of you are aware off?

<comment><USER2> How advanced and how expensive?

Numerix (<http://www.numerix.com/products-and-services>) is one. I've used them before at my previous job to handle client portfolios.

In general you'd need to have separate licenses with the feed providers (Reuters/Markit/Bloomberg etc) and those are quite expensive.

<comment><USER4> Thanks for the referral. I'll have a look at the website. Our business does sell and manage some complex products - most of it is managed out of Excel. I was told to treat this as a low priority (I have a list of solutions I need to get them), so I'm not sure what their budget is. However, if I believe their is a business case for them to adopt a new solution, the door is open for me to make a recommendation

</comment></comment></comment><comment><USER5> Neat. You should make it an app using the new 2013 excel applications [http://msdn.microsoft.com/en- us/library/office/apps/fp142161...](http://msdn.microsoft.com/en- us/library/office/apps/fp142161\(v=office.15\))

</comment><comment><USER6> honest question - does anyone use quantlib in production?

<comment><USER7> We use it pretty heavily for calculating implied vol and for delta calculations.

</comment></comment><comment><USER8> who would need to use QuantLib in Excel?

<comment><USER9> Excel is used quite a lot in the finance sector.

I my previous job I had to write a plugin to allow traders to do some simple algo trading in Excel.

Oh, and once you are forced to work in VBA all other languages seem amazing.

<comment><USER10> +1

I worked for a long time in Finance & Market Data - in Europe (UK/CH mostly). Most people would be surprised how much of it runs of Excel.

Particularly Fixed Income - a lot of the sophisticated instruments will be priced straight off Excel spreadsheets (so you use Excel to _publish_ data, not just analyse it).

<comment><USER11> In fact, most people outside finance would be surprised at how much sophisticated analysis and interactivity you can build in Excel. Once you start digging under the hood it's a powerful platform. The only addition you need is a pricing feed e.g. Bloomberg.

</comment></comment></comment></comment><comment><USER12> this is pretty neat, thanks for sharing</comment>


How Millennials Ended the Running Boom - <AUTHOR> http://www.wsj.com/articles/how-millennials-ended-the-running-boom-1462473195 <comment><USER2> "The running boom is over. Blame millenials."

Ha, boomer press outlets aren't even trying to hide their silly anti-millenial crap anymore.</comment>


Show HN: Manage browser bookmarks from the CLI - <AUTHOR> https://github.com/wkjagt/bkm

<comment><USER2> The best would to have a Pinboard (pinboard.in) integration too :-)

</comment><comment><USER3> Very clever :)</comment>


The Principles Behind Voting Systems - <AUTHOR> https://medium.com/@tunesmith/the-principles-behind-voting-systems-65ee7d85f93#.164j5sh0n <comment><USER2> There are other principles of voting systems that are not mentioned here. I like to divide voting systems into these categories: linear/nonlinear and preferential/nonpreferential.

By "linear" I mean that the votes are, or are converted to, numeric scores that are simply added, with the highest score selecting the winner. Plurality, approval, range, and the Borda count are all linear; STV is nonlinear.

A preferential system allows voters to rank all the candidates. Borda and STV are preferential; the others are not.

It can be shown, for example, that if we restrict ourselves to linear preferential systems, the Borda count is optimal among these, given another assumption which I'll come to in a moment. If we model the preference of each voter for each candidate as a real number in [0, 1], then the voter's collective preferences are given by a point in the unit n-cube. A preferential system divides the unit n-cube into n! regions and asks each voter to select one of them as best representing their collective preferences. A _linear_ preferential system then converts these to numerical scores and adds them up. The Borda count, for example, assigns a number to each candidate on each ballot which is linearly related to that candidate's position in the voter's ordering; a ballot ranking the candidates in the order A, B, C might be scored as A = 2, B = 1, C = 0. The scores for each candidate are totalled across all ballots, and the candidate with the highest score wins.

It turns out that the coordinates of the barycenters of the regions of the n-cube (where the center of mass would be under the assumption of uniform density) follow the same linear pattern; for example, the preference A > B > C picks out a region of a 3-cube whose barycenter is at (A = 3/4, B = 1/2, C = 1/4). So, if we start with the assumption that a voter's preference for each candidate is uniformly distributed on [0, 1], and we use preferential ballots, the Borda count provides the best estimate of the mean barycenter of the preferences of all voters. (We can apply any linear function to the barycenter coordinates without changing the results of the election; in this case I have used f(x) = 4x - 1.)

Approval voting, instead of dividing up the unit n-cube into the diagonal- faced regions of a preferential system, simply divides it into 2 ^ n equally sized, smaller n-cubes. Each coordinate of the barycenter of one of the smaller n-cubes is either 1/4 or 3/4; again, we can linearly map these into 0 and 1. Range voting is a further refinement of the same idea that uses k ^ n smaller n-cubes; usually k is a relatively small number like 5 or 7.

... Whoops, I need to go and can't write as much here as I would like. But maybe this will be interesting enough.</comment>


Time to turn off the lights - <AUTHOR> http://www.nature.com/nature/journal/v457/n7225/full/457027a.html <comment><USER2> If you've never experienced the Milky Way on a truly dark (ie: new moon) night, I highly recommend taking a camping trip.

It's amazing, and the longer you lie there and wait, the more of it you'll see.

It will put into perspective just how little we are in our galaxy. (And that's just one galaxy!)

<comment><USER3> Yeah, it's sad how pervasive unnecessary light pollution has become in this country. In Manhattan, you could barely see half a dozen stars at night.

<comment><USER4> You should attempt to escape to Africa and get busted at Grand Central Station and then get shipped off and be a cast away in Madagascar island, where you can see thousands and thousands of stars instead of helicopters :-)

</comment></comment></comment><comment><USER5> I vacation once a year on the shore of Lake Superior in the Upper Peninsula of Michigan. The closest larger light source is Thunder Bay, several dozens of miles across the lake. The depth and richness of the sky (vague allusion to Vinge, yes) are wonderful. The stars, the galaxies (with the help of a friendly ranger and his telescope). Watching satellites cast their slow arcs overhead.

I think such sights, like the science fiction alluded to, remind us of our _potential_. Current circumstances get some needed contextualization.

And the peace of the moment reminds me of where we come from. Not from a realm of endless distraction, but from a realm of endless engagement.</comment>


Unraveling how children become bilingual so easily - <AUTHOR> http://news.yahoo.com/s/ap/20090721/ap_on_he_me/us_med_healthbeat_bilingual_tots <comment><USER2> I remember a while ago there was a debate raging about how California public schools should deal with young ESL children. Should they immerse them in English-only courses (good for English-learning, bad for 'everything else'-learning and putting them at a disadvantage) or should they start in Spanish and slowly transition them to English-only courses? It was an interesting discussion, but was (understandably) framed around the idea that the children were part of a growing problem which badly needed a solution.

Simultaneously, I (a native English speaker) was sitting in a required high school Spanish course (two years), which was progressing at turtle-like speeds and effectively useless unless you were in AP Spanish.

For the life of me I can't understand how these two 'problems' can exist in a school system and administrators can't put two and two together. Now at 28 I'm _actually_ learning a second language, and I can see both how useless those high school courses were, and how much I would have benefited had I learned a language when young, while surrounded by other children who were 'native' speakers of that language.

My kids will most definitely be raised bilingual, and I hope to expose them to a school which facilitates language learning from the get go.</comment>


RISC-V Spins into Drives, AI - <AUTHOR> https://www.eetimes.com/document.asp?doc_id=1332658&_mc=sm_eet_editor_rickmerritt <comment><USER2> > _A compiler team already wrote a shader compiler to run high-end graphics > jobs on its chips._

All major shader ISAs today are RISCé (no new VLIWs, that I'm aware), and this sentence seems to prove that RISC-V is a viable (base) ISA for shader cores.

> _Ditzel designed server processors at the former Sun Microsystems and > startup Transmeta before doing a relatively short stint at Intel._

The CEO of Esperanto Technologies worked at a company which built a product on Dynamic Binary Translation from x86. Can anyone guess what else might be cooking in that _compiler team_? :- )

I mused earlier today that I'd like to put a RISC-V SBC in an old ThinkPad chassis.

Maybe ET-Minion is GPU-like enough to stand in for a GPU on a workstation, and maybe ET-Maxion would make a good host CPU for that. Set the voltages and frequencies right, and you might be able to put them both in a 2011-era laptop, built to supply and dissipate 35W of load at times.

Just a thought.

<comment><AUTHOR> Is there any RISC-V SBC in the same class as, say, a Raspberry Pi? I've seen some SoCs more targeted at Cortex-M0 and low-end Quark spaces.

<comment><USER2> I'm not sure, I'm hoping that there will be a dev board for the SiFive U500 range; though if there is one, chances are it will not have an integrated GPU. Though, if we're talking desktop use cases, you _could_ use the PCIe 3.0 bus to add one, if that's what you're looking for. I think we're still probably at least a year off from the first RISC-V SBC with an application processor and a GPU on it.

<comment><AUTHOR> It'd be nice to have at least a decent frame buffer. I'm a retrogeek, but VT100 terminals are getting hard to get ;-)

<comment><USER2> I looked at the announcements, and it looks like SiFive will have something called "HiFive Unleashed" coming out in Q1, sooner than I thought. It looks like a U500 board with an HDMI port (and USB ports) attached through an FPGA. So you could even get somewhat (2d) accelerated framebuffer probably with a little bit of fiddling on the FPGA, not sure what kind of resolutions you could get out of the HDMI with an FPGA-based CRTC though. :- )</comment></comment></comment></comment></comment>


Ask HN: Local company with a name brand or remote no name company? - <AUTHOR> Would you take a position at a local company that has a brand that is recognized in the industry, or a remote position with a virtually unknown company? <comment><USER2> I don't think that either would be a strong determinate of my decision absent specific criteria that would be affected by one over the other.</comment>


Denis Johnson Has Died - <AUTHOR> http://www.npr.org/sections/thetwo-way/2017/05/26/530182989/denis-johnson-author-of-jesus-son-and-tree-of-smoke-dies-at-67 <comment><USER2> RIP. This hits hard. Before my career as a programmer I was an aspiring fiction writer. Johnson was my Radiohead of writing: an artist working at a seemingly unattainable level of skill, and very nearly transcending the art, as far as my taste is concerned.

You don't exactly read Johnson for his plotting. The magic is in getting lost in the sentences, in the weird and painful beauty they open up. Jesus' Son is his most famous book, but his other works have that same characteristic: Turns of phrase and shocking ways-of-seeing that reveal the world's strangeness and fragility.

I think of it as the "cradling a baby mouse in your hands, feeling its heartbeat, knowing how easily it could be crushed" feeling.</comment>


Ask HN: What is one best and free password manager out there for Windows user? - <AUTHOR> <comment><USER2> KeePass is okay</comment>


Any U.S. freelancers having problems with freelancer.com? - <AUTHOR>

I was awarded a programming job for $10,000 on freelancer.com back in March for a client with a good reputation. I began work on the project and a few weeks into the project the client created a milestone for $2500 and released the funds. My account was already -$1,000 as freelancer.com was charging 10% for their fee being I am on a free account. When the $2,500 was released, I requested a wire withdrawal and it went through the process on schedule, then it was supposedly sent on 4/22 but I still have not received it.
As the project progressed, the client created another milestone for $5,000 and released the funds immediately. I made a withdrawal request, freelancer.com locked the funds to send it, just like the first $1,500 wire. The next day I received an email telling me my account is now limited and they wanted me to submit a government issued ID and proof of residence, like a utility bill, before they would restore my account and send the wire. They said this would be resolved within 24-48 hours of submitting my documentation. I sent a scan of my New York state driver's license and my electric bill. They rejected both of them.
I then submitted a bank statement and my New York state driver's license. They accepted the bank statement as proof of residence, but rejected my driver's license again.
It clearly states on their identity verification form that a driver's license is an acceptable form of ID.
I am posting this because I am curious if anyone else has had this problem. I am currently getting the runaround, nothing but canned responses (if any) from their support and their facebook page.
At the very least, I want to warn NY residents that if they use freelancer.com, they can expect similar problems. <comment><USER2> I didn't realize they charged their fees before you get paid at all, that just seems unfair. Have you looked at Guru.com? They only charge their percent when you actually get paid.</comment>


RESTful Audio Processing Web API Released - <AUTHOR> https://auphonic.com/blog/2012/10/08/auphonic-audio-processing-web-api-version-1-released/

<comment><AUTHOR> Various audio processing algorithms (loudness normalization, noise reduction, etc.) are available through a free REST API, focused on audio post production.</comment>


Thief Stole Payroll Data for Thousands of Facebook Employees - <AUTHOR> https://www.bloomberg.com/news/articles/2019-12-13/thief-stole-payroll-data-for-thousands-of-facebook-employees <comment><USER2> >The hard drives, which were unencrypted, included payroll data like employee names, bank account numbers and the last four digits of employees' social security numbers, according to an email Facebook shared with staff Friday morning. The drives also included compensation information, including salaries, bonus amounts, and some equity details.

How did information like that get on unencrypted local hard drives in the first place?

Sure leaving it in a car is bad, but this stuff shouldn't be left around anywhere, not even an employee's home.

<comment><USER3> Excel.

<comment><AUTHOR> > _Excel_

I have Excel documents on my SSD. They're still protected by, at the very least, whole-disk encryption.

</comment></comment></comment><comment><USER4> I would think that publishing this story (although a responsibility) may make things worse. Now the thief knows what he has is valuable.

<comment><USER5> This was probably in the bay. Which is one of the worst car break in spots in the country. Thieves dump anything they can not sell immediately. If it was drives, they are in a dumpster or a dump.

If it is a laptop, the data can only be accessed now if you pull the drive, or boot it to some kind of guest/safe mode. I'd guess whoever gets this won't know what they have and will wipe it.

That said, if someone figured out this was what it is, the data is probably worth what, millions of dollars? Is there a way the company could create a reward for this? Who would buy this kind of data, or who would pay to have it leaked? Who is it most useful to if held in secret?

The most damaging would probably be if it fell into the hands of The Intercept or Wikileaks, who could drip it out.

<comment><USER6> Hard to say where the data could end up. If someone pulled the drive and kept it, it could sit around for years doing nothing. It if it immediately got to a black hat it could be sold off on the darknet. Probably not for millions though.

</comment></comment></comment><comment><USER7> I for one applaud Facebook's new efforts to apply radical transparency to the personal information of their employees, as they have done in the past for their users.

Just like your circles of friends, browsing activity, unsent messages, sexual orientation, credit card purchases, webcams, microphones, address books, and geographic location, your banking records want to be free!

The only people who can be harmed by such honesty are those with something to hide, after all- and surely none of _you_ have something to hide?

</comment><comment><USER8> Strange story...unclear if the thief knew what was on the hard drives. Would be a much stranger story if they did.

<comment><USER9> I would speculate that stealing/copying that info and selling it to e.g. Glassdoor would net you some easy money. Specially if you know who carries stuff like that around.

</comment></comment><comment><USER10> This is a perfect example of why I don't trust Facebook or Google with much in the way of personal confidential information. People say it's in their best interest to keep your data confidential, but even the best people screw up and as these companies get more bloated, employee competency goes down and apathy increases.

<comment><USER11> Nothing to worry about. Mark will offer everyone 1 year of free credit monitoring.

<comment><USER12> From the news article:

> In an email, Facebook encouraged employees to notify their banks and offered > them a two-year subscription to an identity theft monitoring service.

<comment><USER13> But what if I already have one from another breach?

</comment></comment></comment></comment><comment><USER14> This doesn't help increase the confidence in Facebook's security posture.... ongoing security and privacy debacles..

</comment><comment><USER15> [https://outline.com/8nJ69A](https://outline.com/8nJ69A)

</comment><comment><USER16> Karma.</comment>


Germany's Next Business Model - <AUTHOR> https://rentry.co/germanys-next-business-model <comment><AUTHOR> TLDR:

> Aroundhome.de claims to be a "search portal" that helps its consumers find > "qualified service providers". It is not searching on the net, but only on > the list of their partners. The search results are only offered when the > consumer leaves his contact information and confirms his existence by > telephone (which some people can not, due to their disability). The > partners, then are notified, that a potential customer in their area is > looking for a service and are offered to purchase their data for significant > money (varies by industry, from 50 to 500 euros). For the consumer, a very > stressful situation arises. At first, they don't know, that their data is > being bought by the servicing companies They probably won't find good > contractors (because reputable companies do not fall for such offers). And > of course, the data is not exclusive, meaning that it is negotiated several > times at several contractors, which then harass consumers's phone</comment>


Hard-Core Career Advice for a 13-Year-Old - <AUTHOR> http://techcrunch.com/2015/05/31/hard-core-career-advice-for-a-13-year-old/

<comment><AUTHOR> "In fact, Mollie, I hope you drop out of school right now. Please?" do you think this is good idea for 13-years old?

</comment><comment><USER3> Career advice for a 13 year old? - <USER2>

YOLO - a 13 year old shouldn't have to be worrying about a career FFS!</comment>


Looking for a Support calls system - <AUTHOR>

Hey, I am looking to move away from my current office phone system
Current usage:
1500-2000 toll free minutes per month. Inbound & outbound ~15 extensions 10 users Voicemail on all extensions iOS & Android apps, all users on mobile
Current limitations:
Forwarding reliability is extremely poor, calls will never make it to the end of the forwarding queue. Calls are mis-forwarded (eg. call to ext 706 is routed to the phone number on 701).
Many calls go unanswered, but it's not clear whether a call was picked up or not. If a call was picked up, it's impossible to know who picked it up.
Landline phones aren't supported without using another provider.
No concept of "departments" or multiple levels.
Max 5 forwarding numbers per extension.
Must use an aggressive 20 second timeout because forwarded calls are slow to reach destination phone.
Not possible to see who's calling while still distinguishing that the call is coming via the company number. Virtually no reporting, impossible to track usage metrics.
No call recording.
Poor customer service. <comment><AUTHOR> In addition to above, I would look for the following in new system:

Must: support the exact same extension ranges. Must: support quick modifications and the addition of extensions as desired (ie. unlimited extensions). Must: support landline phones as well as cell phone forwarding. Must: support Canada & US numbers. Must: allow custom availability hours per forwarded number or extension. Should: allow for easy toggling of numbers/extensions on/off. Should: offer landline/VOIP service without needing to go to a traditional telecom. Must: allow porting of our existing toll-free number. Toll free minutes must either be flexible (per minute charge ok) or unlimited. Must: allow incoming and outgoing calls from the toll free number, via landline and mobile phones. Must: allow voicemail for any/all extensions, with notifications when a message is left. Must: allow single layer greeting message system. Multi-layer is a bonus. Must: allow for custom recorded greetings for all points of the message interface. Must: allow for important contacts or integrate with a given device's contacts. Should: support something more robust than simple sequential forwarding. Someone having their phone on silent or "declining" a call shouldn't interfere with the customer rules, and customers should never reach an employee's personal voicemail rather than the system voicemail. Should: support detailed reporting for tracking usage. Should: allow recording of all calls. Should: allow international (EU & asia) calling at reasonable rates Hope: API to export metrics would be wonderful.</comment>


Aligning AI with Shared Human Values - <AUTHOR> https://arxiv.org/abs/2008.02275 <comment><AUTHOR> The ETHICS dataset, a new AI benchmark that spans concepts in justice, well- being, duties, virtues, and commonsense morality.</comment>