Ask HN: how to go about finding internships? - <AUTHOR>

How's it going HN.
It's summer time, and students much like myself are having a tough time finding interesting summer jobs. It's not that I don't enjoy waiting tables or anything, but at some point I think it's time to look for more meaningful employment.
Some background on myself - I've just completed my second year of engineering education, and have project experience coding C/C++ and assembly. As well, I have web development experience with PHP and MySQL on the backend, and Javascript/html/css/Ajax. In terms of non-programming technical knowledge, I've probably taken a course on "$subject mechanics" (fluid, statistical, quantum... you name it).
So I figure my best way out of waiting tables would be to apply for some internships. In particular, being an HN reader, I'd love to work at a smaller company closer to a start up.
But I'll be honest - I have very little work experience. Just a lot of drive/motivation to work on something interesting and challenging, and a few projects to show.
What advice would HN give? <comment><USER3> Go for all the big companies - they have established internship programs that they recruit heavily for. Try Amazon, Google, Microsoft, Facebook, and any other BigCos you can think of. That's generally the easiest way to go since these companies make it a point to hire a _lot_ of interns every year.

It is probably way too late to make it anywhere for _this_ summer at these companies though, given their structured schedule in recruiting (the intern season at Amazon has already started).

Talk to small companies. I have a friend who literally drove down the highway with a stack of resumes. He walked into every place that seemed like it would be beneficial to work at, walked in, demanded to speak to a manager of sufficient seniority (didn't take no for an answer), explained to said manager his skills and how he could contribute to their business, gave them his resume, and left.

He's also the guy I know who never seems to be lacking a job.

<comment><USER4> It _is_ too late for google, microsoft and facebook - their hiring processes for summer start in winter (I even know some guys who had interviews in november) and most places are taken; you can however try autumn if you want - I know that fb hires for autumn now.

Try some smaller ones - you are on site dedicated to startups so you should find some that hire! My algorithm when searching for interns was going through lots of companies, look into their jobs/careers for interns ad and sending my cv, starting from the most intersting.

Edit: I didn't have lots of projects to show either, but many companies don't really ask for them during interview (however for some it's a must - eg my friend wanted to work in android apps startup and they wanted him to already have something done for android) - algorithm puzzles seem to be popular, also you may be asked to read/write some code and some easy questions checking what you wrote about technology you mentioned in cv. That's really all I think.

</comment></comment><comment><USER5> I hope everything works out for you! Next year, I'd start looking for summer gigs around December or so, just because that's when companies (in my experience - I'm a sophomore CS major) tend to hire for the summer. Typically, they like to get you on for a few months part-time before the summer starts, too, to work out any kinks.

If that doesn't happen to fall into place for you, the only thing stopping you from creating your own little side company while waiting tables or something is yourself. Analyze your day, see what irritates you or you wish could be done better (programmatically), and write up something to fix it. Put it on Github, get to know some other coders (maybe even from around your area - <USER2> highly recommend hnDir - <http://www.hndir.com/> \- just to see who all is around your area, and in college as well).

Also, to note, to add on to the dev experience you have, I'd highly recommend checking out some iTunesU or MIT OCW courses on Algorithms and Data Structures. I would do this regardless of your situation this summer. Heck, I'd do both of these regardless of your situation this summer. There are great opportunities out there to be taken advantage of! If you ever want to work on anything, email me (in my bio)!

</comment><comment><USER6> This might only work for some companies, but it worked out well for me: Take one of a company's flagship products and remake it using open source technology.

You don't even have to do the entire thing: just enough to show that you understand the subject material and are a potential threat if left to your own devices over the summer with nothing to do. Put it up on github or your own website depending on the product, and include all the url's in the application or email that you send to the company. It will make you stand out and show that you are interested in working on the types of things they work on.

All it takes is one open source project gaining momentum to completely change a product space. It's less troublesome/expensive for the company to hire you than it is to try and fight a grassroots opensource movement later on. If you can make a company engineer think that they are getting a deal by hiring you early on, then you are pretty much set.

Bonus points: get the sales department to email the engineers for you.

</comment><comment><USER7> _But I'll be honest - I have very little work experience._

Neither do most other summer interns. Don't worry about it.

The benefit of an internship is skewed in your favor and not the companies; you get to learn (and gain work experience that you need). Depending on where you are, you might be working on an important product, but, it isn't expected that you'll be as productive as a full-time engineer is.

The real benefit that a company gets from having interns is that its basically a two or three month hiring process. If it goes well, you'll be able to another internship with them next summer and/or possibly get a job offer at the end of college.

Practically everyone out there is looking for smart people to hire. If you want to intern at a startup, find one you like and make yourself known. Send them an email with your resume attached and a quick note. At the very least, you'll get a real response from someone (rather than a canned one, or none at all).

</comment><comment><USER8> Do you have a portfolio to show? Also, you should put your email in the HN profile

</comment><comment><USER9> Where are you based out of? At least here in the Ann Arbor/Detroit area the demand for good developers/interns is huge, and it seems most people that want a software job around here have one.

My best advice would be try to get involved in local startup/entrepreneurship events if you have such things. Connect with the community, in my experience everyone is happy to talk to others about what they're working on - they won't bite :). Talk to people about their needs and your skills. Good luck!

</comment><comment><USER10> Best strategy I've found is to email the founders of companies you're interested in and need the skills you have, and ask them flat out if they need interns.

<comment><USER11> This

</comment></comment><comment><USER12> I'm in a similar position (completed 2nd year of software engineering, about same skill set plus some work experience). What I did is email a niche mailing list as well as contact some startups I like directly. Even found about an internship opportunity on Freenode. Started working on this yesterday and currently have about 6 interviews scheduled :)

</comment><comment><USER13> I am graduating next month (last exam in a few hours literally) so I started sending emails for job opportunities a few weeks ago. I found the "Who's hiring" threads (<http://news.ycombinator.com/submitted?id=whoishiring>) of great help.

</comment><comment><USER14> Email me at email@example.com . I am still hiring interns starting June 1st in San Francisco. Paid internship of course.

</comment><comment><USER15> My startup is looking for software engineering interns, send me your resume, firstname.lastname@example.com

</comment><comment><USER16> <http://jobzle.com/>

</comment><comment><USER17> do what woody allen did: just show up! works, not always, but often enough.

</comment><comment><USER18> Internships.com

</comment><comment><USER19> internmatch.com

</comment><comment><USER20> Where are you?

<comment><AUTHOR> Toronto! =)</comment></comment>


RestMS - <AUTHOR> http://www.restms.org/article:introduction-to-restms

<comment><USER2> Shining example of another person who has failed to understand IRC (asynchronous messaging with spanning-tree delivery.)

I like all of the wordings he has made up for things that have been around for 15+ years.

 _Making a good messaging system seems to be an unusually difficult problem. People have tried, over many years, and the results - as we just saw - seem to be all round mediocre. In my view the main reason we have not "solved" this domain (as we've solved operating systems, databases, file systems, word processors, spreadsheets, email, data representation, etc.) are that the problem has been too arcane to interest enough engineers._

I believe every statement in that paragraph to be incorrect.

<comment><USER3> I often think of SMTP as well -- robust message queueing and routing with built-in failover, backoff algorithms, and myriad tools to view all the parts involved. An RFC822 message's envelope can contain infinite metadata and its body can contain text, json, xml, base64-encoded binary, you name it. You can encrypt messages with PGP, or secure the transport layer if you can determine who talks to you. There are more implementations that one can count, it works on every platform, and it doesn't scare away the systems guys.

<comment><USER4> I've also thought of SMTP as the ultimate queuing system. It really covers all of the bases for persistence, async delivery, bridges to every kind of network imaginable (think back to FidoNET, UUCP -- revive the bang path!), built in fault tolerance, etc.

The only thing really missing is delivery order guarantee. It isn't uncommon at all for a message to fail delivery, get stuffed into a retry bucket, and then a bunch of other messages get delivered without problem before the retry occurs. But even this is just an implementation issue. The underlying architecture is nearly perfect.

</comment></comment></comment><comment><USER5> I don't see the reason for the "housecat", "parrot" and "wolfpack" patterns. These patterns have been around a long time in the EAI space, not sure in the logic in giving them a new name.

<http://www.eaipatterns.com/> \- <http://www.eaipatterns.com/PointToPointChannel.html> \- <http://www.eaipatterns.com/PublishSubscribeChannel.html> \- <http://www.eaipatterns.com/CompetingConsumers.html>

It also claims the "parrot" (publish-subscribe) pattern is the most widely used. In certain situations it is very common (Market Data, News, Master Data etc) - but these are fairly specific.

</comment><comment><AUTHOR> Don't you think, maybe, thinking of a pack of wolves tearing away at a dead carcass, or a kitty coming to your outstretched hand, a flock of colourful macaw parrots flying in the Amazonian basin is more friendly than a dryly spoken PointToPointChannel, PublishSubscribeChannel and CompetingConsumers in camel case? It is understandable that application programmers demand simplicity. As they need to implement these patterns, why not change the name?

<comment><USER6> More colourful, yes, but I couldn't see the reason behind the names immediately. "Dry" terms that actually happen to _describe_ their behaviour are immediately grasped and understood.

I understand that perhaps colourful and friendly names can be fun, but I suspect you'd have a hard time getting these accepted among the people that actually use the protocol.

<comment><AUTHOR> <http://github.com/pieterh/restms/tree/master>

<comment><USER5> Which goes into "Reverse Housecat", "Multimaster Housecat", "Wolf Call"... I can't say they are obvious at first glance.

Metaphor is great for explaining things - and as a guide. Those names might make a great sidebar. I just don't see the need to rename things when it's a firmly established domain.

</comment></comment></comment></comment><comment><USER7> I don't understand how an in-depth article like this can not include a mention of RabbitMQ. Did I miss it somehow?

</comment><comment><USER8> Would someone with more knowledge than me on this shed light on whether this is essentially what the Google chaps have done for their Wave protocols?

<comment><AUTHOR> <http://www.slideshare.net/pieterh/restms-introduction></comment></comment>


Next.js 3.0 Preview: Static Exports and Dynamic Imports - <AUTHOR> https://zeit.co/blog/next3-preview <comment><USER2> I used Next.js to build [http://user-agent.io/](http://user-agent.io/) over a weekend and I'm really happy with the results so far. Dynamic url routing is a bit awkward, but not onerously so. (It also uses Express to handle WebSockets and dynamic routing for the share/host pages.)

Source is at [https://github.com/nfriedly/user- agent.io](https://github.com/nfriedly/user-agent.io) if anyone is interested.

I'm thinking about switching some of my work projects over to it sometime soon.

<comment><USER3> Just a heads up you're using the development version of React which is very very slow. You'd want to switch to the production version, not sure how that works in next but you generally build your React with NODE_ENV set to `production` for this to happen.

<comment><USER4> "Very very slow" might be a bit of an overstatement. The initial React render for that page takes 200ms on a MacBook. A release build will speed that up slightly, and cut down the bundle a little, but in the scheme of things it's not going to be noticeable to the end user.

If you actually wanted the page to feel fast you would probably do something like <script>document.write(window.navigator.userAgent)</script>

<comment><USER3> Possibility of 3x-5x perf impact according to Dan Abramov. [https://github.com/facebook/react/issues/2608#issuecomment-2...](https://github.com/facebook/react/issues/2608#issuecomment-219690343)

I did not expect to argue in HN of all places whether it's OK or not to run the development mode of a library in _production_ when it's so simple not to and the authors are trying so hard to prevent people from doing that.

</comment></comment></comment></comment><comment><USER5> I evaluated Next.js recently, and while it looks excellent on the surface, there were a couple of red flags:

\- Devs insisting (incorrectly) that they _have_ to ship the component source code _inline_ in the server-rendered HTML. I commented on this issue here: [https://github.com/zeit/next.js/issues/427#issuecomment-2908...](https://github.com/zeit/next.js/issues/427#issuecomment-290882395)

\- The same transpiled code is used both server-side and client-side. Code which should be strictly server-only, e.g. getInitialProps(), is visible client-side as well.

<comment><USER6> I can only comment about `getInitialProps()`. Of course it's should be on client-side as well, that's the whole point of universal rendering. In combination with isomorphic-fetch you can use your (Rest) API and have nothing to change on the code. I think it's an excellent design decision to makes components actually independent and easily composable.

<comment><USER5> You are right about that, I admit.

Still, using the same transpiled code both client-side and server-side is suboptimal at least. E.g. if I target Node 7.x on the server, I don't need to transpile async functions for example (and screw stacktraces in the process).

<comment><USER5> Also, I might still want to do some things differently server-side in getInitialProps(), despite most of the code being shared. For example, clients might access the API through a load-balanced frontend, while on the server I might want to prefer talking to an API process on the same machine. Authentication might also be different. Of course these things (e.g. the API endpoint) shouldn't be hardcoded, but even then you need to get them somewhere, most likely a configuration file or an environment variable. And sharing these details (names of environment variables for example) with the client is not something I particularly like.

</comment></comment></comment></comment><comment><USER7> A bit off topic but since it's mentioned in the article: how does the unlimited free static hosting compare with netlify's offering?

</comment><comment><USER8> I'm in the market for a good React Universal boilerplate and am considering Next.js for my next project...

A couple of things:

1) Why do you not use React Router? How does your own router play with Redux?

2) Is it possible to strip out now.sh? I appreciate it's how you make money but I want to deploy to my own infrastructure.

<comment><USER9> I tried to do a project with next.js but their router was just too awkward and limiting. Unless you're doing straight 1:1 route to code, you're basically on your own.

[https://github.com/zeit/next.js#custom-server-and- routing](https://github.com/zeit/next.js#custom-server-and-routing)

<comment><AUTHOR> That's the opposite of what that page is trying to explain. We'll take a look at the wording in case it's confusing.

tl;DR: You can do any sort of routing! We use a /:org/:project scheme similar to GitHub at [https://zeit.co](https://zeit.co) :)

Some examples:

\- [https://github.com/zeit/next.js/tree/master/examples/paramet...](https://github.com/zeit/next.js/tree/master/examples/parameterized- routing)

\- [https://github.com/zeit/next.js/tree/master/examples/with- ne...](https://github.com/zeit/next.js/tree/master/examples/with-next-routes)

\- [https://github.com/zeit/next.js/tree/master/examples/with- pr...](https://github.com/zeit/next.js/tree/master/examples/with-pretty-url- routing)

<comment><USER9> The named routes example is probably pretty close to what I was looking for. Oh well, maybe next time.

</comment></comment></comment></comment><comment><USER10> I'm very impressed by the quality of the Next.js framework and how lightweight it is. Glad to see it move forward!

</comment><comment><USER11> I am wondering why server-side rendering? I thought that stage was passed and everyone was doing client-side stuff? Please forgive a web n00b for asking.

<comment><USER9> You can get a faster initial load going with SSR since you're basically skipping a round trip. The really smart SSR's like Redfin's react-server ([https://github.com/redfin/react-server](https://github.com/redfin/react- server)) give you faster "above the fold" rendering too.

Also, while Google can deal with them, a lot of crawlers don't understand SPA's. So if someone links to you from Facebook for example, their auto content loading doesn't work.

</comment></comment><comment><USER12> I really like a static website command, NextJS impresses me every time.

</comment><comment><USER13> can anyone compare with meteor please?

<comment><AUTHOR> 1\. Embraces React exclusively[1]. We at ZEIT think the React Component model is the de-facto component model of the web and mobile.

In practical terms, this means that every "page" or "entry point" to your app is just an exported component `function` or `class`. `export default () => <p>My component!</p>`.

At the expense of a storm of HN downvotes, it's "more PHP than Meteor" :)

2\. No data layer built in, syncing, Models, etc. We added an extra lifecycle hook called `getInitialProps` (think of it as the counterpart to `getInitialState`) whose contract is returning data as a `Promise`.

This allows you to combine and compose different approaches to data retrieval. It works just as well with REST as it does with GraphQL or Socket.IO or server-sent-events or offline-only or…

3\. It hides configuration details but allows you to tap into them.

It's powered by `Babel` and `webpack`, which are exposed as a single command (`next` and `next build`), but you can completely override and customize them.

These are just some ideas. We created it to power the team collaboration aspects of our Web UI ([https://zeit.co](https://zeit.co)). We are committed to supporting it because we use it and we love it.

[1] Also React alternatives like Inferno and Preact ([https://github.com/zeit/next.js/tree/master/examples/using-p...](https://github.com/zeit/next.js/tree/master/examples/using- preact))

<comment><USER14> Just curious: is Typescript supported out of the box?

<comment><USER14> To answer my own question to those that stumble upon this via google or whatever. It doesn't appear to be. However this example was pretty helpful (as of 20170518):

[https://github.com/zeit/next.js/tree/d08e027a8c1d9bfe773a8b3...](https://github.com/zeit/next.js/tree/d08e027a8c1d9bfe773a8b3c8b143ff0f9341ccf/examples/with- typescript)

</comment></comment></comment></comment><comment><USER15> How does Next.js' static export feature compare to using Gatsby.js?

</comment><comment><USER16> Interesting concept, but it seems rather heavy. Installing it from npm pulls in over 400 packages, weighing in at about 60MB.

<comment><USER17> Try installing non-dev dependencies.. That's where a lot of your weight comes from, which is not in production.

<comment><USER16> So, I just did "npm install next react react-dom" which isn't bringing in next's development dependencies. Is there something that I'm missing?

<comment><USER17>
        npm install next react react-dom --production

<comment><USER16> That gets me the exact same thing. And afaik what you get from --production is the default behavior when you install a package directly from npm.

<comment><USER17> What's the contents of your $HOME/.npmrc file? Because it shouldn't be unless you have `production = true` set.

</comment></comment></comment></comment></comment></comment><comment><USER18> > dynamic import

Umm... you mean like AMD? Yeah, it's awesome ( _edit_ I mean, was a solved problem years ago). Somebody explain to me how people live without this.

<comment><USER19> AMD was a handy workaround, but better solutions exist now.

For one thing, each and every little module doesn't need to be written with knowledge of AMD or how it's going to be imported at all. If you used AMD with this component example, every single component you write would need to be wrapped in a `define()`. This has no wrapping, just standard JS exports.

Secondly, each module doesn't need to know its own name (to pass to the `define()` call), or even have a static name at all, it can effectively be anonymous & truly dynamic.

And finally, AMD modules make assumptions about the environment – for example, that you have control over `window.define`. If you're a third-party script trying to load things on someone else's website, good luck – you either just told someone _else 's_ module handler that you loaded, and have no visibility into it, or you clobbered the existing `window.define` and broke other people's scripts. (My former company's product was a third-party JS widget, and co-existing with dozens of other scripts and module loaders was a huge problem.)

<comment><USER18> These are all valid points... but I'm curious what you mean by "better solutions exist now." Basically everybody's agreed to use a transpiler for the foreseeable future [0]. How is that not a workaround?

[0] This is my first time to see that any browser has actually shipped ES6 modules: [http://caniuse.com/#feat=es6-module](http://caniuse.com/#feat=es6-module)</comment></comment></comment>


Computer Vision and the CCPA: What You Need to Know - <AUTHOR> https://medium.com/trueface-ai/computer-vision-and-the-ccpa-what-you-need-to-know-928477de0601 <comment><USER2> Very timely, I have been trying to learn more about what the new privacy laws mean for small saas startups. I wish there were more info on this for startups.</comment>


Man builds giant computer at home - <AUTHOR> http://www.bbc.co.uk/news/technology-33237863 <comment><AUTHOR> And there is a link to the site: [http://www.megaprocessor.com/index.html](http://www.megaprocessor.com/index.html)

<comment><USER2> And was posted here ~6 months ago:

[https://news.ycombinator.com/item?id=9755742](https://news.ycombinator.com/item?id=9755742)</comment></comment>


Docker container breakout? - <AUTHOR> http://stealth.openwall.net/xSports/shocker.c <comment><USER2> Hi all, I'm a maintainer of Docker. As others already indicated this doesn't work on 1.0. But _it could have_.

Please remember that at this time, we don't claim Docker out-of-the-box is suitable for containing untrusted programs with root privileges. So if you're thinking "pfew, good thing we upgraded to 1.0 or we were toast", you need to change your underlying configuration now. Add apparmor or selinux containment, map trust groups to separate machines, or ideally don't grant root access to the application.

Docker will soon support user namespaces, which is a great additional security layer but also not a silver bullet!

When we feel comfortable saying that Docker out-of-the-box can safely contain untrusted uid0 programs, we will say so clearly.

<comment><USER3> Don't worry. This is how things get more secure. Just stay the course and whack the moles. :)

Docker is awesome by the way.

<comment><USER4> It is better to think "less insecure" than "more secure".

</comment></comment></comment><comment><USER5> Here is your annual reminder: Use SELinux.

Nothing with a shared kernel is going to be very secure. That's just the nature of the beast. It's why Docker supports SELinux. It's why RHEL and CentOS ship with pre-written SELinux policy for common daemons.

If you intend to have more than zero services on the system, you want SELinux.

<comment><USER6> I can't help but be skeptical about SELinux, having been written by the NSA. What would make you choose SELinux over AppArmor?

<comment><USER7> Isn't it for the NSA, but by Red Hat? May have my history mixed up.

<comment><USER8> I believe that the National Security Agency was the original developer, but that Red Hat is significant contributor.

</comment></comment></comment></comment><comment><USER9> Apparently this is already fixed in Docker 1.0:

      Its fixed in docker 1.0 since CAP_DAC_READ_SEARCH is no longer available.

      Other FS-related threats to container based VMM's that have been discussed:

      - subvolume related FS operations (snapshots etc)
      - FS ioctl's that accept FS-handles as well (XFS)
      - CAP_DAC_READ_SEARCH also defeats chroot and other
        bind-mount containers (privileged LXC)
      - CAP_MKNOD might be a problem too (still available in docker 1.0) depending on the drivers available in the kernel

Source: [http://seclists.org/oss-sec/2014/q2/565](http://seclists.org/oss- sec/2014/q2/565)

<comment><USER10> Confirmed not working in Docker 1.0:

      root@377a6f4ab0a4:/# history
      10  wget http://stealth.openwall.net/xSports/shocker.c
      11  cc -Wall -std=c99 -O2 shocker.c -static
      12  apt-get install build-essential
      13  cc -Wall -std=c99 -O2 shocker.c -static
      14  cc -Wall -std=c99 -O2 shocker.c -static -Wno-unused-result
      15  ls
      16  ./shocker
      17  shocker
      18  nano a.out
      19  cat a.out
      20  ./a.out
      21  history
      root@377a6f4ab0a4:/# ./a.out
      [***] docker VMM-container breakout Po(C) 2014
      [***]
      [***] The tea from the 90's kicks your sekurity again.     [***]
      [***] If you have pending sec consulting, I'll happily     [***]
      [***] forward to my friends who drink secury-tea too!      [***]
      <enter>
      [*] Resolving 'etc/shadow'
      [-] open_by_handle_at: Operation not permitted
      root@377a6f4ab0a4:/# uname -r
      3.14.1-tinycore64

</comment></comment><comment><USER11> I believe it was Theo de Raadt who once said, "Why does everything think that when it comes to writing VM/container software suddenly people gain super human programming powers and no longer make the same mistakes they make writing operating systems?" (Slightly paraphrasing).

While the issue is currently fixed in the .12 and 1.0 versions. I doubt Docker is still completely bullet proof.

<comment><USER12> This phrasing unfairly conflates VM/hypervisor technology and containers. Containers being a pure software technology _do_ require near superhuman ability to secure but VM/hypervisors can lean on chip-level separation.

People forget that in-chip memory protection didn't come about for security reasons, memory errors were a particularly dangerous and particularly common kind of bug and the hardware was extended to help with memory isolation. OS session ending memory errors are almost unheard of since operating systems have started fully utilizing the on-chip protection. Programmers didn't become "superhuman" at preventing these errors.

For similar reasons it's much easier for hardware-backed virtualization programmers to protect you from malicious business inside a VM than it is for OS or container programmers.

<comment><USER13> You now rely on chip designers being super-human.

The real truth is that the difficulty of containment is proportional to the interface that is available to the contained process. You don't need VM or hypervisor technology to build a virtually unbreakable container. You only need to prevent the contained process from using any syscalls at all.

Hardware only seems better at this kind of stuff because (a) it's harder to find errata in hardware and (b) the syscall interfaces of commonly used operating systems are much larger than what the hardware offers, and were developed without keeping containability in mind. It is a well known fact that tacking on security features in hindsight is problematic.

<comment><USER12> You don't need super-human chip designers because, as you say, "the difficulty of containment is proportional to the interface that is available". Hardware doesn't just seem better because "the syscall interfaces of commonly used operating systems are much larger than what the hardware offers", it _is_ better. It is easier to analyse, has a more limited state-space, has more provable behavior, etc.

You can't just argue away the fact that a certain class of error has been all but eliminated by hardware-supported virtual memory. Multi-tasking as we know it today would basically be impossible without it. The reliability of "just get it right" systems like the early Macintosh isn't even comparable to, for example, a modern Linux machine that uses the chip to trap large classes of erroneous memory accesses.

Given that we have the above, a case of a class of error that programmers seemed unable to eliminate (practically) eliminated, I'm not really sure what you're arguing. Are you saying that hardware designers of the 80's _were_ superhuman?

Okay... maybe Jay Miner...

<comment><USER13> My point is that there is no difference between software and hardware.

You don't need hardware to eliminate memory errors: software can do it as well. Two examples of this are the Singularity system that Microsoft Research built and Google's NaCl, where the system only loads code that can be verified not to access memory incorrectly.

Your claim that hardware is easier to analyze is also incorrect. Modern processors are extremely complex beasts and are not inherently simpler than software. All processors have long lists of errata. You may be mislead into thinking hardware is easier to secure because (a) those errata are less visible to userspace developers because the kernel shields you from them and (b) hardware developers invest _much_ more resources into formal verification than software developers out of necessity (you can't just patch silicon). If software developers invested a similar amount of effort into formal verification tools, your impression would be rather different.

Again, the point is that there is no inherent distinction between software and hardware when it comes to securing systems. It is always and everywhere first a question of how you design your systems and interfaces and second a question of investment in development effort targeted at eliminating bugs.

<comment><USER12> "My point is that there is no difference between software and hardware."

Okay, now I see where you're coming from. Theoretically I agree. However, practically there are a number of things that make hardware different:

* Hardware has inherent "buy-in". The software systems you describe as also solving the memory access problem are basically opt-in frameworks. While you can make software frameworks hard to opt-out of (e.g. OS integration etc.) by definition... software runs on hardware...

* hardware solutions are often much more transparent. Again, your software example require a great deal of re-tooling. One of the most elegant aspects of the classic 80's memory access solution was how transparent it was.

* The ratio of software to hardware vendors has far fewer hardware vendors. Combine this with the fact that, as you point out, hardware is so expensive to retool and you create an environment where it is much more likely that a single hardware solution will be "correct enough" to enforce a constraint on software than it is the case that the majority of software will properly opt-in to a framework/code-correctly.

</comment></comment></comment></comment></comment></comment><comment><USER12> This vulnerability is a good example of how a security bug is _still a bug_. That is: even if all the bad guys went away there would still be problems. This issue was fixed (as far as I can tell) pre-1.0 for non-security reasons. See this discussion: [https://github.com/dotcloud/docker/issues/5661](https://github.com/dotcloud/docker/issues/5661) .

Basically, docker used to have a "drop" list associated with each execdriver. By default docker kept all kernel bestowed capabilities but would explicitly drop those on the execdriver's drop list. This created issues with compatibility. If an image was prepared on a kernel that _didn 't_ have a particular capability at all and was suddenly run on one that was, weird hard to diagnose behavioral differences could emerge. So now docker drops everything by default and the execdrivers have a "keep" list. Also, there's now a check for the kernel defining a capability before trying to mess with it.

There are---of course---still some issues. For example, docker drops everything then tries to add the capability back. That won't work for some capabilities because some can't be added back once they've been renounced. Still, the situation is an interesting example of how a security bug is still a bug and is likely to bite you in some way sooner or later. See also XSS flaws that limit valid inputs.

<comment><USER14> Yes. I pointed it for LXC originally, filing the bug with LXC on sourceforge and later re-filing on github. Nothing to do with docker. Finally, they implemented it. This is like multiple years of timeframe we're talking about. Later I pointed it out for docker. Just sayin'. There's a lot of us contributing here, and much of the work isn't under the docker banner.

<comment><USER12> "There's a lot of us contributing here, and much of the work isn't under the docker banner."

Of course! If my comment could be taken as part of the mass of prose that can be read to imply otherwise, I apologize. I don't want to undermine what Docker has done with providing a packaging format, UX, and history niceness. I also don't want to undermine the years of hard work that's gone into kernel namespacing etc. that makes it all possible.

</comment></comment></comment><comment><USER15> Just to be clear, this doesn't really seem like a problem with Docker specifically. It looks like a problem with the kernel's namespace isolation, affecting _any_ container-based solution. Yes, that's in the PPS, but probably should be in the title.

<comment><USER16> that's true to some extent, but it also has to do with which namespaces and isolation features a given container solution supports, for example lxc has seccomp syscall filtering support and user namespace support ootb which would have mitigated this attack surface to those of the unprivileged user running the container (and covering the ps on kexec). in addition lsm usage (selinux, apparmor) can also limit the attack surface area.

</comment></comment><comment><USER17> Linux capabilities are not a good security model in general. They're more suitable for sysadmins who want to do the very basic locking down of system resources to prevent users from fucking things up, or preventing programs from doing basic accidental mistakes. A MAC or RBAC implementation is a lot more robust and actually fulfills the qualifications for things like secret/top secret computing systems.

<comment><USER14> grsec + containers is nicer.

<comment><USER17> From what I recall, grsec's rbac doesn't give you the same flexibility as selinux's mac. You have to pick and choose whether you want advanced heuristics to prevent different kinds of attack, or just get really fine- grained with your system control. I prefer grsec personally, but only because i'm lazy, and it's more than likely not certified for top secret systems.

<comment><USER14> grsec's developer philosophy fully admits this pragmatic focus... basically, if we are too lazy to use a custom policy because policy development is painful, then essentially we are not going to use any policy and will instead remain vulnerable. grsec makes it easier, therefore it actually gets used.

I studied SEL policies in depth back in 2000 or so, but have never once deployed a custom policy. I suspect others are the same, though common daemons on common distributions recently (~last 5 years) began to have usable pre- supplied policies, unfortunately standard services are so commodified these days they're often outsourced (email, chat, web, etc.) and so the benefits of this 'too-little-too-late' development are partly mitigated in practice.

</comment></comment></comment></comment><comment><USER18> "tested with docker 0.11"

Looks to be a few releases out past 0.11, notably 0.11.1, 0.12, and now 1.0. Can anyone confirm this works on the later versions of docker?

<comment><USER19> The kernel version is just as important, if not more important. I've performed tests that have given me non-specific breakout capabilities on certain combinations of Linux and Docker. I haven't however, as is done here, reproduced and written an exploit.

As an employee of Docker, I feel it is more important to me to know if we can breakout and patch those issues than to write viable exploits for them.

I have noticed that newer kernels and Docker versions (such as 1.0) are currently more difficult to break out of than they were in earlier versions. Again, however, it's highly dependent on the pairing.

What's important to recognize here is that even with breakout potential, containers should add a useful layer of security to break out of that wouldn't otherwise exist. Containers should never remove security from your system, they should only add to it. However, although deployers may find the removal of virtual machines to weaken their security story. The "secure all the things" story would be to put Qemu in a container, then run containers inside the VM.

Otherwise, security practices are as they _always_ have been: Don't leave setuid binaries floating around, etc.

</comment></comment><comment><USER20> Docker's answer [http://blog.docker.com/2014/06/docker-container-breakout- pro...](http://blog.docker.com/2014/06/docker-container-breakout-proof-of- concept-exploit/)

</comment><comment><USER21> Relevant recent discussion on the security of containers vs full virtualization: [https://news.ycombinator.com/item?id=7834338](https://news.ycombinator.com/item?id=7834338)

</comment><comment><USER22> Now try breaking out of a FreeBSD jail ;-)

<comment><USER23> like this? [http://freebsd.1045724.n5.nabble.com/Thoughts-on-jail- privil...](http://freebsd.1045724.n5.nabble.com/Thoughts-on-jail-privilege- FAQ-submission-td4219099.html)

<comment><USER24> That's dated Jan 15, 2009. Are there any newer exploits for breaking out of jails on recent versions of FreeBSD? OR breaking out of a Bhyve VM?

<comment><USER22> And that's not even an exploit, that's the sysadmin doing it wrong: "If the host system and the jail share the `john' user _and_ you are sharing `/usr/local' as read-write between the host and the jail, then ``you are doing it wrong!''."

</comment></comment></comment></comment><comment><USER25> Confirmed this works on lxc 0.7.5-3ubuntu69 (ships with Ubuntu 12.04 lts). Just change "/.dockerinit" to any file within a bind mount and run it.

To fix this you can shutdown the container, edit the config in /var/lib/lxc/<name>/config and add dac_read_search to lxc.cap.drop. Voila.

      [*] Resolving 'etc/shadow'
      [-] open_by_handle_at: Operation not permitted

</comment><comment><USER26> Docker image to test if your host is vulnerable to this particular open_by_handle_at() container breakout: [https://registry.hub.docker.com/u/gabrtv/shocker/](https://registry.hub.docker.com/u/gabrtv/shocker/)

Remember to always audit the source code before running something like this. Origin repo is here: [https://github.com/gabrtv/shocker](https://github.com/gabrtv/shocker)

</comment><comment><USER27> > _" The tea from the 90's kicks your sekurity again. If you have pending sec > consulting, I'll happily forward to my friends who drink secury-tea too!"_

Uh, what?

<comment><AUTHOR> stealth is a legend of the '90s

[http://en.wikipedia.org/wiki/TESO](http://en.wikipedia.org/wiki/TESO)

<comment><USER14> Never really got talking but they sent me some friendly warez when I released an ARP-based remote OS detection script in like 1999. As I recall they were all Germanic. Doubt there's any 'reach out' from groups today, too much profit/loss going on...

</comment></comment></comment><comment><USER28> With a technology used in production in a lot of places, does responsible disclosure apply here? Did the author (OP?) notify Docker and/or the Linux kernel team before distributing this for public consumption?

<comment><USER29> While the author called the exploit "shocker" I don't think anybody is shocked by it. There are likely many other ways to break out of Docker. And while I assume the Docker (and kernel!) people are closing them as they come along, I don't think anyone is claiming Docker is unescapable so it's not a surprise if it is.

<comment><USER30> I think he might have been sarcastic</comment></comment></comment>


Tim Cook: Technology Should Serve Humanity, Not the Other Way Around - <AUTHOR> https://www.technologyreview.com/s/608051/tim-cook-technology-should-serve-humanity-not-the-other-way-around/ <comment><USER2> So is he going to lobby for a massive overhaul of Foxconn's employment practices?

<comment><USER3> Apple has done more than any other American company to improve working conditions in China.

<comment><USER4> Even if that's true, it does not mean they have done enough.

<comment><USER5> That's fair enough as long as other companies and their customers are held equally responsible. Just because we sometimes/always use linux does not mean the hardware we run it on has an equally "clean" background. Also, we buy too much stuff, meaning too much stuff is being produced... etc.

</comment></comment></comment></comment><comment><USER6> Does it mean that technology companies should pay their taxes, to serve humanity, rather than playing tax optimization tricks ?

<comment><USER7> Don't blame individual companies for taking advantage of a broken system. This is a political issue, not a business issue.

<comment><USER8> Didn't Apple make special deals with Ireland? Doesn't sound like everyone else was offered these.

</comment></comment></comment><comment><USER9> more context for the headline quote. FTA:

 _" While he calls AI "profound" and increasingly capable of doing unbelievable things, on matters that require judgment he's not comfortable with automating the human entirely out of the equation. "When technological advancement can go up so exponentially I do think there's a risk of losing sight of the fact that tech should serve humanity, not the other way around."_

he's talking about AI here.

<comment><USER10> > there's a risk of losing sight of the fact that tech should serve humanity, > not the other way around

Whoever thinks for even a moment that humanity should serve technology?

<comment><USER9> the ones who own the technology

</comment></comment></comment><comment><USER11> Why is the Hacker News community up-voting these blatant PR pieces? This statement coming from Tim Cook seems like a joke.

<comment><USER12> Read the article. It's practically a death knell for iOS. If iOS can't come to grips with figuring out how to let AI get more access to the user, it could lose the AI race against Google.

Already, people are installing Google Assistant on their iPhones. You have to understand, that the future may make most apps other than games and entertainment, completely irrelevant. You just want a Web Browser and an AI Agent.

</comment></comment><comment><USER13> What is the other way around -- that humanity should service technology?

What does humanity servicing technology mean? That depends on who is controlling the technology, and that often means corporations and the elite classes that control it on top.

<comment><USER14> humanity serves technology... like being glued to a screen all day

</comment></comment><comment><USER15> This is a pretty ironic statement, given their entire product design is built to serve apple, and the users are often secondary to that or ignored entirely; such as making UI more difficult on purpose so you're more inclined to use siri, or buying music instead of bringing your own.

I dont see AI at apple being any different. Its for them FIRST, us second, if at all. "humanity" may as well mean corporations since they are comprised of humans, but the general public will bare the costs in the end.

<comment><USER16> > _given their entire product design is built to serve apple, and the users > are often secondary to that or ignored entirely; such as making UI more > difficult on purpose so you 're more inclined to use siri, or buying music > instead of bringing your own._

That's simply not true, and it's a really offensive statement for pretty much anybody working at Apple. There's no company I can think of that cares _more_ about the user experience than Apple, and here you are claiming that they're doing the exact opposite.

<comment><USER17> Apple is extremely user-hostile, they make it hard to do anything they don't want you to do with YOUR device. It's simple things like using uncommon screws internally, or soldering in the ram, or requiring a certain set of bits at the front of your hard drive, or making it so the batteries cannot be removed.

<comment><USER18> That's not user hostile, that's user friendly, those things enable them to delivery a standard experience (something you cannot get on a droid) on their appliance to users who by the way love the shit out of them for how well their phones work. You might not like Apple, but their users do precisely because of those things. Apple sees their phones as appliances, not as personal computers to be customized; that approach has earned them die hard loyal fans who love those appliances as is. We don't all want to hack our phones, I'll take an iPhone over a droid any day, it's a much better experience.

<comment><USER19> I think you're right, but that kind of thinking is what leads to less open devices and software, which in turn leads to technology serving whoever controls it first and foremost.

<comment><USER18> An open market requires choice, including the choice for closed appliances. As long as alternatives exist, there's nothing wrong with closed platforms, those who want choice have Droid. Open devices and software come at a cost, they don't deliver the same experience you can get on a closed appliance that due to tight control over hardware and software can deliver a consistence experience impossible to deliver otherwise, this has always been Apple's way and it's how they deliver the experience they do.

<comment><USER17> It's not impossible to deliver otherwise. Apple could open source IOS and it wouldn't preclude them from doing exactly what they're going to do.

<comment><USER18> Non sequitur. They could not deliver "their" experience without locking down "their" hardware/software on "their" devices to keep it under control thus avoiding all the issues faced by the droid camp. Whether they could or should release iOS to run on other hardware has nothing to do with anything being discussed.

<comment><USER17> What are you even arguing at this point? What's the difference between every android phone and an apple aside from the openness of the software? No one is providing open hardware.

<comment><USER18> > What are you even arguing at this point?

Ask yourself that question.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Intense article. If you read it carefully and between the lines, you see the real future battle lines between iOS and Android, and they center around AI and privacy.</comment>


Persistent Myths in Feminist Scholarship - <AUTHOR> http://chronicle.com/free/v55/i40/40sommers.htm

<comment><USER2> I think the problems Summers identified here are common to fields that are very politically charged. I think that "scholars" are more likely to trumpet questionable or even clearly false "research" - and their opponents are more likely to angrily attack them for these mistakes.

Suppose that an immensely convenient theorem showed up in a math paper 10 years ago, that was later shown to be flawed. Well, I suppose math grad students looking to solve problems would be tempted by this theorem, and might erroneously use it for a while. But unlike the "rule of thumb" inaccuracy, math doesn't tend to induce the same wish to believe. We may "wish" to believe that a map can filled out with four colors, because it seems like a cool concept, but we're not going to get angry when someone shows that our current proof is false.

</comment><comment><USER3> This is an important issue in and of itself, but I want to point out that such problems are not limited to this field. See the comments at <http://news.ycombinator.com/item?id=623420>.

<comment><USER4> _such problems are not limited to this field_

I agree - it seems to be particularly common in fields that touch, no matter how obliquely, onto issues of public policy. On more than one occasion I have tried to find a definitive reference for a claim and found nothing.

Now that evidence-based medicine has done so much for us, one can only wish for evidence-based sociology. Admittedly, it is a bit harder...

</comment></comment><comment><USER5> Interestingly I missed the author's name at the top, and read the whole article assuming it was written by a man. I was surprised at the end to discover the opposite.

<comment><USER6> I missed the name too, but I took a guess it was a woman. I was with a Jewish friend today who'd mentioned that the jokes Sasha Cohen makes about Jews could only be made by a Jew or there'd be backlash.

I've had some decent discussions with feminists in the past, and their work on identity is really pretty interesting and valuable. But their numbers are totally screwed up - you know that "1/4th of all women have been raped" statistic? It's actually, "1/4th of women surveyed had sex that they wished they hadn't". I'll guess just as many men have had sex they wish they hadn't later.

I wonder why people cook up statistics to make their group's position look worse than it is. Do they think it helps in legislation or funding or education? The health people do it with STDs (greatly exaggerated risks), the drug people do it hardcore (I don't do any intoxicants, but alcohol is way more deadly and dangerous than half the illegal stuff in the USA), racial issues, ethnic issues, gender issues, sexuality, immigration, labor, etc, etc. It seems like tremendously many causes want to exaggerate their positions as worse off than they are, or the effects of choosing the other side as much worse than they are.

I think that'd be tremendously damaging to credibility in the long run, but I guess not many people check up on the science they read in the paper or see on the news.

<comment> onreact-com "I wonder why people cook up statistics to make their group's position look worse than it is."

It's due to the fact that such groups by the nature of their lower status can't get through with their message. Nobody cared much for slavery in the US until Uncle Tom's Cabin came out back then among other gruesome real life accounts. The average plight of downtrodden peoples just gets overlooked. Compare the global hunger crisis to the swine flu scare. Nobody cares for all the food riots and tens of thousands dying of hunger daily etc. but people go crazy about a few flu deaths.

So basically you need something shocking to get attention, whether it's a statistic, story or whatever.

<comment> barry-cotter _Nobody cared much for slavery in the US until Uncle Tom's Cabin came out back then among other gruesome real life accounts._

UTC was propaganda, not a real life account. Slaves were much too valuable to be treated in the way depicted in the book. Horrible treatment sure, but what's in the book makes no sense on a commercial/economic level.

<comment> onreact-com "UTC" was literature ;-) based on real people. My sentence was a little misleading though: I meant that the other accounts were "real life".

You sound like a slavery supporter though. You should look up some history books. Slaves were treated like cattle or pets basically. House slaves were pets and plantation slaves were cattle.

<comment><USER7> Acknowledging that slaves had real economic value is in no way a declaration of support for slavery. The fact that you can make such a jump in logic is profoundly disturbing to me. Those sorts of conclusions take away from honest discussion.

<comment><USER8> I think he means that that argument sounds similar to the ones actually given by slavery's supporters. I've heard an old economic argument that chattel slavery is better than wage slavery (what we have now), because you treat something you own better than what you merely rent.

(So an anarchonistic example is that a car you own will remain in better shape than one you rent. That's actually not such a terrible argument, though of course we'd reject it nowadays.)

That said, I don't personally know either way, and Wikipedia does mention that _Uncle Tom's Cabin_ is popularly seen as propaganda. (I personally haven't read the book, but it wouldn't surprise me if it were 'propaganda' in the sense that it was biased and promoted a political point of view. Apparently, before the Nazis, propaganda didn't have such bad connotations.) [http://en.wikipedia.org/wiki/Uncle_Tom%27s_Cabin#Literary_si...](http://en.wikipedia.org/wiki/Uncle_Tom%27s_Cabin#Literary_significance_and_criticism)

<comment> onreact-com Exactly. This is the way slave holders in the south argued. You should read the actual book. It's very moving, one of the greatest American literary works. I read it in my first semester of American Studies.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> One has to wonder - given the individual and group mindset that promulgated and then rationalized those feminist book(s), ideas, and arguments laden with falsehoods and fabrications - what the reaction to this article would have been had its author been a man.

</comment><comment><USER10> It may be safe to say that a lot of scholarship, regardless of gender, is flawed. That women do not wish to be publicly flogged is, perhaps, a tendency of the gender.

Maybe contacting the author, first, was a better way to handle the situation?

Of course, the article author doesn't try to search her own flaws in her approach.

<comment><USER11> "Maybe contacting the author, first, was a better way to handle the situation?"

I disagree. Statements made in a public, academic context should be debated and corrected in a public, academic context. This is perfectly appropriate; indeed, taking it private may well be _in_ appropriate. This is the nature of academia, and anything less is a disservice to the greater academic community in question, who are shut out of a private conversation.

Obviously some professional courtesy is called for; such debate should not be acrimonious, and sending a note to the originator of the debated items is probably appropriate unless you know they can't miss it. But I'm not seeing anything egregiously wrong with the author's approach or tone in this article.

Many of the corrections in question involve objective facts, too. While I am keeping in mind I am seeing only one side of the story, I have a hard time seeing what justifies responding to a debate about what the objective fact of the matter is with _any_ sort of accusations or stonewalling. The March of Dimes example seems pretty open-and-shut, for instance.

<comment><USER12> It's standard procedure in academia---in CS, at the very least---to notify the people you're correcting in advance. This ensures that they (a) know about the problem, (b) are aware of your efforts and can comment directly to you, and (c) can participate in the discussion that ensues when you publish.

</comment></comment></comment><comment><USER13> Insightful.

But not Hacker News.

<comment><AUTHOR> I swear, "not Hacker News" seems to be the overriding meme here on HN, and it's getting old.

Sure this article's partially about feminism, but it's also about academic integrity, which I think falls well under the purview of "Hacker News". Not to mention the fact that CS and programming are often the focus of gender difference issues by feminists.

<comment><USER14> CS and programming are actually /not/ often the focus of gender issues by feminists.

The discussion on the gender-balance in said fields is brought up internally, most of the time, if not always. The 'feminist' crowd (gender theorists, women's studies academics, etc.) is honestly not that interested, or aware, of our problems.

<comment><USER3> > The discussion...is brought up internally, most of the time, if not always.

You may be right, but I suspect the reason for the above has something to do with the influence of feminists.

<comment><USER14> I doubt it.

That implies that the problems women face in computing (by being women) historically and currently are myths and only exist if you think about 'em.

They aren't, and there's plenty of evidence to show otherwise. email me if you really want a lit. review on the subject.

<comment><USER15> Data point: My mother was a programmer back in the 1950s. She wrote numerical programs that simulated missile trajectories... in octal. She thought it was great when she got an assembler.

I don't recall her ever saying anything about discrimination on the job. The thing she griped about was being told by a math professor that math was no place for a woman.

Maybe there are some gating effects happening that steer women away from trying technical fields? It seems to me that, within most software places, you belong if you know your stuff. Nobody cares about your race, gender, religion, sexual orientation, or other basis for "discrimination". We care if you can code. (If you can't code, and got the job as a token person-of-that- color/gender/sexual orientation, then we usually have a problem with that, but that's not the same as bias against that color or gender or sexual orientation.)

That's the way it's been almost everywhere I've ever worked, and I've been in software for 25 years.

So what I'm trying to say is, there's almost always room for some introspection, but maybe we're too hard on ourselves? Maybe the lack of women in software isn't really the software guys' fault?</comment></comment></comment></comment></comment></comment>


Dashcube – Communicate In Context - <AUTHOR> https://dashcube.com/

<comment><USER2> Our company uses Trello and Slack. This is basically Trello + real time updates on the comments + separate user-to-user private chat. This could almost replace Trello for us but won't replace Slack.

Slack also has:

\- very good mobile/desktop apps

\- integrations

\- fast search

\- group chat rooms

The project replay feature is also cool but I'm discounting it because I can't think of a use for it as long as everything is timestamped.

<comment><AUTHOR> Thanks for your feedback!

Specific notes:

\- We have native mobile apps on iOS and Android. The links to both app stores are on the homepage. The apps are a bit rough around the edges, but we're working really hard on them.

\- Integrations will come, as will importing.

\- We do have fast search, in a drawer from the left.

\- Every single task and project ("cube") functions like a group chat room. And there's rollup, meaning that if you are talking in a task, the discussion is visible on tasks above it in the hierarchy, all the way up to cube level.

The project replay feature is designed for things like project retrospectives, getting up to speed when joining a new project (aka "onboarding" which is usually painful), getting caught up when coming back from a vacation, etc.

<comment><AUTHOR> By the way, I buried the lede: our point is that Trello (tasks, kanban) and Slack (chat) need to be first class citizens in the _same_ app. Having two separate apps for this is the mistake of the industry -- e.g. Basecamp and Campfire being separate, etc.

</comment></comment></comment><comment><USER3> Maybe it's just Safari in OS X Yosemite, but that animation that progresses as you scroll looks terrible. Jerky, not fluid, etc. These scrolling animations look really, really bad if you don't nail the execution, and they can actively hurt you if they work this poorly.

<comment><USER4> Yeah, we tried making it smoother in Safari by using CSS to enable hardware acceleration. However, doing this overrode the stacking context of the page.... which made it look worse.

</comment></comment><comment><USER5> This is very interesting. We've been bounced through Trello/Asana/HipChat/Slack quite a bit, and definitely experience this problem.

Curious - how well does it support chat contexts not associated with tasks? Like general or subject-based group chat?

Also - one of Slack's major advantages is it works great everywhere (web/desktop/mobile). Attaching task tracking to a mobile chat app seems like an incredibly difficult UI/UX problem.

<comment><AUTHOR> Right now chats are either private messages or else they are on a task. We probably need to generalize this though, since not everything is a task.

Our mobile apps are interesting. We are experimenting with both the iOS and Android apps and still working out some of the UX kinks. (Right now, for example, we have hamburger menus, etc.)

</comment></comment><comment><USER6> This seems like an awesome project. I have two issues. One people get tired of moving between systems, it's an easy sell for me to move to something better, but a hard sell for my team. Two, how does this product ensure security for intellectual property?

<comment><AUTHOR> Thanks!

In terms of convincing your team, we need to build importers to import popular tools (e.g. Trello, Pivotal, Slack, Asana). What do you use?

In terms of security and IP: the security model is at the cube level. Anyone you add to a cube can see the tasks and conversation inside it. Private conversations are between you and the other person, and are not attached to cubes.

In terms of hosting, we're on AWS. Eventually we may offer a hosted option for companies that this is a deal-breaker for, but that would be priced at Enterprise levels. If you're interested, please let me know...

</comment></comment><comment><USER7> The killer app in messaging will continue to be presence awareness. I have yet to find an app that effectively communicates that I'm away from my desk after 5 minutes but still available through my mobile device.

<comment><AUTHOR> We've been debating whether to differentiate between "online" and "mobile". The obvious answer is to do so, but it might be that with phones being better etc some people prefer to just use the mobile app for much of the day, especially if they only have one monitor...

</comment></comment><comment><USER8> A friend of mine tried to do something a bit like this; it's all MIT licensed on GitHub now.

[https://github.com/Founden](https://github.com/Founden)

</comment><comment><USER9> I really like this. I find a lot of communication and task tracking apps offer more than I need.

My only gripe is that the UI needs a little more colour. :P

<comment><AUTHOR> The UI is intended to be something that is pleasant to look at for hours, since ideally we want it to be left open all day on a second monitor. So we didn't make it bright and shiny...

</comment></comment><comment><USER10> "Chris and Robert Carkhuff currently own the majority of Dashcube."

That's a pretty weird thing to put on your homepage, right?

<comment><AUTHOR> They're more active than typical investors, but it does sound weird. Fixing.

</comment></comment><comment><USER11> This post set off HN's voting ring detector, but we turned that off because we want to see original work on HN. (We also reverted to the document title because "Dashcube: the love child of Trello and Slack" seems a little feverish.)

All: it's not in your interests to ring-vote posts (i.e. to solicit upvotes for it). It's against the rules, incites the ring detector into demoting your story, and eventually will get your account penalized.

<comment><AUTHOR> I was actually quoting a journalist (David Coleman, CMSWire) whose article was quoted at the top of the Dashcube homepage. I have no idea why a voting ring detection got triggered, but it's probably because everyone who has been working on Dashcube was excited and sharing with their friends. I've been on HN for years and am not a bad actor...

<comment><USER11> Yes, it's clear from the home page that you were quoting a journalist. That's not the problem; the problem is that that title violated the HN guidelines by being linkbait. We want titles that are accurate and neutral. Happy to change it again if you want to suggest a better one.

<comment><AUTHOR> This is fine; thanks. Sorry about that...</comment></comment></comment></comment>


Choosing Cloud Foundry for the UK Government's Platform as a Service - <AUTHOR> https://governmentasaplatform.blog.gov.uk/2015/12/17/choosing-cloudfoundry/ <comment><USER2> Looks like they're going for the full ecosystem of CF development tools too -- BOSH for deployment, Pivotal Tracker for managing work, Concourse for CI.

[Obligatory disclaimer that I work for Pivotal, the main donor of engineering effort to Cloud Foundry].

<comment><USER3> (Disclosure: I worked at Pivotal for a bit, as well as a consultancy supplying services to Her Maj's Government)

Yeah, and that's a good call in my book. Concourse + Bosh makes open source CF manageable. I've heard stories of people trying to deploy OS CF without Bosh, and it ending in a world of pain.

I wish Bosh had a better user experience - in fact, I gave a talk alluding to that at CF Summit Berlin. It's got some great qualities missing in other tools, but I dare say most of the folks reading this will never had heard of it. Declarative, convergent, effectively immutable infrastructure-as-code across all the major IaaS providers.

Great to see UK Government IT modernising. Can't wait for HMRC to catch up!

<comment><USER4> _Great to see UK Government IT modernising. Can 't wait for HMRC to catch up!_

You haven't seen that many publicly funded technology projects, I take it? GDS are a monopoly, and the govt don't care about using what they're making - they're just going through the motions, spending the money.

So, while this is notable from a technical pov, don't kid yourself that this'll be anything other than a billion pound cash cow for the nepotistic web of government.

How's that nhs digitisation (NPfIT) going? Oh, it isn't?

<comment><USER3> _You haven 't seen that many publicly funded technology projects, I take it?_ I have as it happens. Ex-colleagues happen to be working on some, which is rather entertaining as some of those involved are particular left-leaning!

Government buying policy has moved to replace the massive SI consultancies that were holding the Government to ransom with nine-figure contracts to support (and deliver) legacy systems (think 00's era EJB nonsense). GDS is part of that move to more modern working practices, and I for one welcome it.

Governments need IT systems. I would prefer they were delivered with open source platforms and agile methodologies.

I'm interested to hear your ideas for an alternative.

<comment><USER5> Glad to see I'm not the only one who believes that governments should try to deliver using open source - the improvement that can be made to society in general from taking this approach is immense, IMO. There are so many areas where doing so will benefit everyone, eventually.

</comment></comment></comment></comment></comment><comment><USER6> Another project free of generics, exceptions and heavy abstractions strikes again. Great to see Vulcand usage.</comment>


iPhone, iPad and Mac sales are down, but Apple only cares about services now - <AUTHOR> https://techcrunch.com/2016/07/26/iphone-ipad-and-mac-sales-are-down-but-apple-only-cares-about-services-now/ <comment><USER3> As a single, insignificant data point: I just bought my first Windows laptop after 2008. I kept waiting for Apple to release Skylake professional machines. Just gave up waiting for them. Ended up getting a Windows Signature machine, which came with a free tablet. Guess I don't need to wait for the iPad Air refresh anymore as well.

I think Apple has lost its way. It has forgotten about its power users. I think they are trying to be a luxury brand now ... limited function devices that overpriced (but look really nice). I'm a bit bitter as I say this since I was a huge Apple fan.

<comment><USER4> You did not write anything about the actual user experience, which is telling. Is the mere fact that there exist machines which will boot into a non Apple OS supposed to spell doom for them or something? I just used my first Windows machine in almost ten years as well and... guess what it still sucks. Particularly if you are trying to develop software.

<comment><USER5> Really? Next week you can install WSL (Bash on Windows) on Windows 10 which is amazing considering its in beta. Definitely try it if are developing on a Windows box.

<comment><USER6> If I can viably develop on Windows instead of a slow (on my i3 laptop) Linux VM I'll be thrilled.

Not getting my hopes up though.

<comment><USER7> I'm pretty sure WSL is not enough for any decent sized dev effort. And running Linux on a VM on an i3 would just be masochistic. Stick to Linux would be my suggestion.

<comment><USER6> It's really not thaat bad most of the time. And I would but I don't trust Windows updates to not eventually trash any dual boot setup, or Linux updates not eventually trash my graphics drivers etc.

<comment><USER7> WHy not switch completely to Linux? Unless you play games.

<comment><USER6> A bit of LoL here and there, plus little things like being able to cast to my roku hassle free and reliable sleep/suspend. Was all Linux for a few years but the man won. I know I should probably get a real dev machine but this is what I'm working with at the moment.

Really my current development needs consist of git, ssh, node, redis, mysql, apache, and python. If WSL can do that I'm all set.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> $42.4 billion of revenue in total. $6 billion of which is services. That is not the profile of a services company. That is the profile of a company who's PR department is running distraction on the press.

You cannot replace the revenue of a once every two years $800 purchase with some music sales. Consummers only even spend that $800 because the cost is hidden in a larger monthly bill.

This should be a big deal. Apple is no longer taking market share from Android. Apple is no longer convincing consumers to replace their old iPhones. This is a trend which should scare investors. Let Apple is still priced assuming 11 more years of current profits.

<comment><USER9> I think Apple has it's issues, but isn't this textbook Innovator's Dilemma? Newer vertical looks small compared to established vertical, thus dismissed.

$400 every two years (assuming 50% profit per phone!) is just $17/month. If Apple can convince you to pay for 2 or 3 of its services, then they're gold.

Where does the "11 years" comment come from though? How do you figure that?

<comment><USER10> If you're counting profit on the phone, you need to compare that to profit from the service.

I doubt they are running Apple Music with a 50% profit. Most services are probably being priced close to cost to gain market share.

<comment><USER9> Yeah that's a good point. I don't really think these services are "at cost", though: isn't the whole point of this industry that marginal costs are super low?

</comment></comment></comment></comment><comment><USER11> Honestly at this point the only thing that's keeping me from switching to Windows is XCode because I need to build iOS apps. I will immediately switch to Windows if someone figures out a way to seamlessly build true native iOS apps on Windows.

I've waited enough for their laptops--not because I love mac but because that's the only option I have for the reason above--and getting tired of it. As I am typing this on my macbook air, I have to take my hands off the keyboard time to time because it gets too hot. Also the battery has swollen up to a point where I can't even close the laptop. I've been waiting for a legitimate new laptop from them for TWO years. All they released was some minor upgrades and a "macbook" which I didn't buy because I know better than to act as Apple's guinea pig and buy their first iteration of anything--I learned it the hard way with my iPhones and iPads.

Anyway, all this to me feels like it's because Apple is no more an innovator company, instead they follow the stock market. I used to be a Windows user but switched when Vista came out and I really couldn't stand it. I feel very reminiscent of those times when I think about what's going on with Apple nowadays.

<comment><USER12> Maybe Apple has stopped innovating, but Windows is just not there for developers, not even close to what Mac has been ~3 years ago.

Saying this from recent personal experience.

<comment><USER13> There are no good options these days. I know that's been the song of developers since the beginning of software, but it does seem we've hit a bit of a valley in terms of desktop OS's. Linux still can't quite get its foot in the door. OS X peaked with 10.6.4. Windows peaked with 7. Everything since has been the long, slow decline of trying to mimic mobile's success and failing.

<comment><USER14> Wholeheartedly agree.

I want Windows 10s graphics performance, Linux' kernel/CLI tools/open source mindset and OS X' graphical applications/UI design/integration with my my other devices.

Currently using OS X, but the hardware situation is frustrating (has always been, but currently at it's worst since ~10 years), the software quality is declining and Apple's ongoing direction towards iOS doesn't fit me.

Using Linux on my PC is frustrating, the graphics situation is terrible. All I want is 60 fps vsync'd performance, fluid scrolling, no choppiness when moving or resizing windows. Also, there is still a lack of many important applications (Adobe, MS Office). The whole Gtk vs. Qt situation also aggravates this.

Windows, for me, as a developer, is a total disaster, not only does it differ totally from my usual UNIX environment with it's completely different way of handling files and directories, but I also dislike the software: font rendering is terrible (in my eyes), the switch to UWP is terrible, as is the platform (UWP) itself, to me, the lack of choice is even worse than on OS X. But Windows seems to be the only OS at the moment to run without major problems on hardware of my choice with good graphics performance.

I really wished Linux would get it's graphics stack straight. I know it's not the individual developer's fault (and most certainly, the NVIDIA/AMD didn't help much in the past), but the current situation is still somewhat subpar. Still, the choices at the moment all frustrate me, so I stick to what I have.

<comment><USER15> What GPU do you have, and which driver stack do you use?

<comment><USER14> The machine on which I installed Linux had a Core i7 4770, so it came with an Intel HD 4600. This chip did well, but of course the performance is not enough, so I installed my GTX 770. The proprietary driver made many problems, reported wrong refresh rates (Compiz never got above 30 fps, unless I manually told it the refresh rate, which breaks my multi monitor setup). I tried mutter (Gnome 3), Compton and Compiz, but none of them could easily deliver sane, smooth 60 fps using vsync.

Kwin from KDE actually managed that, but the performance was very bad, whenever I started playing a YouTube video for example, scrolling got choppy and to a maximum of 30 fps.

</comment></comment></comment></comment></comment></comment><comment><USER16> I am always puzzled when analysts are seemingly baffled that a company cannot keep selling more and more product each year to a finite audience and never reach saturation point...

<comment><USER17> I really liked this small article about exponential growth. Exponentials don't really exist in nature, there are pretty much always limits.

[http://radar.oreilly.com/2007/11/its-not-exponential-its- sig...](http://radar.oreilly.com/2007/11/its-not-exponential-its-sigmoi.html)

<comment><USER18> Pretty much this. Growth to carrying capacity looks a lot like exponential growth for a bit and then stops. Assuming it _is_ exponential is a recipe for sadness and disappointing earnings reports.

</comment></comment></comment><comment><USER19> This is a significant feat. Apple's $6b in revenue from services beats Facebook's last reported quarter for the entire company.

<comment><USER20> A lot of people in this thread are seeing $6 in revenue next to Apple's huge worth and dismissing it. That's a lot of money, and it is growing.

In my opinion, Apple is undervalued right now (I'm biased, I own a trivial amount of Apple stock). There is no real competitor that I've seen in the phone and tablet space, and their services business is growing.

<comment><USER21> > _There is no real competitor that I 've seen in the phone and tablet space_

If you haven't seen them, you haven't looked. Google, Samsung, Huawei, etc. Android is dominating Apple in market share at this point. Apple is making great margins still, but they are not without legit competitors and have not been for years.

</comment></comment></comment><comment><USER22> I've been sitting around for the past year or so wanting to give them more money for a new Air. Last month I tried a Surface and that came damn close to replacing my Air for its primary job of "going out to cafes and parks with me to draw stuff in Illustrator". I only brought it back because it had some major issues with Illustrator dropping the first half second of stylus strokes. Despite really hating the Windows experience.

If Apple comes out with a laptop/tablet hybrid like that, they will have my money in a hot second.

</comment><comment><USER23> The wait for the new MacBook Pro is agonizing but I am convinced it will sell like hotcakes when it finally comes out.

<comment><USER24> What do you think is taking so long? I'm waiting too - it's hard :).

<comment><USER25> Firmware weirdness with skylake.

Something about how it handles suspend, I remember the linux kernel having massive problems too, and they don't employ the same level of power saving optimisations as Apple do.

<comment><USER26> The Surface Book had power management-related firmware weirdness for its first couple of months as well. That said, Microsoft had it fixed by ~January- February as I recall it.

</comment></comment></comment></comment><comment><USER27> Well, they're not really wrong; while it's true they were selling high-margin hardware and making a handsome profit, they've been a vertical for many, many years, and all that hardware install base is just to get their services into people's hands.

While earnings calls always try to put a positive spin on the facts, I don't think their calling attention to their services is a distraction; it's simply pointing out what several people already knew: that selling 'services' on an ongoing basis is better in the end than selling actual tangible objects, which you can only sell once.

<comment><USER28> I think in general that selling ongoing services is a good business model, but Apple's bread and butter and golden goose has been hardware. Their enormous cash reserves were built by hardware, not software. Certainly software was a bit part of making that happen, but the margins and money came from hardware.

</comment></comment><comment><USER29> Anecdotal, but for me, I feel my iPhone is now good enough for my use and feel no compelling urge to upgrade. My guess is that many people feel the same way about the iPad.

<comment><USER30> Don't worry, new iOS release will show you what a clunker you actually have! ;-)

</comment></comment><comment><USER31> If Apple services were best of class, eco system leading stars, this approach would make sense. When we get iTunes and iCloud, well, their Kool Aid is probably spiked...

<comment><USER32> You're the first person I've seen make this point. All the way down here, and it's by far the most glaring issue with this picture. Apple's services are kind of a bit flimsy. They're at best an expensive value added service for their devices. The only reason I use Apple Music/iTunes under Windows is because I have an iPhone. Otherwise I'd probably be using Spotify.

Apple is a devices company first and foremost. The services augment these devices. To say that services are some kind of a way forward for growth neglects the fact that these devices are a gating factor for these services.

Services are an enticing revenue model because they guarantee a steady income, while developing a good device experience is "hard". But it's a hard way to make money, with your revenue constantly consumed by labour costs. Only "products" can provide the kind growth a devices company needs. Leo Apotheker got caught up in this with HP - thankfully wiser minds prevailed and they backed out before it was too late.

</comment></comment><comment><USER33> >But it looks like the company is investing a lot on services as we can see with the Apple Music redesign happening just a year after the launch

This is a bit of a stretch. The "redesign" is basically a new skin on the original, fixing confusion that should have never existed in the first place. I don't think it constitutes a major development from such a large company and a year's worth of work. Meanwhile the Mac product line sits gathering dust and Siri either makes incremental improvements or goes backwards.

It saddens me to say but Apple seems to have become one of these lumbering giants that is too slow to change course and adapt to the changing surroundings. Are they just too scared to move fast in case they lose what they have? Or is there some systemic problem that is dragging the pace down? I'm sure any one of the engineers working there has 100 ideas and the enthusiasm to move them forward.

</comment><comment><USER34> I don't want to be pessimistic, but making money by milking profits out of existing products while loosing market shares and not opening successful busines lines is exactly the sign of failing big companies. Blackberry was making profit until very late.

I see signs of decline on everything apple does, from failing products ( watch ), to failing software ( xcode, macos having the same network connectivity issues for years and not releasing anything new for years, ios still relying on decade old software stack and an aging cocoa framework).

The only true technological success i've seen from apple recently is what they're doing with swift, and it's maybe not a coincidence that it was aimed at being a cross platform, community driven technology.

</comment><comment><USER35> I wonder how much of this downturn is due to not much exciting hardware being release by manufacturers? Intel hasn't released anything much in the last few years, video cards are already overpowered for 99%, phones are pretty much all the same, etc.

Seems like there is no need to upgrade pc hardware or phones these days and VR/IoT hasn't really taken off in any way.

<comment><USER36> I wouldn't agree. Innovation for portable laptop/tablet form factors had been slow for quite some time, but I think there's a small uptick again. Everything from the Razer Blade which supports a external dGPU to devices like Microsoft's Surface Pro 4 and Surface Book are pretty exciting.

On other fronts, $99 "laptop containers" which utilize your smartphone's computing power are popping up:

SuperBook: [https://www.kickstarter.com/projects/andromium/the- superbook...](https://www.kickstarter.com/projects/andromium/the-superbook- turn-your-smartphone-into-a-laptop-f)

NexDock: [http://nexdock.com/](http://nexdock.com/)

And finally: $250 Chromebooks have started to get so good that it's actually viable replacement for a large portion of people who do most of their work in a browser anyways!

</comment></comment><comment><USER37> I will ignore the sensational nonsense headline from TC.

So revenue from services up 19% and App Store growth is up 27% which are quite impressive numbers yet all the media seems to be talking about is "is the Apple Goldrush over?" The market for smartphone is fairly well saturated in the majority of first world countries. And they are using that success to sell services that run on those devices which seems to be working. How is this a back drop against which to paint a picture of decline and impending demise?

</comment><comment><USER38> This focus on services seems like a bad sign for Apple's product quality. Apple's goal of making their products a great, cohesive experience aligned well with their profit incentive to sell hardware. Trying to get customers to use services they may not really want could have a negative effect on the overall product. We've already seen some of this with ads in the App Store.

</comment><comment><USER39> I waited for my macbook upgrade to have 5th Gen Intel processor , became 6th gen and now 7th Gen. Guess they will never catch up to latest generation

</comment><comment><USER40> Is Apple Pay even a thing any more? The near-field readers in stores seem to have disappeared when the chip card readers went in.

<comment><USER26> Most places that I've seen have installed NFC readers at the same time they upgraded to chip readers.

That said, I've yet to see anyone actually _use_ contactless in the wild.

I did, once. Because Discover was offering 10% cashback when they launched Apple Pay support, so I loaded up my card on my buddy's iPhone and went to Best Buy to buy a Surface Book. I've had zero other incentive to use contactless otherwise.

<comment><USER41> Contactless is a perfectly mundane and unremarkable thing in the uk. Just about everywhere you go accepts All of Visa, MasterCard or Apple Pay, including the underground. There is currently no other way to pay for London busses other than Oyster or contactless.

<comment><USER26> It's honestly mundane in it's availability in the US as well; I just haven't seen anyone actually _using_ it.

</comment></comment></comment></comment><comment><USER42> Windows? come on, come on.

</comment><comment><USER43> Why is the stock up? I'm confused.

<comment><USER44> Stock prices tend to fly when reality exceeds Wall Street expectations - <USER2> if those expectations were poor to begin with (the opposite is also true)

</comment></comment><comment><USER45> >"12.9-inch iPad Pro"

I had to look this up. It's real. A 13" iPad. Are these still labeled as tablets? Same size as my laptop screen.

<comment><USER46> I have one. It's excellent.

<comment><USER47> For what is it excellent? What do you use it for?

To me it has weirdly uncomfortable ergonomics, and it's still nothing more than a jumbo iPhone. I have long tried to like iPad but I find no use for it.

<comment><USER48> I got one for work use, and it slowly turned in to my at home laptop replacement. Definitely shines at casual consumption, the only time I use it productively is when it acts as a second display (meaning my laptop is productive).

Regular uses: \- Streaming video, cool and quiet, unlike my laptop (especially if it is sitting on fabric, like a lap or bed) \- Dual monitors on the go using duet \- Quickly looking things up with someone else (instead of sharing a phone screen, or starting a computer) \- Playing games in places where a laptop would be uncomfortable (heat and noise) or overkill: human resource machine, worm.is, hearthstone \- Skype (including conference calls)

Less commonly: \- Insanely long battery life for replaying downloaded videos on flights (last flight was ~15 hours, ~8 hours watching iPad video, <10% battery used)</comment></comment></comment></comment>


Concurrencys Shysters - <AUTHOR> http://dtrace.org/blogs/bmc/2008/11/03/concurrencys-shysters/

<comment><USER2> Most concurrency is now achieved by a somewhat M:N threading model where n kernel threads map to m 'slots' (actors.. etc). Why does this method of M:N threading work yet kernel to userspace M:N threading doesn't?</comment>


Domain Name Dollar Store  - <AUTHOR> http://ca.youtube.com/watch?v=7FZ1M_UmQes&feature=user

<comment><USER2> Hilarious! But oh so true!!!</comment>


Calculations in the latent space - <AUTHOR> https://medium.com/@juliendespois/latent-space-visualization-deep-learning-bits-2-bd09a46920df#.mb3try3i0 <comment><USER2> Why is the author referring to the most hidden layer in a vanilla autoencoder as the latent space? I thought only variational autoencoder uses the latent space for generative purposes.</comment>


"Fight Club" Author Chuck Palahniuk Apologizes for Piracy Rants - <AUTHOR> https://torrentfreak.com/fight-club-author-chuck-palahniuk-apologizes-for-piracy-rants-180602/ <comment><USER2> This guy got most of his fame from internet (and piracy). I remember reading about "Fight Club" in Usenet and ftp'ing it from "Russian Deep Repository". Ordering lesser-known paper books from America would have been difficult and costly.</comment>


Deloitte Joins Adobe and Accenture in Dumping Performance Reviews - <AUTHOR> http://blog.impraise.com/360-feedback/deloitte-joins-adobe-and-accenture-in-dumping-performance-reviews-360-feedback <comment><USER2> This is a corporate blog post. The title reads like a news headline, but the writing has a tint of marketing in it. Worst is the last section, which is simply an ad for its service.

Is there any better source for this?

<comment><USER3> [https://hbr.org/2015/04/reinventing-performance- management](https://hbr.org/2015/04/reinventing-performance-management)

</comment></comment><comment><USER4> No mention in article about the worst part of corporate performance reviews: stack ranking, in which employees are ranked against each other, and only a certain number of employees can be given top marks (and top salaries), and a certain number are required to get low marks (and low salaries), force-fitting employees into categories that don't reflect reality, but that look good on paper.

</comment><comment><USER5> Can anyone summarize what the performance reviews will be replaced with?

I admire the intentions, but I'm a little cautious about what comes after. Tried to read the article, but got tired of the words/marketing slant, and the hbr link posted in a different comments wasn't working when I tried it.

<comment><USER6> I can confidently say this: I'm highly knowledgeable of what several big-name companies are doing, and it's not as big of a difference as they market it to be. For one, there are still ratings behind the scenes so it's actually just making the process less transparent than before. For the other (one of which is named in the title of this post), they haven't figured out what they'll be doing instead, which means it may just be lipstick on a pig.

<comment> steve-howard Here's another company that overhauled its reviews not so long ago:

[http://blogs.seattletimes.com/microsoftpri0/2013/11/12/micro...](http://blogs.seattletimes.com/microsoftpri0/2013/11/12/microsoft- gets-rid-of-stacking-ranking-review-system/)

I have as little insight into the process as before. We get to do performance paperwork more often, but the process that turns that into money is as opaque as it ever was.

</comment></comment></comment><comment><USER7> This is a strong of BS PR items from a single company promoting itself by getting past-their-prime big companies to let it use their name, in exchange for them appearing to be trendsetters in hopes of attracting talent getting vacuumed up by Amazon/Google/Facebook</comment>


Ask HN: Is there any way an app can listen conversations secretly and show ads? - sahin-boydas I am a person who is pretty aware of what i search what i type.<p>I had few instances that i heard an ad on radio and chat with my wife or my friends and sometime after i see an ad on the mobile web. (i am 100% sure i didnt do any searches about it) <comment><AUTHOR> There's no conspiracy. The guys who make the ads target radio and the web in the area the radio broadcast was made.

The radio ad is for familiarity and the web is to get people to get whatever it is.

</comment><comment><USER2> Yes, if they have access to your microphone, pull audio and convert it to text, search keywords and display ads. It's not really practical though, and there are other behaviors which are way better and easier to track for advertising purposes.

<comment><USER3> See: [https://www.youtube.com/watch?v=zBnDWSvaQ1I](https://www.youtube.com/watch?v=zBnDWSvaQ1I)

I tested this with my mother, telling her about this in person and talking about dog toys. My mother does not have a dog - but by the end of our 2 hour talk about how much she wanted to get her dog a dog toy she was getting advertisements for dog toys and dog food on Facebook.

She has an iPhone.

<comment><USER4> iPhone or Android does not matter. You need to disable microphone access to Instagram, Facebook and Facebook Messenger if you wish them to not listen to you.

Actually if you are on Android I'm pretty sure there is no way to disable google listening to you 24/7.

<comment><USER5> What is your source for google listening to your microphone all the time on Android?

<comment><USER6> "Ok Google"</comment></comment></comment></comment></comment>


Ask HN: Why nobody talk about reference bias in employment? - <AUTHOR> I see lots of very weak candidates are getting high paying jobs using reference and many talented candidates are getting rejected as they don't have reference. With the flow of academics in the industry after AI, this trend has increased. Why nobody talks about it? <comment><USER2> I think this is probably an issue with the company's hiring process more than anything else. If the company was vetting for technical abilities they would be less likely to get in with just a reference.</comment>


FBI drafted Interpol resolution calling for ban on end-to-end encryption - <AUTHOR> https://arstechnica.com/tech-policy/2019/11/think-of-the-children-fbi-sought-interpol-statement-against-end-to-end-crypto/ <comment><USER2> I'll say what I always say: Reject the "going dark" framing. We are under vastly more surveillance than ever before, yet they want to strip us of even these last, tiny scraps of privacy we have left. Don't let them frame total surveillance as 'normal', and some small corner where they can't look as some unprecedented new development.

<comment><USER3> > I'll say what I always say: Reject the "going dark" framing.

Also, the ability to "go dark" from the authorities needs to be understood to be _a good thing_ , because sometimes the good guys are the authorities' enemy. That doesn't happen every day, but when it happens, it's critical for a resilient democracy that the people have the tools they need to resist.

Somewhat reduced law enforcement efficiency is worth trading for that societal resilience.

The protests in Hong Kong are a good example of this: they use E2E encryption apps to organize to support democracy and civil rights. They'd have been crushed long ago if they'd been forced to used surveillance-friendly communications tools like text messaging or WeChat.

<comment><USER2> > That doesn't happen every day

Doesn't it? There are many non-democratic countries in the world, and many shady things happen in the democratic ones as well (by whatever definition of 'democratic').

Imagine that the political leanings of everyone in China/Russia/whichever countries in Central and South America are currently in a state of revolution, were exposed to their authorities.

Imagine if the police spied on trade unionists, and helped private corporations to blacklist them. Or don't imagine: [https://www.bbc.co.uk/news/uk-43507728](https://www.bbc.co.uk/news/uk-43507728)

<comment><USER4> Exactly. I think the estimate is that 30% of the world lives under a totalitarian regime. So the good-guys having a need for encryption probably outnumber the badguys 1,000 to 1</comment></comment></comment></comment>


Was Postmates breached? - <AUTHOR> My wife's account was breached and someone ordered food for ~$150 2 days ago. And my account was accessed from a random device few hours ago. <comment><USER2> Maybe just your account? Using the same password on multiple services? There has been alot of database released online and all someone would have to do is cross reference an email and they got your login.

<comment><AUTHOR> it's mine and my wifes. 1 day apart and we don't use same passwords. maybe someone got access to something related to us then. I looked online and couldn't find any news about a breach as well</comment></comment>